Provide some way for smaller Javascript projects to pass the Fuzzing check

[djahandarie]

Currently, the following options exist for passing the fuzzing check:

• if the repository name is included in the OSS-Fuzz project list;

  Not possible for smaller projects

• if ClusterFuzzLite is deployed in the repository;

  Does not support Javascript

• if there are user-defined language-specified fuzzing functions (currently only supports Go fuzzing) in the repository.

  Does not support Javascript

• if it contains a OneFuzz integration detection file;

  Does not support Javascript

There are a couple JS fuzzing tools out there, but since OSS-Fuzz has settled on Jazzer.js as their supported JS fuzzing tool, perhaps it'd be a good first step if the scorecard checked for the existence of @jazzer.js/core in the node config as an alternative way to pass this check?

[laurentsimon]

/cc @spencerschrock

[spencerschrock]

Hmm, I could see about adding logic here:

scorecard/checks/raw/fuzzing.go

Lines 50 to 63 in ef16fd8

	// Contains fuzzing speficications for programming languages.
	// Please use the type Language defined in clients/languages.go rather than a raw string.
	var languageFuzzSpecs = map[clients.LanguageName]languageFuzzConfig{
	// Default fuzz patterns for Go.
	clients.Go: {
	filePattern: "*_test.go",
	funcPattern: `func\s+Fuzz\w+\s*\(\w+\s+\*testing.F\)`,
	Name: fuzzerBuiltInGo,
	URL: asPointer("https://go.dev/doc/fuzz/"),
	Desc: asPointer(
	"Go fuzzing intelligently walks through the source code to report failures and find vulnerabilities."),
	},
	// TODO: add more language-specific fuzz patterns & configs.
	}

I'm not that knowledgable about JS, but would it just be looking for "@jazzer.js/core" in the package.json file? That could have some false positives as opposed to parsing the dev dependencies to look for it

[djahandarie]

I'm not that knowledgable about JS, but would it just be looking for "@jazzer.js/core" in the package.json file?

Yeah.

That could have some false positives as opposed to parsing the dev dependencies to look for it

In the end it isn't a perfect check as anyone can easily include the dependency and then not actually implementing any fuzzing, so I don't think a false positive due it being in the wrong part of the file is a huge deal.

But I think this is a fine initial level of support, it could be refined to be more accurate if someone comes up with an idea for a more precise check.

[ericcornelissen]

I'd like to propose considering jsfuzz (jsfuzz repository) in addition to @jazzer.js/core.

[spencerschrock]

If someone would like to send a PR they can use #2843 as a template more or less.

[dubzzz]

Same as:

I'd like to propose considering jsfuzz (jsfuzz repository) in addition to @jazzer.js/core.

I think adding "the project is relying on fast-check" should also be considered as a fuzzed project.

[laurentsimon]

If you know how how to check support for fas-check, feel free to send a PR

[github-actions]

Stale issue message - this issue will be closed in 7 days

[spencerschrock]

Completed initially via #3073, with other issues tracking alternatives (e.g. #3491 for jazzer.js)