Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

✨ Support user-defined fuzz functions (GoLang) in fuzzing check #1979

Merged
merged 36 commits into from Jun 9, 2022
Merged

✨ Support user-defined fuzz functions (GoLang) in fuzzing check #1979

merged 36 commits into from Jun 9, 2022

Conversation

aidenwang9867
Copy link
Contributor

@aidenwang9867 aidenwang9867 commented Jun 3, 2022

What kind of change does this PR introduce?

  1. Introduce a new feature for the fuzzing check.

Now scorecard's fuzzing check can detect GoLang fuzz functions defined in the repo, such as:

func FuzzFoo (f *testing.F) {
    // func body
}

and report them as project is fuzzed with user-defined fuzz functions.

Moreover, with param --details, scorecard now can report detailed information of fuzz functions in the result, including the file paths, function name, and number of lines in code.

  1. Add an interface clients.RepoClient.ListProgrammingLanguages used for retrieving programming languages of a repository.

  2. Update checks.yaml to generate the doc for fuzzing.

What is the current behavior?

The fuzzing check of scorecard only checks for the config of OSS-Fuzz and ClusterFuzzLite in a repo.

What is the new behavior (if this is a feature change)?**

It can check for user-defined golang fuzz functions in the repo and give the check a full score (10/10) if such functions are found.
Also, detailed information of the found fuzz functions would be logged into DetailLogger.

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Special notes for your reviewer

Does this PR introduce a user-facing change?

Yes.

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Users now can check for golang fuzz functions in repo as a part of the fuzzing check, and with param `--details`, detailed fuzz function names and positions can be seen in the result.

checks/evaluation/dependency_update_tool.go Outdated Show resolved Hide resolved
checks/evaluation/dependency_update_tool_test.go Outdated Show resolved Hide resolved
checks/evaluation/dependency_update_tool_test.go Outdated Show resolved Hide resolved
checks/raw/fuzzing.go Outdated Show resolved Hide resolved
checks/raw/fuzzing.go Outdated Show resolved Hide resolved
checks/raw/fuzzing.go Outdated Show resolved Hide resolved
checks/raw/fuzzing.go Outdated Show resolved Hide resolved
clients/githubrepo/client.go Outdated Show resolved Hide resolved
pkg/json_raw_results.go Outdated Show resolved Hide resolved
pkg/json_raw_results.go Outdated Show resolved Hide resolved
checks/evaluation/dependency_update_tool.go Outdated Show resolved Hide resolved
checks/evaluation/fuzzing.go Show resolved Hide resolved
checks/raw/fuzzing.go Outdated Show resolved Hide resolved
checks/raw/fuzzing.go Outdated Show resolved Hide resolved
checks/raw/fuzzing.go Outdated Show resolved Hide resolved
checks/raw/fuzzing_test.go Outdated Show resolved Hide resolved
cron/internal/format/json_raw_results.go Outdated Show resolved Hide resolved
@codecov
Copy link

codecov bot commented Jun 3, 2022

Codecov Report

Merging #1979 (af0c157) into main (3b7c46f) will increase coverage by 1.93%.
The diff coverage is 25.13%.

@@            Coverage Diff             @@
##             main    #1979      +/-   ##
==========================================
+ Coverage   51.08%   53.02%   +1.93%     
==========================================
  Files          87       88       +1     
  Lines        7074     7225     +151     
==========================================
+ Hits         3614     3831     +217     
+ Misses       3220     3141      -79     
- Partials      240      253      +13     

@aidenwang9867 aidenwang9867 temporarily deployed to integration-test June 7, 2022 22:28 Inactive
@github-actions
Copy link

github-actions bot commented Jun 7, 2022

Integration tests success for
[a2a61f0]
(https://github.com/ossf/scorecard/actions/runs/2457838119)

@aidenwang9867
Copy link
Contributor Author

@laurentsimon please see my implementation for caching the programming languages at https://github.com/ossf/scorecard/pull/1979/files#diff-8214bff6f7acf7713c122c9b398050b1464aca5ec3153a03d8ebf16bf0c95f81R42, and resolve the requested change if it looks good.

Also, @olivekl please see my modifications on the document checks.yaml at https://github.com/ossf/scorecard/pull/1979/files#diff-559ea3714bd377beb540b09445c0655ba80f0e80ebf0e6d803c04b8f08a3d904, and resolve the requested change if it looks good.

Thanks! :)

Copy link
Contributor

@olivekl olivekl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the changes. LGTM!

@aidenwang9867 aidenwang9867 temporarily deployed to integration-test June 8, 2022 23:29 Inactive
@github-actions
Copy link

github-actions bot commented Jun 8, 2022

Integration tests success for
[af0c157]
(https://github.com/ossf/scorecard/actions/runs/2464981104)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants