1558638 - Fuzz the RemoteSettings client endpoint

Status: RESOLVED WONTFIX

(Core :: Fuzzing, defect, P1)

Description

[Mike Conley (:mconley) (:⚙️)]

The Remote Settings infrastructure is used to update things like the addons and graphics driver blocklists, the local Firefox Monitor stuff, and some other things as well.

Mathieu Leplatre suggested that we add the client portion of Remote Settings as a fuzzing surface, so that's what this bug tracks.

I've sent an email to [e-mail] as well.

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:abillings, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[:Gijs (he/him)]

Freddy, we're shipping this in 71, so it'd help if we had (even more) confidence in the endpoints we were using. Who could help get this bug some traction?

Comment 3

[Frederik Braun [:freddy]]

Sylvestre is managing the fuzzing team. I'm confident he will get this triaged speedily :-)

Comment 4

[Jason Kratzer [:jkratzer]]

I spoke with Mathieu about this and since the entire API is written in JS, it doesn't appear to be something that would benefit from fuzzing. In fuzzing we're typically looking for crashes and fatal asserts that result from memory corruption issues and none of that would apply here. I would however suggest looking at having a pentest or code review done on the remote endpoint to ensure that it's properly validating it's inputs.

Comment 5

[Christian Holler (:decoder)]

Closing per comment 4.