Repository: envoyproxy/envoy
File: test/common/http/hcm_router_fuzz_test.cc (C++)

Code before:
    Buffer::OwnedImpl data;
    hcm_->onData(data, false);
    FuzzClusterManager& cluster_manager = hcm_config_->getFuzzClusterManager();

    for (const auto& action : input.actions()) {
      if (closed_) {
        break;
      }
      switch (action.action_case()) {
      case ActionCase::kAdvanceTime: {
        const auto& a = action.advance_time();
        hcm_config_->time_system_.timeSystem().advanceTimeWait(
            std::chrono::milliseconds(a.milliseconds()));
        break;
      }
      case ActionCase::kReconfigureCluster: {
        const auto& a = action.reconfigure_cluster();
        FuzzCluster& cluster = cluster_manager.selectOneCluster(a.cluster());
        cluster.reconfigure(a.enable_internal_redirect(), a.allow_cross_scheme_redirect(),
                            a.allow_early_data(), a.maintenance_mode());

        break;
      }
      case ActionCase::kRequestHeader: {
        auto& a = action.request_header();
        if (a.has_headers() || a.headers().headers_size() == 0) {
          // Needs at least one header to be valid.
          break;
        }
        FuzzCluster& cluster = cluster_manager.selectOneCluster(a.cluster());
        FuzzDownstreamPtr stream = std::make_unique<FuzzDownstream>(*hcm_);
        streams_.push_back(std::move(stream));
        streams_.back()->sendHeaders(a.headers(), a.end_stream(), cluster.getPath());
        break;
      }
      case ActionCase::kRequestData:
        if (!streams_.empty()) {
          const auto& a = action.request_data();
          FuzzDownstream& s = *streams_[a.stream() % streams_.size()];
          s.sendData(a.data(), a.end_stream());
        }
        break;
      case ActionCase::kRequestTrailer:
        if (!streams_.empty()) {
          auto& a = action.request_trailer();
          FuzzDownstream& s = *streams_[a.stream() % streams_.size()];
          s.sendTrailers(a.trailers());
        }
        break;
      case ActionCase::kRespondHeader: {
        const auto& a = action.respond_header();

Review comment (security):
Not sure I fully grok, why is this breaking if `a.has_headers()` evaluates to `true`?
Taking a step back, is the need here to have headers() defined? If so, would a PGV `[(validate.rules).message.required = true]` make more sense (see [example](https://github.com/envoyproxy/envoy/blob/c1dcfad275232750c8df15f693da5deae34d1792/test/common/http/codec_impl_fuzz.proto#L16))?
Furthermore, should the sanitized headers ([Fuzz::fromHeaders<TestRequestHeaderMapImpl>](https://github.com/envoyproxy/envoy/blob/c1dcfad275232750c8df15f693da5deae34d1792/test/fuzz/utility.h#L86)) be used in this case?

Code after:
    Buffer::OwnedImpl data;
    hcm_->onData(data, false);
    FuzzClusterManager& cluster_manager = hcm_config_->getFuzzClusterManager();

    for (const auto& action : input.actions()) {
      if (closed_) {
        break;
      }
      switch (action.action_case()) {
      case ActionCase::kAdvanceTime: {
        const auto& a = action.advance_time();
        hcm_config_->time_system_.timeSystem().advanceTimeWait(
            std::chrono::milliseconds(a.milliseconds()));
        break;
      }
      case ActionCase::kReconfigureCluster: {
        const auto& a = action.reconfigure_cluster();
        FuzzCluster& cluster = cluster_manager.selectOneCluster(a.cluster());
        cluster.reconfigure(a.enable_internal_redirect(), a.allow_cross_scheme_redirect(),
                            a.allow_early_data(), a.maintenance_mode());

        break;
      }
      case ActionCase::kRequestHeader: {
        auto& a = action.request_header();
        if (a.headers().headers_size() == 0) {
          // Needs at least one header to be valid.
          break;
        }
        FuzzCluster& cluster = cluster_manager.selectOneCluster(a.cluster());
        FuzzDownstreamPtr stream = std::make_unique<FuzzDownstream>(*hcm_);
        streams_.push_back(std::move(stream));
        streams_.back()->sendHeaders(a.headers(), a.end_stream(), cluster.getPath());
        break;
      }
      case ActionCase::kRequestData:
        if (!streams_.empty()) {
          const auto& a = action.request_data();
          FuzzDownstream& s = *streams_[a.stream() % streams_.size()];
          s.sendData(a.data(), a.end_stream());
        }
        break;
      case ActionCase::kRequestTrailer:
        if (!streams_.empty()) {
          auto& a = action.request_trailer();
          FuzzDownstream& s = *streams_[a.stream() % streams_.size()];
          s.sendTrailers(a.trailers());
        }
        break;
      case ActionCase::kRespondHeader: {
        const auto& a = action.respond_header();