Skip to content

Commit d6fe7e9

Browse files
DavidKorczynskiDavidKorczynski
authored
connexion: initial integration (#9744)
Signed-off-by: David Korczynski <david@adalogics.com>
1 parent 2f0f64b commit d6fe7e9

File tree

4 files changed

+156
-0
lines changed

4 files changed

+156
-0
lines changed

‎projects/connexion/Dockerfile‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/python3
2+
# Copyright 2023 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
FROM gcr.io/oss-fuzz-base/base-builder-python
16+
RUN pip3 install --upgrade pip asgiref flask
17+
RUN git clone https://github.com/spec-first/connexion connexion
18+
COPY *.sh *py $SRC/
19+
WORKDIR $SRC/connexion

‎projects/connexion/build.sh‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/bin/bash -eu
2+
# Copyright 2023 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
################################################################################
17+
18+
pip3 install .
19+
# Build fuzzers in $OUT.
20+
for fuzzer in $(find $SRC -name 'fuzz_*.py'); do
21+
# Add relevant data and two hidden modules
22+
compile_python_fuzzer $fuzzer \
23+
--add-data ./connexion/resources/schemas/:connexion/resources/schemas/ \
24+
--hidden-import=asgiref \
25+
--hidden-import=flask
26+
done

‎projects/connexion/fuzz_query_resolving.py‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/usr/bin/python3
2+
# Copyright 2023 Google LLC
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
import sys
16+
import atheris
17+
import connexion
18+
19+
from werkzeug.datastructures import MultiDict
20+
21+
22+
def fixed_params(data):
23+
"""Create a given URI parser and pass in fixed params for the URI object
24+
and a random query."""
25+
fdp = atheris.FuzzedDataProvider(data)
26+
collection_formats = ['csv', 'pipes', 'multi']
27+
parameters = [{
28+
"name": "letters",
29+
"in": "query",
30+
"type": "string",
31+
"items": {
32+
"type": "string"
33+
},
34+
"collectionFormat": fdp.PickValueInList(collection_formats),
35+
}]
36+
37+
parser_classes = [
38+
connexion.uri_parsing.OpenAPIURIParser,
39+
connexion.uri_parsing.Swagger2URIParser,
40+
connexion.uri_parsing.AlwaysMultiURIParser,
41+
connexion.uri_parsing.FirstValueURIParser,
42+
]
43+
parser_class = fdp.PickValueInList(parser_classes)
44+
parser = parser_class(parameters, {})
45+
param_dict = MultiDict([
46+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24)),
47+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24)),
48+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24)),
49+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24))
50+
])
51+
parser.resolve_query(param_dict.to_dict(flat=False))
52+
53+
54+
def arbitrary(data):
55+
"""Create a given URI parser and pass in random params as well as random
56+
query params."""
57+
fdp = atheris.FuzzedDataProvider(data)
58+
collection_formats = ['csv', 'pipes', 'multi']
59+
parameters = [{
60+
fdp.ConsumeUnicodeNoSurrogates(24): fdp.ConsumeUnicodeNoSurrogates(24),
61+
fdp.ConsumeUnicodeNoSurrogates(24): fdp.ConsumeUnicodeNoSurrogates(24),
62+
fdp.ConsumeUnicodeNoSurrogates(24): fdp.ConsumeUnicodeNoSurrogates(24),
63+
fdp.ConsumeUnicodeNoSurrogates(24): {
64+
fdp.ConsumeUnicodeNoSurrogates(24): fdp.ConsumeUnicodeNoSurrogates(24)
65+
},
66+
"collectionFormat": fdp.PickValueInList(collection_formats),
67+
}]
68+
69+
parser_classes = [
70+
connexion.uri_parsing.OpenAPIURIParser,
71+
connexion.uri_parsing.Swagger2URIParser,
72+
connexion.uri_parsing.AlwaysMultiURIParser,
73+
connexion.uri_parsing.FirstValueURIParser,
74+
]
75+
parser_class = fdp.PickValueInList(parser_classes)
76+
try:
77+
parser = parser_class(parameters, {})
78+
except KeyError:
79+
return
80+
param_dict = MultiDict([
81+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24)),
82+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24)),
83+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24)),
84+
(fdp.ConsumeUnicodeNoSurrogates(24), fdp.ConsumeUnicodeNoSurrogates(24))
85+
])
86+
parser.resolve_query(param_dict.to_dict(flat=False))
87+
88+
89+
def TestOneInput(data):
90+
fixed_params(data)
91+
arbitrary(data)
92+
93+
94+
def main():
95+
atheris.instrument_all()
96+
atheris.Setup(sys.argv, TestOneInput)
97+
atheris.Fuzz()
98+
99+
100+
if __name__ == "__main__":
101+
main()

‎projects/connexion/project.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
homepage: https://github.com/spec-first/connexion
2+
main_repo: https://github.com/spec-first/connexion
3+
language: python
4+
fuzzing_engines:
5+
- libfuzzer
6+
sanitizers:
7+
- address
8+
- undefined
9+
vendor_ccs:
10+
- david@adalogics.com

0 commit comments

Comments
 (0)