From afb0b41056df349bf1d9d17c807c413c59e880d8 Mon Sep 17 00:00:00 2001
From: DavidKorczynski <david@adalogics.com>
Date: Wed, 17 Aug 2022 17:14:12 +0100
Subject: [PATCH] python-oauthlib: initial integration (#8233)

---
 projects/g-api-py-oauthlib/Dockerfile     | 22 ++++++++
 projects/g-api-py-oauthlib/build.sh       | 21 +++++++
 projects/g-api-py-oauthlib/fuzz_config.py | 68 +++++++++++++++++++++++
 projects/g-api-py-oauthlib/project.yaml   | 10 ++++
 4 files changed, 121 insertions(+)
 create mode 100644 projects/g-api-py-oauthlib/Dockerfile
 create mode 100755 projects/g-api-py-oauthlib/build.sh
 create mode 100644 projects/g-api-py-oauthlib/fuzz_config.py
 create mode 100644 projects/g-api-py-oauthlib/project.yaml

diff --git a/projects/g-api-py-oauthlib/Dockerfile b/projects/g-api-py-oauthlib/Dockerfile
new file mode 100644
index 000000000..4e1850fad
--- /dev/null
+++ b/projects/g-api-py-oauthlib/Dockerfile
@@ -0,0 +1,22 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+FROM gcr.io/oss-fuzz-base/base-builder-python
+RUN apt-get update && apt-get install -y make autoconf automake libtool
+RUN pip3 install --upgrade pip && pip3 install mock
+RUN git clone --depth 1 https://github.com/googleapis/google-auth-library-python-oauthlib
+WORKDIR google-auth-library-python-oauthlib
+COPY build.sh *.py $SRC/
diff --git a/projects/g-api-py-oauthlib/build.sh b/projects/g-api-py-oauthlib/build.sh
new file mode 100755
index 000000000..1974eb7eb
--- /dev/null
+++ b/projects/g-api-py-oauthlib/build.sh
@@ -0,0 +1,21 @@
+#!/bin/bash -eu
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+pip3 install .
+for fuzzer in $(find $SRC -name 'fuzz_*.py'); do
+  compile_python_fuzzer $fuzzer
+done
diff --git a/projects/g-api-py-oauthlib/fuzz_config.py b/projects/g-api-py-oauthlib/fuzz_config.py
new file mode 100644
index 000000000..6d9d0be83
--- /dev/null
+++ b/projects/g-api-py-oauthlib/fuzz_config.py
@@ -0,0 +1,68 @@
+#!/usr/bin/python3
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+import mock
+import atheris
+
+import json
+import mock
+from google_auth_oauthlib import helpers
+
+
+def TestOneInput(data):
+    fdp = atheris.FuzzedDataProvider(data)
+    config_file = "conf.txt"
+    try:
+        payload = json.loads(fdp.ConsumeUnicodeNoSurrogates(1024))
+    except:
+        return
+
+    if type(payload) is not dict:
+        return
+
+    with open(config_file, "w") as f:
+        f.write(json.dumps(payload))
+
+    if not os.path.isfile(config_file):
+        return
+
+    try:
+        helpers.session_from_client_secrets_file(
+            config_file, scopes=mock.sentinel.scopes
+        )
+    except ValueError as ve:
+        legit_exceptions = [
+            "Client secrets must be for a web or installed app.",
+            "Client secrets is not in the correct format."
+        ]
+        legit = False
+        for msg in legit_exceptions:
+            if msg in str(ve):
+                legit = True
+        if not legit:
+            raise ve
+    os.remove(config_file)
+
+
+def main():
+    atheris.instrument_all()
+    atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True)
+    atheris.Fuzz()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/projects/g-api-py-oauthlib/project.yaml b/projects/g-api-py-oauthlib/project.yaml
new file mode 100644
index 000000000..71247cdae
--- /dev/null
+++ b/projects/g-api-py-oauthlib/project.yaml
@@ -0,0 +1,10 @@
+homepage: "https://github.com/googleapis/google-auth-library-python-oauthlib"
+language: python
+main_repo: "https://github.com/googleapis/google-auth-library-python-oauthlib"
+fuzzing_engines:
+  - libfuzzer
+sanitizers:
+  - address
+  - undefined
+vendor_ccs:
+  - david@adalogics.com