feat: add dockerfile and script to perform fuzzing test on all swagger files and individual #4569

vli11 · 2023-05-16T18:29:16Z

If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/edgex-go/blob/main/.github/Contributing.md

PR Checklist

Please check if your PR fulfills the following requirements:

I am not introducing a breaking change (if you are, flag in conventional commit message with BREAKING CHANGE: describing the break)
I am not introducing a new dependency (add notes below if you are)
I have added unit tests for the new feature or bug fix (if not, why?)
I have fully tested (add details below) this the new feature or bug fix (if not, why?)
I have opened a PR for the related docs change (if not, why?)

Testing Instructions

to build: docker build -f Dockerfile.fuzz -t fuzz-edgex-go:latest .
to run: docker run --net host -v $(pwd)/fuzz_results:/fuzz_results fuzz-edgex-go:latest

New Dependency Instructions (If applicable)

sonarqubecloud · 2023-05-16T18:32:19Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
2 Security Hotspots
1 Code Smell

No Coverage information
0.0% Duplication

Dockerfile.fuzz

fuzzing_docker.sh

bnevis-i · 2023-08-14T15:19:38Z

Dockerfile.fuzz

+
+RUN apk add --no-cache python3 py3-pip bash coreutils
+
+RUN wget https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz


Sonarqube is flagging this line:

https://sonarcloud.io/project/security_hotspots?pullRequest=4569&id=edgexfoundry_edgex-go&tab=how_to_fix

lenny-goodell · 2023-08-14T15:46:05Z

@vli11 , please add make targets for building and running .

docker-fuzz
- docker build -f Dockerfile.fuzz -t fuzz-edgex-go:latest .
fuxx-test
- docker run --net host -v $(pwd)/fuzz_results:/fuzz_results fuzz-edgex-go:latest

Dockerfile.fuzz

fuzzing_docker.sh

jim-wang-intel · 2023-08-14T16:19:10Z

Dockerfile.fuzz

+RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz"
+RUN tar -xvf v9.2.2.tar.gz && mv restler-fuzzer-9.2.2 restler-fuzzer


combine these two runs and delete gz file after mv

Actually, it is more efficient to just pipe the wget output into tar directly, and use tar options to manipulate the target directory

WORKDIR /restler-fuzzer RUN wget -q -O - (url.tar.gz) | tar xz --strip-components 1 && mkdir restler_bin`

that's great

bnevis-i · 2023-08-14T16:41:16Z

Dockerfile.fuzz

+RUN cd restler-fuzzer; mkdir -p restler_bin
+WORKDIR /restler-fuzzer


Suggested change

RUN cd restler-fuzzer; mkdir -p restler_bin

WORKDIR /restler-fuzzer

Combined into previous statement

Dockerfile.fuzz

bnevis-i · 2023-08-14T17:55:58Z

Dockerfile.fuzz

+RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz" && \
+    tar -xvf v9.2.2.tar.gz && \
+    mv restler-fuzzer-9.2.2 restler-fuzzer && \
+    rm v9.2.2.tar.gz && \
+    cd restler-fuzzer && \
+    mkdir -p restler_bin
+
+WORKDIR /restler-fuzzer


Suggested change

RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz" && \

tar -xvf v9.2.2.tar.gz && \

mv restler-fuzzer-9.2.2 restler-fuzzer && \

rm v9.2.2.tar.gz && \

cd restler-fuzzer && \

mkdir -p restler_bin

WORKDIR /restler-fuzzer

WORKDIR /restler-fuzzer

RUN wget -q -O - "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz" | \

tar xvf - --strip-components 1 && \

mkdir -p restler_bin

fuzzing_docker.sh

Makefile

Dismissing my stale review.

bnevis-i · 2023-08-14T19:36:10Z

@vli11 You will have to squash and rebase this PR due to the Semantic PR check failing.

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual Closes: edgexfoundry#4568 Signed-off-by: Valina Li <[email protected]>

Signed-off-by: Valina Li <[email protected]>

bnevis-i

Re-approved.

jim-wang-intel

LGTM, except make test failed

lenny-goodell · 2023-08-15T16:00:11Z

LGTM, except make test failed

@vli11 , Hado lint failing on your new docker file.

Dockerfile.fuzz

Makefile

fuzzing_docker.sh

vli11 · 2023-08-15T20:33:55Z

LGTM, except make test failed

@vli11 , Hado lint failing on your new docker file.

FROM mcr.microsoft.com/dotnet/sdk:6.0-alpine hadolint error: DL3026 error: Use only an allowed registry in the FROM image; but docker hub does have this official image https://hub.docker.com/_/microsoft-dotnet-sdk/https://hub.docker.com/_/microsoft-dotnet-sdk/. any suggestions? @lenny-intel @bnevis-i

bnevis-i · 2023-08-15T21:05:38Z

FROM mcr.microsoft.com/dotnet/sdk:6.0-alpine hadolint error: DL3026 error: Use only an allowed registry in the FROM image; but docker hub does have this official image https://hub.docker.com/_/microsoft-dotnet-sdk/https://hub.docker.com/_/microsoft-dotnet-sdk/. any suggestions? @lenny-intel @bnevis-i

I would ignore the error in .hadolint.yaml. https://github.com/edgexfoundry/edgex-go/blob/main/.hadolint.yml

Signed-off-by: Valina Li <[email protected]>

jim-wang-intel · 2023-08-15T21:34:25Z

LGTM, except make test failed

@vli11 , Hado lint failing on your new docker file.

FROM mcr.microsoft.com/dotnet/sdk:6.0-alpine hadolint error: DL3026 error: Use only an allowed registry in the FROM image; but docker hub does have this official image https://hub.docker.com/_/microsoft-dotnet-sdk/https://hub.docker.com/_/microsoft-dotnet-sdk/. any suggestions? @lenny-intel @bnevis-i

i wonder what is the reason that Microsoft doesn't publish the latest version to Docker hub. maybe the one in docker hub is stable version

Signed-off-by: Valina Li <[email protected]>

bnevis-i · 2023-08-15T21:43:39Z

i wonder what is the reason that Microsoft doesn't publish the latest version to Docker hub. maybe the one in docker hub is stable version

Because Microsoft has the better registry? (Probably true, it supports the latest OCI registry standards.)

bnevis-i

LGTM. Third time lucky?

Makefile

.hadolint.yml

Signed-off-by: Valina Li <[email protected]>

sonarqubecloud · 2023-08-15T22:04:03Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
1 Security Hotspot
0 Code Smells

No Coverage information
0.0% Duplication

jim-wang-intel

LGTM

lenny-goodell

LGTM

vli11 marked this pull request as draft May 16, 2023 18:29

vli11 self-assigned this May 16, 2023

vli11 force-pushed the fuzz_docker_script branch from 832011d to 67c93f7 Compare May 16, 2023 18:31

jim-wang-intel reviewed May 17, 2023

View reviewed changes

Dockerfile.fuzz Outdated Show resolved Hide resolved

fuzzing_docker.sh Outdated Show resolved Hide resolved

fuzzing_docker.sh Outdated Show resolved Hide resolved

fuzzing_docker.sh Outdated Show resolved Hide resolved

bnevis-i self-requested a review August 9, 2023 16:47

vli11 force-pushed the fuzz_docker_script branch from 68fae54 to 807f438 Compare August 12, 2023 00:56

vli11 changed the title ~~feat: core-data fuzzing dockerfile and script~~ feat: add dockerfile and script to perform fuzzing test on all swagger files and individual Aug 12, 2023

vli11 added the enhancement New feature or request label Aug 12, 2023

vli11 requested a review from lenny-goodell August 12, 2023 01:00

vli11 marked this pull request as ready for review August 12, 2023 01:00

This was referenced Aug 12, 2023

core-command swagger file has incorrect example and missing PUT parameters #4629

Closed

fix: Fix core command swagger #4630

Closed

fix: Fix core-command swagger file #4631

Merged

bnevis-i previously requested changes Aug 14, 2023

View reviewed changes

lenny-goodell requested changes Aug 14, 2023

View reviewed changes

Dockerfile.fuzz Outdated Show resolved Hide resolved

fuzzing_docker.sh Outdated Show resolved Hide resolved

jim-wang-intel requested changes Aug 14, 2023

View reviewed changes

bnevis-i reviewed Aug 14, 2023

View reviewed changes

jim-wang-intel reviewed Aug 14, 2023

View reviewed changes

Dockerfile.fuzz Outdated Show resolved Hide resolved

bnevis-i reviewed Aug 14, 2023

View reviewed changes

jim-wang-intel reviewed Aug 14, 2023

View reviewed changes

fuzzing_docker.sh Outdated Show resolved Hide resolved

jim-wang-intel requested changes Aug 14, 2023

View reviewed changes

Makefile Outdated Show resolved Hide resolved

bnevis-i previously approved these changes Aug 14, 2023

View reviewed changes

feat: add dockerfile and script to perform fuzzing test

00c7f83

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual Closes: edgexfoundry#4568 Signed-off-by: Valina Li <[email protected]>

vli11 force-pushed the fuzz_docker_script branch from a0e06c8 to 00c7f83 Compare August 14, 2023 21:07

vli11 requested review from jim-wang-intel and lenny-goodell August 14, 2023 21:14

feat: add details and more clean up

4913631

Signed-off-by: Valina Li <[email protected]>

vli11 dismissed bnevis-i’s stale review via 4913631 August 14, 2023 23:31

bnevis-i previously approved these changes Aug 14, 2023

View reviewed changes

jim-wang-intel previously approved these changes Aug 14, 2023

View reviewed changes

lenny-goodell requested changes Aug 15, 2023

View reviewed changes

feat: moved fuzz test related into fuzz_test directory

323adb0

Signed-off-by: Valina Li <[email protected]>

vli11 dismissed stale reviews from jim-wang-intel and bnevis-i via 323adb0 August 15, 2023 21:22

feat: fix hadolint problem

067ba46

Signed-off-by: Valina Li <[email protected]>

bnevis-i previously approved these changes Aug 15, 2023

View reviewed changes

vli11 requested review from lenny-goodell and jim-wang-intel August 15, 2023 21:47

jim-wang-intel requested changes Aug 15, 2023

View reviewed changes

Makefile Outdated Show resolved Hide resolved

jim-wang-intel reviewed Aug 15, 2023

View reviewed changes

.hadolint.yml Outdated Show resolved Hide resolved

feat: fix docker build command on docker-fuzz

402cc22

Signed-off-by: Valina Li <[email protected]>

vli11 dismissed bnevis-i’s stale review via 402cc22 August 15, 2023 21:58

feat: move hadolint ignore to local dockerfile

0440360

Signed-off-by: Valina Li <[email protected]>

jim-wang-intel approved these changes Aug 15, 2023

View reviewed changes

vli11 requested a review from bnevis-i August 15, 2023 22:10

bnevis-i removed their request for review August 15, 2023 22:11

bnevis-i approved these changes Aug 15, 2023

View reviewed changes

lenny-goodell approved these changes Aug 15, 2023

View reviewed changes

vli11 merged commit 6b7b8e6 into edgexfoundry:main Aug 15, 2023

bnevis-i mentioned this pull request Aug 15, 2023

Fuzzing for EdgeX REST/MQTT interfaces [ossf silver] edgexfoundry/edgex-taf#714

Open

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual #4569

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual #4569

vli11 commented May 16, 2023 •

edited

Loading

sonarqubecloud bot commented May 16, 2023

bnevis-i Aug 14, 2023

lenny-goodell commented Aug 14, 2023

jim-wang-intel Aug 14, 2023

bnevis-i Aug 14, 2023 •

edited

Loading

jim-wang-intel Aug 14, 2023

bnevis-i Aug 14, 2023

bnevis-i Aug 14, 2023

bnevis-i commented Aug 14, 2023

bnevis-i left a comment

jim-wang-intel left a comment

lenny-goodell commented Aug 15, 2023

vli11 commented Aug 15, 2023

bnevis-i commented Aug 15, 2023

jim-wang-intel commented Aug 15, 2023

bnevis-i commented Aug 15, 2023

bnevis-i left a comment

sonarqubecloud bot commented Aug 15, 2023

jim-wang-intel left a comment

lenny-goodell left a comment


		RUN apk add --no-cache python3 py3-pip bash coreutils

		RUN wget https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz

		RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz"
		RUN tar -xvf v9.2.2.tar.gz && mv restler-fuzzer-9.2.2 restler-fuzzer

		RUN cd restler-fuzzer; mkdir -p restler_bin
		WORKDIR /restler-fuzzer

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual #4569

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual #4569

Conversation

vli11 commented May 16, 2023 • edited Loading

PR Checklist

Testing Instructions

New Dependency Instructions (If applicable)

sonarqubecloud bot commented May 16, 2023

bnevis-i Aug 14, 2023

Choose a reason for hiding this comment

lenny-goodell commented Aug 14, 2023

jim-wang-intel Aug 14, 2023

Choose a reason for hiding this comment

bnevis-i Aug 14, 2023 • edited Loading

Choose a reason for hiding this comment

jim-wang-intel Aug 14, 2023

Choose a reason for hiding this comment

bnevis-i Aug 14, 2023

Choose a reason for hiding this comment

bnevis-i Aug 14, 2023

Choose a reason for hiding this comment

bnevis-i commented Aug 14, 2023

bnevis-i left a comment

Choose a reason for hiding this comment

jim-wang-intel left a comment

Choose a reason for hiding this comment

lenny-goodell commented Aug 15, 2023

vli11 commented Aug 15, 2023

bnevis-i commented Aug 15, 2023

jim-wang-intel commented Aug 15, 2023

bnevis-i commented Aug 15, 2023

bnevis-i left a comment

Choose a reason for hiding this comment

sonarqubecloud bot commented Aug 15, 2023

jim-wang-intel left a comment

Choose a reason for hiding this comment

lenny-goodell left a comment

Choose a reason for hiding this comment

vli11 commented May 16, 2023 •

edited

Loading

bnevis-i Aug 14, 2023 •

edited

Loading