Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

✨ Support user-defined fuzz functions (GoLang) in fuzzing check #1979

Merged
merged 36 commits into from Jun 9, 2022
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
36 commits
Select commit Hold shift + click to select a range
f21d341
temp save 05262022
May 26, 2022
1edd76b
Merge branch 'main' into feat/897_go_fuzzer_check
May 26, 2022
2804c75
Merge branch 'ossf:main' into feat/897_go_fuzzer_check
aidenwang9867 May 26, 2022
d42b58d
Merge branch 'feat/897_go_fuzzer_check' of https://github.com/aidenwa…
May 26, 2022
091f311
finished golang fuzz func check, getLang interface to be done next week
May 27, 2022
949b6df
Merge branch 'main' into feat/897_go_fuzzer_check
May 31, 2022
3a225fa
temp save 05/31/2022
Jun 1, 2022
162de28
temp save 06/01/2022
Jun 2, 2022
a9f8fcb
Merge branch 'main' into feat/897_go_fuzzer_check
Jun 2, 2022
724e70c
Merge branch 'ossf:main' into feat/897_go_fuzzer_check
aidenwang9867 Jun 2, 2022
1c1c25a
Merge branch 'feat/897_go_fuzzer_check' of https://github.com/aidenwa…
Jun 2, 2022
69b807b
temp save-2 06/01/2022
Jun 2, 2022
000d9c3
temp save-1 06032022
Jun 2, 2022
f62dc64
temp save-2 06022022
Jun 2, 2022
4b0178d
temp save
Jun 3, 2022
69f6b18
temp save 06032022
Jun 3, 2022
ffe1bf1
temp save 06032022 (2)
Jun 3, 2022
739de16
update err def
Jun 3, 2022
06a0373
temp save 3
Jun 3, 2022
f999d7c
update docs for fuzzing
Jun 6, 2022
3d10b94
update docs for fuzzing
Jun 6, 2022
f481803
update checks.yaml to gen docs
Jun 6, 2022
531b103
Merge branch 'main' into feat/897_go_fuzzer_check
aidenwang9867 Jun 6, 2022
68a6cb2
temp save 0606
Jun 6, 2022
06e46ac
Merge branch 'feat/897_go_fuzzer_check' of https://github.com/aidenwa…
Jun 6, 2022
40ad2a0
temp save-2 0606
Jun 7, 2022
a918025
temp save-3 0606
Jun 7, 2022
b41e82f
temp save-4 0606
Jun 7, 2022
543ff10
fix linter errors
Jun 7, 2022
56d7d3e
fix linter errs-2
Jun 7, 2022
e043558
Merge branch 'main' into feat/897_go_fuzzer_check
aidenwang9867 Jun 7, 2022
ff02e79
fix e2e errors
Jun 7, 2022
a2a61f0
Merge branch 'feat/897_go_fuzzer_check' of https://github.com/aidenwa…
Jun 7, 2022
20b192d
0608
Jun 8, 2022
658059f
Merge branch 'ossf:main' into feat/897_go_fuzzer_check
aidenwang9867 Jun 8, 2022
af0c157
0608-2
Jun 8, 2022
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 1 addition & 4 deletions checks/evaluation/dependency_update_tool.go
Expand Up @@ -54,10 +54,7 @@ func DependencyUpdateTool(name string, dl checker.DetailLogger,
return checker.CreateRuntimeErrorResult(name, e)
}

// Note: only one file per tool is present,
// so we do not iterate thru all entries.
// Modified by AidenW on 05/31/2022: now Tool.File is a type of []File,
// so we need to do iterations on the files.
// Iterate over all the files, since a Tool can contain multiple files.
for _, file := range r.Tools[0].File {
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
dl.Info(&checker.LogMessage{
Path: file.Path,
Expand Down
2 changes: 1 addition & 1 deletion checks/evaluation/dependency_update_tool_test.go
Expand Up @@ -96,7 +96,7 @@ func TestDependencyUpdateTool(t *testing.T) {
enabled = true
`,
Offset: 0,
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
Type: 0,
Type: checker.FileTypeNone,
},
},
},
Expand Down
10 changes: 7 additions & 3 deletions checks/evaluation/fuzzing.go
Expand Up @@ -32,6 +32,10 @@ func Fuzzing(name string, dl checker.DetailLogger,
return checker.CreateRuntimeErrorResult(name, e)
}

if len(r.Fuzzers) == 0 {
return checker.CreateMinScoreResult(name, "project is not fuzzed")
}
fuzzers := &[]string{}
for i := range r.Fuzzers {
fuzzer := r.Fuzzers[i]
if fuzzer.Name == raw.FuzzNameUserDefinedFunc {
Expand All @@ -44,8 +48,8 @@ func Fuzzing(name string, dl checker.DetailLogger,
dl.Info(&msg)
}
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
}
return checker.CreateMaxScoreResult(name,
fmt.Sprintf("project is fuzzed with %s", fuzzer.Name))
*fuzzers = append(*fuzzers, fuzzer.Name)
}
return checker.CreateMinScoreResult(name, "project is not fuzzed")
return checker.CreateMaxScoreResult(name,
fmt.Sprintf("project is fuzzed with %v", *fuzzers))
}
12 changes: 8 additions & 4 deletions checks/raw/errors.go
Expand Up @@ -19,8 +19,12 @@ import (
)

var (
errInternalCommitishNil = errors.New("commitish is nil")
errInvalidArgType = errors.New("invalid arg type")
errInvalidArgLength = errors.New("invalid arg length")
errInvalidGitHubWorkflow = errors.New("invalid GitHub workflow")
errInternalCommitishNil = errors.New("commitish is nil")
errInvalidArgType = errors.New("invalid arg type")
errInvalidArgLength = errors.New("invalid arg length")
errInvalidGitHubWorkflow = errors.New("invalid GitHub workflow")
errEmptyRepoClient = errors.New("empty RepoClient")
errGetRepoProgrammingLang = errors.New("cannot get repo programming languages")
errGetRepoProminentLang = errors.New("cannot get repo prominent languages")
errFuncParamIsNil = errors.New("function parameter is nil")
)
20 changes: 10 additions & 10 deletions checks/raw/fuzzing.go
Expand Up @@ -34,8 +34,8 @@ const (
)

type filesWithPatternStr struct {
files []checker.File
pattern string
files []checker.File
}
type languageFuzzConfig struct {
fuzzFileMatchPattern, fuzzFuncRegexPattern, langFuzzDocumentURL, langFuzzDesc string
Expand Down Expand Up @@ -138,24 +138,24 @@ func checkOSSFuzz(c *checker.CheckRequest) (bool, error) {

func checkFuzzFunc(c *checker.CheckRequest) (bool, []checker.File, error) {
if c.RepoClient == nil {
return false, nil, fmt.Errorf("empty RepoClient")
return false, nil, errEmptyRepoClient
}
// To get the prominent programming language(s) to be checked.
langMap, err := c.RepoClient.ListProgrammingLanguages()
if err != nil {
return false, nil, fmt.Errorf("get programming languages of repo failed %w", err)
return false, nil, errGetRepoProgrammingLang
}
langsProminent, err := getProminentLanguages(langMap)
prominentLangs, err := getProminentLanguages(langMap)
if err != nil {
return false, nil, fmt.Errorf("error when getting promiment languages: %w", err)
return false, nil, errGetRepoProminentLang
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
}

data := filesWithPatternStr{
files: make([]checker.File, 0),
}

// Iterate the prominant language list and check for fuzz funcs per language.
for _, lang := range *langsProminent {
// Iterate the prominent language list and check for fuzz funcs per language.
for _, lang := range *prominentLangs {
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
// Search language fuzz patterns in the hashmap.
pattern, found := languageFuzzSpecsMap[lang]
if !found {
Expand Down Expand Up @@ -191,7 +191,7 @@ var getFuzzFunc fileparser.DoWhileTrueOnFileContent = func(path string, content
if !ok {
return false, fmt.Errorf("invalid arg type: %w", errInvalidArgType)
}
r, _ := regexp.Compile(pdata.pattern)
r := regexp.MustCompile(pdata.pattern)
lines := bytes.Split(content, []byte("\n"))
for i, line := range lines {
found := r.FindString(string(line))
Expand All @@ -212,7 +212,7 @@ var getFuzzFunc fileparser.DoWhileTrueOnFileContent = func(path string, content

func getProminentLanguages(langs map[string]int) (*[]string, error) {
if langs == nil {
return nil, fmt.Errorf("no languages found in map")
return nil, errFuncParamIsNil
}
numLangs := len(langs)
totalLoC := 0
Expand All @@ -224,7 +224,7 @@ func getProminentLanguages(langs map[string]int) (*[]string, error) {
// and it can stay as an int, no need for a float value.
avgLoC := totalLoC / numLangs

// Languages that has lines of code above average will be considered prominent.
// Languages that have lines of code above average will be considered prominent.
ret := &[]string{}
for lang, LoC := range langs {
if LoC >= avgLoC {
Expand Down
10 changes: 5 additions & 5 deletions checks/raw/fuzzing_test.go
Expand Up @@ -216,14 +216,14 @@ func Test_fuzzFileAndFuncMatchPattern(t *testing.T) {
t.Errorf("retrieve supported language error")
}
fileMatchPattern := langSpecs.fuzzFileMatchPattern
fileMatch, _ := path.Match(fileMatchPattern, tt.fileName)
if (fileMatch != tt.expectedFileMatch) && !tt.wantErr {
fileMatch, err := path.Match(fileMatchPattern, tt.fileName)
if fileMatch != tt.expectedFileMatch || err != nil && !tt.wantErr {
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
t.Errorf("fileMatch = %v, want %v for %v", fileMatch, tt.expectedFileMatch, tt.name)
}
funcRegexPattern := langSpecs.fuzzFuncRegexPattern
r, _ := regexp.Compile(funcRegexPattern)
found := r.MatchString(tt.fileContent)
if (found != tt.expectedFuncMatch) && !tt.wantErr {
if found != tt.expectedFuncMatch && !tt.wantErr {
t.Errorf("funcMatch = %v, want %v for %v", fileMatch, tt.expectedFileMatch, tt.name)
}
})
Expand Down Expand Up @@ -275,8 +275,8 @@ func Test_checkFuzzFunc(t *testing.T) {
req := checker.CheckRequest{
RepoClient: mockClient,
}
got, _, _ := checkFuzzFunc(&req)
if got != tt.want && !tt.wantErr {
got, _, err := checkFuzzFunc(&req)
if got != tt.want || err != nil && !tt.wantErr {
t.Errorf("checkFuzzFunc() = %v, want %v for %v", got, tt.want, tt.name)
}
})
Expand Down
3 changes: 3 additions & 0 deletions clients/githubrepo/client.go
Expand Up @@ -185,6 +185,9 @@ func (client *Client) ListProgrammingLanguages() (map[string]int, error) {
return nil, fmt.Errorf("request for repo languages failed with %w", err)
}
bodyJSON := map[string]int{}
// The client.repoClient.Do API writes the reponse body to var bodyJSON,
// so we can ignore the first returned variable (the http response object)
// since we only need the response body here.
_, errResp := client.repoClient.Do(client.ctx, req, &bodyJSON)
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
if errResp != nil {
return nil, fmt.Errorf("response for repo languages failed with %w", err)
Expand Down
2 changes: 1 addition & 1 deletion cron/internal/format/json_raw_results.go
Expand Up @@ -206,7 +206,7 @@ func addDependencyUpdateToolRawResults(r *jsonScorecardRawResult,
}
if t.File != nil {
aidenwang9867 marked this conversation as resolved.
Show resolved Hide resolved
jt.File = &jsonFile{
Path: t.File.Path,
Path: t.File[0].Path,
}
}
r.Results.DependencyUpdateTools = append(r.Results.DependencyUpdateTools, jt)
Expand Down
18 changes: 11 additions & 7 deletions pkg/json_raw_results.go
Expand Up @@ -50,7 +50,7 @@ type jsonTool struct {
URL *string `json:"url"`
Desc *string `json:"desc"`
Job *jsonWorkflowJob `json:"job,omitempty"`
File *jsonFile `json:"file,omitempty"`
File []jsonFile `json:"file,omitempty"`
Name string `json:"name"`
// TODO: Runs, Issues, Merge requests.
}
Expand Down Expand Up @@ -508,9 +508,11 @@ func (r *jsonScorecardRawResult) addFuzzingRawResults(fd *checker.FuzzingData) e
URL: f.URL,
Desc: f.Desc,
}
if f.File != nil && len(f.File) == 1 {
jt.File = &jsonFile{
Path: f.File[0].Path,
if f.File != nil {
for _, f := range f.File {
jt.File = append(jt.File, jsonFile{
Path: f.Path,
})
}
}
r.Results.Fuzzers = append(r.Results.Fuzzers, jt)
Expand All @@ -528,9 +530,11 @@ func (r *jsonScorecardRawResult) addDependencyUpdateToolRawResults(dut *checker.
URL: t.URL,
Desc: t.Desc,
}
if t.File != nil && len(t.File) == 1 {
jt.File = &jsonFile{
Path: t.File[0].Path,
if t.File != nil {
for _, f := range t.File {
jt.File = append(jt.File, jsonFile{
Path: f.Path,
})
}
}
r.Results.DependencyUpdateTools = append(r.Results.DependencyUpdateTools, jt)
Expand Down