mirror of https://github.com/google/oss-fuzz.git
opencsv: Initial integration (#10069)
Initial integration of opencsv into OSS-Fuzz.
This commit is contained in:
Henry Lin
GitHub
parent
987055edc8
commit
baab3431e0
|
|
@ -0,0 +1,4 @@
|
|||
project-parent/opencsv
|
||||
project-parent/fuzz-targets/target
|
||||
project-parent/fuzz-targets/src/test/resources
|
||||
project-parent/fuzz-targets/pom.xml.versionsBackup
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
# Copyright 2023 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
################################################################################
|
||||
|
||||
FROM gcr.io/oss-fuzz-base/base-builder-jvm
|
||||
|
||||
RUN curl -L https://archive.apache.org/dist/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \
|
||||
unzip maven.zip -d $SRC/maven && \
|
||||
rm -rf maven.zip
|
||||
|
||||
ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn
|
||||
|
||||
RUN git clone --depth 1 https://github.com/google/fuzzing && \
|
||||
cp fuzzing/dictionaries/csv.dict $SRC/CSVReaderFuzzer.dict && \
|
||||
rm -rf fuzzing
|
||||
|
||||
RUN git clone --depth 1 https://github.com/dvyukov/go-fuzz-corpus && \
|
||||
zip -j $SRC/CSVReaderFuzzer_seed_corpus.zip go-fuzz-corpus/csv/corpus/* && \
|
||||
rm -rf go-fuzz-corpus
|
||||
|
||||
# if not set python infra helper cannot be used for local testing
|
||||
|
||||
COPY project-parent $SRC/project-parent/
|
||||
|
||||
RUN rm -rf $SRC/project-parent/opencsv
|
||||
RUN git clone --depth 1 https://git.code.sf.net/p/opencsv/source/ $SRC/project-parent/opencsv
|
||||
|
||||
COPY build.sh $SRC/
|
||||
WORKDIR $SRC/
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
#!/bin/bash -eu
|
||||
# Copyright 2023 Google LLC
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
################################################################################
|
||||
|
||||
PROJECT=opencsv
|
||||
PROJECT_GROUP_ID=com.opencsv
|
||||
PROJECT_ARTIFACT_ID=opencsv
|
||||
MAIN_REPOSITORY=https://git.code.sf.net/p/opencsv/source/
|
||||
MAVEN_ARGS="-Djavac.src.version=15 -Djavac.target.version=15 -Denforcer.skip=true -DskipTests -Dgpg.skip"
|
||||
|
||||
function set_project_version_in_fuzz_targets_dependency {
|
||||
PROJECT_VERSION=$(cd $PROJECT && $MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout)
|
||||
# set dependency project version in fuzz-targets
|
||||
(cd fuzz-targets && $MVN versions:use-dep-version -Dincludes=$PROJECT_GROUP_ID:$PROJECT_ARTIFACT_ID -DdepVersion=$PROJECT_VERSION -DforceVersion=true)
|
||||
}
|
||||
|
||||
cd project-parent
|
||||
|
||||
# LOCAL_DEV env variable need to be set in local development env
|
||||
if [[ -v LOCAL_DEV ]]; then
|
||||
MVN=mvn
|
||||
|
||||
# checkout latest project version
|
||||
git -C $PROJECT pull || git clone $MAIN_REPOSITORY $PROJECT
|
||||
|
||||
set_project_version_in_fuzz_targets_dependency
|
||||
|
||||
#install
|
||||
(cd $PROJECT && $MVN install $MAVEN_ARGS)
|
||||
mvn -pl fuzz-targets install
|
||||
|
||||
else
|
||||
# Move seed corpus and dictionary.
|
||||
mv $SRC/{*.zip,*.dict} $OUT
|
||||
|
||||
set_project_version_in_fuzz_targets_dependency
|
||||
|
||||
#install
|
||||
(cd $PROJECT && $MVN install $MAVEN_ARGS -Dmaven.repo.local=$OUT/m2)
|
||||
$MVN -pl fuzz-targets install -Dmaven.repo.local=$OUT/m2
|
||||
|
||||
# build classpath
|
||||
$MVN -pl fuzz-targets dependency:build-classpath -Dmdep.outputFile=cp.txt -Dmaven.repo.local=$OUT/m2
|
||||
cp -r $SRC/project-parent/fuzz-targets/target/test-classes/ $OUT/
|
||||
RUNTIME_CLASSPATH_ABSOLUTE="$(cat fuzz-targets/cp.txt):$OUT/test-classes"
|
||||
RUNTIME_CLASSPATH=$(echo $RUNTIME_CLASSPATH_ABSOLUTE | sed "s|$OUT|\$this_dir|g")
|
||||
|
||||
for fuzzer in $(find $SRC/project-parent -name '*Fuzzer.java'); do
|
||||
fuzzer_basename=$(basename -s .java $fuzzer)
|
||||
|
||||
# Create an execution wrapper for every fuzztarget
|
||||
echo "#!/bin/bash
|
||||
# LLVMFuzzerTestOneInput comment for fuzzer detection by infrastructure.
|
||||
this_dir=\$(dirname \"\$0\")
|
||||
if [[ \"\$@\" =~ (^| )-runs=[0-9]+($| ) ]]; then
|
||||
mem_settings='-Xmx1900m -Xss900k'
|
||||
else
|
||||
mem_settings='-Xmx2048m -Xss1024k'
|
||||
fi
|
||||
java -cp $RUNTIME_CLASSPATH \
|
||||
\$mem_settings \
|
||||
com.code_intelligence.jazzer.Jazzer \
|
||||
--target_class=com.example.$fuzzer_basename \
|
||||
--disabled_hooks=com.code_intelligence.jazzer.sanitizers.RegexInjection \
|
||||
\$@" > $OUT/$fuzzer_basename
|
||||
chmod u+x $OUT/$fuzzer_basename
|
||||
done
|
||||
|
||||
fi
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<groupId>com.fuzzer</groupId>
|
||||
<artifactId>fuzz-targets</artifactId>
|
||||
<version>0.0.1-SNAPSHOT</version>
|
||||
<name>fuzz</name>
|
||||
<description>fuzz</description>
|
||||
|
||||
<properties>
|
||||
<java.version>15</java.version>
|
||||
<maven.compiler.source>15</maven.compiler.source>
|
||||
<maven.compiler.target>15</maven.compiler.target>
|
||||
</properties>
|
||||
|
||||
<dependencies>
|
||||
|
||||
<dependency>
|
||||
<groupId>com.code-intelligence</groupId>
|
||||
<artifactId>jazzer-junit</artifactId>
|
||||
<version>0.15.0</version>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>org.junit.jupiter</groupId>
|
||||
<artifactId>junit-jupiter-engine</artifactId>
|
||||
<version>5.9.0</version>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>org.junit.platform</groupId>
|
||||
<artifactId>junit-platform-launcher</artifactId>
|
||||
<version>1.9.2</version>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>com.opencsv</groupId>
|
||||
<artifactId>opencsv</artifactId>
|
||||
<version>Fuzzing-SNAPSHOT</version>
|
||||
</dependency>
|
||||
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<artifactId>maven-surefire-plugin</artifactId>
|
||||
<version>2.22.2</version>
|
||||
</plugin>
|
||||
</plugins>
|
||||
<testResources>
|
||||
<testResource>
|
||||
<directory>${project.basedir}/src/test/resources</directory>
|
||||
</testResource>
|
||||
</testResources>
|
||||
</build>
|
||||
|
||||
</project>
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
// Copyright 2023 Google LLC
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
//
|
||||
////////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
package com.example;
|
||||
|
||||
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
|
||||
import com.code_intelligence.jazzer.junit.FuzzTest;
|
||||
|
||||
import com.opencsv.*;
|
||||
import com.opencsv.enums.CSVReaderNullFieldIndicator;
|
||||
import com.opencsv.exceptions.CsvException;
|
||||
import com.opencsv.exceptions.CsvMultilineLimitBrokenException;
|
||||
import com.opencsv.exceptions.CsvValidationException;
|
||||
import org.apache.commons.lang3.StringUtils;
|
||||
import org.junit.jupiter.api.*;
|
||||
|
||||
import java.io.FileReader;
|
||||
import java.io.IOException;
|
||||
import java.io.StringReader;
|
||||
import java.util.Locale;
|
||||
import java.util.regex.PatternSyntaxException;
|
||||
|
||||
class CSVReaderFuzzer {
|
||||
static CSVParser csvParser;
|
||||
static Locale systemLocale;
|
||||
|
||||
@BeforeAll
|
||||
static void storeSystemLocale() {
|
||||
systemLocale = Locale.getDefault();
|
||||
}
|
||||
|
||||
@FuzzTest
|
||||
void myFuzzTest(FuzzedDataProvider data) {
|
||||
try {
|
||||
Locale.setDefault(data.pickValue(Locale.getAvailableLocales()));
|
||||
csvParser = new CSVParser();
|
||||
ICSVParser parser = new CSVParserBuilder()
|
||||
.withEscapeChar(data.consumeChar())
|
||||
.withFieldAsNull(data.pickValue(CSVReaderNullFieldIndicator.values()))
|
||||
.withIgnoreLeadingWhiteSpace(data.consumeBoolean())
|
||||
.withIgnoreQuotations(data.consumeBoolean())
|
||||
.withQuoteChar(data.consumeChar())
|
||||
.withSeparator(data.consumeChar())
|
||||
.withStrictQuotes(data.consumeBoolean())
|
||||
.build();
|
||||
|
||||
RFC4180Parser rfc4180Parser = new RFC4180ParserBuilder()
|
||||
.withFieldAsNull(data.pickValue(CSVReaderNullFieldIndicator.values()))
|
||||
.withQuoteChar(data.consumeChar())
|
||||
.withSeparator(data.consumeChar())
|
||||
.build();
|
||||
|
||||
ICSVParser [] icsvParsers = {csvParser, parser, rfc4180Parser};
|
||||
CSVReader csvReader = new CSVReaderBuilder(new StringReader(data.consumeString(500)))
|
||||
.withCSVParser(data.pickValue(icsvParsers))
|
||||
.withFieldAsNull(data.pickValue(CSVReaderNullFieldIndicator.values()))
|
||||
.withKeepCarriageReturn(data.consumeBoolean())
|
||||
.build();
|
||||
csvReader.readAll();
|
||||
|
||||
Locale.setDefault(systemLocale);
|
||||
} catch (CsvException | IOException e) {
|
||||
// Documented exceptions.
|
||||
} catch (UnsupportedOperationException | PatternSyntaxException e) {
|
||||
// Need to catch them to continue fuzzing.
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<groupId>com.fuzzer</groupId>
|
||||
<artifactId>project-parent</artifactId>
|
||||
<version>0.1.0</version>
|
||||
<packaging>pom</packaging>
|
||||
|
||||
<modules>
|
||||
<module>opencsv</module>
|
||||
<module>fuzz-targets</module>
|
||||
</modules>
|
||||
|
||||
</project>
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
homepage: "https://sourceforge.net/projects/opencsv/"
|
||||
language: jvm
|
||||
fuzzing_engines:
|
||||
- libfuzzer
|
||||
main_repo: "https://git.code.sf.net/p/opencsv/source/"
|
||||
sanitizers:
|
||||
- address
|
||||
vendor_ccs:
|
||||
- "wagner@code-intelligence.com"
|
||||
- "yakdan@code-intelligence.com"
|
||||
- "glendowne@code-intelligence.com"
|
||||
- "patrice.salathe@code-intelligence.com"
|
||||
- "hlin@code-intelligence.com"
|
||||
- "bug-disclosure@code-intelligence.com"
|
||||
Loading…
Reference in New Issue