Skip to content

Commit caa0f1d

Browse files
vyppkarwasz
vy
and
ppkarwasz
authored
Google OSS-Fuzz integration (#2949)
Co-authored-by: Piotr P. Karwasz <[email protected]>
1 parent 602bf88 commit caa0f1d

File tree

36 files changed

+1813
-606
lines changed

36 files changed

+1813
-606
lines changed

‎.mvn/wrapper/maven-wrapper.properties

+1-3
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,6 @@
1515
# specific language governing permissions and limitations
1616
# under the License.
1717
distributionSha256Sum=8351955a9acf2f83c136c4eee0f6db894ab6265fdbe0a94b32a380307dbaa3e1
18-
distributionType=script
18+
distributionType=only-script
1919
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.8/apache-maven-3.9.8-bin.zip
20-
wrapperSha256Sum=3d8f20ce6103913be8b52aef6d994e0c54705fb527324ceb9b835b338739c7a8
21-
wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.3.2/maven-wrapper-3.3.2.jar
2220
wrapperVersion=3.3.2

‎FUZZING.adoc

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
////
2+
Licensed to the Apache Software Foundation (ASF) under one or more
3+
contributor license agreements. See the NOTICE file distributed with
4+
this work for additional information regarding copyright ownership.
5+
The ASF licenses this file to You under the Apache License, Version 2.0
6+
(the "License"); you may not use this file except in compliance with
7+
the License. You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
////
17+
18+
Log4j contains fuzz tests implemented using https://github.com/CodeIntelligenceTesting/jazzer[Jazzer]footnote:[
19+
We are aware that https://github.com/google/oss-fuzz/discussions/12195[Jazzer is discontinued].
20+
Yet it is still the only mature fuzzing framework in Java and https://google.github.io/oss-fuzz/getting-started/new-project-guide/jvm-lang/#jazzer[the recommended library by OSS-Fuzz].].
21+
These tests are located in `-fuzz-test` prefixed modules; `log4j-core-fuzz-test`, `log4j-layout-template-json-fuzz-test`, etc.
22+
23+
[#oss-fuzz]
24+
== Google OSS-Fuzz
25+
26+
https://github.com/google/oss-fuzz[OSS-Fuzz] is a Google service that continuously runs fuzz tests of critical F/OSS projects on a beefy cluster and reports its findings (bugs, vulnerabilities, etc.) privately to project maintainers.
27+
Log4j provides OSS-Fuzz integration with following helpers:
28+
29+
- https://github.com/google/oss-fuzz/tree/master/projects/log4j2/Dockerfile[Dockerfile] to create a container image for running tests
30+
- link:oss-fuzz-build.sh[`oss-fuzz-build.sh`] to generate fuzz test runner scripts along with all necessary dependencies
31+
32+
[#faq]
33+
== F.A.Q.
34+
35+
Below we will try to answer some frequently asked questions.
36+
37+
[#running]
38+
=== How can I run fuzz tests locally?
39+
40+
. Clone the OSS-Fuzz repository:
41+
+
42+
[source,bash]
43+
----
44+
git clone --depth 1 https://github.com/google/oss-fuzz google-oss-fuzz && cd $_
45+
----
46+
47+
. Build the container image:
48+
+
49+
[source,bash]
50+
----
51+
python infra/helper.py build_image log4j2
52+
----
53+
54+
. Run the container image to build the Log4j project and generate runner scripts along with dependencies:
55+
+
56+
[source,bash]
57+
----
58+
python infra/helper.py build_fuzzers \
59+
--sanitizer address --engine libfuzzer --architecture x86_64 \
60+
log4j2
61+
----
62+
63+
. List generated runner scripts:
64+
+
65+
[source,bash]
66+
----
67+
ls -al build/out/log4j2
68+
----
69+
70+
. Check one of the generated runner scripts:
71+
+
72+
[source,bash]
73+
----
74+
python infra/helper.py check_build \
75+
--sanitizer address --engine libfuzzer --architecture x86_64 \
76+
log4j2 log4j-core-fuzz-test-PatternLayoutFuzzer
77+
----
78+
79+
. Execute one of the generated runner scripts:
80+
+
81+
[source,bash]
82+
----
83+
python infra/helper.py run_fuzzer \
84+
--sanitizer address --engine libfuzzer --architecture x86_64 \
85+
log4j2 log4j-core-fuzz-test-PatternLayoutFuzzer
86+
----
87+
88+
[#view]
89+
=== How can I view fuzzing failures detected by OSS-Fuzz?
90+
91+
The system running fuzzers registered to OSS-Fuzz is called *ClusterFuzz*, which provides https://oss-fuzz.com/[a web interface] for maintainers to monitor the fuzzing results.
92+
Tests outputs and <<#reproduce,reproduction>> inputs for failed tests are stored in https://console.cloud.google.com/storage/browser/log4j2-logs.clusterfuzz-external.appspot.com[a Google Cloud Storage bucket].
93+
Access to both the web interface and the bucket is restricted, and only allowed to https://github.com/google/oss-fuzz/blob/master/projects/log4j2/project.yaml[those configured for the project].
94+
95+
[#reproduce]
96+
=== How can I reproduce fuzzing failures detected by OSS-Fuzz?
97+
98+
Download the associated `.testcase` file from https://console.cloud.google.com/storage/browser/log4j2-logs.clusterfuzz-external.appspot.com[the Google Cloud Storage bucket], and run the following command:
99+
100+
[source,bash]
101+
----
102+
python infra/helper.py reproduce \
103+
log4j2 <FUZZ-TARGET-NAME> <TESTCASE-FILE-PATH>
104+
----
105+
106+
Refer to https://google.github.io/oss-fuzz/advanced-topics/reproducing/[the related OSS-Fuzz documentation] for details.

‎log4j-core-fuzz-test/pom.xml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to you under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
19+
20+
<modelVersion>4.0.0</modelVersion>
21+
22+
<parent>
23+
<groupId>org.apache.logging.log4j</groupId>
24+
<artifactId>log4j</artifactId>
25+
<version>${revision}</version>
26+
<relativePath>../log4j-parent</relativePath>
27+
</parent>
28+
29+
<artifactId>log4j-core-fuzz-test</artifactId>
30+
31+
<name>Apache Log4j Core fuzz tests</name>
32+
33+
<properties>
34+
<bnd.baseline.skip>true</bnd.baseline.skip>
35+
<log4j.docgen.skip>true</log4j.docgen.skip>
36+
<maven.deploy.skip>true</maven.deploy.skip>
37+
<maven.install.skip>true</maven.install.skip>
38+
<maven.test.skip>true</maven.test.skip>
39+
<sign.skip>true</sign.skip>
40+
</properties>
41+
42+
<dependencies>
43+
44+
<dependency>
45+
<groupId>org.apache.logging.log4j</groupId>
46+
<artifactId>log4j-fuzz-test</artifactId>
47+
</dependency>
48+
49+
</dependencies>
50+
51+
</project>

‎log4j-core-fuzz-test/src/main/java/org/apache/logging/log4j/core/fuzz/PatternLayoutFuzzer.java

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to you under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.logging.log4j.core.fuzz;
18+
19+
import static org.apache.logging.log4j.fuzz.FuzzingUtil.createLoggerContext;
20+
import static org.apache.logging.log4j.fuzz.FuzzingUtil.fuzzLogger;
21+
22+
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
23+
import org.apache.logging.log4j.core.LoggerContext;
24+
import org.apache.logging.log4j.fuzz.EncodingAppender;
25+
import org.apache.logging.log4j.fuzz.FuzzingUtil.Log4jLoggerFacade;
26+
import org.apache.logging.log4j.fuzz.FuzzingUtil.LoggerFacade;
27+
import org.apache.logging.log4j.spi.ExtendedLogger;
28+
29+
public final class PatternLayoutFuzzer {
30+
31+
public static void fuzzerTestOneInput(final FuzzedDataProvider dataProvider) {
32+
final String loggerContextName = PatternLayoutFuzzer.class.getSimpleName() + "LoggerContext";
33+
try (final LoggerContext loggerContext =
34+
createLoggerContext(loggerContextName, EncodingAppender.PLUGIN_NAME, configBuilder -> configBuilder
35+
.newLayout("PatternLayout")
36+
// Enforce using a single message-based converter, i.e., `MessagePatternConverter`
37+
.addAttribute("pattern", "%m"))) {
38+
final ExtendedLogger logger = loggerContext.getLogger(PatternLayoutFuzzer.class);
39+
final LoggerFacade loggerFacade = new Log4jLoggerFacade(logger);
40+
fuzzLogger(loggerFacade, dataProvider);
41+
}
42+
}
43+
}

‎log4j-core-its/pom.xml

+8-2
Original file line numberDiff line numberDiff line change
@@ -16,26 +16,32 @@
1616
~ limitations under the License.
1717
-->
1818
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
19+
1920
<modelVersion>4.0.0</modelVersion>
21+
2022
<parent>
2123
<groupId>org.apache.logging.log4j</groupId>
2224
<artifactId>log4j</artifactId>
2325
<version>${revision}</version>
2426
<relativePath>../log4j-parent</relativePath>
2527
</parent>
28+
2629
<artifactId>log4j-core-its</artifactId>
27-
<packaging>jar</packaging>
30+
2831
<name>Apache Log4j Core Integration Tests</name>
29-
<description>Integration Tests for the Apache Log4j Implementation</description>
32+
3033
<properties>
34+
3135
<bnd.baseline.skip>true</bnd.baseline.skip>
36+
<log4j.docgen.skip>true</log4j.docgen.skip>
3237
<maven.deploy.skip>true</maven.deploy.skip>
3338
<maven.install.skip>true</maven.install.skip>
3439
<sign.skip>true</sign.skip>
3540
<spotbugs.skip>true</spotbugs.skip>
3641

3742
<!-- Dependency versions -->
3843
<slf4j2.version>2.0.16</slf4j2.version>
44+
3945
</properties>
4046

4147
<dependencyManagement>

‎log4j-fuzz-test/.log4j-plugin-processing-activator

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This file is here to activate the `plugin-processing` Maven profile.

‎log4j-fuzz-test/pom.xml

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to you under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
19+
20+
<modelVersion>4.0.0</modelVersion>
21+
22+
<parent>
23+
<groupId>org.apache.logging.log4j</groupId>
24+
<artifactId>log4j</artifactId>
25+
<version>${revision}</version>
26+
<relativePath>../log4j-parent</relativePath>
27+
</parent>
28+
29+
<artifactId>log4j-fuzz-test</artifactId>
30+
31+
<name>Apache Log4j fuzz tests</name>
32+
33+
<properties>
34+
35+
<log4j.docgen.skip>true</log4j.docgen.skip>
36+
<bnd.baseline.skip>true</bnd.baseline.skip>
37+
<maven.deploy.skip>true</maven.deploy.skip>
38+
<maven.test.skip>true</maven.test.skip>
39+
<sign.skip>true</sign.skip>
40+
41+
<!-- dependency versions -->
42+
<json.version>20240303</json.version>
43+
44+
</properties>
45+
46+
<dependencies>
47+
48+
<dependency>
49+
<groupId>org.apache.logging.log4j</groupId>
50+
<artifactId>log4j-core</artifactId>
51+
</dependency>
52+
53+
<dependency>
54+
<groupId>org.jspecify</groupId>
55+
<artifactId>jspecify</artifactId>
56+
<scope>provided</scope>
57+
</dependency>
58+
59+
<dependency>
60+
<groupId>org.assertj</groupId>
61+
<artifactId>assertj-core</artifactId>
62+
</dependency>
63+
64+
<dependency>
65+
<groupId>com.code-intelligence</groupId>
66+
<artifactId>jazzer</artifactId>
67+
</dependency>
68+
69+
<dependency>
70+
<groupId>org.json</groupId>
71+
<artifactId>json</artifactId>
72+
<version>${json.version}</version>
73+
</dependency>
74+
75+
</dependencies>
76+
77+
</project>

‎log4j-fuzz-test/src/main/java/org/apache/logging/log4j/fuzz/EncodingAppender.java

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to you under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package org.apache.logging.log4j.fuzz;
18+
19+
import static org.assertj.core.api.Assertions.assertThat;
20+
21+
import java.io.Serializable;
22+
import org.apache.logging.log4j.core.Appender;
23+
import org.apache.logging.log4j.core.Core;
24+
import org.apache.logging.log4j.core.Layout;
25+
import org.apache.logging.log4j.core.LogEvent;
26+
import org.apache.logging.log4j.core.appender.AbstractAppender;
27+
import org.apache.logging.log4j.core.config.plugins.Plugin;
28+
import org.apache.logging.log4j.core.config.plugins.PluginAttribute;
29+
import org.apache.logging.log4j.core.config.plugins.PluginElement;
30+
import org.apache.logging.log4j.core.config.plugins.PluginFactory;
31+
32+
/**
33+
* Appender encoding incoming log events using the provided layout.
34+
* It is intended for appender-agnostic fuzzing.
35+
*/
36+
@Plugin(name = EncodingAppender.PLUGIN_NAME, category = Core.CATEGORY_NAME, elementType = Appender.ELEMENT_TYPE)
37+
public final class EncodingAppender extends AbstractAppender {
38+
39+
public static final String PLUGIN_NAME = "EncodingAppender";
40+
41+
private EncodingAppender(final String name, final Layout<? extends Serializable> layout) {
42+
super(name, null, layout, true, null);
43+
// Guard `PLUGIN_NAME` against copy-paste mistakes
44+
assertThat(PLUGIN_NAME).isEqualTo(getClass().getSimpleName());
45+
}
46+
47+
@PluginFactory
48+
public static EncodingAppender createAppender(
49+
final @PluginAttribute("name") String name, final @PluginElement("layout") Layout<?> layout) {
50+
return new EncodingAppender(name, layout);
51+
}
52+
53+
@Override
54+
public void append(final LogEvent event) {
55+
try {
56+
getLayout().toByteArray(event);
57+
} catch (final Exception ignored) {
58+
// We are inspecting unexpected access.
59+
// Hence, event encoding failures are not of interest.
60+
}
61+
}
62+
}

0 commit comments

Comments
 (0)