From d64c6a55e1926e01aa05fe3d3f029d9721a45631 Mon Sep 17 00:00:00 2001 From: Flawz Date: Sun, 3 May 2026 23:39:30 +0200 Subject: [PATCH 1/3] Added ClusterFuzzLite to the codebase --- .clusterfuzzlite/Dockerfile | 8 +++ .clusterfuzzlite/build.sh | 69 ++++++++++++++++++++ .clusterfuzzlite/project.yaml | 2 + fuzz/ApisCommonFuzzer.java | 117 ++++++++++++++++++++++++++++++++++ 4 files changed, 196 insertions(+) create mode 100644 .clusterfuzzlite/Dockerfile create mode 100755 .clusterfuzzlite/build.sh create mode 100644 .clusterfuzzlite/project.yaml create mode 100644 fuzz/ApisCommonFuzzer.java diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile new file mode 100644 index 0000000..114e490 --- /dev/null +++ b/.clusterfuzzlite/Dockerfile @@ -0,0 +1,8 @@ +# ClusterFuzzLite build image (OpenSSF Scorecard detects this path). +# Source is copied in at build time; see https://google.github.io/clusterfuzzlite/build-integration/ +FROM gcr.io/oss-fuzz-base/base-builder-jvm +RUN apt-get update && apt-get install -y maven git \ + && rm -rf /var/lib/apt/lists/* +COPY . $SRC/apis-common +WORKDIR $SRC/apis-common +COPY .clusterfuzzlite/build.sh $SRC/build.sh diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh new file mode 100755 index 0000000..656487d --- /dev/null +++ b/.clusterfuzzlite/build.sh @@ -0,0 +1,69 @@ +#!/bin/bash -eu +# Copyright 2026 The APIS Common Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Build apis-common and a Jazzer fuzz target without modifying pom.xml. +# Mirrors patterns from https://google.github.io/oss-fuzz/getting-started/new-project-guide/jvm-lang/ + +PROJECT_ROOT="${SRC}/apis-common" +# Pinned apis-bom (same ref as CI in .github/workflows/ci.yml) +APIS_BOM_COMMIT="${APIS_BOM_COMMIT:-266abde1821756ee75bbbdcef1fc746bb66dcc3c}" + +rm -rf "${WORK}/apis-bom" +git clone https://github.com/hyphae/apis-bom.git "${WORK}/apis-bom" +pushd "${WORK}/apis-bom" >/dev/null +git checkout "${APIS_BOM_COMMIT}" +"${MVN:-mvn}" -B -DskipTests install +popd >/dev/null + +pushd "${PROJECT_ROOT}" >/dev/null +"${MVN:-mvn}" -B -DskipTests package +cp target/apis-common-*.jar "${OUT}/apis-common.jar" +mkdir -p "${OUT}/lib" +"${MVN:-mvn}" -B org.apache.maven.plugins:maven-dependency-plugin:3.6.1:copy-dependencies \ + -DoutputDirectory="${OUT}/lib" -DincludeScope=runtime +popd >/dev/null + +BUILD_CP="${OUT}/apis-common.jar" +for j in "${OUT}/lib"/*.jar; do + BUILD_CP="${BUILD_CP}:${j}" +done +BUILD_CP="${BUILD_CP}:${JAZZER_API_PATH}" + +FUZZER_SRC="${PROJECT_ROOT}/fuzz/ApisCommonFuzzer.java" +javac -cp "${BUILD_CP}" -d "${OUT}" "${FUZZER_SRC}" + +RUNTIME_CP="" +for j in "${OUT}/lib"/*.jar; do + RUNTIME_CP="${RUNTIME_CP}\$this_dir/lib/$(basename "${j}"):" +done +RUNTIME_CP="${RUNTIME_CP}\$this_dir/apis-common.jar:\$this_dir" + +cat >"${OUT}/ApisCommonFuzzer" < Date: Sun, 3 May 2026 23:43:35 +0200 Subject: [PATCH 2/3] Added ClusterFuzzLite to the codebase --- .clusterfuzzlite/Dockerfile | 2 -- .clusterfuzzlite/build.sh | 15 --------------- .clusterfuzzlite/project.yaml | 2 +- fuzz/ApisCommonFuzzer.java | 20 +------------------- 4 files changed, 2 insertions(+), 37 deletions(-) diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile index 114e490..f24af0f 100644 --- a/.clusterfuzzlite/Dockerfile +++ b/.clusterfuzzlite/Dockerfile @@ -1,5 +1,3 @@ -# ClusterFuzzLite build image (OpenSSF Scorecard detects this path). -# Source is copied in at build time; see https://google.github.io/clusterfuzzlite/build-integration/ FROM gcr.io/oss-fuzz-base/base-builder-jvm RUN apt-get update && apt-get install -y maven git \ && rm -rf /var/lib/apt/lists/* diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh index 656487d..c41aab7 100755 --- a/.clusterfuzzlite/build.sh +++ b/.clusterfuzzlite/build.sh @@ -1,20 +1,5 @@ #!/bin/bash -eu -# Copyright 2026 The APIS Common Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# Build apis-common and a Jazzer fuzz target without modifying pom.xml. -# Mirrors patterns from https://google.github.io/oss-fuzz/getting-started/new-project-guide/jvm-lang/ PROJECT_ROOT="${SRC}/apis-common" # Pinned apis-bom (same ref as CI in .github/workflows/ci.yml) diff --git a/.clusterfuzzlite/project.yaml b/.clusterfuzzlite/project.yaml index b103ca1..7c6ded3 100644 --- a/.clusterfuzzlite/project.yaml +++ b/.clusterfuzzlite/project.yaml @@ -1,2 +1,2 @@ -# ClusterFuzzLite metadata (see https://google.github.io/clusterfuzzlite/build-integration/) +# see https://google.github.io/clusterfuzzlite/build-integration/ language: jvm diff --git a/fuzz/ApisCommonFuzzer.java b/fuzz/ApisCommonFuzzer.java index e90cdeb..f65c194 100644 --- a/fuzz/ApisCommonFuzzer.java +++ b/fuzz/ApisCommonFuzzer.java @@ -1,31 +1,13 @@ -// Copyright 2026 The APIS Common Authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. import com.code_intelligence.jazzer.api.FuzzedDataProvider; - import io.vertx.core.json.JsonArray; import io.vertx.core.json.JsonObject; - import jp.co.sony.csl.dcoes.apis.common.util.DateTimeUtil; import jp.co.sony.csl.dcoes.apis.common.util.NumberUtil; import jp.co.sony.csl.dcoes.apis.common.util.StringUtil; import jp.co.sony.csl.dcoes.apis.common.util.vertx.JsonObjectUtil; -/** - * Jazzer entry point for OSS-Fuzz / ClusterFuzzLite. Not on the Maven test classpath; - * compiled only by {@code .clusterfuzzlite/build.sh} inside the fuzzing image. - */ + public class ApisCommonFuzzer { public static void fuzzerTestOneInput(FuzzedDataProvider data) { switch (data.consumeInt(0, 5)) { From 4c70c7afd74944af3dadde89b0cec88a8b05bdc4 Mon Sep 17 00:00:00 2001 From: Flawz Date: Tue, 5 May 2026 18:59:06 +0200 Subject: [PATCH 3/3] changed variable name --- fuzz/ApisCommonFuzzer.java | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/fuzz/ApisCommonFuzzer.java b/fuzz/ApisCommonFuzzer.java index f65c194..436d10d 100644 --- a/fuzz/ApisCommonFuzzer.java +++ b/fuzz/ApisCommonFuzzer.java @@ -72,9 +72,9 @@ private static void fuzzJsonArray(FuzzedDataProvider data) { private static void fuzzJsonObjectUtil(FuzzedDataProvider data) { String raw = data.consumeString(8192); - final JsonObject jo; + final JsonObject jsonobject; try { - jo = new JsonObject(raw); + jsonobject = new JsonObject(raw); } catch (RuntimeException e) { return; } @@ -84,15 +84,15 @@ private static void fuzzJsonObjectUtil(FuzzedDataProvider data) { keys[i] = data.consumeString(64); } try { - JsonObjectUtil.getValue(jo, keys); - JsonObjectUtil.getString(jo, keys); - JsonObjectUtil.getFloat(jo, keys); - JsonObjectUtil.getInteger(jo, keys); - JsonObjectUtil.getLong(jo, keys); - JsonObjectUtil.getBoolean(jo, keys); - JsonObjectUtil.getLocalDateTime(jo, keys); - JsonObjectUtil.getJsonArray(jo, keys); - JsonObjectUtil.getJsonObject(jo, keys); + JsonObjectUtil.getValue(jsonobject, keys); + JsonObjectUtil.getString(jsonobject, keys); + JsonObjectUtil.getFloat(jsonobject, keys); + JsonObjectUtil.getInteger(jsonobject, keys); + JsonObjectUtil.getLong(jsonobject, keys); + JsonObjectUtil.getBoolean(jsonobject, keys); + JsonObjectUtil.getLocalDateTime(jsonobject, keys); + JsonObjectUtil.getJsonArray(jsonobject, keys); + JsonObjectUtil.getJsonObject(jsonobject, keys); } catch (RuntimeException ignored) { } }