-
Notifications
You must be signed in to change notification settings - Fork 6
131 lines (120 loc) · 3.88 KB
/
fuzz.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: Fuzz
on:
pull_request:
branches:
- "**"
push:
branches: [ master ]
tags:
- "*"
schedule:
- cron: 30 0 * * *
workflow_dispatch:
inputs:
duration:
description: 'Duration of the fuzzing run in seconds'
required: true
default: "60"
type: string
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
jobs:
# TODO: build all fuzzers first, then run independently
global-fuzzer:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Install deps
run: |
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y remove python3-lldb-14
sudo .github/workflows/scripts/llvm.sh 17
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y install libfuzzer-17-dev
- name: Build
run: ./fuzzer/global/build.sh
- name: Run fuzzer
run: ./fuzzer/global/run.sh ${{ github.event.inputs.duration }}
- name: Log
if: ${{ always() }}
run: grep -v -f fuzzer/global/scripts/report-negative-patterns.txt fuzzer/global/fuzz-*.log
- name: Show coverage
run: ./fuzzer/global/scripts/show_coverage.sh 40 || true
- name: Compress artifact
if: ${{ always() }}
run: tar -czvf fuzzing.tar.gz fuzzer/global/
- name: Artifact
uses: actions/upload-artifact@v4
if: ${{ always() }}
with:
name: fuzzing-data
path: fuzzing.tar.gz
local-fuzzer:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
variant:
- fuzzer: uri_parse
params: ""
- fuzzer: ssrf_detector
params: ""
- fuzzer: lfi_detector
params: ""
- fuzzer: sql_tokenizer
params: "--dialect=mysql"
- fuzzer: sql_tokenizer
params: "--dialect=postgresql"
- fuzzer: sql_tokenizer
params: "--dialect=sqlite"
- fuzzer: sql_tokenizer
params: "--dialect=standard"
- fuzzer: sqli_detector
params: "--dialect=mysql"
- fuzzer: sqli_detector
params: "--dialect=postgresql"
- fuzzer: sqli_detector
params: "--dialect=sqlite"
- fuzzer: sqli_detector
params: "--dialect=standard"
- fuzzer: shell_tokenizer
params: ""
- fuzzer: shi_detector_string
params: ""
- fuzzer: shi_detector_array
params: ""
- fuzzer: cmdi_detector
params: ""
- fuzzer: sha256
params: ""
- fuzzer: http_endpoint_fingerprint
params: ""
- fuzzer: http_header_fingerprint
params: ""
- fuzzer: http_network_fingerprint
params: ""
- fuzzer: session_fingerprint
params: ""
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Install deps
run: |
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y remove python3-lldb-14
sudo .github/workflows/scripts/llvm.sh 17
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y install libfuzzer-17-dev
- name: Build
env:
CC: clang-17
CXX: clang++-17
run: |
mkdir build ; cd build
cmake -DCMAKE_VERBOSE_MAKEFILE=1 -DCMAKE_BUILD_TYPE=RelWithDebInfo ..
make -j $(nproc) ${{ matrix.variant.fuzzer }}_fuzzer
cp fuzzer/${{ matrix.variant.fuzzer }}_fuzzer ../fuzzer/${{ matrix.variant.fuzzer }}
- name: Run fuzzer
run: |
cd fuzzer/${{ matrix.variant.fuzzer }}
./${{ matrix.variant.fuzzer }}_fuzzer ${{ matrix.variant.params }} -max_total_time=${{ github.event.inputs.duration || 300 }} corpus/