You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description
Add unit test styles to test expectations for simple fuzz test cases and utility functions used by the fuzzer.
Background CVE-2019-15225 (#8519) was caused by recursive algorithms for matching regular expressions, especially those with '*' or '+' quantifiers. These are simple regular expressions that, when matched with very long URI, should have been caught by a timeout in our route resolution fuzzer.
However, route_fuzz_test was unable to catch this error due to a logical error in a utility function that resulted in headers created by the fuzz engine to not be ignored by default (#8653).
Moreover, fuzzers didn't explore any interesting configurations for HeaderMatchers, which specify the set of headers the route should match on. Between ignoring :path headers by default, and without a full enough corpus to cover different behaviors of route matching, the fuzzer never caught this CVE.
Proposal
Functions used inside in the fuzzer, especially utility functions that parse inputs to the fuzzer should have unit style tests to confirm their expected behavior.
In addition, we should add corpus entries for any configurations consumed by the fuzz target that appear in existing unit tests and integration tests.
Any PRs that add regression tests or security critical tests should also include corpus entries for fuzzers.
The text was updated successfully, but these errors were encountered:
This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.
stalebot
added
the
stale
stalebot believes this issue/PR has not been touched recently
label
Dec 4, 2019
This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted". Thank you for your contributions.
Description
Add unit test styles to test expectations for simple fuzz test cases and utility functions used by the fuzzer.
Background
CVE-2019-15225 (#8519) was caused by recursive algorithms for matching regular expressions, especially those with '*' or '+' quantifiers. These are simple regular expressions that, when matched with very long URI, should have been caught by a timeout in our route resolution fuzzer.
However,
route_fuzz_test
was unable to catch this error due to a logical error in a utility function that resulted in headers created by the fuzz engine to not be ignored by default (#8653).Moreover, fuzzers didn't explore any interesting configurations for
HeaderMatchers
, which specify the set of headers the route should match on. Between ignoring:path
headers by default, and without a full enough corpus to cover different behaviors of route matching, the fuzzer never caught this CVE.Proposal
The text was updated successfully, but these errors were encountered: