Fuzzing for EdgeX REST/MQTT interfaces [ossf silver]

[bnevis-i]

🚀 Feature Request

In order to find potential vulnerabilities in EdgeX's APIs, all EdgeX REST and MQTT incoming interfaces (provided by EdgeX components) should be fuzz tested, and fuzz tested should be integrated into our testing framework.

This task does not require fixing the bug, just fuzzing the interfaces, confirming fuzz failures (reproducible with a good explanation on why it is a bug), and file the issue.

OpenSSF Silver Badge requirement:
The project results MUST check all inputs from potentially untrusted sources to ensure they are valid (an allowlist), and reject invalid inputs, if there are any restrictions on the data at all. [input_validation]
Note that comparing input against a list of "bad formats" (aka a denylist) is normally not enough, because attackers can often work around a denylist. In particular, numbers are converted into internal formats and then checked if they are between their minimum and maximum (inclusive), and text strings are checked to ensure that they are valid text patterns (e.g., valid UTF-8, length, syntax, etc.). Some data may need to be "anything at all" (e.g., a file uploader), but these would typically be rare.

• Core Data
• Core Metadata
• Core Command
• Support Notifications
• Support Scheduler

[bnevis-i]

While not integrated into TAF, fuzzing tests have been added to edgex-go in edgexfoundry/edgex-go#4569

[lenny-goodell]

@cloudxxx8 , @jumpingliu , This is the larger issue for adding the fuzzing testing. Valina got thru the core-data, core-command & support-notifications. core-metadata and support-scheduler are still TBD. I have added a checklist to the description above to reflect this.

Here is the PR for support-notifications for reference:
https://github.com/edgexfoundry/edgex-go/pull/4744/files

The swagger files need more details for proper fuzz testing.

Once these are complete, issues are submitted for true fuzz test failures. Most, if not all, are due to returning Internal Server Error when Bad request should be returned.

You can move this into Ice Box also if there are no plans to complete this "Test" phase.

[jumpingliu]

@lenny-intel Thanks Lenny, right now our team doesn't have the bandwidth for this, so move to Ice Box for now