[Nodejs] initial integration.

projects/nodejs/Dockerfile

@@ -0,0 +1,25 @@
+# Copyright 2020 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+
+FROM gcr.io/oss-fuzz-base/base-builder
+MAINTAINER david@adalogics.com
+RUN apt-get update && apt-get install -y make
+RUN apt-get install -y flex bison build-essential
+RUN git clone --recursive --depth 1 https://github.com/nodejs/node
+WORKDIR $SRC
+COPY build.sh $SRC/
+
+COPY fuzz_url.cc $SRC/

projects/nodejs/build.sh

@@ -0,0 +1,137 @@
+#!/bin/bash -eu
+# Copyright 2020 Google Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+################################################################################
+cd node
+
+# Step 1) build all dependencies with non-fuzzer flags.
+# Afterwards we will build the specific nodejs core using the 
+# correct fuzzer flags.
+# Save original flags
+ORIG_CFLAGS=$CFLAGS
+ORIG_CXXFLAGS=$CXXFLAGS
+
+export CXXFLAGS="-stdlib=libc++"
+export CFLAGS=""
+export LDFLAGS="-stdlib=libc++"
+export LD="clang++"
+./configure
+make -j4
+
+export CXXFLAGS=${ORIG_CXXFLAGS}
+export CFLAGS=${ORIG_CFLAGS}
+
+# Step 2) build libnode with correct fuzzer flags
+CMDS='-DV8_DEPRECATION_WARNINGS '
+CMDS+='-DV8_IMMINENT_DEPRECATION_WARNINGS '
+CMDS+='-D__STDC_FORMAT_MACROS '
+CMDS+='-DOPENSSL_NO_PINSHARED '
+CMDS+='-DOPENSSL_THREADS '
+CMDS+='-DNODE_ARCH="x64" '
+CMDS+='-DNODE_PLATFORM="linux" '
+CMDS+='-DNODE_WANT_INTERNALS=1 '
+CMDS+='-DHAVE_OPENSSL=1 '
+CMDS+='-DHAVE_INSPECTOR=1 '
+CMDS+='-D__POSIX__ '
+CMDS+='-DNODE_HAVE_I18N_SUPPORT=1 '
+
+# Include flags
+INCLUDES='-I../src '
+INCLUDES+='-I../tools/msvs/genfiles '
+INCLUDES+='-I../deps/v8/include '
+INCLUDES+='-I../deps/cares/include '
+INCLUDES+='-I../deps/uv/include '
+INCLUDES+='-I../deps/uvwasi/include '
+INCLUDES+='-I../test/cctest '
+INCLUDES+='-I../deps/histogram/src '
+INCLUDES+='-I../deps/icu-small/source/i18n '
+INCLUDES+='-I../deps/icu-small/source/common '
+INCLUDES+='-I../deps/zlib '
+INCLUDES+='-I../deps/llhttp/include '
+INCLUDES+='-I../deps/nghttp2/lib/includes '
+INCLUDES+='-I../deps/brotli/c/include '
+INCLUDES+='-I../deps/openssl/openssl/include'
+
+cd $SRC/node/src
+for target in *cc;
+do
+    fname=${target:0:-3}
+    clang++ ${CXXFLAGS} -o $fname.o $fname.cc $CMDS $INCLUDES -pthread -fno-omit-frame-pointer -fno-rtti -fno-exceptions -std=gnu++1y -MMD -c  || true
+    if test -f $fname.o; then
+        echo "Moving $fname"
+        mv $fname.o ../out/Release/obj.target/libnode/src/$fname.o
+    fi;
+done
+
+# Create the static archive
+cd ../out/Release/obj.target
+rm -f ./libnode.a
+
+complete_libs=""
+for target in ./libnode/src/api/*.o ./libnode/src/*.o ./libnode/gen/*.o ./libnode/src/large_pages/*.o ./libnode/src/inspector/*.o ./libnode/gen/src/node/inspector/protocol/*.o ./libnode/src/tracing/*.o
+do
+    complete_libs="$complete_libs $target"
+done
+ar crsT ./libnode.a $complete_libs
+
+
+# Step 3, compile and link the fuzzers
+cd $SRC/node/src
+mkdir fuzzers
+cp ../../fuzz_url.cc ./fuzzers/
+
+# Compile the fuzzer
+clang++ -o fuzzers/fuzz_url.o fuzzers/fuzz_url.cc $CXXFLAGS $CMDS $INCLUDES -pthread -fno-omit-frame-pointer -fno-rtti -fno-exceptions -std=gnu++1y -MMD -c
+
+
+# Link the fuzzer
+cd $SRC/node/out
+
+GROUP_ARCHIVES="Release/obj.target/cctest/src/node_snapshot_stub.o "
+GROUP_ARCHIVES+="Release/obj.target/cctest/src/node_code_cache_stub.o "
+GROUP_ARCHIVES+="../src/fuzzers/fuzz_url.o "
+GROUP_ARCHIVES+="Release/obj.target/libnode.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/histogram/libhistogram.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/uvwasi/libuvwasi.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_snapshot.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_libplatform.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/icu/libicui18n.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/zlib/libzlib.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/llhttp/libllhttp.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/cares/libcares.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/uv/libuv.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/nghttp2/libnghttp2.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/brotli/libbrotli.a "
+GROUP_ARCHIVES+="Release/obj.target/deps/openssl/libopenssl.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/icu/libicuucx.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/icu/libicudata.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_base_without_compiler.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_libbase.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_libsampler.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_zlib.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_compiler.a "
+GROUP_ARCHIVES+="Release/obj.target/tools/v8_gypfiles/libv8_initializers.a"
+
+clang++ -o Release/fuzz_url $LIB_FUZZING_ENGINE $CXXFLAGS -rdynamic \
+                        -Wl,--whole-archive \
+                        Release/obj.target/deps/zlib/libzlib.a \
+                        Release/obj.target/deps/uv/libuv.a \
+                        Release/obj.target/tools/v8_gypfiles/libv8_snapshot.a \
+                        Release/obj.target/deps/openssl/libopenssl.a \
+                        -Wl,-z,noexecstack,-z,relro,-z,now \
+                        -Wl,--no-whole-archive -pthread \
+                        -Wl,--start-group  $GROUP_ARCHIVES -latomic -lm -ldl -Wl,--end-group
+
+cp Release/fuzz_url $OUT/fuzz_url

projects/nodejs/fuzz_url.cc

@@ -0,0 +1,29 @@
+/* Copyright 2020 Google Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+#include <stdlib.h>
+
+#include "env-inl.h"
+#include "node_crypto.h"
+#include "node_crypto_common.h"
+#include "node.h"
+#include "node_internals.h"
+#include "node_url.h"
+#include "string_bytes.h"
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    node::url::URL url2((char*)data, size);
+
+    return 0;
+} 

projects/nodejs/project.yaml

@@ -1,2 +1,5 @@
 homepage: "https://nodejs.org"
 primary_contact: "security@nodejs.org"
+language: c++
+auto_ccs:
+  - "david@adalogics.com"