diff --git a/projects/opencsv/.gitignore b/projects/opencsv/.gitignore new file mode 100644 index 000000000..fbdfca19f --- /dev/null +++ b/projects/opencsv/.gitignore @@ -0,0 +1,4 @@ +project-parent/opencsv +project-parent/fuzz-targets/target +project-parent/fuzz-targets/src/test/resources +project-parent/fuzz-targets/pom.xml.versionsBackup \ No newline at end of file diff --git a/projects/opencsv/Dockerfile b/projects/opencsv/Dockerfile new file mode 100644 index 000000000..6650bfdc7 --- /dev/null +++ b/projects/opencsv/Dockerfile @@ -0,0 +1,41 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +FROM gcr.io/oss-fuzz-base/base-builder-jvm + +RUN curl -L https://archive.apache.org/dist/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \ + unzip maven.zip -d $SRC/maven && \ + rm -rf maven.zip + +ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn + +RUN git clone --depth 1 https://github.com/google/fuzzing && \ + cp fuzzing/dictionaries/csv.dict $SRC/CSVReaderFuzzer.dict && \ + rm -rf fuzzing + +RUN git clone --depth 1 https://github.com/dvyukov/go-fuzz-corpus && \ + zip -j $SRC/CSVReaderFuzzer_seed_corpus.zip go-fuzz-corpus/csv/corpus/* && \ + rm -rf go-fuzz-corpus + +# if not set python infra helper cannot be used for local testing + +COPY project-parent $SRC/project-parent/ + +RUN rm -rf $SRC/project-parent/opencsv +RUN git clone --depth 1 https://git.code.sf.net/p/opencsv/source/ $SRC/project-parent/opencsv + +COPY build.sh $SRC/ +WORKDIR $SRC/ \ No newline at end of file diff --git a/projects/opencsv/build.sh b/projects/opencsv/build.sh new file mode 100755 index 000000000..7ccf465de --- /dev/null +++ b/projects/opencsv/build.sh @@ -0,0 +1,82 @@ +#!/bin/bash -eu +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +PROJECT=opencsv +PROJECT_GROUP_ID=com.opencsv +PROJECT_ARTIFACT_ID=opencsv +MAIN_REPOSITORY=https://git.code.sf.net/p/opencsv/source/ +MAVEN_ARGS="-Djavac.src.version=15 -Djavac.target.version=15 -Denforcer.skip=true -DskipTests -Dgpg.skip" + +function set_project_version_in_fuzz_targets_dependency { + PROJECT_VERSION=$(cd $PROJECT && $MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout) + # set dependency project version in fuzz-targets + (cd fuzz-targets && $MVN versions:use-dep-version -Dincludes=$PROJECT_GROUP_ID:$PROJECT_ARTIFACT_ID -DdepVersion=$PROJECT_VERSION -DforceVersion=true) +} + +cd project-parent + +# LOCAL_DEV env variable need to be set in local development env +if [[ -v LOCAL_DEV ]]; then + MVN=mvn + + # checkout latest project version + git -C $PROJECT pull || git clone $MAIN_REPOSITORY $PROJECT + + set_project_version_in_fuzz_targets_dependency + + #install + (cd $PROJECT && $MVN install $MAVEN_ARGS) + mvn -pl fuzz-targets install + +else + # Move seed corpus and dictionary. + mv $SRC/{*.zip,*.dict} $OUT + + set_project_version_in_fuzz_targets_dependency + + #install + (cd $PROJECT && $MVN install $MAVEN_ARGS -Dmaven.repo.local=$OUT/m2) + $MVN -pl fuzz-targets install -Dmaven.repo.local=$OUT/m2 + + # build classpath + $MVN -pl fuzz-targets dependency:build-classpath -Dmdep.outputFile=cp.txt -Dmaven.repo.local=$OUT/m2 + cp -r $SRC/project-parent/fuzz-targets/target/test-classes/ $OUT/ + RUNTIME_CLASSPATH_ABSOLUTE="$(cat fuzz-targets/cp.txt):$OUT/test-classes" + RUNTIME_CLASSPATH=$(echo $RUNTIME_CLASSPATH_ABSOLUTE | sed "s|$OUT|\$this_dir|g") + + for fuzzer in $(find $SRC/project-parent -name '*Fuzzer.java'); do + fuzzer_basename=$(basename -s .java $fuzzer) + + # Create an execution wrapper for every fuzztarget + echo "#!/bin/bash + # LLVMFuzzerTestOneInput comment for fuzzer detection by infrastructure. + this_dir=\$(dirname \"\$0\") + if [[ \"\$@\" =~ (^| )-runs=[0-9]+($| ) ]]; then + mem_settings='-Xmx1900m -Xss900k' + else + mem_settings='-Xmx2048m -Xss1024k' + fi + java -cp $RUNTIME_CLASSPATH \ + \$mem_settings \ + com.code_intelligence.jazzer.Jazzer \ + --target_class=com.example.$fuzzer_basename \ + --disabled_hooks=com.code_intelligence.jazzer.sanitizers.RegexInjection \ + \$@" > $OUT/$fuzzer_basename + chmod u+x $OUT/$fuzzer_basename + done + +fi \ No newline at end of file diff --git a/projects/opencsv/project-parent/fuzz-targets/pom.xml b/projects/opencsv/project-parent/fuzz-targets/pom.xml new file mode 100644 index 000000000..9cddfe1b0 --- /dev/null +++ b/projects/opencsv/project-parent/fuzz-targets/pom.xml @@ -0,0 +1,61 @@ + + + + 4.0.0 + com.fuzzer + fuzz-targets + 0.0.1-SNAPSHOT + fuzz + fuzz + + + 15 + 15 + 15 + + + + + + com.code-intelligence + jazzer-junit + 0.15.0 + + + + org.junit.jupiter + junit-jupiter-engine + 5.9.0 + test + + + + org.junit.platform + junit-platform-launcher + 1.9.2 + + + + com.opencsv + opencsv + Fuzzing-SNAPSHOT + + + + + + + + maven-surefire-plugin + 2.22.2 + + + + + ${project.basedir}/src/test/resources + + + + + \ No newline at end of file diff --git a/projects/opencsv/project-parent/fuzz-targets/src/test/java/com/example/CSVReaderFuzzer.java b/projects/opencsv/project-parent/fuzz-targets/src/test/java/com/example/CSVReaderFuzzer.java new file mode 100644 index 000000000..da6590672 --- /dev/null +++ b/projects/opencsv/project-parent/fuzz-targets/src/test/java/com/example/CSVReaderFuzzer.java @@ -0,0 +1,82 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +//////////////////////////////////////////////////////////////////////////////// + +package com.example; + +import com.code_intelligence.jazzer.api.FuzzedDataProvider; +import com.code_intelligence.jazzer.junit.FuzzTest; + +import com.opencsv.*; +import com.opencsv.enums.CSVReaderNullFieldIndicator; +import com.opencsv.exceptions.CsvException; +import com.opencsv.exceptions.CsvMultilineLimitBrokenException; +import com.opencsv.exceptions.CsvValidationException; +import org.apache.commons.lang3.StringUtils; +import org.junit.jupiter.api.*; + +import java.io.FileReader; +import java.io.IOException; +import java.io.StringReader; +import java.util.Locale; +import java.util.regex.PatternSyntaxException; + +class CSVReaderFuzzer { + static CSVParser csvParser; + static Locale systemLocale; + + @BeforeAll + static void storeSystemLocale() { + systemLocale = Locale.getDefault(); + } + + @FuzzTest + void myFuzzTest(FuzzedDataProvider data) { + try { + Locale.setDefault(data.pickValue(Locale.getAvailableLocales())); + csvParser = new CSVParser(); + ICSVParser parser = new CSVParserBuilder() + .withEscapeChar(data.consumeChar()) + .withFieldAsNull(data.pickValue(CSVReaderNullFieldIndicator.values())) + .withIgnoreLeadingWhiteSpace(data.consumeBoolean()) + .withIgnoreQuotations(data.consumeBoolean()) + .withQuoteChar(data.consumeChar()) + .withSeparator(data.consumeChar()) + .withStrictQuotes(data.consumeBoolean()) + .build(); + + RFC4180Parser rfc4180Parser = new RFC4180ParserBuilder() + .withFieldAsNull(data.pickValue(CSVReaderNullFieldIndicator.values())) + .withQuoteChar(data.consumeChar()) + .withSeparator(data.consumeChar()) + .build(); + + ICSVParser [] icsvParsers = {csvParser, parser, rfc4180Parser}; + CSVReader csvReader = new CSVReaderBuilder(new StringReader(data.consumeString(500))) + .withCSVParser(data.pickValue(icsvParsers)) + .withFieldAsNull(data.pickValue(CSVReaderNullFieldIndicator.values())) + .withKeepCarriageReturn(data.consumeBoolean()) + .build(); + csvReader.readAll(); + + Locale.setDefault(systemLocale); + } catch (CsvException | IOException e) { + // Documented exceptions. + } catch (UnsupportedOperationException | PatternSyntaxException e) { + // Need to catch them to continue fuzzing. + } + + } +} \ No newline at end of file diff --git a/projects/opencsv/project-parent/pom.xml b/projects/opencsv/project-parent/pom.xml new file mode 100644 index 000000000..bd5004e6c --- /dev/null +++ b/projects/opencsv/project-parent/pom.xml @@ -0,0 +1,16 @@ + + + 4.0.0 + + com.fuzzer + project-parent + 0.1.0 + pom + + + opencsv + fuzz-targets + + + \ No newline at end of file diff --git a/projects/opencsv/project.yaml b/projects/opencsv/project.yaml new file mode 100644 index 000000000..9e401ccaf --- /dev/null +++ b/projects/opencsv/project.yaml @@ -0,0 +1,14 @@ +homepage: "https://sourceforge.net/projects/opencsv/" +language: jvm +fuzzing_engines: + - libfuzzer +main_repo: "https://git.code.sf.net/p/opencsv/source/" +sanitizers: + - address +vendor_ccs: + - "wagner@code-intelligence.com" + - "yakdan@code-intelligence.com" + - "glendowne@code-intelligence.com" + - "patrice.salathe@code-intelligence.com" + - "hlin@code-intelligence.com" + - "bug-disclosure@code-intelligence.com" \ No newline at end of file