Skip to content

✨ Support user-defined fuzz functions (GoLang) in fuzzing check#1979

Merged
laurentsimon merged 36 commits intoossf:mainfrom
aidenwang9867:feat/897_go_fuzzer_check
Jun 9, 2022
Merged

✨ Support user-defined fuzz functions (GoLang) in fuzzing check#1979
laurentsimon merged 36 commits intoossf:mainfrom
aidenwang9867:feat/897_go_fuzzer_check

Conversation

@aidenwang9867
Copy link
Copy Markdown
Contributor

@aidenwang9867 aidenwang9867 commented Jun 3, 2022

What kind of change does this PR introduce?

  1. Introduce a new feature for the fuzzing check.

Now scorecard's fuzzing check can detect GoLang fuzz functions defined in the repo, such as:

func FuzzFoo (f *testing.F) {
    // func body
}

and report them as project is fuzzed with user-defined fuzz functions.

Moreover, with param --details, scorecard now can report detailed information of fuzz functions in the result, including the file paths, function name, and number of lines in code.

  1. Add an interface clients.RepoClient.ListProgrammingLanguages used for retrieving programming languages of a repository.

  2. Update checks.yaml to generate the doc for fuzzing.

What is the current behavior?

The fuzzing check of scorecard only checks for the config of OSS-Fuzz and ClusterFuzzLite in a repo.

What is the new behavior (if this is a feature change)?**

It can check for user-defined golang fuzz functions in the repo and give the check a full score (10/10) if such functions are found.
Also, detailed information of the found fuzz functions would be logged into DetailLogger.

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Special notes for your reviewer

Does this PR introduce a user-facing change?

Yes.

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Users now can check for golang fuzz functions in repo as a part of the fuzzing check, and with param `--details`, detailed fuzz function names and positions can be seen in the result.

Comment thread checks/evaluation/dependency_update_tool.go Outdated
Comment thread checks/evaluation/dependency_update_tool_test.go Outdated
Comment thread checks/evaluation/dependency_update_tool_test.go Outdated
Comment thread checks/raw/fuzzing.go Outdated
Comment thread checks/raw/fuzzing.go Outdated
Comment thread checks/raw/fuzzing.go Outdated
Comment thread checks/raw/fuzzing.go Outdated
Comment thread clients/githubrepo/client.go Outdated
Comment thread pkg/json_raw_results.go Outdated
Comment thread pkg/json_raw_results.go Outdated
Comment thread checks/evaluation/dependency_update_tool.go Outdated
Comment thread checks/evaluation/fuzzing.go
Comment thread checks/raw/fuzzing.go Outdated
Comment thread checks/raw/fuzzing.go Outdated
Comment thread checks/raw/fuzzing.go Outdated
Comment thread checks/raw/fuzzing_test.go Outdated
Comment thread cron/internal/format/json_raw_results.go Outdated
@codecov
Copy link
Copy Markdown

codecov bot commented Jun 3, 2022

Codecov Report

Merging #1979 (af0c157) into main (3b7c46f) will increase coverage by 1.93%.
The diff coverage is 25.13%.

@@            Coverage Diff             @@
##             main    #1979      +/-   ##
==========================================
+ Coverage   51.08%   53.02%   +1.93%     
==========================================
  Files          87       88       +1     
  Lines        7074     7225     +151     
==========================================
+ Hits         3614     3831     +217     
+ Misses       3220     3141      -79     
- Partials      240      253      +13     

@aidenwang9867 aidenwang9867 temporarily deployed to integration-test June 7, 2022 22:28 Inactive
@github-actions
Copy link
Copy Markdown

github-actions bot commented Jun 7, 2022

@aidenwang9867
Copy link
Copy Markdown
Contributor Author

@laurentsimon please see my implementation for caching the programming languages at https://github.com/ossf/scorecard/pull/1979/files#diff-8214bff6f7acf7713c122c9b398050b1464aca5ec3153a03d8ebf16bf0c95f81R42, and resolve the requested change if it looks good.

Also, @olivekl please see my modifications on the document checks.yaml at https://github.com/ossf/scorecard/pull/1979/files#diff-559ea3714bd377beb540b09445c0655ba80f0e80ebf0e6d803c04b8f08a3d904, and resolve the requested change if it looks good.

Thanks! :)

Copy link
Copy Markdown
Contributor

@olivekl olivekl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the changes. LGTM!

Comment thread clients/githubrepo/languages.go
@aidenwang9867 aidenwang9867 temporarily deployed to integration-test June 8, 2022 23:29 Inactive
@github-actions
Copy link
Copy Markdown

github-actions bot commented Jun 8, 2022

Comment thread clients/githubrepo/languages.go
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants