-
Notifications
You must be signed in to change notification settings - Fork 6
128 lines (116 loc) · 3.76 KB
/
fuzz.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
name: Fuzz
on:
pull_request:
branches:
- "**"
push:
branches: [ master ]
tags:
- "*"
schedule:
- cron: 30 0 * * *
workflow_dispatch:
inputs:
duration:
description: 'Duration of the fuzzing run in seconds'
required: true
default: "60"
type: string
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
jobs:
# TODO: build all fuzzers first, then run independently
global-fuzzer:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Install deps
run: |
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y remove python3-lldb-14
sudo .github/workflows/scripts/llvm.sh 17
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y install libfuzzer-17-dev
- name: Build
run: ./fuzzer/global/build.sh
- name: Run fuzzer
run: ./fuzzer/global/run.sh ${{ github.event.inputs.duration }}
- name: Log
if: ${{ always() }}
run: grep -v -f fuzzer/global/scripts/report-negative-patterns.txt fuzzer/global/fuzz-*.log
- name: Show coverage
run: ./fuzzer/global/scripts/show_coverage.sh 40 || true
- name: Compress artifact
if: ${{ always() }}
run: tar -czvf fuzzing.tar.gz fuzzer/global/
- name: Artifact
uses: actions/upload-artifact@v4
if: ${{ always() }}
with:
name: fuzzing-data
path: fuzzing.tar.gz
local-fuzzer:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
variant:
- fuzzer: uri_parse
params: ""
- fuzzer: ssrf_detector
params: ""
- fuzzer: lfi_detector
params: ""
- fuzzer: sql_tokenizer
params: "--dialect=mysql"
- fuzzer: sql_tokenizer
params: "--dialect=postgresql"
- fuzzer: sql_tokenizer
params: "--dialect=sqlite"
- fuzzer: sql_tokenizer
params: "--dialect=standard"
- fuzzer: sqli_detector
params: "--dialect=mysql"
- fuzzer: sqli_detector
params: "--dialect=postgresql"
- fuzzer: sqli_detector
params: "--dialect=sqlite"
- fuzzer: sqli_detector
params: "--dialect=standard"
- fuzzer: shell_tokenizer
params: ""
- fuzzer: shi_detector
params: ""
- fuzzer: sha256
params: ""
- fuzzer: http_endpoint_fingerprint
params: ""
- fuzzer: http_header_fingerprint
params: ""
- fuzzer: http_network_fingerprint
params: ""
- fuzzer: session_fingerprint
params: ""
steps:
- uses: actions/checkout@v4
with:
submodules: recursive
- name: Install deps
run: |
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y remove python3-lldb-14
sudo .github/workflows/scripts/llvm.sh 17
DEBIAN_FRONTEND="noninteractive" sudo apt-get -y install libfuzzer-17-dev
- name: Build
env:
CC: clang-17
CXX: clang++-17
run: |
mkdir build ; cd build
cmake -DCMAKE_VERBOSE_MAKEFILE=1 -DCMAKE_BUILD_TYPE=RelWithDebInfo ..
make -j $(nproc) ${{ matrix.variant.fuzzer }}_fuzzer
cp fuzzer/${{ matrix.variant.fuzzer }}_fuzzer ../fuzzer/${{ matrix.variant.fuzzer }}
- name: Run fuzzer
run: |
cd fuzzer/${{ matrix.variant.fuzzer }}
./${{ matrix.variant.fuzzer }}_fuzzer ${{ matrix.variant.params }} -max_total_time=${{ github.event.inputs.duration || 300 }} corpus/