From 1c4b760e162a1995ca73233285ba9ab5fe8a79d8 Mon Sep 17 00:00:00 2001 From: Henry Lin Date: Mon, 6 Mar 2023 15:22:41 +0100 Subject: [PATCH] MVEL: Initial integration. (#9856) Initial integration for MVEL. --- projects/mvel/.gitignore | 4 + projects/mvel/Dockerfile | 33 ++++++++ projects/mvel/build.sh | 82 +++++++++++++++++++ .../mvel/project-parent/fuzz-targets/pom.xml | 61 ++++++++++++++ .../src/test/java/com/example/MvelFuzzer.java | 41 ++++++++++ projects/mvel/project-parent/pom.xml | 16 ++++ projects/mvel/project.yaml | 9 ++ 7 files changed, 246 insertions(+) create mode 100644 projects/mvel/.gitignore create mode 100644 projects/mvel/Dockerfile create mode 100755 projects/mvel/build.sh create mode 100644 projects/mvel/project-parent/fuzz-targets/pom.xml create mode 100644 projects/mvel/project-parent/fuzz-targets/src/test/java/com/example/MvelFuzzer.java create mode 100644 projects/mvel/project-parent/pom.xml create mode 100644 projects/mvel/project.yaml diff --git a/projects/mvel/.gitignore b/projects/mvel/.gitignore new file mode 100644 index 000000000..89267517b --- /dev/null +++ b/projects/mvel/.gitignore @@ -0,0 +1,4 @@ +project-parent/mvel +project-parent/fuzz-targets/target +project-parent/fuzz-targets/src/test/resources +project-parent/fuzz-targets/pom.xml.versionsBackup \ No newline at end of file diff --git a/projects/mvel/Dockerfile b/projects/mvel/Dockerfile new file mode 100644 index 000000000..84e44e723 --- /dev/null +++ b/projects/mvel/Dockerfile @@ -0,0 +1,33 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +FROM gcr.io/oss-fuzz-base/base-builder-jvm + +RUN curl -L https://downloads.apache.org/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \ + unzip maven.zip -d $SRC/maven && \ + rm -rf maven.zip + +ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn + +# if not set python infra helper cannot be used for local testing + +COPY project-parent $SRC/project-parent/ + +RUN rm -rf $SRC/project-parent/mvel +RUN git clone --depth 1 https://github.com/mvel/mvel/ $SRC/project-parent/mvel + +COPY build.sh $SRC/ +WORKDIR $SRC/ \ No newline at end of file diff --git a/projects/mvel/build.sh b/projects/mvel/build.sh new file mode 100755 index 000000000..7eac40c05 --- /dev/null +++ b/projects/mvel/build.sh @@ -0,0 +1,82 @@ +#!/bin/bash -eu +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +PROJECT=mvel +PROJECT_GROUP_ID=org.mvel +PROJECT_ARTIFACT_ID=mvel2 +MAIN_REPOSITORY=https://github.com/mvel/mvel/ + +MAVEN_ARGS="-Djavac.src.version=15 -Djavac.target.version=15 -Denforcer.skip=true -DskipTests" + +function set_project_version_in_fuzz_targets_dependency { + PROJECT_VERSION=$(cd $PROJECT && $MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout) + # set dependency project version in fuzz-targets + (cd fuzz-targets && $MVN versions:use-dep-version -Dincludes=$PROJECT_GROUP_ID:$PROJECT_ARTIFACT_ID -DdepVersion=$PROJECT_VERSION -DforceVersion=true) +} + +cd project-parent + +# LOCAL_DEV env variable need to be set in local development env +if [[ -v LOCAL_DEV ]]; then + MVN=mvn + + # checkout latest project version + git -C $PROJECT pull || git clone $MAIN_REPOSITORY $PROJECT + + set_project_version_in_fuzz_targets_dependency + + #install + (cd $PROJECT && $MVN install $MAVEN_ARGS) + mvn -pl fuzz-targets install + +else + # Move seed corpus and dictionary. + # mv $SRC/{*.zip,*.dict} $OUT + + set_project_version_in_fuzz_targets_dependency + + #install + (cd $PROJECT && $MVN install $MAVEN_ARGS -Dmaven.repo.local=$OUT/m2) + $MVN -pl fuzz-targets install -Dmaven.repo.local=$OUT/m2 + + # build classpath + $MVN -pl fuzz-targets dependency:build-classpath -Dmdep.outputFile=cp.txt -Dmaven.repo.local=$OUT/m2 + cp -r $SRC/project-parent/fuzz-targets/target/test-classes/ $OUT/ + RUNTIME_CLASSPATH_ABSOLUTE="$(cat fuzz-targets/cp.txt):$OUT/test-classes" + RUNTIME_CLASSPATH_RELATIVE=$(echo $RUNTIME_CLASSPATH_ABSOLUTE | sed "s|$OUT|.|g") + + for fuzzer in $(find $SRC/project-parent/fuzz-targets -name '*Fuzzer.java'); do + fuzzer_basename=$(basename -s .java $fuzzer) + + # Create an execution wrapper for every fuzztarget + echo "#!/bin/bash + # LLVMFuzzerTestOneInput comment for fuzzer detection by infrastructure. + if [[ \"\$@\" =~ (^| )-runs=[0-9]+($| ) ]]; then + mem_settings='-Xmx1900m -Xss900k' + else + mem_settings='-Xmx2048m -Xss1024k' + fi + java -cp $RUNTIME_CLASSPATH_RELATIVE \ + \$mem_settings \ + com.code_intelligence.jazzer.Jazzer \ + --target_class=com.example.$fuzzer_basename \ + --disabled_hooks=com.code_intelligence.jazzer.sanitizers.ExpressionLanguageInjection:com.code_intelligence.jazzer.sanitizers.RegexInjection \ + \$@" > $OUT/$fuzzer_basename + chmod u+x $OUT/$fuzzer_basename + done + +fi \ No newline at end of file diff --git a/projects/mvel/project-parent/fuzz-targets/pom.xml b/projects/mvel/project-parent/fuzz-targets/pom.xml new file mode 100644 index 000000000..c5d2900c7 --- /dev/null +++ b/projects/mvel/project-parent/fuzz-targets/pom.xml @@ -0,0 +1,61 @@ + + + + 4.0.0 + com.fuzzer + fuzz-targets + 0.0.1-SNAPSHOT + fuzz + fuzz + + + 15 + 15 + 15 + + + + + + com.code-intelligence + jazzer-junit + 0.15.0 + + + + org.junit.platform + junit-platform-launcher + 1.9.2 + + + + org.junit.jupiter + junit-jupiter-engine + 5.9.0 + test + + + + org.mvel + mvel2 + 2.4.16-SNAPSHOT + + + + + + + + maven-surefire-plugin + 2.22.2 + + + + + ${project.basedir}/src/test/resources + + + + + \ No newline at end of file diff --git a/projects/mvel/project-parent/fuzz-targets/src/test/java/com/example/MvelFuzzer.java b/projects/mvel/project-parent/fuzz-targets/src/test/java/com/example/MvelFuzzer.java new file mode 100644 index 000000000..3504c76d8 --- /dev/null +++ b/projects/mvel/project-parent/fuzz-targets/src/test/java/com/example/MvelFuzzer.java @@ -0,0 +1,41 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +//////////////////////////////////////////////////////////////////////////////// + +package com.example; + +import com.code_intelligence.jazzer.api.FuzzedDataProvider; +import com.code_intelligence.jazzer.junit.FuzzTest; + +import org.mvel2.MVEL; +import org.mvel2.CompileException; +import org.mvel2.ScriptRuntimeException; +import org.mvel2.UnresolveablePropertyException; + +class MvelFuzzer { + + @FuzzTest + void myFuzzTest(FuzzedDataProvider data) { + String input = data.consumeRemainingAsString(); + try { + MVEL.eval(input); + MVEL.compileExpression(input); + } catch (UnresolveablePropertyException | CompileException | ArithmeticException | ScriptRuntimeException e) { + // Documented Exceptions + } catch (java.lang.AssertionError | RuntimeException e) { + // Not expected to be thrown but we catch to reach deeper program states. + } + } +} \ No newline at end of file diff --git a/projects/mvel/project-parent/pom.xml b/projects/mvel/project-parent/pom.xml new file mode 100644 index 000000000..97a58e06a --- /dev/null +++ b/projects/mvel/project-parent/pom.xml @@ -0,0 +1,16 @@ + + + 4.0.0 + + com.fuzzer + project-parent + 0.1.0 + pom + + + mvel + fuzz-targets + + + \ No newline at end of file diff --git a/projects/mvel/project.yaml b/projects/mvel/project.yaml new file mode 100644 index 000000000..7a1c1d4cd --- /dev/null +++ b/projects/mvel/project.yaml @@ -0,0 +1,9 @@ +homepage: "https://github.com/mvel/mvel/" +language: jvm +fuzzing_engines: + - libfuzzer +main_repo: "https://github.com/mvel/mvel/" +sanitizers: + - address +vendor_ccs: + - "bug-disclosure@code-intelligence.com" \ No newline at end of file