Merge branch 'main' into fix/signature-deduplication

Author: mohityadav8

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,9 @@
+FROM gcr.io/oss-fuzz-base/base-builder-python
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    protobuf-compiler \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY . $SRC/hiero-sdk-python
+WORKDIR $SRC/hiero-sdk-python
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,32 @@
+#!/bin/bash -eu
+
+pip3 install grpcio-tools
+
+python3 generate_proto.py
+
+pip3 install .
+
+pip3 install atheris pyinstaller
+
+find "$SRC/hiero-sdk-python/.clusterfuzzlite" -name '*_fuzzer.py' -print0 | while IFS= read -r -d '' fuzzer; do
+  fuzzer_basename=$(basename -s .py "$fuzzer")
+  fuzzer_package="${fuzzer_basename}.pkg"
+
+  # Bundle the fuzzer and all its dependencies into a single portable package.
+  pyinstaller --distpath "$OUT" --onefile --name "$fuzzer_package" "$fuzzer"
+
+  # Write a thin shell wrapper that ClusterFuzzLite uses to invoke the fuzzer.
+  # The wrapper preloads the sanitizer library and sets ASAN_OPTIONS.
+  # LD_PRELOAD is required here because the SDK uses C extensions (grpcio,
+  # cryptography, protobuf) that must be covered by the sanitizer.
+  cat > "$OUT/$fuzzer_basename" << EOF
+#!/bin/sh
+# LLVMFuzzerTestOneInput for fuzzer detection.
+this_dir=\$(dirname "\$0")
+LD_PRELOAD=\$this_dir/sanitizer_with_fuzzer.so \\
+PYCRYPTODOME_DISABLE_DEEPBIND=1 \\
+ASAN_OPTIONS=\$ASAN_OPTIONS:symbolize=1:external_symbolizer_path=\$this_dir/llvm-symbolizer:detect_leaks=0 \\
+  "\$this_dir/$fuzzer_package" "\$@"
+EOF
+  chmod +x "$OUT/$fuzzer_basename"
+done

.clusterfuzzlite/contract_params_fuzzer.py

@@ -0,0 +1,55 @@
+"""Atheris fuzz target: ContractFunctionParameters ABI encoding."""
+
+from __future__ import annotations
+
+import sys
+
+import atheris
+
+
+with atheris.instrument_imports():
+    from eth_abi.exceptions import EncodingTypeError, ValueOutOfBounds
+
+    from hiero_sdk_python import ContractFunctionParameters
+
+
+def TestOneInput(data: bytes) -> None:
+    """Feed arbitrary bytes into ContractFunctionParameters encoding paths."""
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, 9)
+    params = ContractFunctionParameters()
+    if choice == 0:
+        params.add_bool(fdp.ConsumeBool())
+    elif choice == 1:
+        # add_address expects a 20-byte hex string or bytes
+        params.add_address(fdp.ConsumeBytes(20).hex())
+    elif choice == 2:
+        params.add_string(fdp.ConsumeUnicodeNoSurrogates(256))
+    elif choice == 3:
+        params.add_bytes(fdp.ConsumeBytes(256))
+    elif choice == 4:
+        params.add_bytes32(fdp.ConsumeBytes(32))
+    elif choice == 5:
+        count = fdp.ConsumeIntInRange(0, 8)
+        params.add_bool_array([fdp.ConsumeBool() for _ in range(count)])
+    elif choice == 6:
+        count = fdp.ConsumeIntInRange(0, 8)
+        params.add_string_array([fdp.ConsumeUnicodeNoSurrogates(64) for _ in range(count)])
+    elif choice == 7:
+        count = fdp.ConsumeIntInRange(0, 8)
+        params.add_bytes_array([fdp.ConsumeBytes(32) for _ in range(count)])
+    elif choice == 8:
+        count = fdp.ConsumeIntInRange(0, 8)
+        params.add_address_array([fdp.ConsumeBytes(20).hex() for _ in range(count)])
+    else:
+        count = fdp.ConsumeIntInRange(0, 8)
+        params.add_bytes32_array([fdp.ConsumeBytes(32) for _ in range(count)])
+    try:
+        params.to_bytes()
+    except (TypeError, ValueError, EncodingTypeError, ValueOutOfBounds):
+        # Malformed fuzz input can trigger expected validation/ABI encoding failures.
+        pass
+
+
+atheris.Setup(sys.argv, TestOneInput)
+atheris.Fuzz()

.clusterfuzzlite/entity_id_fuzzer.py

@@ -0,0 +1,34 @@
+"""Atheris fuzz target: entity ID string parsing."""
+
+from __future__ import annotations
+
+import sys
+
+import atheris
+
+
+with atheris.instrument_imports():
+    from hiero_sdk_python import AccountId, ContractId, FileId, TokenId, TopicId
+
+_CLASSES = (AccountId, TokenId, ContractId, FileId, TopicId)
+
+
+def _try_parse_entity_id(entity_id_class, text: str) -> None:
+    try:
+        entity_id_class.from_string(text)
+    except (TypeError, ValueError, IndexError, OverflowError):
+        # Expected errors from malformed string input (parsing, indexing, conversions)
+        pass
+
+
+def TestOneInput(data: bytes) -> None:
+    """Feed arbitrary strings into entity ID parsers."""
+    fdp = atheris.FuzzedDataProvider(data)
+    text = fdp.ConsumeUnicodeNoSurrogates(256)
+
+    for cls in _CLASSES:
+        _try_parse_entity_id(cls, text)
+
+
+atheris.Setup(sys.argv, TestOneInput)
+atheris.Fuzz()

.clusterfuzzlite/keys_fuzzer.py

@@ -0,0 +1,45 @@
+"""Atheris fuzz target: PrivateKey and PublicKey parsing."""
+
+from __future__ import annotations
+
+import sys
+import warnings
+
+import atheris
+
+
+with atheris.instrument_imports():
+    from hiero_sdk_python import PrivateKey, PublicKey
+
+
+def _quiet(fn, *args):
+    """Call *fn* with *args*, suppressing UserWarning."""
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", UserWarning)
+        return fn(*args)
+
+
+def TestOneInput(data: bytes) -> None:
+    """Feed arbitrary bytes/strings into key parsers."""
+    fdp = atheris.FuzzedDataProvider(data)
+    choice = fdp.ConsumeIntInRange(0, 3)
+
+    try:
+        if choice == 0:
+            text = fdp.ConsumeUnicodeNoSurrogates(256)
+            _quiet(PrivateKey.from_string, text)
+        elif choice == 1:
+            raw = fdp.ConsumeBytes(128)
+            _quiet(PrivateKey.from_bytes, raw)
+        elif choice == 2:
+            text = fdp.ConsumeUnicodeNoSurrogates(256)
+            _quiet(PublicKey.from_string, text)
+        else:
+            raw = fdp.ConsumeBytes(128)
+            _quiet(PublicKey.from_bytes, raw)
+    except ValueError:
+        pass
+
+
+atheris.Setup(sys.argv, TestOneInput)
+atheris.Fuzz()

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: python

.clusterfuzzlite/transaction_from_bytes_fuzzer.py

@@ -0,0 +1,27 @@
+"""Atheris fuzz target: Transaction.from_bytes deserialization."""
+
+from __future__ import annotations
+
+import sys
+
+import atheris
+
+
+with atheris.instrument_imports():
+    from hiero_sdk_python import Transaction
+
+
+def TestOneInput(data: bytes) -> None:
+    """Feed arbitrary bytes into Transaction.from_bytes and re-serialise."""
+    try:
+        tx = Transaction.from_bytes(data)
+        tx.to_bytes()
+    except Exception:
+        # Protobuf deserialization and transaction parsing can raise many
+        # exception types (DecodeError, ValueError, TypeError, KeyError, etc.);
+        # only unhandled exceptions that escape are reported as fuzzer crashes.
+        pass
+
+
+atheris.Setup(sys.argv, TestOneInput)
+atheris.Fuzz()

.codacy.yml

@@ -1,6 +1,7 @@
 ---
 exclude_paths:
   - "tck/**"
+  - ".clusterfuzzlite/**"
 
 engines:
   bandit:

.github/ISSUE_TEMPLATE/00-good-first-issue-candidate.yml

@@ -82,7 +82,7 @@ body:
         - The complete steps to implement the solution
         - What the final result or output should look like
         - Links to relevant documentation or code (if helpful)
-        For good first issues, please keep this as guided and clear as possible.
+        For Good First Issues, please keep this as guided and clear as possible.
       value: |
         <!-- Identify what to change in which files -->
 
@@ -95,7 +95,7 @@ body:
     attributes:
       label: 🧠 Good First Issue Developers — Prerequisites & Expectations
       description: |
-        Adapt as needed. Concrete requirements before claiming this good first issue. Adapt as needed.
+        Adapt as needed. Concrete requirements before claiming this Good First Issue. Adapt as needed.
       value: |
         > [!IMPORTANT]
         > **This issue does not require prior domain knowledge.**

.github/ISSUE_TEMPLATE/01-good-first-issue.yml

@@ -69,7 +69,7 @@ body:
         - The complete steps to implement the solution
         - What the final result or output should look like
         - Links to relevant documentation or code (if helpful)
-        For good first issues, please keep this as guided and clear as possible.
+        For Good First Issues, please keep this as guided and clear as possible.
       value: |
         <!-- Identify what to change in which files -->
 
@@ -82,7 +82,7 @@ body:
     attributes:
       label: 🧠 Good First Issue Developers — Prerequisites & Expectations
       description: |
-        Adapt as needed. Concrete requirements before claiming this good first issue. Adapt as needed.
+        Adapt as needed. Concrete requirements before claiming this Good First Issue. Adapt as needed.
       value: |
         > [!IMPORTANT]
         > **This issue does not require prior domain knowledge.**