package netguard

import (
	"net"
	"testing"
)

// FuzzValidateURL guards against a crash in the podcast feed/enclosure
// URL sanity check — the URLs it validates are admin-supplied but the
// check must never panic regardless of input.
func FuzzValidateURL(f *testing.F) {
	f.Add("https://example.com/feed.xml")
	f.Add("http://127.0.0.1/feed")
	f.Add("ftp://example.com")
	f.Add("not a url at all")
	f.Add("")
	f.Add("http://")
	f.Add("javascript:alert(1)")
	f.Add("http://[::1]:8080/feed")

	f.Fuzz(func(t *testing.T, raw string) {
		defer func() {
			if r := recover(); r != nil {
				t.Fatalf("ValidateURL panicked on %q: %v", raw, r)
			}
		}()
		_ = ValidateURL(raw)
	})
}

// FuzzIsPublicIP guards the address classifier that decides whether a
// resolved IP is safe to connect to.
func FuzzIsPublicIP(f *testing.F) {
	f.Add("8.8.8.8")
	f.Add("127.0.0.1")
	f.Add("::1")
	f.Add("169.254.169.254")
	f.Add("100.64.0.1")
	f.Add("::ffff:127.0.0.1")

	f.Fuzz(func(t *testing.T, s string) {
		ip := net.ParseIP(s)
		if ip == nil {
			return
		}
		defer func() {
			if r := recover(); r != nil {
				t.Fatalf("IsPublicIP panicked on %q: %v", s, r)
			}
		}()
		IsPublicIP(ip)
	})
}