Skip to content

Commit 1586752

Browse files
fmeumfmeum
committed
Run ./format.sh 
1 parent 69bb119 commit 1586752

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1169
-854
lines changed

‎examples/src/main/java/com/example/ExampleKotlinFuzzer.kt

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,16 @@ import com.code_intelligence.jazzer.api.FuzzedDataProvider
2020
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium
2121

2222
object ExampleKotlinFuzzer {
23-
2423
@JvmStatic
2524
fun fuzzerTestOneInput(data: FuzzedDataProvider) {
2625
exploreMe(data.consumeString(8), data.consumeInt(), data.consumeRemainingAsString())
2726
}
2827

29-
private fun exploreMe(prefix: String, n: Int, suffix: String) {
28+
private fun exploreMe(
29+
prefix: String,
30+
n: Int,
31+
suffix: String,
32+
) {
3033
if (prefix.findAnyOf(arrayListOf("Fuzz", "Test")) != null) {
3134
if (n >= 2000000) {
3235
if (suffix.startsWith("@")) {

‎examples/src/main/java/com/example/ExampleKotlinValueProfileFuzzer.kt

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import com.code_intelligence.jazzer.api.FuzzedDataProvider
2020
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium
2121

2222
object ExampleKotlinValueProfileFuzzer {
23-
2423
@JvmStatic
2524
fun fuzzerTestOneInput(data: FuzzedDataProvider) {
2625
if (data.consumeInt().compareTo(0x11223344) != 0) {
@@ -33,7 +32,5 @@ object ExampleKotlinValueProfileFuzzer {
3332
}
3433
}
3534

36-
private fun encrypt(n: Long): Long {
37-
return n.xor(0x1122334455667788)
38-
}
35+
private fun encrypt(n: Long): Long = n.xor(0x1122334455667788)
3936
}

‎examples/src/main/java/com/example/KlaxonFuzzer.kt

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import com.code_intelligence.jazzer.api.FuzzedDataProvider
2222

2323
// Reproduces https://github.com/cbeust/klaxon/pull/330
2424
object KlaxonFuzzer {
25-
2625
@JvmStatic
2726
fun fuzzerTestOneInput(data: FuzzedDataProvider) {
2827
try {

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/Deserialization.kt

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ import java.util.WeakHashMap
3333
*/
3434
@Suppress("unused_parameter", "unused")
3535
object Deserialization {
36-
3736
private val OBJECT_INPUT_STREAM_HEADER =
3837
ObjectStreamConstants.STREAM_MAGIC.toBytes() + ObjectStreamConstants.STREAM_VERSION.toBytes()
3938

@@ -88,13 +87,19 @@ object Deserialization {
8887
targetMethodDescriptor = "(Ljava/io/InputStream;)V",
8988
)
9089
@JvmStatic
91-
fun objectInputStreamInitBeforeHook(method: MethodHandle?, alwaysNull: Any?, args: Array<Any?>, hookId: Int) {
90+
fun objectInputStreamInitBeforeHook(
91+
method: MethodHandle?,
92+
alwaysNull: Any?,
93+
args: Array<Any?>,
94+
hookId: Int,
95+
) {
9296
val originalInputStream = args[0] as? InputStream ?: return
93-
val fixedInputStream = if (originalInputStream.markSupported()) {
94-
originalInputStream
95-
} else {
96-
BufferedInputStream(originalInputStream)
97-
}
97+
val fixedInputStream =
98+
if (originalInputStream.markSupported()) {
99+
originalInputStream
100+
} else {
101+
BufferedInputStream(originalInputStream)
102+
}
98103
args[0] = fixedInputStream
99104
guideMarkableInputStreamTowardsEquality(fixedInputStream, OBJECT_INPUT_STREAM_HEADER, hookId)
100105
}

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/ExpressionLanguageInjection.kt

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ import java.lang.invoke.MethodHandle
2828
*/
2929
@Suppress("unused_parameter", "unused")
3030
object ExpressionLanguageInjection {
31-
3231
/**
3332
* Try to call the default constructor of the honeypot class.
3433
*/
@@ -71,7 +70,9 @@ object ExpressionLanguageInjection {
7170
hookId: Int,
7271
) {
7372
// The overloads taking a second string argument have either three or four arguments
74-
if (arguments.size < 3) { return }
73+
if (arguments.size < 3) {
74+
return
75+
}
7576
val expression = arguments[1] as? String ?: return
7677
Jazzer.guideTowardsContainment(expression, EXPRESSION_LANGUAGE_ATTACK, hookId)
7778
}
@@ -95,7 +96,9 @@ object ExpressionLanguageInjection {
9596
arguments: Array<Any>,
9697
hookId: Int,
9798
) {
98-
if (arguments.size != 1) { return }
99+
if (arguments.size != 1) {
100+
return
101+
}
99102
val message = arguments[0] as String
100103
Jazzer.guideTowardsContainment(message, EXPRESSION_LANGUAGE_ATTACK, hookId)
101104
}

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/LdapInjection.kt

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ import javax.naming.directory.InvalidSearchFilterException
4444
*/
4545
@Suppress("unused_parameter", "unused")
4646
object LdapInjection {
47-
4847
// Characters to escape in DNs
4948
private const val NAME_CHARACTERS = "\\+<>,;\"="
5049

@@ -67,7 +66,6 @@ object LdapInjection {
6766
targetMethodDescriptor = "(Ljava/lang/String;Ljavax/naming.directory/Attributes;[Ljava/lang/Sting;)Ljavax/naming/NamingEnumeration;",
6867
additionalClassesToHook = ["javax.naming.directory.InitialDirContext"],
6968
),
70-
7169
// Object search, possible DN and search filter injection
7270
MethodHook(
7371
type = HookType.REPLACE,
@@ -92,7 +90,12 @@ object LdapInjection {
9290
),
9391
)
9492
@JvmStatic
95-
fun searchLdapContext(method: MethodHandle, thisObject: Any?, args: Array<Any>, hookId: Int): Any? {
93+
fun searchLdapContext(
94+
method: MethodHandle,
95+
thisObject: Any?,
96+
args: Array<Any>,
97+
hookId: Int,
98+
): Any? {
9699
try {
97100
return method.invokeWithArguments(thisObject, *args).also {
98101
(args[0] as? String)?.let { name ->

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/NamingContextLookup.kt

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ import javax.naming.CommunicationException
2626

2727
@Suppress("unused")
2828
object NamingContextLookup {
29-
3029
// The particular URL g.co is used here since it is:
3130
// - short, which makes it easier for the fuzzer to incorporate into the input;
3231
// - valid, which means that a `lookup` call on it could actually result in RCE;
@@ -50,7 +49,12 @@ object NamingContextLookup {
5049
),
5150
)
5251
@JvmStatic
53-
fun lookupHook(method: MethodHandle?, thisObject: Any?, args: Array<Any?>, hookId: Int): Any {
52+
fun lookupHook(
53+
method: MethodHandle?,
54+
thisObject: Any?,
55+
args: Array<Any?>,
56+
hookId: Int,
57+
): Any {
5458
val name = args[0] as? String ?: throw CommunicationException()
5559
if (name.startsWith(RMI_MARKER) || name.startsWith(LDAP_MARKER)) {
5660
Jazzer.reportFindingFromHook(

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/OsCommandInjection.kt

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ import java.lang.invoke.MethodHandle
3333
*/
3434
@Suppress("unused_parameter", "unused")
3535
object OsCommandInjection {
36-
3736
// Short and probably non-existing command name
3837
private const val COMMAND = "jazze"
3938

@@ -44,8 +43,15 @@ object OsCommandInjection {
4443
additionalClassesToHook = ["java.lang.ProcessBuilder"],
4544
)
4645
@JvmStatic
47-
fun processImplStartHook(method: MethodHandle?, alwaysNull: Any?, args: Array<Any?>, hookId: Int) {
48-
if (args.isEmpty()) { return }
46+
fun processImplStartHook(
47+
method: MethodHandle?,
48+
alwaysNull: Any?,
49+
args: Array<Any?>,
50+
hookId: Int,
51+
) {
52+
if (args.isEmpty()) {
53+
return
54+
}
4955
// Calling ProcessBuilder already checks if command array is empty
5056
@Suppress("UNCHECKED_CAST")
5157
(args[0] as? Array<String>)?.first().let { cmd ->

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/ReflectiveCall.kt

Lines changed: 57 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -30,25 +30,64 @@ import java.lang.invoke.MethodHandle
3030
*/
3131
@Suppress("unused_parameter", "unused")
3232
object ReflectiveCall {
33-
3433
@MethodHooks(
35-
MethodHook(type = HookType.BEFORE, targetClassName = "java.lang.Class", targetMethod = "forName", targetMethodDescriptor = "(Ljava/lang/String;)Ljava/lang/Class;"),
36-
MethodHook(type = HookType.BEFORE, targetClassName = "java.lang.Class", targetMethod = "forName", targetMethodDescriptor = "(Ljava/lang/String;ZLjava/lang/ClassLoader;)Ljava/lang/Class;"),
37-
MethodHook(type = HookType.BEFORE, targetClassName = "java.lang.ClassLoader", targetMethod = "loadClass", targetMethodDescriptor = "(Ljava/lang/String;)Ljava/lang/Class;"),
38-
MethodHook(type = HookType.BEFORE, targetClassName = "java.lang.ClassLoader", targetMethod = "loadClass", targetMethodDescriptor = "(Ljava/lang/String;Z)Ljava/lang/Class;"),
34+
MethodHook(
35+
type = HookType.BEFORE,
36+
targetClassName = "java.lang.Class",
37+
targetMethod = "forName",
38+
targetMethodDescriptor = "(Ljava/lang/String;)Ljava/lang/Class;",
39+
),
40+
MethodHook(
41+
type = HookType.BEFORE,
42+
targetClassName = "java.lang.Class",
43+
targetMethod = "forName",
44+
targetMethodDescriptor = "(Ljava/lang/String;ZLjava/lang/ClassLoader;)Ljava/lang/Class;",
45+
),
46+
MethodHook(
47+
type = HookType.BEFORE,
48+
targetClassName = "java.lang.ClassLoader",
49+
targetMethod = "loadClass",
50+
targetMethodDescriptor = "(Ljava/lang/String;)Ljava/lang/Class;",
51+
),
52+
MethodHook(
53+
type = HookType.BEFORE,
54+
targetClassName = "java.lang.ClassLoader",
55+
targetMethod = "loadClass",
56+
targetMethodDescriptor = "(Ljava/lang/String;Z)Ljava/lang/Class;",
57+
),
3958
)
4059
@JvmStatic
41-
fun loadClassHook(method: MethodHandle?, alwaysNull: Any?, args: Array<Any?>, hookId: Int) {
60+
fun loadClassHook(
61+
method: MethodHandle?,
62+
alwaysNull: Any?,
63+
args: Array<Any?>,
64+
hookId: Int,
65+
) {
4266
val className = args[0] as? String ?: return
4367
Jazzer.guideTowardsEquality(className, HONEYPOT_CLASS_NAME, hookId)
4468
}
4569

4670
@MethodHooks(
47-
MethodHook(type = HookType.BEFORE, targetClassName = "java.lang.Class", targetMethod = "forName", targetMethodDescriptor = "(Ljava/lang/Module;Ljava/lang/String;)Ljava/lang/Class;"),
48-
MethodHook(type = HookType.BEFORE, targetClassName = "java.lang.ClassLoader", targetMethod = "loadClass", targetMethodDescriptor = "(Ljava/lang/Module;Ljava/lang/String;)Ljava/lang/Class;"),
71+
MethodHook(
72+
type = HookType.BEFORE,
73+
targetClassName = "java.lang.Class",
74+
targetMethod = "forName",
75+
targetMethodDescriptor = "(Ljava/lang/Module;Ljava/lang/String;)Ljava/lang/Class;",
76+
),
77+
MethodHook(
78+
type = HookType.BEFORE,
79+
targetClassName = "java.lang.ClassLoader",
80+
targetMethod = "loadClass",
81+
targetMethodDescriptor = "(Ljava/lang/Module;Ljava/lang/String;)Ljava/lang/Class;",
82+
),
4983
)
5084
@JvmStatic
51-
fun loadClassWithModuleHook(method: MethodHandle?, alwaysNull: Any?, args: Array<Any?>, hookId: Int) {
85+
fun loadClassWithModuleHook(
86+
method: MethodHandle?,
87+
alwaysNull: Any?,
88+
args: Array<Any?>,
89+
hookId: Int,
90+
) {
5291
val className = args[1] as? String ?: return
5392
Jazzer.guideTowardsEquality(className, HONEYPOT_CLASS_NAME, hookId)
5493
}
@@ -62,8 +101,15 @@ object ReflectiveCall {
62101
MethodHook(type = HookType.BEFORE, targetClassName = "java.lang.ClassLoader", targetMethod = "findLibrary"),
63102
)
64103
@JvmStatic
65-
fun loadLibraryHook(method: MethodHandle?, alwaysNull: Any?, args: Array<Any?>, hookId: Int) {
66-
if (args.isEmpty()) { return }
104+
fun loadLibraryHook(
105+
method: MethodHandle?,
106+
alwaysNull: Any?,
107+
args: Array<Any?>,
108+
hookId: Int,
109+
) {
110+
if (args.isEmpty()) {
111+
return
112+
}
67113
val libraryName = args[0] as? String ?: return
68114
if (libraryName == HONEYPOT_LIBRARY_NAME) {
69115
Jazzer.reportFindingFromHook(

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/RegexInjection.kt

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,12 @@ object RegexInjection {
5151
targetMethodDescriptor = "(Ljava/lang/String;I)Ljava/util/regex/Pattern;",
5252
)
5353
@JvmStatic
54-
fun compileWithFlagsHook(method: MethodHandle, alwaysNull: Any?, args: Array<Any?>, hookId: Int): Any? {
54+
fun compileWithFlagsHook(
55+
method: MethodHandle,
56+
alwaysNull: Any?,
57+
args: Array<Any?>,
58+
hookId: Int,
59+
): Any? {
5560
val pattern = args[0] as String?
5661
val hasCanonEqFlag = ((args[1] as Int) and Pattern.CANON_EQ) != 0
5762
return hookInternal(method, pattern, hasCanonEqFlag, hookId, *args)
@@ -72,9 +77,12 @@ object RegexInjection {
7277
),
7378
)
7479
@JvmStatic
75-
fun patternHook(method: MethodHandle, alwaysNull: Any?, args: Array<Any?>, hookId: Int): Any? {
76-
return hookInternal(method, args[0] as String?, false, hookId, *args)
77-
}
80+
fun patternHook(
81+
method: MethodHandle,
82+
alwaysNull: Any?,
83+
args: Array<Any?>,
84+
hookId: Int,
85+
): Any? = hookInternal(method, args[0] as String?, false, hookId, *args)
7886

7987
@MethodHooks(
8088
MethodHook(
@@ -109,9 +117,12 @@ object RegexInjection {
109117
),
110118
)
111119
@JvmStatic
112-
fun stringHook(method: MethodHandle, thisObject: Any?, args: Array<Any?>, hookId: Int): Any? {
113-
return hookInternal(method, args[0] as String?, false, hookId, thisObject, *args)
114-
}
120+
fun stringHook(
121+
method: MethodHandle,
122+
thisObject: Any?,
123+
args: Array<Any?>,
124+
hookId: Int,
125+
): Any? = hookInternal(method, args[0] as String?, false, hookId, thisObject, *args)
115126

116127
private fun hookInternal(
117128
method: MethodHandle,

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/Utils.kt

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,11 @@ import java.io.InputStream
2525
const val HONEYPOT_CLASS_NAME = "jaz.Zer"
2626
const val HONEYPOT_LIBRARY_NAME = "jazzer_honeypot"
2727

28-
internal fun Short.toBytes(): ByteArray {
29-
return byteArrayOf(
28+
internal fun Short.toBytes(): ByteArray =
29+
byteArrayOf(
3030
((toInt() shr 8) and 0xFF).toByte(),
3131
(toInt() and 0xFF).toByte(),
3232
)
33-
}
3433

3534
// Runtime is only O(size * needle.size), only use for small arrays.
3635
internal fun ByteArray.indexOf(needle: ByteArray): Int {
@@ -45,8 +44,15 @@ internal fun ByteArray.indexOf(needle: ByteArray): Int {
4544
return -1
4645
}
4746

48-
internal fun guideMarkableInputStreamTowardsEquality(stream: InputStream, target: ByteArray, id: Int) {
49-
fun readBytes(stream: InputStream, size: Int): ByteArray {
47+
internal fun guideMarkableInputStreamTowardsEquality(
48+
stream: InputStream,
49+
target: ByteArray,
50+
id: Int,
51+
) {
52+
fun readBytes(
53+
stream: InputStream,
54+
size: Int,
55+
): ByteArray {
5056
val current = ByteArray(size)
5157
var n = 0
5258
while (n < size) {

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/XPathInjection.kt

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@ import javax.xml.xpath.XPathExpressionException
3636
*/
3737
@Suppress("unused_parameter", "unused")
3838
object XPathInjection {
39-
4039
// Characters that should be escaped in user input.
4140
// https://owasp.org/www-community/attacks/XPATH_Injection
4241
private const val CHARACTERS_TO_ESCAPE = "'\""
@@ -49,7 +48,12 @@ object XPathInjection {
4948
MethodHook(type = HookType.REPLACE, targetClassName = "javax.xml.xpath.XPath", targetMethod = "evaluateExpression"),
5049
)
5150
@JvmStatic
52-
fun checkXpathExecute(method: MethodHandle, thisObject: Any?, arguments: Array<Any>, hookId: Int): Any {
51+
fun checkXpathExecute(
52+
method: MethodHandle,
53+
thisObject: Any?,
54+
arguments: Array<Any>,
55+
hookId: Int,
56+
): Any {
5357
if (arguments.isNotEmpty() && arguments[0] is String) {
5458
val query = arguments[0] as String
5559
Jazzer.guideTowardsContainment(query, CHARACTERS_TO_ESCAPE, hookId)
@@ -67,8 +71,8 @@ object XPathInjection {
6771
Jazzer.reportFindingFromHook(
6872
FuzzerSecurityIssueHigh(
6973
"""
70-
XPath Injection
71-
Injected query: ${arguments[0]}
74+
XPath Injection
75+
Injected query: ${arguments[0]}
7276
""".trimIndent(),
7377
exception,
7478
),

0 commit comments

Comments
 (0)