From 157ce1a9a39157cb9511b76760065d12d66dbe56 Mon Sep 17 00:00:00 2001 From: aschaich <108736614+aschaich@users.noreply.github.com> Date: Wed, 7 Sep 2022 16:53:13 +0000 Subject: [PATCH] [cglib] Initial Integration (#8429) --- projects/cglib/Dockerfile | 33 +++++ projects/cglib/build.sh | 78 +++++++++++ projects/cglib/pom.xml | 59 +++++++++ projects/cglib/project.yaml | 14 ++ .../src/main/java/ossfuzz/EnhancerFuzzer.java | 121 ++++++++++++++++++ 5 files changed, 305 insertions(+) create mode 100644 projects/cglib/Dockerfile create mode 100644 projects/cglib/build.sh create mode 100644 projects/cglib/pom.xml create mode 100644 projects/cglib/project.yaml create mode 100644 projects/cglib/src/main/java/ossfuzz/EnhancerFuzzer.java diff --git a/projects/cglib/Dockerfile b/projects/cglib/Dockerfile new file mode 100644 index 000000000..efc23a1a9 --- /dev/null +++ b/projects/cglib/Dockerfile @@ -0,0 +1,33 @@ +# Copyright 2022 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +FROM gcr.io/oss-fuzz-base/base-builder-jvm + +RUN curl -L https://downloads.apache.org/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \ +unzip maven.zip -d $SRC/maven && \ +rm -rf maven.zip + +ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn + +WORKDIR ${SRC} +# +# clone repository +# +RUN git clone https://github.com/cglib/cglib + +ADD pom.xml build.sh ${SRC}/ +ADD src/ ${SRC}/src/ +WORKDIR ${SRC}/cglib \ No newline at end of file diff --git a/projects/cglib/build.sh b/projects/cglib/build.sh new file mode 100644 index 000000000..06092b820 --- /dev/null +++ b/projects/cglib/build.sh @@ -0,0 +1,78 @@ +#!/bin/bash -eu +# Copyright 2022 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +# +# cglib uses different variables for the java version. +# +MVN_FLAGS="-Dmaven.compiler.source=15 -Dmaven.compiler.target=15 -DskipTests -Djava.version.source=15 -Djava.version.target=15 -Djavac.target=15" +ALL_JARS="" + +# install the build servers' jazzer-api into the maven repository +pushd "/tmp" + ${MVN} install:install-file -Dfile=${JAZZER_API_PATH} \ + -DgroupId="com.code-intelligence" \ + -DartifactId="jazzer-api" \ + -Dversion="0.12.0" \ + -Dpackaging=jar +popd + +pushd "${SRC}/cglib" + ${MVN} package ${MVN_FLAGS} + ${MVN} install ${MVN_FLAGS} + CURRENT_VERSION=$(${MVN} org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate \ + -Dexpression=project.version -q -DforceStdout) +popd + +pushd ${SRC} + ${MVN} package -DcglibVersion="${CURRENT_VERSION}" ${MVN_FLAGS} + install -v target/cglib-fuzzer-${CURRENT_VERSION}.jar ${OUT}/cglib-fuzzer-${CURRENT_VERSION}.jar + ALL_JARS="${ALL_JARS} cglib-fuzzer-${CURRENT_VERSION}.jar" +popd + + + +# The classpath at build-time includes the project jars in $OUT as well as the +# Jazzer API. +BUILD_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "$OUT/%s:"):$JAZZER_API_PATH + +# All .jar and .class files lie in the same directory as the fuzzer at runtime. +RUNTIME_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "\$this_dir/%s:"):\$this_dir + +MVN_FUZZERS_PREFIX="src/main/java" + +for fuzzer in $(find ${SRC} -name '*Fuzzer.java'); do + stripped_path=$(echo ${fuzzer} | sed 's|^.*src/main/java/\(.*\).java$|\1|'); + # the .java was stripped by sed + if (echo ${stripped_path} | grep ".java$"); then + continue; + fi + + fuzzer_basename=$(basename -s .java $fuzzer) + fuzzer_classname=$(echo ${stripped_path} | sed 's|/|.|g'); + + # Create an execution wrapper that executes Jazzer with the correct arguments. + echo "#!/bin/sh +# LLVMFuzzerTestOneInput for fuzzer detection. +this_dir=\$(dirname \"\$0\") +LD_LIBRARY_PATH=\"$JVM_LD_LIBRARY_PATH\":\$this_dir \ +\$this_dir/jazzer_driver --agent_path=\$this_dir/jazzer_agent_deploy.jar \ +--cp=${RUNTIME_CLASSPATH} \ +--target_class=${fuzzer_classname} \ +--jvm_args=\"-Xmx2048m\" \ +\$@" > $OUT/${fuzzer_basename} + chmod u+x $OUT/${fuzzer_basename} +done diff --git a/projects/cglib/pom.xml b/projects/cglib/pom.xml new file mode 100644 index 000000000..23445ac3b --- /dev/null +++ b/projects/cglib/pom.xml @@ -0,0 +1,59 @@ + + 4.0.0 + + ossfuzz + cglib-fuzzer + ${cglibVersion} + jar + + + 15 + 15 + ossfuzz.ASTFuzzer + UTF-8 + + + + + + com.code-intelligence + jazzer-api + 0.12.0 + + + + cglib + cglib + ${cglibVersion} + + + + + + + org.apache.maven.plugins + maven-shade-plugin + 3.3.0 + + + package + + shade + + + + + + + \ No newline at end of file diff --git a/projects/cglib/project.yaml b/projects/cglib/project.yaml new file mode 100644 index 000000000..c7d4df3e4 --- /dev/null +++ b/projects/cglib/project.yaml @@ -0,0 +1,14 @@ +homepage: "https://github.com/cglib/cglib/wiki" +language: jvm +main_repo: "https://github.com/cglib/cglib" +fuzzing_engines: + - libfuzzer +sanitizers: + - address +vendor_ccs: + - "wagner@code-intelligence.com" + - "yakdan@code-intelligence.com" + - "glendowne@code-intelligence.com" + - "patrice.salathe@code-intelligence.com" + - "hlin@code-intelligence.com" + - "schaich@code-intelligence.com" \ No newline at end of file diff --git a/projects/cglib/src/main/java/ossfuzz/EnhancerFuzzer.java b/projects/cglib/src/main/java/ossfuzz/EnhancerFuzzer.java new file mode 100644 index 000000000..bca26357d --- /dev/null +++ b/projects/cglib/src/main/java/ossfuzz/EnhancerFuzzer.java @@ -0,0 +1,121 @@ +/* + * Copyright 2022 Google LLC + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package ossfuzz; + +import com.code_intelligence.jazzer.api.FuzzedDataProvider; +import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow; + +import java.lang.reflect.Method; +import net.sf.cglib.proxy.Enhancer; +import net.sf.cglib.proxy.FixedValue; +import net.sf.cglib.proxy.MethodInterceptor; +import net.sf.cglib.proxy.MethodProxy; + +class SampleClass { + + String test() { + return "Hello World"; + } + + String test(String string) { + return string; + } +}; + +class FixedValueCallback implements FixedValue { + FixedValueCallback(String string) { + m_string = string; + } + + @Override + public Object loadObject() throws Exception { + return m_string; + } + + public String getString() { + return m_string; + } + + protected String m_string; +} + +class MethodInterceptorCallback implements MethodInterceptor { + + MethodInterceptorCallback(String string) { + m_string = string; + } + + @Override + public Object intercept(Object obj, Method method, Object[] args, MethodProxy proxy) throws Throwable { + if (method.getDeclaringClass() == SampleClass.class) { + if (method.getParameterCount() == 0) { + return m_string; + } + } + + return proxy.invokeSuper(obj, args); + } + + public String getString() { + return m_string; + } + + protected String m_string; +} + +public class EnhancerFuzzer { + + public static void fixedValueCallback(FuzzedDataProvider fuzzedDataProvider) { + Enhancer enhancer = new Enhancer(); + enhancer.setSuperclass(SampleClass.class); + + FixedValueCallback fixedValueCallback = new FixedValueCallback(fuzzedDataProvider.consumeRemainingAsString()); + enhancer.setCallback(fixedValueCallback); + + SampleClass proxy = (SampleClass) enhancer.create(); + if (!proxy.test().equals(fixedValueCallback.getString())) { + throw new FuzzerSecurityIssueLow("FixedValue defect"); + } + if (!proxy.test("someString").equals(fixedValueCallback.getString())) { + throw new FuzzerSecurityIssueLow("FixedValue defect"); + } + } + + public static void methodInterceptorCallback(FuzzedDataProvider fuzzedDataProvider) { + + Enhancer enhancer = new Enhancer(); + enhancer.setSuperclass(SampleClass.class); + + MethodInterceptorCallback methodInterceptorCallback = new MethodInterceptorCallback(fuzzedDataProvider.consumeString(5)); + enhancer.setCallback(methodInterceptorCallback); + + SampleClass proxy = (SampleClass) enhancer.create(); + if (!proxy.test().equals(methodInterceptorCallback.getString())) { + throw new FuzzerSecurityIssueLow("MethodInterceptor defect"); + } + + String argument = fuzzedDataProvider.consumeRemainingAsString(); + if (!proxy.test(argument).equals(argument)) { + throw new FuzzerSecurityIssueLow("MethodInterceptor defect"); + } + } + + public static void fuzzerTestOneInput(FuzzedDataProvider fuzzedDataProvider) throws Exception { + fixedValueCallback(fuzzedDataProvider); + methodInterceptorCallback(fuzzedDataProvider); + } +} \ No newline at end of file