You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2024/09/22 14:12:53 UTC
(commons-text) branch master updated: Add test for OSS-Fuzz issue 42527776
This is an automated email from the ASF dual-hosted git repository.
ggregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-text.git
The following commit(s) were added to refs/heads/master by this push:
new c1be85b4 Add test for OSS-Fuzz issue 42527776
c1be85b4 is described below
commit c1be85b4f07df6c400b493d93edfee7159814739
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Sun Sep 22 10:12:47 2024 -0400
Add test for OSS-Fuzz issue 42527776
- apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security
exception in java.base/java.util.Arrays.copyOf
- https://issues.oss-fuzz.com/issues/42527776
---
.../commons/text/StringSubstitutorOssFuzzTest.java | 24 ++++++++++++++++++----
...gSubstitutorInterpolatorFuzzer-6287296750813184 | 1 +
2 files changed, 21 insertions(+), 4 deletions(-)
diff --git a/src/test/java/org/apache/commons/text/StringSubstitutorOssFuzzTest.java b/src/test/java/org/apache/commons/text/StringSubstitutorOssFuzzTest.java
index cf916910..d0819ffd 100644
--- a/src/test/java/org/apache/commons/text/StringSubstitutorOssFuzzTest.java
+++ b/src/test/java/org/apache/commons/text/StringSubstitutorOssFuzzTest.java
@@ -28,6 +28,11 @@ import org.junit.jupiter.api.Test;
public class StringSubstitutorOssFuzzTest {
+ private String readAllString(final String testCase) throws IOException {
+ final byte[] allBytes = Files.readAllBytes(Paths.get("src/test/resources/org/apache/commons/text/oss-fuzz/" + testCase));
+ return new String(allBytes, StandardCharsets.UTF_8);
+ }
+
/**
* Tests OSS-Fuzz issue 42522985.
*
@@ -36,10 +41,8 @@ public class StringSubstitutorOssFuzzTest {
* https://issues.oss-fuzz.com/issues/42522985
*/
@Test
- public void test() throws IOException {
- final byte[] allBytes = Files.readAllBytes(
- Paths.get("src/test/resources/org/apache/commons/text/oss-fuzz/clusterfuzz-testcase-StringSubstitutorInterpolatorFuzzer-5149898315268096"));
- assertThrows(IllegalArgumentException.class, () -> StringSubstitutor.createInterpolator().replace(new String(allBytes, StandardCharsets.UTF_8)));
+ public void test42522985() throws IOException {
+ StringSubstitutor.createInterpolator().replace(readAllString("clusterfuzz-testcase-StringSubstitutorInterpolatorFuzzer-6287296750813184"));
}
/**
@@ -53,4 +56,17 @@ public class StringSubstitutorOssFuzzTest {
public void test42527553() {
StringSubstitutor.createInterpolator().replace("${date:swswswswsws\177sw\001\000swswswswswwswsswswswsws\177sw\001\000swswswsswswswswswswswswswswsws}");
}
+
+ /**
+ * Tests OSS-Fuzz issue 42527776.
+ *
+ * apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security exception in java.base/java.util.Arrays.copyOf
+ *
+ * https://issues.oss-fuzz.com/issues/42527776
+ */
+ @Test
+ public void test42527776() throws IOException {
+ assertThrows(IllegalArgumentException.class, () -> StringSubstitutor.createInterpolator()
+ .replace(readAllString("clusterfuzz-testcase-StringSubstitutorInterpolatorFuzzer-5149898315268096")));
+ }
}
diff --git a/src/test/resources/org/apache/commons/text/oss-fuzz/clusterfuzz-testcase-StringSubstitutorInterpolatorFuzzer-6287296750813184 b/src/test/resources/org/apache/commons/text/oss-fuzz/clusterfuzz-testcase-StringSubstitutorInterpolatorFuzzer-6287296750813184
new file mode 100644
index 00000000..08a49770
--- /dev/null
+++ b/src/test/resources/org/apache/commons/text/oss-fuzz/clusterfuzz-testcase-StringSubstitutorInterpolatorFuzzer-6287296750813184
@@ -0,0 +1 @@
+${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:A}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}$${datE:HZH:HZH}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}${env:_}${eNv:_}${eNv:_}${eNv:_}$nv:_}${eNv: [...]
\ No newline at end of file