[Nodejs] initial integration. #3860
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@mikeal @bnoordhuis @ry, can you please review this. Also, can you suggest good api places to fuzz. |
|
Hey @DavidKorczynski, TravisCI finished with status TravisBuddy Request Identifier: 1dafddd0-9ba7-11ea-bde9-fb9aa5b18627 |
|
Hey @DavidKorczynski, TravisCI finished with status TravisBuddy Request Identifier: 48a18f60-9ba8-11ea-bde9-fb9aa5b18627 |
|
Note that the failures of the builds are due to timeouts in Travis. |
|
Any plans on a target taking javascript as input ? |
Yes i think those would be good targets. Still we need maintainer approval first, asking @mikeal @bnoordhuis @ry |
Yeah - I think in general my approach on Nodejs will be to cover it extensively. @inferno-chromium I have also reached out to the security team of nodejs and am waiting to hear back. Should have something soon. |
|
@addaleax or @jasnell could you maybe assist here? The set up in this PR is used to find the bug in nodejs/node#33640 and it would be nice to get some responds on whether the NodeJS maintainers would be happy to have fuzzing of NodeJS integrated via OSS-Fuzz? |
bnoordhuis
approved these changes
Jun 4, 2020
Thanks a lot - this one took quite a bit more effort!
I would be happy to assist here and can give references on the difficulties that occurred when integrating it into the OSS-Fuzz environment. Should we do it over an issue on Nodejs? |
|
Yes, good idea. |
|
@oliverchang - can you please help to review Nodejs, we are very excited to accept this project. |
oliverchang
approved these changes
Jun 5, 2020
| #include "string_bytes.h" | ||
|
|
||
| extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { | ||
| node::url::URL url2((char*)data, size); |
There was a problem hiding this comment.
this target is pretty basic. do you have plans for targets that test more core nodejs functionality?
|
I likely won't be able to take a detailed look at this for at least a few more days but in general: yes, I'd love to see some regular fuzz testing for Node.js |
Yes build.sh is extremely complicated right now, can you please make it a proper build config upstream (optionally if it can be tested in CI, that is super nice). Then we can merge this. |
|
Hey @DavidKorczynski, TravisCI finished with status TravisBuddy Request Identifier: 509ed480-a85e-11ea-8d1c-67d490be1668 |
Travis tests have failedHey @DavidKorczynski, 1st Build./infra/travis/travis_build.pyTravisBuddy Request Identifier: c8d01b10-a8b5-11ea-b23f-e753f45396de |
|
Hey @DavidKorczynski, TravisCI finished with status TravisBuddy Request Identifier: b36bae60-a8bf-11ea-b23f-e753f45396de |
|
Hey @DavidKorczynski, TravisBuddy Request Identifier: aaef5eb0-a8c1-11ea-b23f-e753f45396de |
|
Hey @DavidKorczynski, TravisBuddy Request Identifier: a4605380-a8d8-11ea-b23f-e753f45396de |
|
@inferno-chromium please check it now. The build script is now simple and clean, and I also got it to work in CI. |
|
Hey @DavidKorczynski, TravisBuddy Request Identifier: 9085c3b0-a8f9-11ea-b23f-e753f45396de |
inferno-chromium
approved these changes
Jun 9, 2020
1 task
Trott
pushed a commit
to nodejs/node
that referenced
this pull request
Aug 15, 2020
Refs: google/oss-fuzz#3860 Fixes: #33724 PR-URL: #34761 Fixes: #33724 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com>
MylesBorins
pushed a commit
to nodejs/node
that referenced
this pull request
Aug 17, 2020
Refs: google/oss-fuzz#3860 Fixes: #33724 PR-URL: #34761 Fixes: #33724 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com>
BethGriggs
pushed a commit
to nodejs/node
that referenced
this pull request
Aug 20, 2020
Refs: google/oss-fuzz#3860 Fixes: #33724 PR-URL: #34761 Fixes: #33724 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com>
addaleax
pushed a commit
to nodejs/node
that referenced
this pull request
Sep 22, 2020
Refs: google/oss-fuzz#3860 Fixes: #33724 PR-URL: #34761 Fixes: #33724 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fuzzing for nodejs core. Notice that the build time here can take quite some time ~10/15 minutes, since we need to build v8 first.
The
project.yamlfile has been here since December 2016 so I am not sure if the same information is valid anymore. The originalproject.yamlwas added by @oliverchang so perhaps you might have an idea here? I have not reached out to the security people at Nodejs as I assume if the contact information is accurate, if not then please do tell me.