-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
google-oauth-java-client: initial integration (#11065)
Initial integration for project google-oauth-java-client. Signed-off-by: Arthur Chan <[email protected]>
- Loading branch information
1 parent
3e29067
commit fda1ebb
Showing
4 changed files
with
143 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,23 @@ | ||
# Copyright 2023 Google LLC | ||
# | ||
# Licensed under the Apache License, Version 2.0 (the "License"); | ||
# you may not use this file except in compliance with the License. | ||
# You may obtain a copy of the License at | ||
# | ||
# http://www.apache.org/licenses/LICENSE-2.0 | ||
# | ||
# Unless required by applicable law or agreed to in writing, software | ||
# distributed under the License is distributed on an "AS IS" BASIS, | ||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
# See the License for the specific language governing permissions and | ||
# limitations under the License. | ||
# | ||
########################################################################## | ||
FROM gcr.io/oss-fuzz-base/base-builder-jvm | ||
RUN curl -L https://archive.apache.org/dist/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \ | ||
unzip maven.zip -d $SRC/maven && \ | ||
rm -rf maven.zip | ||
ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn | ||
RUN git clone --depth 1 https://github.com/googleapis/google-oauth-java-client google-oauth-java-client | ||
COPY *.sh *.java $SRC/ | ||
WORKDIR $SRC/google-oauth-java-client |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,50 @@ | ||
// Copyright 2023 Google LLC | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
// | ||
/////////////////////////////////////////////////////////////////////////// | ||
import com.code_intelligence.jazzer.api.FuzzedDataProvider; | ||
import com.google.api.client.auth.oauth.OAuthSigner; | ||
import com.google.api.client.auth.oauth.OAuthHmacSigner; | ||
import com.google.api.client.auth.oauth.OAuthHmacSha256Signer; | ||
import com.google.api.client.auth.oauth.OAuthRsaSigner; | ||
import java.security.GeneralSecurityException; | ||
|
||
// Generated with https://github.com/ossf/fuzz-introspector/tree/main/tools/auto-fuzz | ||
// Minor modifications to beautify code and ensure exception is caught. | ||
// jvm-autofuzz-heuristics-2 | ||
// Heuristic name: jvm-autofuzz-heuristics-2 | ||
// Target method: [com.google.api.client.auth.oauth.OAuthHmacSha256Signer] public java.lang.String computeSignature(java.lang.String) throws java.security.GeneralSecurityException | ||
// Target method: [com.google.api.client.auth.oauth.OAuthHmacSigner] public java.lang.String computeSignature(java.lang.String) throws java.security.GeneralSecurityException | ||
// Target method: [com.google.api.client.auth.oauth.OAuthRsaSigner] public java.lang.String computeSignature(java.lang.String) throws java.security.GeneralSecurityException | ||
public class OauthSignerFuzzer { | ||
public static void fuzzerTestOneInput(FuzzedDataProvider data) { | ||
try { | ||
OAuthSigner obj = null; | ||
switch (data.consumeInt(1, 3)) { | ||
case 1: | ||
obj = new OAuthHmacSigner(); | ||
break; | ||
case 2: | ||
obj = new OAuthHmacSha256Signer(data.consumeString(data.remainingBytes() / 2)); | ||
break; | ||
case 3: | ||
obj = new OAuthRsaSigner(); | ||
break; | ||
} | ||
obj.computeSignature(data.consumeRemainingAsString()); | ||
} catch (GeneralSecurityException e1) { | ||
// Known exception | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,59 @@ | ||
#!/bin/bash -eu | ||
# Copyright 2023 Google LLC | ||
# | ||
# Licensed under the Apache License, Version 2.0 (the "License"); | ||
# you may not use this file except in compliance with the License. | ||
# You may obtain a copy of the License at | ||
# | ||
# http://www.apache.org/licenses/LICENSE-2.0 | ||
# | ||
# Unless required by applicable law or agreed to in writing, software | ||
# distributed under the License is distributed on an "AS IS" BASIS, | ||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
# See the License for the specific language governing permissions and | ||
# limitations under the License. | ||
# | ||
########################################################################## | ||
CURRENT_VERSION=$($MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate \ | ||
-Dexpression=project.version -q -DforceStdout) | ||
$MVN clean package -Dmaven.javadoc.skip=true -DskipTests=true -Dpmd.skip=true \ | ||
-Dencoding=UTF-8 -Dmaven.antrun.skip=true -Dcheckstyle.skip=true \ | ||
-DperformRelease=True org.apache.maven.plugins:maven-shade-plugin:3.2.4:shade | ||
|
||
cp "./google-oauth-client/target/google-oauth-client-$CURRENT_VERSION.jar" $OUT/oauth.jar | ||
|
||
ALL_JARS='oauth.jar' | ||
|
||
# The classpath at build-time includes the project jars in $OUT as well as the | ||
# Jazzer API. | ||
BUILD_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "$OUT/%s:"):$JAZZER_API_PATH | ||
|
||
# All .jar and .class files lie in the same directory as the fuzzer at runtime. | ||
RUNTIME_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "\$this_dir/%s:"):\$this_dir | ||
|
||
for fuzzer in $(find $SRC -name '*Fuzzer.java') | ||
do | ||
fuzzer_basename=$(basename -s .java $fuzzer) | ||
javac -cp $BUILD_CLASSPATH $fuzzer | ||
cp $SRC/$fuzzer_basename.class $OUT/ | ||
|
||
# Create an execution wrapper that executes Jazzer with the correct arguments. | ||
echo "#!/bin/bash | ||
# LLVMFuzzerTestOneInput for fuzzer detection. | ||
this_dir=\$(dirname "\$0") | ||
if [[ "\$@" =~ (^| )-runs=[0-9]+($| ) ]] | ||
then | ||
mem_settings='-Xmx1900m:-Xss900k' | ||
else | ||
mem_settings='-Xmx2048m:-Xss1024k' | ||
fi | ||
LD_LIBRARY_PATH="$JVM_LD_LIBRARY_PATH":\$this_dir \ | ||
\$this_dir/jazzer_driver \ | ||
--agent_path=\$this_dir/jazzer_agent_deploy.jar \ | ||
--cp=$RUNTIME_CLASSPATH \ | ||
--target_class=$fuzzer_basename \ | ||
--jvm_args="\$mem_settings" \ | ||
\$@" > $OUT/$fuzzer_basename | ||
|
||
chmod u+x $OUT/$fuzzer_basename | ||
done |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,11 @@ | ||
homepage: https://github.com/googleapis/google-oauth-java-client | ||
main_repo: https://github.com/googleapis/google-oauth-java-client | ||
language: jvm | ||
fuzzing_engines: | ||
- libfuzzer | ||
sanitizers: | ||
- address | ||
vendor_ccs: | ||
- [email protected] | ||
- [email protected] | ||
- [email protected] |