👷 ci(fuzz): native Go fuzzing of the mqweb MQSC DISPLAY parser (CI-20) - #182
Merged
Conversation
…I-20) Restores fuzzing to CI (OpenSSF Scorecard 'Fuzzing' was 0 since the v1alpha1 conversion round-trip fuzz was retired in Phase 8e). Adds FuzzParseMQSCDisplayAttributes over parseMQSCDisplayAttributes — the parser of untrusted mqweb REST DISPLAY text — asserting it never panics and upholds its key/value output contract on arbitrary input. Seed corpus doubles as regression (run by `go test`); 20s local run = 560k execs, no crash. New `fuzz` matrix job in ci.yaml (30s fuzztime, CGO-free, SHA-pinned) modeled on the retired CI-8 job: retries only transient infra failures, but fails immediately (no retry) if a new crash corpus appears under testdata/fuzz so a real finding is never masked.
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary (CI-20)
Restores fuzzing to CI — the OpenSSF Scorecard Fuzzing check has been
0since the v1alpha1↔v1beta1 conversion round-trip fuzz was retired in Phase 8e. This adds a native Go fuzz target over a real parser of untrusted external input.What
FuzzParseMQSCDisplayAttributes(internal/adapter/mqrest/mqsc_display_parse_fuzz_test.go) fuzzesparseMQSCDisplayAttributes— the parser that turns mqweb RESTrunCommandDISPLAY text (from an external queue manager) intoKEY(value)attribute maps. Asserts it never panics and upholds its output contract on arbitrary bytes: keys non-empty, lower-cased,[a-z0-9]only; values carry no surrounding single-quote.AMQ8864I …details. PROFILE(APP.Q) …samples + adversarial edges) doubles as regression —go testruns it every build.fuzzmatrix job inci.yaml(30s-fuzztime,CGO_ENABLED=0, SHA-pinned,go-cache), modeled on the retired CI-8 job: retries only transient infra failures, but fails immediately with no retry if a new crash corpus appears undertestdata/fuzz, so a real finding is never masked.Verification
go test ./internal/adapter/mqrest/green (seed corpus).-fuzz -fuzztime=20s: ~560k execs, 137 interesting inputs, no crash, invariants held.go build ./...,task format:checkclean; golangci clean on the package; actionlint clean for the new job.Notes
FuzzXxxtargets (e.g. LTPA/auth body parsing) as follow-ups by appending tomatrix.target.func Fuzztarget; the CI job provides active fuzzing regardless.