1496427 - [meta] Implement fuzztest for feature policy parser

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P3)

Description

[Frederik Braun [:freddy]]

Looking at <https://searchfox.org/mozilla-central/source/dom/security/featurepolicy/test/gtest/TestFeaturePolicyParser.cpp>, it seems useful and relatively easy to incorporate the parser in our fuzzing attempts.

Decoder tells me this is something he could do and asked me to make this bug private.

(DOM specific / webapp security problems will occur in in bug 1495619.)

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The meta keyword is there, the bug doesn't depend on other bugs and there is no activity for 12 months.
:decoder, maybe it's time to close this bug?

Comment 2

[Christian Holler (:decoder)]

I think this would be a good first fuzzing bug for someone who wants to implement a libFuzzer target. The targeted parser code does not very complicated to I don't expect a lot of bugs to fall out of this, but since it is low effort, it might still be worth trying. I think we should leave this open and find someone who wants to try this.

Comment 3

[Frederik Braun [:freddy]]

Attachment: Bug 1496427 - fuzzing target for featurepolicy parser r=decoder

Comment 4

[Frederik Braun [:freddy]]

this is still work-in-progress, but I figured I might give it a shot while I'm waiting on this other thing..

Comment 5

[Frederik Braun [:freddy]]

decoder is there anything else needed for fuzzing bugs in particular or can this be checked into central?

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:freddy, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 7

[Frederik Braun [:freddy]]

Waiting for decoder's reply in comment 5
I've ran it locally and didn't find anything. What are the best next steps?
Run longer? Improve fuzzing? WONTFIX?

Comment 8

[Christian Holler (:decoder)]

I think we can just go ahead and land this and we might be able to scale it in oss-fuzz.

@freddy, if you want to try, you can add it to https://github.com/google/oss-fuzz/tree/master/projects/firefox and send them a PR.

Comment 9

[Frederik Braun [:freddy]]

I'll have a couple of follow-up questions regarding the oss-fuzz work.
Who's maintaining the docker image https://github.com/google/oss-fuzz/blob/master/projects/firefox/Dockerfile#L18, specifically who is <[e-mail]>? Do you have a link to a patch or even a doc on how to add new targets here?

Comment 10

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

fuzzing target for featurepolicy parser r=decoder
https://hg.mozilla.org/integration/autoland/rev/4992d58d861d746d49b04b78ed268ad6ad0c90eb

Comment 11

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/4992d58d861d

Comment 12

[Frederik Braun [:freddy]]

(In reply to Frederik Braun [:freddy] from comment #9)

I'll have a couple of follow-up questions regarding the oss-fuzz work.
Who's maintaining the docker image https://github.com/google/oss-fuzz/blob/master/projects/firefox/Dockerfile#L18, specifically who is <[e-mail]>? Do you have a link to a patch or even a doc on how to add new targets here?

First question is obviously out of curiosity. Second is more important going forward.

Comment 13

[Christian Holler (:decoder)]

(In reply to Frederik Braun [:freddy] from comment #12)

(In reply to Frederik Braun [:freddy] from comment #9)

I'll have a couple of follow-up questions regarding the oss-fuzz work.
Who's maintaining the docker image https://github.com/google/oss-fuzz/blob/master/projects/firefox/Dockerfile#L18, specifically who is <[e-mail]>? Do you have a link to a patch or even a doc on how to add new targets here?

First question is obviously out of curiosity. Second is more important going forward.

The usual process is to send a PR to the oss-fuzz repository, previous patches doing so are in the Github history. Adding the target to build.sh should be sufficient at first glance.

The oss-fuzz documentation is here: https://google.github.io/oss-fuzz/

And in particular this part is relevant to check locally that the build process works: https://google.github.io/oss-fuzz/advanced-topics/reproducing/#building-using-docker

Let me know if you hit any problems :)

Comment 14

[Frederik Braun [:freddy]]

https://github.com/google/oss-fuzz/pull/3959

Comment 15

[Frederik Braun [:freddy]]

This landed and is now enabled in oss-fuzz. I suppose we can lift security flags from this bug quite soon?