From 21075bf868f991fb9b40f0833a7a05b4c4b00be4 Mon Sep 17 00:00:00 2001 From: davkor Date: Mon, 7 Dec 2020 15:40:09 +0000 Subject: [PATCH 1/8] Added first fuzzers as step in OSS-Fuzz integration. --- tests/fuzz_http_parser.py | 28 ++++++++++++++++++++++++++++ tests/fuzz_payload_url.py | 31 +++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 tests/fuzz_http_parser.py create mode 100644 tests/fuzz_payload_url.py diff --git a/tests/fuzz_http_parser.py b/tests/fuzz_http_parser.py new file mode 100644 index 00000000000..3413a190cce --- /dev/null +++ b/tests/fuzz_http_parser.py @@ -0,0 +1,28 @@ +#!/usr/bin/python3 +import sys +import atheris + +# aiohttp imports +import asyncio +import aiohttp +from aiohttp.base_protocol import BaseProtocol +from aiohttp import http_exceptions, streams + +def TestOneInput(data): + loop = asyncio.get_event_loop() + pr = BaseProtocol(loop) + h_p = aiohttp.http_parser.HttpRequestParser(pr, loop, 32768) + try: + h_p.feed_data(data) + except aiohttp.http_exceptions.HttpProcessingError: + return + return + +def main(): + atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True) + loop = asyncio.get_event_loop() + asyncio.set_event_loop(loop) + atheris.Fuzz() + +if __name__ == "__main__": + main() diff --git a/tests/fuzz_payload_url.py b/tests/fuzz_payload_url.py new file mode 100644 index 00000000000..2066286cc59 --- /dev/null +++ b/tests/fuzz_payload_url.py @@ -0,0 +1,31 @@ +#!/usr/bin/python3 +import sys +import atheris + +# aiohttp specific +from aiohttp import http_exceptions, payload + +from yarl import URL + +def TestOneInput(data): + fdp = atheris.FuzzedDataProvider(data) + original = fdp.ConsumeString(sys.maxsize) + + try: + p = payload.StringPayload(original) + except UnicodeEncodeError: + None + + try: + u = URL(original) + except ValueError: + None + + return + +def main(): + atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True) + atheris.Fuzz() + +if __name__ == "__main__": + main() From 2c67c5e25994ca34db6f5e738c88da958808fd16 Mon Sep 17 00:00:00 2001 From: davkor Date: Tue, 26 Jan 2021 17:59:26 +0000 Subject: [PATCH 2/8] Updated the syntax of the fuzzers. --- tests/fuzz_http_parser.py | 8 +++++--- tests/fuzz_payload_url.py | 6 ++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/tests/fuzz_http_parser.py b/tests/fuzz_http_parser.py index 3413a190cce..e035b5baa54 100644 --- a/tests/fuzz_http_parser.py +++ b/tests/fuzz_http_parser.py @@ -1,12 +1,12 @@ #!/usr/bin/python3 +import asyncio import sys + import atheris -# aiohttp imports -import asyncio import aiohttp -from aiohttp.base_protocol import BaseProtocol from aiohttp import http_exceptions, streams +from aiohttp.base_protocol import BaseProtocol def TestOneInput(data): loop = asyncio.get_event_loop() @@ -18,11 +18,13 @@ def TestOneInput(data): return return + def main(): atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True) loop = asyncio.get_event_loop() asyncio.set_event_loop(loop) atheris.Fuzz() + if __name__ == "__main__": main() diff --git a/tests/fuzz_payload_url.py b/tests/fuzz_payload_url.py index 2066286cc59..573f49278b8 100644 --- a/tests/fuzz_payload_url.py +++ b/tests/fuzz_payload_url.py @@ -1,12 +1,12 @@ #!/usr/bin/python3 import sys + import atheris -# aiohttp specific from aiohttp import http_exceptions, payload - from yarl import URL + def TestOneInput(data): fdp = atheris.FuzzedDataProvider(data) original = fdp.ConsumeString(sys.maxsize) @@ -23,9 +23,11 @@ def TestOneInput(data): return + def main(): atheris.Setup(sys.argv, TestOneInput, enable_python_coverage=True) atheris.Fuzz() + if __name__ == "__main__": main() From d9a2e05eeeb12914ff4539d156c422a263d8e12c Mon Sep 17 00:00:00 2001 From: davkor Date: Tue, 26 Jan 2021 18:12:26 +0000 Subject: [PATCH 3/8] updated the fuzz payload --- tests/fuzz_payload_url.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/fuzz_payload_url.py b/tests/fuzz_payload_url.py index 573f49278b8..e8b49a8393a 100644 --- a/tests/fuzz_payload_url.py +++ b/tests/fuzz_payload_url.py @@ -2,9 +2,9 @@ import sys import atheris +from yarl import URL from aiohttp import http_exceptions, payload -from yarl import URL def TestOneInput(data): From 03a098c7441f34bde8a83573b8cf69b28c032c02 Mon Sep 17 00:00:00 2001 From: davkor Date: Tue, 26 Jan 2021 18:39:19 +0000 Subject: [PATCH 4/8] Add missing whitespace. --- tests/fuzz_http_parser.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/fuzz_http_parser.py b/tests/fuzz_http_parser.py index e035b5baa54..c5ba95bf52d 100644 --- a/tests/fuzz_http_parser.py +++ b/tests/fuzz_http_parser.py @@ -8,6 +8,7 @@ from aiohttp import http_exceptions, streams from aiohttp.base_protocol import BaseProtocol + def TestOneInput(data): loop = asyncio.get_event_loop() pr = BaseProtocol(loop) From 3f3d84000415e54793294905a59e108230b2f2fd Mon Sep 17 00:00:00 2001 From: davkor Date: Tue, 26 Jan 2021 18:43:22 +0000 Subject: [PATCH 5/8] cleanup code. --- tests/fuzz_http_parser.py | 1 - tests/fuzz_payload_url.py | 6 ++---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/tests/fuzz_http_parser.py b/tests/fuzz_http_parser.py index c5ba95bf52d..4716091a976 100644 --- a/tests/fuzz_http_parser.py +++ b/tests/fuzz_http_parser.py @@ -5,7 +5,6 @@ import atheris import aiohttp -from aiohttp import http_exceptions, streams from aiohttp.base_protocol import BaseProtocol diff --git a/tests/fuzz_payload_url.py b/tests/fuzz_payload_url.py index e8b49a8393a..376d6fde24e 100644 --- a/tests/fuzz_payload_url.py +++ b/tests/fuzz_payload_url.py @@ -4,20 +4,18 @@ import atheris from yarl import URL -from aiohttp import http_exceptions, payload - def TestOneInput(data): fdp = atheris.FuzzedDataProvider(data) original = fdp.ConsumeString(sys.maxsize) try: - p = payload.StringPayload(original) + payload.StringPayload(original) except UnicodeEncodeError: None try: - u = URL(original) + URL(original) except ValueError: None From 726d23b34b0730d660953e75d142fb5508ed15a6 Mon Sep 17 00:00:00 2001 From: davkor Date: Tue, 26 Jan 2021 18:48:22 +0000 Subject: [PATCH 6/8] Insert payload again. --- tests/fuzz_payload_url.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/fuzz_payload_url.py b/tests/fuzz_payload_url.py index 376d6fde24e..6f8432acdd7 100644 --- a/tests/fuzz_payload_url.py +++ b/tests/fuzz_payload_url.py @@ -4,6 +4,8 @@ import atheris from yarl import URL +from aiohttp import payload + def TestOneInput(data): fdp = atheris.FuzzedDataProvider(data) From 5364bb02edb4ec6dd97442114f8cfb492524c581 Mon Sep 17 00:00:00 2001 From: davkor Date: Tue, 26 Jan 2021 20:00:53 +0000 Subject: [PATCH 7/8] moved fuzzers into specific directory. --- {tests => fuzzers}/fuzz_http_parser.py | 0 {tests => fuzzers}/fuzz_payload_url.py | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename {tests => fuzzers}/fuzz_http_parser.py (100%) rename {tests => fuzzers}/fuzz_payload_url.py (100%) diff --git a/tests/fuzz_http_parser.py b/fuzzers/fuzz_http_parser.py similarity index 100% rename from tests/fuzz_http_parser.py rename to fuzzers/fuzz_http_parser.py diff --git a/tests/fuzz_payload_url.py b/fuzzers/fuzz_payload_url.py similarity index 100% rename from tests/fuzz_payload_url.py rename to fuzzers/fuzz_payload_url.py From 42f0d254b9b4904f1957805ca1a6c060166a4f78 Mon Sep 17 00:00:00 2001 From: davkor Date: Tue, 26 Jan 2021 20:21:45 +0000 Subject: [PATCH 8/8] Add a news fragment. --- CHANGES/5320.feature | 1 + 1 file changed, 1 insertion(+) create mode 100644 CHANGES/5320.feature diff --git a/CHANGES/5320.feature b/CHANGES/5320.feature new file mode 100644 index 00000000000..2066e6a301f --- /dev/null +++ b/CHANGES/5320.feature @@ -0,0 +1 @@ +Implements new feature of fuzzers with the purpose of integrating aiohttp with OSS-Fuzz.