[jstl-api] Initial Integration for jstl-api (#9550)

2023-02-02 00:11:37 +09:00 · 2023-02-02 00:11:37 +09:00 · 0ad4a86f21
parent b048be69a8
commit 0ad4a86f21
8 changed files with 319 additions and 0 deletions
--- a/projects/jstl-api/0001-support-new-jdk.patch
+++ b/projects/jstl-api/0001-support-new-jdk.patch
@ -0,0 +1,12 @@
+diff --git a/jaxrpc-ri/pom.xml b/jaxrpc-ri/pom.xml
+--- a/jaxrpc-ri/pom.xml
+++ b/jaxrpc-ri/pom.xml
+@@ -49,6 +49,8 @@
+         <fastInfoset.version>1.2.16</fastInfoset.version>
+         <saaj.api.version>1.4.2</saaj.api.version>
+         <ant.version>1.9.13</ant.version>
+		<maven.compiler.target>1.8</maven.compiler.target>
+		<maven.compiler.source>1.8</maven.compiler.source>
+ 
+         <legal.doc.source>${maven.multiModuleProjectDirectory}/..</legal.doc.source>
+ 
--- a/projects/jstl-api/0002-avoid-ConcurrentModificationException.patch
+++ b/projects/jstl-api/0002-avoid-ConcurrentModificationException.patch
@ -0,0 +1,12 @@
+diff --git a/jaxrpc-ri/pom.xml b/jaxrpc-ri/pom.xml
+--- a/jaxrpc-ri/pom.xml
+++ b/jaxrpc-ri/pom.xml
+@@ -147,7 +149,7 @@
+                 <plugin>
+                     <groupId>org.apache.felix</groupId>
+                     <artifactId>maven-bundle-plugin</artifactId>
+-                    <version>4.2.1</version>
+                    <version>5.1.8</version>
+                         <configuration>
+                             <instructions>
+                                 <_removeheaders>Bnd-LastModified,Build-Jdk,Built-By,Include-Resource</_removeheaders>
--- a/projects/jstl-api/Dockerfile
+++ b/projects/jstl-api/Dockerfile
@ -0,0 +1,59 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+FROM gcr.io/oss-fuzz-base/base-builder-jvm
+
+#
+# install maven configuration, which is also used by gradles's publishToMavenLocal
+#
+ADD maven-settings.xml ${SRC}/
+RUN apt-get install -y xmlstarlet
+RUN mkdir -p ~/.m2 && \
+	xmlstarlet ed \
+		-u "settings/localRepository" -v "${OUT}/m2/repository" \
+	< ${SRC}/maven-settings.xml > ~/.m2/settings.xml
+
+#
+# install maven and gradle
+#
+RUN curl -L https://downloads.apache.org/maven/maven-3/3.8.7/binaries/apache-maven-3.8.7-bin.zip -o maven.zip && \
+	unzip maven.zip -d $SRC/maven-3.8.7 && \
+	rm -rf maven.zip
+
+ENV MVN $SRC/maven-3.8.7/apache-maven-3.8.7/bin/mvn
+
+RUN curl -L https://services.gradle.org/distributions/gradle-7.6-bin.zip -o gradle.zip && \
+    unzip gradle.zip -d $SRC/gradle && \
+    rm -rf gradle.zip
+
+ENV GRADLE $SRC/gradle/gradle-7.6/bin/gradle
+
+ENV LIBRARY_NAME jstl-api
+WORKDIR ${SRC}
+#
+# clone repository
+#
+RUN git clone https://github.com/eclipse-ee4j/jstl-api.git ${LIBRARY_NAME}
+
+#
+# apply fixes
+#
+#ADD *.patch ${SRC}/
+#RUN cd ${SRC}/${LIBRARY_NAME} && (for i in ${SRC}/*.patch; do tr -d '\015' < $i | git apply -v; done )
+
+ADD build.sh ${SRC}/
+ADD ${LIBRARY_NAME}-fuzzer ${SRC}/${LIBRARY_NAME}-fuzzer/
+WORKDIR ${SRC}/${LIBRARY_NAME}
--- a/projects/jstl-api/build.sh
+++ b/projects/jstl-api/build.sh
@ -0,0 +1,92 @@
+#!/bin/bash -eu
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+SRC_SUBDIR=""
+MVN_FLAGS="-Djavac.src.version=15 -Djavac.target.version=15 -DskipTests"
+ALL_JARS=""
+
+# Install the build servers' jazzer-api into the maven repository.
+pushd "/tmp"
+	${MVN} install:install-file -Dfile=${JAZZER_API_PATH} \
+		-DgroupId="com.code-intelligence" \
+		-DartifactId="jazzer-api" \
+		-Dversion="0.14.0" \
+		-Dpackaging=jar
+popd
+
+pushd "${SRC}/${LIBRARY_NAME}/${SRC_SUBDIR}"
+	${MVN} install ${MVN_FLAGS}
+	CURRENT_VERSION=$(${MVN} org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout)
+popd
+
+#this package uses multiple versions [...]
+pushd "${SRC}/${LIBRARY_NAME}/api"
+	CURRENT_VERSION_API=$(${MVN} org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout)
+popd
+pushd "${SRC}/${LIBRARY_NAME}/impl"
+	CURRENT_VERSION_IMPL=$(${MVN} org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout)
+popd
+
+pushd "${SRC}/${LIBRARY_NAME}-fuzzer"
+	${MVN} package -DfuzzedLibaryVersion="${CURRENT_VERSION}" \
+		-DapiVersion="${CURRENT_VERSION_API}" \
+		-DimplVersion="${CURRENT_VERSION_IMPL}" \
+		${MVN_FLAGS}
+	install -v target/${LIBRARY_NAME}-fuzzer-${CURRENT_VERSION}.jar ${OUT}/${LIBRARY_NAME}-fuzzer-${CURRENT_VERSION}.jar
+	ALL_JARS="${ALL_JARS} ${LIBRARY_NAME}-fuzzer-${CURRENT_VERSION}.jar"
+popd
+
+
+
+# The classpath at build-time includes the project jars in $OUT as well as the
+# Jazzer API.
+BUILD_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "$OUT/%s:"):$JAZZER_API_PATH
+
+# All .jar and .class files lie in the same directory as the fuzzer at runtime.
+RUNTIME_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "\$this_dir/%s:"):\$this_dir
+
+MVN_FUZZERS_PREFIX="src/main/java"
+
+for fuzzer in $(find ${SRC} -name '*Fuzzer.java'); do
+	# Find our fuzzer inside the maven structure
+	stripped_path=$(echo ${fuzzer} | sed \
+		-e 's|^.*src/main/java/\(.*\).java$|\1|' \
+		-e 's|^.*src/test/java/\(.*\).java$|\1|' \
+	);
+	# The .java suffix was stripped by sed.
+	if (echo ${stripped_path} | grep ".java$"); then
+		continue;
+	fi
+	
+	fuzzer_basename=$(basename -s .java $fuzzer)
+	fuzzer_classname=$(echo ${stripped_path} | sed 's|/|.|g');
+	
+	# Create an execution wrapper that executes Jazzer with the correct arguments.
+	
+	echo "#!/bin/sh
+# LLVMFuzzerTestOneInput Magic String required for infra/base-images/base-runner/test_all.py. DO NOT REMOVE
+
+
+this_dir=\$(dirname \"\$0\")
+LD_LIBRARY_PATH=\"\$JVM_LD_LIBRARY_PATH\":\$this_dir \
+\$this_dir/jazzer_driver --agent_path=\$this_dir/jazzer_agent_deploy.jar \
+--cp=${RUNTIME_CLASSPATH} \
+--target_class=${fuzzer_classname} \
+--jvm_args=\"-Xmx2048m\" \
+\$@" > $OUT/${fuzzer_basename}
+	chmod u+x $OUT/${fuzzer_basename}
+done
--- a/projects/jstl-api/jstl-api-fuzzer/pom.xml
+++ b/projects/jstl-api/jstl-api-fuzzer/pom.xml
@ -0,0 +1,95 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+	<modelVersion>4.0.0</modelVersion>
+
+	<groupId>ossfuzz</groupId>
+	<artifactId>jstl-api-fuzzer</artifactId>
+	<version>${fuzzedLibaryVersion}</version>
+	<packaging>jar</packaging>
+	
+	<properties>
+		<maven.compiler.source>15</maven.compiler.source>
+		<maven.compiler.target>15</maven.compiler.target>
+		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+		<fuzzedLibaryVersion>3.0.0</fuzzedLibaryVersion>
+		<exec.mainClass>com.sun.xml.rpc.processor.modeler.rmi.SOAPSimpleTypeCreatorFuzzer</exec.mainClass>
+	</properties>
+
+	<!-- This repositories list is copy pasted from the projects' main BOM -->
+	
+	<dependencies>
+		<!--
+			On the CI, install the jazzer file with
+		
+				mvn install:install-file -Dfile=${JAZZER_API_PATH} \
+					-DgroupId="com.code-intelligence" \
+					-DartifactId="jazzer-api" \
+					-Dversion="0.14.0" \
+					-Dpackaging=jar
+		
+			in order to avoid mismatching driver/api versions.
+		-->
+		<dependency>
+			<groupId>com.code-intelligence</groupId>
+			<artifactId>jazzer-api</artifactId>
+			<version>0.14.0</version>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.servlet.jsp.jstl</groupId>
+			<artifactId>jakarta.servlet.jsp.jstl-api</artifactId>
+			<version>${apiVersion}</version>
+		</dependency>
+		<dependency>
+			<groupId>org.glassfish.web</groupId>
+			<artifactId>jakarta.servlet.jsp.jstl</artifactId>
+			<version>${implVersion}</version>
+		</dependency>
+
+
+		<dependency>
+			<groupId>jakarta.servlet</groupId>
+			<artifactId>jakarta.servlet-api</artifactId>
+			<version>6.0.0</version>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.servlet.jsp</groupId>
+			<artifactId>jakarta.servlet.jsp-api</artifactId>
+			<version>3.1.0</version>
+		</dependency>
+		<dependency>
+			<groupId>jakarta.el</groupId>
+			<artifactId>jakarta.el-api</artifactId>
+			<version>5.0.0</version>
+		</dependency>
+	</dependencies>
+
+	<build>
+		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-shade-plugin</artifactId>
+				<version>3.3.0</version>
+				<configuration>
+					<filters>
+						<filter>
+							<artifact>*:*</artifact>
+							<excludes>
+								<exclude>META-INF/*.SF</exclude>
+								<exclude>META-INF/*.DSA</exclude>
+								<exclude>META-INF/*.RSA</exclude>
+							</excludes>
+						</filter>
+					</filters>
+				</configuration>
+				<executions>
+					<execution>
+						<phase>package</phase>
+						<goals>
+							<goal>shade</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+		</plugins>
+	</build>
+</project>
--- a/projects/jstl-api/jstl-api-fuzzer/src/main/java/jakarta/servlet/jsp/ParserFuzzer.java
+++ b/projects/jstl-api/jstl-api-fuzzer/src/main/java/jakarta/servlet/jsp/ParserFuzzer.java
@ -0,0 +1,31 @@
+package jakarta.servlet.jsp;
+
+import org.apache.taglibs.standard.lang.jstl.Evaluator;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+
+
+public class ParserFuzzer {
+
+    private FuzzedDataProvider fuzzedDataProvider;
+
+    public ParserFuzzer(FuzzedDataProvider fuzzedDataProvider) throws Exception {
+        this.fuzzedDataProvider = fuzzedDataProvider;
+    }
+
+    void test() {
+        try {
+            String result = Evaluator.parseAndRender(fuzzedDataProvider.consumeRemainingAsString());
+        } catch (JspException ex) {
+            /* documented, ignore */
+        } catch (IllegalArgumentException ex) {
+            /* general purpose, ignore */
+        }
+    }
+
+    public static void fuzzerTestOneInput(FuzzedDataProvider fuzzedDataProvider)  throws Exception {
+
+        ParserFuzzer fixture = new ParserFuzzer(fuzzedDataProvider);
+        fixture.test();
+    }
+}
--- a/projects/jstl-api/maven-settings.xml
+++ b/projects/jstl-api/maven-settings.xml
@ -0,0 +1,3 @@
+<settings>
+	<localRepository>${user.home}/.m2/repository</localRepository>
+</settings>
--- a/projects/jstl-api/project.yaml
+++ b/projects/jstl-api/project.yaml
@ -0,0 +1,15 @@
+homepage: "https://github.com/eclipse-ee4j/jstl-api"
+language: jvm
+main_repo: "https://github.com/eclipse-ee4j/jstl-api.git"
+fuzzing_engines:
+  - libfuzzer
+sanitizers:
+  - address
+vendor_ccs:
+  - "wagner@code-intelligence.com"
+  - "yakdan@code-intelligence.com"
+  - "glendowne@code-intelligence.com"
+  - "patrice.salathe@code-intelligence.com"
+  - "hlin@code-intelligence.com"
+  - "schaich@code-intelligence.com"
+  - "bug-disclosure@code-intelligence.com"