diff --git a/projects/opencensus-java/.gitignore b/projects/opencensus-java/.gitignore new file mode 100644 index 000000000000..dcf5c8528871 --- /dev/null +++ b/projects/opencensus-java/.gitignore @@ -0,0 +1,4 @@ +project-parent/opencensus-java +project-parent/fuzz-targets/target +project-parent/fuzz-targets/src/test/resources +project-parent/fuzz-targets/pom.xml.versionsBackup \ No newline at end of file diff --git a/projects/opencensus-java/Dockerfile b/projects/opencensus-java/Dockerfile new file mode 100644 index 000000000000..0f524876c870 --- /dev/null +++ b/projects/opencensus-java/Dockerfile @@ -0,0 +1,34 @@ +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +FROM gcr.io/oss-fuzz-base/base-builder-jvm + +RUN curl -L https://archive.apache.org/dist/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \ + unzip maven.zip -d $SRC/maven && \ + rm -rf maven.zip + +ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn + +# if not set python infra helper cannot be used for local testing + +COPY project-parent $SRC/project-parent/ + +RUN rm -rf $SRC/project-parent/opencensus-java +RUN apt update && apt install -y openjdk-8-jdk +RUN git clone --depth 1 https://github.com/census-instrumentation/opencensus-java/ $SRC/project-parent/opencensus-java + +COPY build.sh $SRC/ +WORKDIR $SRC/ \ No newline at end of file diff --git a/projects/opencensus-java/build.sh b/projects/opencensus-java/build.sh new file mode 100755 index 000000000000..57dbf67a2af8 --- /dev/null +++ b/projects/opencensus-java/build.sh @@ -0,0 +1,125 @@ +#!/bin/bash -eu +# Copyright 2023 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +PROJECT=opencensus-java +PROJECT_GROUP_ID=io.opencensus +PROJECT_ARTIFACT_ID=opencensus-api +MAIN_REPOSITORY=https://github.com/census-instrumentation/opencensus-java/ +MAVEN_ARGS="-Djavac.src.version=8 -Djavac.target.version=8 -Denforcer.skip=true -DskipTests" +GRADLE_ARGS="-x javadoc -x test" + +function set_project_version_in_fuzz_targets_dependency { + PROJECT_VERSION=$(cd $PROJECT && $MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate -Dexpression=project.version -q -DforceStdout) + # set dependency project version in fuzz-targets + (cd fuzz-targets && $MVN versions:use-dep-version -Dincludes=$PROJECT_GROUP_ID:$PROJECT_ARTIFACT_ID -DdepVersion=$PROJECT_VERSION -DforceVersion=true) +} + +cd project-parent + +pushd $PROJECT + export OPENCENSUS_JAVA_VERSION=$(awk '$1 ~ /version/ {print $3}' build.gradle | sed 's/"//g') +popd + +# LOCAL_DEV env variable need to be set in local development env +if [[ -v LOCAL_DEV ]]; then + MVN=mvn + + # checkout latest project version + git -C $PROJECT pull || git clone $MAIN_REPOSITORY $PROJECT + + # set_project_version_in_fuzz_targets_dependency + + #install + # mvn -pl $PROJECT install -DskipTests + (cd $PROJECT && ./gradlew build $GRADLE_ARGS) + mvn -pl fuzz-targets install + +else + # Move seed corpus and dictionary. + # mv $SRC/{*.zip,*.dict} $OUT + + export JAVA_HOME="$OUT/open-jdk-8" + mkdir -p $JAVA_HOME + rsync -aL --exclude=*.zip "/usr/lib/jvm/java-8-openjdk-amd64/" "$JAVA_HOME" + + (cd $PROJECT && ./gradlew build $GRADLE_ARGS) + cp $SRC/project-parent/opencensus-java/api/build/libs/opencensus-api-$OPENCENSUS_JAVA_VERSION.jar $OUT/opencensus-api.jar + cp $SRC/project-parent/opencensus-java/impl/build/libs/opencensus-impl-$OPENCENSUS_JAVA_VERSION.jar $OUT/opencensus-impl.jar + cp $SRC/project-parent/opencensus-java/impl_core/build/libs/opencensus-impl-core-$OPENCENSUS_JAVA_VERSION.jar $OUT/opencensus-impl-core.jar + cp $SRC/project-parent/opencensus-java/exporters/trace/util/build/libs/opencensus-exporter-trace-util-$OPENCENSUS_JAVA_VERSION.jar $OUT/opencensus-exporter-trace-util.jar + cp $SRC/project-parent/opencensus-java/exporters/trace/ocagent/build/libs/opencensus-exporter-trace-ocagent-$OPENCENSUS_JAVA_VERSION.jar $OUT/opencensus-exporter-trace-ocagent.jar + cp $SRC/project-parent/opencensus-java/contrib/resource_util/build/libs/opencensus-contrib-resource-util-$OPENCENSUS_JAVA_VERSION.jar $OUT/opencensus-contrib-resource-util.jar + cp $SRC/project-parent/opencensus-java/exporters/trace/elasticsearch/build/libs/opencensus-exporter-trace-elasticsearch-$OPENCENSUS_JAVA_VERSION.jar $OUT/opencensus-exporter-trace-elasticsearch.jar + + ALL_JARS="opencensus-api.jar opencensus-impl.jar opencensus-impl-core.jar opencensus-exporter-trace-util.jar opencensus-contrib-resource-util.jar opencensus-exporter-trace-elasticsearch.jar" + + for fuzzer in $(find $SRC/project-parent/fuzz-targets -name '*Fuzzer.java' ! -name JsonConversionFuzzer.java); do + $MVN -pl fuzz-targets install -Dmaven.repo.local=$OUT/m2 + $MVN -pl fuzz-targets dependency:build-classpath -Dmdep.outputFile=cp.txt -Dmaven.repo.local=$OUT/m2 + cp -r $SRC/project-parent/fuzz-targets/target/test-classes/ $OUT/ + RUNTIME_CLASSPATH_ABSOLUTE="$(echo $ALL_JARS | xargs printf -- "$OUT/%s:"):$(cat fuzz-targets/cp.txt):$OUT/test-classes" + RUNTIME_CLASSPATH_RELATIVE=$(echo $RUNTIME_CLASSPATH_ABSOLUTE | sed "s|$OUT|.|g") + + fuzzer_basename=$(basename -s .java $fuzzer) + + # Create an execution wrapper for every fuzztarget + echo "#!/bin/bash + # LLVMFuzzerTestOneInput comment for fuzzer detection by infrastructure. + if [[ \"\$@\" =~ (^| )-runs=[0-9]+($| ) ]]; then + mem_settings='-Xmx1900m -Xss900k' + else + mem_settings='-Xmx2048m -Xss1024k' + fi + JAVA_HOME=\"\$this_dir/open-jdk-8/\" \ + ./open-jdk-8/bin/java -cp $RUNTIME_CLASSPATH_RELATIVE \ + \$mem_settings \ + com.code_intelligence.jazzer.Jazzer \ + --target_class=com.example.$fuzzer_basename \ + \$@" > $OUT/$fuzzer_basename + chmod u+x $OUT/$fuzzer_basename + done + + + PACKAGE_NAME="io.opencensus.exporter.trace.elasticsearch" + PACKAGE_DIR=$SRC/project-parent/fuzz-targets/src/test/java/$(echo $PACKAGE_NAME | sed 's/\./\//g') + mkdir -p $PACKAGE_DIR + mv $SRC/project-parent/fuzz-targets/src/test/java/com/example/JsonConversionFuzzer.java $PACKAGE_DIR + + $MVN -pl fuzz-targets install -Dmaven.repo.local=$OUT/m2 + $MVN -pl fuzz-targets dependency:build-classpath -Dmdep.outputFile=cp.txt -Dmaven.repo.local=$OUT/m2 + cp -r $SRC/project-parent/fuzz-targets/target/test-classes/ $OUT/ + RUNTIME_CLASSPATH_ABSOLUTE="$(cat fuzz-targets/cp.txt):$OUT/test-classes:$PACKAGE_NAME:$(echo $ALL_JARS | xargs printf -- "$OUT/%s:")." + RUNTIME_CLASSPATH_RELATIVE=$(echo $RUNTIME_CLASSPATH_ABSOLUTE | sed "s|$OUT|.|g") + + echo "#!/bin/bash + # LLVMFuzzerTestOneInput comment for fuzzer detection by infrastructure. + if [[ \"\$@\" =~ (^| )-runs=[0-9]+($| ) ]]; then + mem_settings='-Xmx1900m -Xss900k' + else + mem_settings='-Xmx2048m -Xss1024k' + fi + JAVA_HOME=\"\$this_dir/open-jdk-8/\" \ + ./open-jdk-8/bin/java -cp $RUNTIME_CLASSPATH_RELATIVE \ + \$mem_settings \ + com.code_intelligence.jazzer.Jazzer \ + --target_class=$PACKAGE_NAME.JsonConversionFuzzer \ + \$@" > $OUT/JsonConversionFuzzer + chmod u+x $OUT/JsonConversionFuzzer + + rm -rf $PACKAGE_DIR + +fi \ No newline at end of file diff --git a/projects/opencensus-java/project-parent/fuzz-targets/pom.xml b/projects/opencensus-java/project-parent/fuzz-targets/pom.xml new file mode 100644 index 000000000000..e9bb2f6cb07c --- /dev/null +++ b/projects/opencensus-java/project-parent/fuzz-targets/pom.xml @@ -0,0 +1,134 @@ + + + + 4.0.0 + com.fuzzer + fuzz-targets + 0.0.1-SNAPSHOT + fuzz + fuzz + + + 1.8 + 1.8 + 1.8 + + + + + + com.code-intelligence + jazzer-junit + 0.16.0 + + + + org.junit.platform + junit-platform-launcher + 1.9.2 + + + + org.junit.jupiter + junit-jupiter-engine + 5.9.0 + test + + + + io.opencensus + opencensus-api + ${env.OPENCENSUS_JAVA_VERSION} + system + ${basedir}/../opencensus-java/api/build/libs/opencensus-api-0.32.0-SNAPSHOT.jar + + + + io.opencensus + opencensus-impl + ${env.OPENCENSUS_JAVA_VERSION} + system + ${basedir}/../opencensus-java/impl/build/libs/opencensus-impl-0.32.0-SNAPSHOT.jar + + + + io.opencensus + opencensus-impl-core + ${env.OPENCENSUS_JAVA_VERSION} + system + ${basedir}/../opencensus-java/impl_core/build/libs/opencensus-impl-core-0.32.0-SNAPSHOT.jar + + + + io.opencensus + opencensus-exporter-trace-util + ${env.OPENCENSUS_JAVA_VERSION} + system + ${basedir}/../opencensus-java/exporters/trace/util/build/libs/opencensus-exporter-trace-util-0.32.0-SNAPSHOT.jar + + + + io.opencensus + opencensus-contrib-resource-util + ${env.OPENCENSUS_JAVA_VERSION} + system + ${basedir}/../opencensus-java/contrib/resource_util/build/libs/opencensus-contrib-resource-util-0.32.0-SNAPSHOT.jar + + + + io.opencensus + opencensus-exporter-trace-elasticsearch + ${env.OPENCENSUS_JAVA_VERSION} + system + ${basedir}/../opencensus-java/exporters/trace/elasticsearch/build/libs/opencensus-exporter-trace-elasticsearch-${env.OPENCENSUS_JAVA_VERSION}.jar + + + + io.opencensus + opencensus-proto + 0.2.0 + runtime + + + + com.google.guava + guava + 31.1-jre + + + + com.google.protobuf + protobuf-java + 4.0.0-rc-2 + + + + com.lmax + disruptor + 3.4.4 + + + + io.grpc + grpc-context + 1.54.0 + + + + + + + + maven-surefire-plugin + 2.22.2 + + + + + ${project.basedir}/src/test/resources + + + + + \ No newline at end of file diff --git a/projects/opencensus-java/project-parent/fuzz-targets/src/test/java/com/example/JsonConversionFuzzer.java b/projects/opencensus-java/project-parent/fuzz-targets/src/test/java/com/example/JsonConversionFuzzer.java new file mode 100644 index 000000000000..45a751e2ed1f --- /dev/null +++ b/projects/opencensus-java/project-parent/fuzz-targets/src/test/java/com/example/JsonConversionFuzzer.java @@ -0,0 +1,100 @@ +// Copyright 2023 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +//////////////////////////////////////////////////////////////////////////////// + +package io.opencensus.exporter.trace.elasticsearch; + +import com.code_intelligence.jazzer.api.FuzzedDataProvider; +import com.code_intelligence.jazzer.junit.FuzzTest; + +import io.opencensus.exporter.trace.elasticsearch.JsonConversionUtils; +import com.google.common.collect.ImmutableList; +import com.google.common.collect.ImmutableMap; +import io.opencensus.common.Timestamp; +import io.opencensus.trace.Annotation; +import io.opencensus.trace.AttributeValue; +import io.opencensus.trace.Link; +import io.opencensus.trace.MessageEvent; +import io.opencensus.trace.MessageEvent.Type; +import io.opencensus.trace.SpanContext; +import io.opencensus.trace.SpanId; +import io.opencensus.trace.Status; +import io.opencensus.trace.TraceId; +import io.opencensus.trace.TraceOptions; +import io.opencensus.trace.Tracestate; +import io.opencensus.trace.export.SpanData; +import io.opencensus.trace.export.SpanData.Attributes; +import io.opencensus.trace.export.SpanData.Links; +import io.opencensus.trace.export.SpanData.TimedEvent; +import io.opencensus.trace.export.SpanData.TimedEvents; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; +import java.util.Map; + +public class JsonConversionFuzzer { + static List spanDataList; + + @FuzzTest + void myFuzzTest(FuzzedDataProvider data) { + spanDataList = new ArrayList(); + + String name = data.consumeString(200); + String traceId = data.consumeString(200); + String spanId = data.consumeString(200); + String parentSpanId = data.consumeString(200); + String spanName = data.consumeString(200); + String key = data.consumeString(200); + String value = data.consumeString(200); + boolean isSampled = data.consumeBoolean(); + boolean hasRemoteParent = data.consumeBoolean(); + + try { + List> messageEvents = + ImmutableList.of( + TimedEvent.create( + Timestamp.create(data.consumeInt(), data.consumeInt()), + MessageEvent.builder(Type.RECEIVED, 0).setCompressedMessageSize(data.consumeInt()).build()), + TimedEvent.create( + Timestamp.create(data.consumeInt(), data.consumeInt()), + MessageEvent.builder(Type.SENT, 0).setCompressedMessageSize(data.consumeInt()).build())); + + SpanData spanData = + SpanData.create( + SpanContext.create( + TraceId.fromLowerBase16(traceId), + SpanId.fromLowerBase16(spanId), + TraceOptions.builder().setIsSampled(isSampled).build(), + Tracestate.builder().build()), + SpanId.fromLowerBase16(parentSpanId), + hasRemoteParent, + spanName, + null, + Timestamp.create(data.consumeInt(), data.consumeInt()), + Attributes.create(ImmutableMap.of(key, AttributeValue.stringAttributeValue(value)), 0), + TimedEvents.create(Collections.emptyList(), 0), + TimedEvents.create(messageEvents, 0), + Links.create(Collections.emptyList(), 0), + null, + Status.OK, + Timestamp.create(data.consumeInt(), data.consumeInt())); + + spanDataList.add(spanData); + List json = JsonConversionUtils.convertToJson(name, spanDataList); + } catch (IllegalArgumentException e) { + } + } +} diff --git a/projects/opencensus-java/project-parent/pom.xml b/projects/opencensus-java/project-parent/pom.xml new file mode 100644 index 000000000000..32c597e30e43 --- /dev/null +++ b/projects/opencensus-java/project-parent/pom.xml @@ -0,0 +1,16 @@ + + + 4.0.0 + + com.fuzzer + project-parent + 0.1.0 + pom + + + + fuzz-targets + + + \ No newline at end of file diff --git a/projects/opencensus-java/project.yaml b/projects/opencensus-java/project.yaml new file mode 100644 index 000000000000..92e688776e59 --- /dev/null +++ b/projects/opencensus-java/project.yaml @@ -0,0 +1,15 @@ +homepage: "https://opencensus.io/" +language: jvm +fuzzing_engines: + - libfuzzer +main_repo: "https://github.com/census-instrumentation/opencensus-java/" +sanitizers: + - address +vendor_ccs: + - "wagner@code-intelligence.com" + - "yakdan@code-intelligence.com" + - "glendowne@code-intelligence.com" + - "patrice.salathe@code-intelligence.com" + - "hlin@code-intelligence.com" + - "bug-disclosure@code-intelligence.com" +run_tests: False \ No newline at end of file