Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add unit tests to fuzzers #8875

Closed
asraa opened this issue Nov 4, 2019 · 2 comments
Closed

Add unit tests to fuzzers #8875

asraa opened this issue Nov 4, 2019 · 2 comments
Labels
stale stalebot believes this issue/PR has not been touched recently tech debt

Comments

@asraa
Copy link
Contributor

asraa commented Nov 4, 2019

Description
Add unit test styles to test expectations for simple fuzz test cases and utility functions used by the fuzzer.

Background
CVE-2019-15225 (#8519) was caused by recursive algorithms for matching regular expressions, especially those with '*' or '+' quantifiers. These are simple regular expressions that, when matched with very long URI, should have been caught by a timeout in our route resolution fuzzer.

However, route_fuzz_test was unable to catch this error due to a logical error in a utility function that resulted in headers created by the fuzz engine to not be ignored by default (#8653).
Moreover, fuzzers didn't explore any interesting configurations for HeaderMatchers, which specify the set of headers the route should match on. Between ignoring :path headers by default, and without a full enough corpus to cover different behaviors of route matching, the fuzzer never caught this CVE.

Proposal

  • Functions used inside in the fuzzer, especially utility functions that parse inputs to the fuzzer should have unit style tests to confirm their expected behavior.
  • In addition, we should add corpus entries for any configurations consumed by the fuzz target that appear in existing unit tests and integration tests.
  • Any PRs that add regression tests or security critical tests should also include corpus entries for fuzzers.
@snowp snowp added the tech debt label Nov 4, 2019
@stale
Copy link

stale bot commented Dec 4, 2019

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

@stale stale bot added the stale stalebot believes this issue/PR has not been touched recently label Dec 4, 2019
@stale
Copy link

stale bot commented Dec 11, 2019

This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted". Thank you for your contributions.

@stale stale bot closed this as completed Dec 11, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
stale stalebot believes this issue/PR has not been touched recently tech debt
Projects
None yet
Development

No branches or pull requests

2 participants