Skip to content

Commit 7eeb039

Browse files
tballisonoetr
tballison
and
oetr
committed
# This is the 1st commit message:
add a path traversal sanitizer Co-authored-by: Peter Samarin <petersamarin@gmail.com>
1 parent d9c1a09 commit 7eeb039

File tree

73 files changed

+2185
-948
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

73 files changed

+2185
-948
lines changed

‎.github/BUILD.bazel

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ xcode_version(
2020
version = "14.2.0.14C18",
2121
)
2222

23-
# Xcode version on public GitHub Actions macos-13 runners
23+
# Xcode version on public GitHub Actions macos-13 and macos-14 runners
2424
xcode_version(
2525
name = "version15_2_0_15C500b",
2626
aliases = [

‎.github/workflows/prerelease.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
include:
1515
- os: ubuntu-22.04
1616
name: linux
17-
- os: macos-13
17+
- os: macos-14
1818
name: macos
1919
- os: windows-2019
2020
name: windows
@@ -143,7 +143,7 @@ jobs:
143143
path: _releases/
144144

145145
- name: create release
146-
uses: softprops/action-gh-release@4634c16e79c963813287e889244c50009e7f0981
146+
uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2.0.9
147147
with:
148148
generate_release_notes: true
149149
draft: true

‎.github/workflows/release.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Release
22

33
on:
44
workflow_dispatch:
5+
release:
6+
types: [released]
7+
58

69
jobs:
710

‎.github/workflows/run-all-tests-main.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,11 @@ jobs:
3636
name: Build & Test
3737
strategy:
3838
matrix:
39-
os: [ macos-13, windows-2019 ]
39+
os: [ macos-14, windows-2019 ]
4040
# Test JDK 8 on Windows and mac only on main.
4141
jdk: [8]
4242
include:
43-
- os: macos-13
43+
- os: macos-14
4444
arch: "macos-arm64"
4545
bazel_args: "--xcode_version_config=//.github:host_xcodes"
4646
- os: windows-2019

‎.github/workflows/run-all-tests-pr.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
name: Build & Test
1818
strategy:
1919
matrix:
20-
os: [ubuntu-22.04, windows-2019, macos-13]
20+
os: [ubuntu-22.04, windows-2019, macos-14]
2121
jdk: [21]
2222
include:
2323
- jdk: 21
@@ -29,7 +29,7 @@ jobs:
2929
- os: ubuntu-22.04
3030
# Use JDK 8 only on Ubuntu in PRs.
3131
jdk: 8
32-
- os: macos-13
32+
- os: macos-14
3333
arch: "macos-arm64"
3434
bazel_args: "--xcode_version_config=//.github:host_xcodes"
3535
- os: windows-2019

‎MODULE.bazel

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ module(name = "jazzer")
66
# Kept up-to-date by Renovate
77
################################################################################
88

9-
bazel_dep(name = "abseil-cpp", version = "20230802.0.bcr.1")
9+
bazel_dep(name = "abseil-cpp", version = "20230802.1")
1010
bazel_dep(name = "apple_support", version = "1.11.1")
1111
bazel_dep(name = "bazel_jar_jar", version = "0.1.0")
1212
bazel_dep(name = "bazel_skylib", version = "1.7.1")
@@ -18,11 +18,20 @@ bazel_dep(name = "protobuf")
1818
bazel_dep(name = "rules_android", version = "0.1.1")
1919
bazel_dep(name = "rules_android_ndk", version = "0.1.2")
2020
bazel_dep(name = "rules_foreign_cc", version = "0.11.1")
21-
bazel_dep(name = "rules_java", version = "7.7.0")
21+
bazel_dep(name = "rules_java", version = "7.12.2")
2222
bazel_dep(name = "rules_jni", version = "0.9.1")
23-
bazel_dep(name = "rules_jvm_external", version = "6.2")
24-
bazel_dep(name = "rules_kotlin", version = "1.9.5")
25-
bazel_dep(name = "rules_license", version = "0.0.8")
23+
bazel_dep(name = "rules_jvm_external")
24+
25+
# TODO: Remove after the next release.
26+
archive_override(
27+
module_name = "rules_jvm_external",
28+
integrity = "sha256-7AerLOLhQ+oIDH2id7OE8WJmbH01MqBWV4CbqJ6Nh68=",
29+
strip_prefix = "rules_jvm_external-a1d4e4f4267c1797b686719aa385e707b732c541",
30+
urls = ["https://github.com/bazelbuild/rules_jvm_external/archive/a1d4e4f4267c1797b686719aa385e707b732c541.tar.gz"],
31+
)
32+
33+
bazel_dep(name = "rules_kotlin", version = "1.9.6")
34+
bazel_dep(name = "rules_license", version = "1.0.0")
2635
bazel_dep(name = "rules_pkg", version = "0.9.1")
2736
bazel_dep(name = "toolchains_llvm", version = "0.10.3")
2837

‎README.md

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -114,11 +114,6 @@ See [the README](https://github.com/bazelbuild/rules_fuzzing#java-fuzzing) for i
114114
[Code Intelligence](https://code-intelligence.com) and Google have teamed up to bring support for Java, Kotlin, and other JVM-based languages to [OSS-Fuzz](https://github.com/google/oss-fuzz), Google's project for large-scale fuzzing of open-source software.
115115
Read [the OSS-Fuzz guide](https://google.github.io/oss-fuzz/getting-started/new-project-guide/jvm-lang/) to learn how to set up a Java project.
116116

117-
**Note**: Open source projects can use Jazzer for free and benefit from the
118-
OSS-Fuzz infrastructure, including ClusterFuzzLite and OSS-Fuzz-Gen for
119-
automated analysis and continuous integration. There is no risk of accidental
120-
license violation as long as Jazzer is used for testing open-source code.
121-
122117
## Building from source
123118

124119
Information on building and testing Jazzer for development can be found in [CONTRIBUTING.md](CONTRIBUTING.md)

‎deploy/BUILD.bazel

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,13 @@ java_export(
3838
],
3939
maven_coordinates = "com.code-intelligence:jazzer-api:$(JAZZER_VERSION)",
4040
pom_template = "//deploy:jazzer-api.pom",
41-
tags = ["no-sources"],
4241
toolchains = [":jazzer_version"],
4342
visibility = ["//visibility:public"],
44-
runtime_deps = ["//src/main/java/com/code_intelligence/jazzer/api"],
43+
exports = [
44+
"//src/main/java/com/code_intelligence/jazzer/api",
45+
"//src/main/java/com/code_intelligence/jazzer/mutation/annotation",
46+
"//src/main/java/com/code_intelligence/jazzer/mutation/annotation/proto",
47+
],
4548
)
4649

4750
java_export(
@@ -73,9 +76,14 @@ alias(
7376

7477
java_export(
7578
name = "jazzer-junit",
76-
# Exclude the unshaded classes comprising com.code-intelligence:jazzer since the java_library
77-
# target comprising jazzer-junit depend on the individual libraries, not the shaded jar.
78-
deploy_env = ["//src/main/java/com/code_intelligence/jazzer:jazzer_lib"],
79+
deploy_env = [
80+
# Exclude the unshaded classes comprising com.code-intelligence:jazzer since the java_library
81+
# target comprising jazzer-junit depend on the individual libraries, not the shaded jar.
82+
"//src/main/java/com/code_intelligence/jazzer:jazzer_lib",
83+
# Spring dependencies are required for javadoc but should be excluded from the jar.
84+
"@maven//:org_springframework_spring_test",
85+
"@maven//:org_springframework_spring_web",
86+
],
7987
doc_deps = [
8088
":jazzer-api-docs",
8189
":jazzer-docs",
@@ -89,21 +97,18 @@ java_export(
8997
],
9098
maven_coordinates = "com.code-intelligence:jazzer-junit:$(JAZZER_VERSION)",
9199
pom_template = "jazzer-junit.pom",
92-
tags = [
93-
"no-sources",
94-
# Generating javadocs breaks the build due to weird dependency issues.
95-
# Deactivate it for now.
96-
"no-javadocs",
97-
],
98100
toolchains = [":jazzer_version"],
99101
visibility = ["//visibility:public"],
100-
runtime_deps = [
101-
# These deps' only effect is to include a dependency on the 'jazzer' and 'jazzer-api' Maven artifacts in the
102-
# POM.
103-
"//deploy:jazzer",
102+
exports = [
103+
# Maven users should not need to depend on jazzer-api directly if they already directly depend on jazzer-junit,
104+
# both for convenience and backwards compatibility.
104105
"//deploy:jazzer-api",
105106
"//src/main/java/com/code_intelligence/jazzer/junit",
106107
],
108+
runtime_deps = [
109+
# This dep's only effect is to include a dependency on the 'jazzer' Maven artifacts in the POM.
110+
"//deploy:jazzer",
111+
],
107112
)
108113

109114
sh_test(

‎deploy/jazzer-api.pom

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,25 @@
3838
<scm>
3939
<url>https://github.com/CodeIntelligenceTesting/jazzer</url>
4040
</scm>
41+
42+
<licenses>
43+
<license>
44+
<name>Apache-2.0</name>
45+
</license>
46+
</licenses>
47+
48+
<developers>
49+
<developer>
50+
<name>Fabian Meumertzheim</name>
51+
</developer>
52+
<developer>
53+
<name>Norbert Schneider</name>
54+
</developer>
55+
<developer>
56+
<name>Khaled Yakdan</name>
57+
</developer>
58+
<developer>
59+
<name>Peter Samarin</name>
60+
</developer>
61+
</developers>
4162
</project>

‎deploy/jazzer-api_artifact_test.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ JAR="$2/bin/jar"
2727
-e '^com/code_intelligence/$' \
2828
-e '^com/code_intelligence/jazzer/$' \
2929
-e '^com/code_intelligence/jazzer/api/' \
30+
-e '^com/code_intelligence/jazzer/mutation/$' \
31+
-e '^com/code_intelligence/jazzer/mutation/annotation/' \
32+
-e '^com/code_intelligence/jazzer/mutation/utils/' \
3033
-e '^jaz/' \
3134
-e '^META-INF/$' \
3235
-e '^META-INF/MANIFEST.MF$'

‎deploy/jazzer-junit.pom

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,25 @@
3737
<scm>
3838
<url>https://github.com/CodeIntelligenceTesting/jazzer</url>
3939
</scm>
40+
41+
<licenses>
42+
<license>
43+
<name>Apache-2.0</name>
44+
</license>
45+
</licenses>
46+
47+
<developers>
48+
<developer>
49+
<name>Fabian Meumertzheim</name>
50+
</developer>
51+
<developer>
52+
<name>Norbert Schneider</name>
53+
</developer>
54+
<developer>
55+
<name>Khaled Yakdan</name>
56+
</developer>
57+
<developer>
58+
<name>Peter Samarin</name>
59+
</developer>
60+
</developers>
4061
</project>

‎deploy/jazzer.pom

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,25 @@
3737
<scm>
3838
<url>https://github.com/CodeIntelligenceTesting/jazzer</url>
3939
</scm>
40+
41+
<licenses>
42+
<license>
43+
<name>Apache-2.0</name>
44+
</license>
45+
</licenses>
46+
47+
<developers>
48+
<developer>
49+
<name>Fabian Meumertzheim</name>
50+
</developer>
51+
<developer>
52+
<name>Norbert Schneider</name>
53+
</developer>
54+
<developer>
55+
<name>Khaled Yakdan</name>
56+
</developer>
57+
<developer>
58+
<name>Peter Samarin</name>
59+
</developer>
60+
</developers>
4061
</project>

‎examples/src/main/java/com/example/ExampleKotlinFuzzer.kt

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,16 @@ import com.code_intelligence.jazzer.api.FuzzedDataProvider
2020
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium
2121

2222
object ExampleKotlinFuzzer {
23-
2423
@JvmStatic
2524
fun fuzzerTestOneInput(data: FuzzedDataProvider) {
2625
exploreMe(data.consumeString(8), data.consumeInt(), data.consumeRemainingAsString())
2726
}
2827

29-
private fun exploreMe(prefix: String, n: Int, suffix: String) {
28+
private fun exploreMe(
29+
prefix: String,
30+
n: Int,
31+
suffix: String,
32+
) {
3033
if (prefix.findAnyOf(arrayListOf("Fuzz", "Test")) != null) {
3134
if (n >= 2000000) {
3235
if (suffix.startsWith("@")) {

‎examples/src/main/java/com/example/ExampleKotlinValueProfileFuzzer.kt

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import com.code_intelligence.jazzer.api.FuzzedDataProvider
2020
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueMedium
2121

2222
object ExampleKotlinValueProfileFuzzer {
23-
2423
@JvmStatic
2524
fun fuzzerTestOneInput(data: FuzzedDataProvider) {
2625
if (data.consumeInt().compareTo(0x11223344) != 0) {
@@ -33,7 +32,5 @@ object ExampleKotlinValueProfileFuzzer {
3332
}
3433
}
3534

36-
private fun encrypt(n: Long): Long {
37-
return n.xor(0x1122334455667788)
38-
}
35+
private fun encrypt(n: Long): Long = n.xor(0x1122334455667788)
3936
}

‎examples/src/main/java/com/example/KlaxonFuzzer.kt

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import com.code_intelligence.jazzer.api.FuzzedDataProvider
2222

2323
// Reproduces https://github.com/cbeust/klaxon/pull/330
2424
object KlaxonFuzzer {
25-
2625
@JvmStatic
2726
fun fuzzerTestOneInput(data: FuzzedDataProvider) {
2827
try {

‎format.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ if [[ "${CI:-0}" == 0 ]]; then
3535
# Check which ktlint_tests failed and run the corresponding fix targets. This is much faster than
3636
# running all ktlint_fix targets when e.g. only a few or no .kt files changed.
3737
# shellcheck disable=SC2046
38-
TARGETS_TO_RUN=$(bazel test --config=quiet $(bazel query --config=quiet 'kind(ktlint_test, //...)') | { grep FAILED || true; } | cut -f1 -d' ' | sed -e 's/:ktlint_test/:ktlint_fix/g')
38+
TARGETS_TO_RUN=$(bazel test --config=quiet $(bazel query --config=quiet 'kind(ktlint_test, //...)') | { grep FAILED || true; } | cut -f1 -d' ' | sed -e 's/:ktlint_test/:ktlint_fix/g' || true)
3939
if [[ -n "${TARGETS_TO_RUN}" ]]; then
40-
echo "$TARGETS_TO_RUN" | xargs -n 1 bazel run --config=quiet
40+
echo "$TARGETS_TO_RUN" | xargs -I '{}' -n 1 bazel run --config=quiet {} -- --format
4141
fi
4242

4343
# BUILD files

‎sanitizers/sanitizers.bzl

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ _sanitizer_class_names = [
2121
"ClojureLangHooks",
2222
"Deserialization",
2323
"ExpressionLanguageInjection",
24+
"FilePathTraversal",
2425
"LdapInjection",
2526
"NamingContextLookup",
2627
"OsCommandInjection",

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/BUILD.bazel

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@ java_library(
99
deps = ["//src/main/java/com/code_intelligence/jazzer/api:hooks"],
1010
)
1111

12+
java_library(
13+
name = "file_path_traversal",
14+
srcs = ["FilePathTraversal.java"],
15+
deps = ["//src/main/java/com/code_intelligence/jazzer/api:hooks"],
16+
)
17+
1218
java_library(
1319
name = "regex_roadblocks",
1420
srcs = ["RegexRoadblocks.java"],
@@ -58,6 +64,7 @@ kt_jvm_library(
5864
visibility = ["//sanitizers:__pkg__"],
5965
runtime_deps = [
6066
":clojure_lang_hooks",
67+
":file_path_traversal",
6168
":regex_roadblocks",
6269
":script_engine_injection",
6370
":server_side_request_forgery",

‎sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/Deserialization.kt

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ import java.util.WeakHashMap
3333
*/
3434
@Suppress("unused_parameter", "unused")
3535
object Deserialization {
36-
3736
private val OBJECT_INPUT_STREAM_HEADER =
3837
ObjectStreamConstants.STREAM_MAGIC.toBytes() + ObjectStreamConstants.STREAM_VERSION.toBytes()
3938

@@ -88,13 +87,19 @@ object Deserialization {
8887
targetMethodDescriptor = "(Ljava/io/InputStream;)V",
8988
)
9089
@JvmStatic
91-
fun objectInputStreamInitBeforeHook(method: MethodHandle?, alwaysNull: Any?, args: Array<Any?>, hookId: Int) {
90+
fun objectInputStreamInitBeforeHook(
91+
method: MethodHandle?,
92+
alwaysNull: Any?,
93+
args: Array<Any?>,
94+
hookId: Int,
95+
) {
9296
val originalInputStream = args[0] as? InputStream ?: return
93-
val fixedInputStream = if (originalInputStream.markSupported()) {
94-
originalInputStream
95-
} else {
96-
BufferedInputStream(originalInputStream)
97-
}
97+
val fixedInputStream =
98+
if (originalInputStream.markSupported()) {
99+
originalInputStream
100+
} else {
101+
BufferedInputStream(originalInputStream)
102+
}
98103
args[0] = fixedInputStream
99104
guideMarkableInputStreamTowardsEquality(fixedInputStream, OBJECT_INPUT_STREAM_HEADER, hookId)
100105
}

0 commit comments

Comments
 (0)