You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "vy (via GitHub)" <gi...@apache.org> on 2024/09/13 11:33:15 UTC
[PR] Google OSS-Fuzz integration (logging-log4j2)
vy opened a new pull request, #2949:
URL: https://github.com/apache/logging-log4j2/pull/2949
As a deliverable of #2891 and #2892, implements Google OSS-Fuzz integration. See the added `FUZZING.adoc` for details.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Google OSS-Fuzz integration (logging-log4j2)
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on code in PR #2949:
URL: https://github.com/apache/logging-log4j2/pull/2949#discussion_r1762677468
##########
log4j-fuzz-test/src/main/java/org/apache/logging/log4j/fuzz/FuzzingUtil.java:
##########
@@ -0,0 +1,190 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.fuzz;
+
+import static java.util.Objects.requireNonNull;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import edu.umd.cs.findbugs.annotations.Nullable;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+import java.util.stream.Stream;
+import org.apache.logging.log4j.Level;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.LoggerContext;
+import org.apache.logging.log4j.core.config.Configuration;
+import org.apache.logging.log4j.core.config.Configurator;
+import org.apache.logging.log4j.core.config.builder.api.AppenderComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilder;
+import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilderFactory;
+import org.apache.logging.log4j.core.config.builder.api.LayoutComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.api.RootLoggerComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.impl.BuiltConfiguration;
+import org.apache.logging.log4j.util.Strings;
+
+public final class FuzzingUtil {
+
+ private static final int MAX_STRING_LENGTH = 30;
+
+ public static LoggerContext createLoggerContext(
+ final String appenderPluginName,
+ final Function<ConfigurationBuilder<?>, LayoutComponentBuilder> layoutSupplier) {
+
+ // Create the configuration builder
+ final ConfigurationBuilder<BuiltConfiguration> configBuilder =
+ ConfigurationBuilderFactory.newConfigurationBuilder();
+
+ // Create the appender configuration
+ final String appenderName = "FUZZING_APPENDER";
+ final LayoutComponentBuilder layoutComponentBuilder = layoutSupplier.apply(configBuilder);
+ final AppenderComponentBuilder appenderComponentBuilder =
+ configBuilder.newAppender(appenderName, appenderPluginName).add(layoutComponentBuilder);
+
+ // Create the root logger configuration
+ final RootLoggerComponentBuilder loggerComponentBuilder =
+ configBuilder.newRootLogger(Level.ALL).add(configBuilder.newAppenderRef(appenderName));
+
+ // Create the conclusive configuration (uninitialized!)
+ final Configuration config = configBuilder
+ .setStatusLevel(Level.OFF)
+ .add(appenderComponentBuilder)
+ .add(loggerComponentBuilder)
+ .build(false);
+
+ // Initialize the configuration
+ return Configurator.initialize(config);
Review Comment:
_Nit_: I have a slight preference not to use a `LoggerContext` statically reachable from `LogManager`. A new `LoggerContext` should be fine.
##########
log4j-fuzz-test/src/main/java/org/apache/logging/log4j/fuzz/FuzzingUtil.java:
##########
@@ -0,0 +1,190 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.fuzz;
+
+import static java.util.Objects.requireNonNull;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import edu.umd.cs.findbugs.annotations.Nullable;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+import java.util.stream.Stream;
+import org.apache.logging.log4j.Level;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.LoggerContext;
+import org.apache.logging.log4j.core.config.Configuration;
+import org.apache.logging.log4j.core.config.Configurator;
+import org.apache.logging.log4j.core.config.builder.api.AppenderComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilder;
+import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilderFactory;
+import org.apache.logging.log4j.core.config.builder.api.LayoutComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.api.RootLoggerComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.impl.BuiltConfiguration;
+import org.apache.logging.log4j.util.Strings;
+
+public final class FuzzingUtil {
+
+ private static final int MAX_STRING_LENGTH = 30;
+
+ public static LoggerContext createLoggerContext(
+ final String appenderPluginName,
+ final Function<ConfigurationBuilder<?>, LayoutComponentBuilder> layoutSupplier) {
+
+ // Create the configuration builder
+ final ConfigurationBuilder<BuiltConfiguration> configBuilder =
+ ConfigurationBuilderFactory.newConfigurationBuilder();
+
+ // Create the appender configuration
+ final String appenderName = "FUZZING_APPENDER";
+ final LayoutComponentBuilder layoutComponentBuilder = layoutSupplier.apply(configBuilder);
+ final AppenderComponentBuilder appenderComponentBuilder =
+ configBuilder.newAppender(appenderName, appenderPluginName).add(layoutComponentBuilder);
+
+ // Create the root logger configuration
+ final RootLoggerComponentBuilder loggerComponentBuilder =
+ configBuilder.newRootLogger(Level.ALL).add(configBuilder.newAppenderRef(appenderName));
+
+ // Create the conclusive configuration (uninitialized!)
+ final Configuration config = configBuilder
+ .setStatusLevel(Level.OFF)
+ .add(appenderComponentBuilder)
+ .add(loggerComponentBuilder)
+ .build(false);
+
+ // Initialize the configuration
+ return Configurator.initialize(config);
+ }
+
+ /**
+ * Contract modelling an API-agnostic logger.
+ * This allows {@link #fuzzLogger(LoggerFacade, FuzzedDataProvider)} to accept all logger implementations; of Log4j API, of SLF4J, etc.
+ */
+ public interface LoggerFacade {
+
+ void log(String message);
+
+ void log(String message, Throwable throwable);
+
+ void log(String message, Object[] parameters);
+ }
+
+ public static final class Log4jLoggerFacade implements LoggerFacade {
+
+ private final Logger logger;
+
+ public Log4jLoggerFacade(final Logger logger) {
+ this.logger = requireNonNull(logger, "logger");
+ }
+
+ @Override
+ public void log(final String message) {
+ logger.error(message);
+ }
+
+ @Override
+ public void log(final String message, final Throwable throwable) {
+ logger.error(message, throwable);
+ }
+
+ @Override
+ public void log(final String message, final Object[] parameters) {
+ logger.error(message, parameters);
+ }
Review Comment:
```suggestion
private static final String FQCN = Log4jLoggerFacade.class.getName();
private final ExtendedLogger logger;
public Log4jLoggerFacade(final ExtendedLogger logger) {
this.logger = requireNonNull(logger, "logger");
}
@Override
public void log(final String message) {
logger.logIfEnabled(FQCN, Level.ERROR, null, message);
}
@Override
public void log(final String message, final Throwable throwable) {
logger.logIfEnabled(FQCN, Level.ERROR, null, message, throwable);
}
@Override
public void log(final String message, final Object[] parameters) {
logger.logIfEnabled(FQCN, Level.ERROR, null, message, parameters);
}
```
##########
log4j-perf-test/README.adoc:
##########
@@ -0,0 +1,27 @@
+////
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+////
+
+This module contains JMH-based performance tests for Log4j.
+You can use the generated fat JAR to run the tests as follows:
+
+[source,bash]
+----
+java \
+ -cp target/log4j-perf-test-<VERSION>-uber.jar \
+ org.openjdk.jmh.Main \
+ <JMH-ARGS>
+----
Review Comment:
```suggestion
[source,bash]
----
java -jar target/log4j-perf-test-*-uber.jar <JMH-ARGS>
----
To list the available JMH arguments run:
[source,bash]
----
java -jar target/log4j-perf-test-*-uber.jar -h
----
```
##########
log4j-parent/pom.xml:
##########
@@ -921,6 +936,57 @@
<version>${maven-taglib-plugin.version}</version>
</plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-shade-plugin</artifactId>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-transform-maven-shade-plugin-extensions</artifactId>
+ <version>${log4j-transform.version}</version>
+ </dependency>
+ </dependencies>
+ <executions>
+ <execution>
+ <id>generate-uber-jar</id>
+ <goals>
+ <goal>shade</goal>
+ </goals>
+ <phase>package</phase>
+ <configuration>
+ <createDependencyReducedPom>false</createDependencyReducedPom>
+ <!-- Minimization causes `@Plugin`-annotated classes to be omitted, hence disabling it: -->
+ <minimizeJar>false</minimizeJar>
+ <finalName>${project.artifactId}-${project.version}-uber</finalName>
+ <transformers>
+ <transformer implementation="org.apache.maven.plugins.shade.resource.ApacheLicenseResourceTransformer" />
Review Comment:
```suggestion
<transformer implementation="org.apache.maven.plugins.shade.resource.ApacheLicenseResourceTransformer" />
<transformer implementation="org.apache.maven.plugins.shade.resource.ApacheNoticeResourceTransformer"/>
```
##########
log4j-slf4j2-impl-fuzz-test/src/main/java/org/apache/logging/slf4j/fuzz/Slf4jLoggerFacade.java:
##########
@@ -0,0 +1,53 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.slf4j.fuzz;
+
+import static java.util.Objects.requireNonNull;
+
+import org.apache.logging.log4j.fuzz.FuzzingUtil.LoggerFacade;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public final class Slf4jLoggerFacade implements LoggerFacade {
+
+ private final Logger logger;
+
+ private Slf4jLoggerFacade(final Logger logger) {
+ this.logger = logger;
+ }
+
+ static Slf4jLoggerFacade ofClass(final Class<?> clazz) {
+ requireNonNull(clazz, "clazz");
+ final Logger logger = LoggerFactory.getLogger(clazz);
+ return new Slf4jLoggerFacade(logger);
+ }
+
+ @Override
+ public void log(final String message) {
+ logger.error(message);
+ }
+
+ @Override
+ public void log(String message, Throwable throwable) {
+ logger.error(message, throwable);
+ }
+
+ @Override
+ public void log(String message, Object[] parameters) {
+ logger.error(message, parameters);
+ }
Review Comment:
```suggestion
private static final String FQCN = Slf4jLoggerFacade.class.getName();
private final Logger logger;
private Slf4jLoggerFacade(final Logger logger) {
this.logger = logger;
}
static Slf4jLoggerFacade ofClass(final Class<?> clazz) {
requireNonNull(clazz, "clazz");
final Logger logger = LoggerFactory.getLogger(clazz);
return new Slf4jLoggerFacade(logger);
}
private LoggingEventBuilder atError() {
LoggingEventBuilder builder = logger.atError();
if (builder instanceof CallerBoundaryAware) {
((CallerBoundaryAware) builder).setCallerBoundary(FQCN);
}
return builder;
}
@Override
public void log(final String message) {
atError().log(message);
}
@Override
public void log(String message, Throwable throwable) {
atError().setCause(throwable).log(message);
}
@Override
public void log(String message, Object[] parameters) {
atError().log(message, parameters);
}
```
##########
log4j-parent/pom.xml:
##########
@@ -921,6 +936,57 @@
<version>${maven-taglib-plugin.version}</version>
</plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-shade-plugin</artifactId>
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.logging.log4j</groupId>
+ <artifactId>log4j-transform-maven-shade-plugin-extensions</artifactId>
+ <version>${log4j-transform.version}</version>
+ </dependency>
+ </dependencies>
+ <executions>
+ <execution>
+ <id>generate-uber-jar</id>
+ <goals>
+ <goal>shade</goal>
+ </goals>
+ <phase>package</phase>
+ <configuration>
+ <createDependencyReducedPom>false</createDependencyReducedPom>
+ <!-- Minimization causes `@Plugin`-annotated classes to be omitted, hence disabling it: -->
+ <minimizeJar>false</minimizeJar>
+ <finalName>${project.artifactId}-${project.version}-uber</finalName>
+ <transformers>
+ <transformer implementation="org.apache.maven.plugins.shade.resource.ApacheLicenseResourceTransformer" />
+ <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
+ <manifestEntries>
+ <Multi-Release>true</Multi-Release>
+ </manifestEntries>
+ </transformer>
+ <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
+ <transformer implementation="org.apache.logging.log4j.maven.plugins.shade.transformer.Log4j2PluginCacheFileTransformer" />
+ </transformers>
+ <filters>
+ <filter>
+ <!--
+ Shading signed JARs will fail without this.
+ http://stackoverflow.com/questions/999489/invalid-signature-file-when-attempting-to-run-a-jar
+ -->
+ <artifact>*:*</artifact>
+ <excludes>
+ <exclude>META-INF/*.SF</exclude>
+ <exclude>META-INF/*.DSA</exclude>
+ <exclude>META-INF/*.RSA</exclude>
Review Comment:
```suggestion
<exclude>META-INF/*.RSA</exclude>
<exclude>META-INF/MANIFEST.MF</exclude>
<exclude>module-info.class</exclude>
<exclude>META-INF/versions/9/module-info.class</exclude>
```
Not sure why, but Maven Shade Plugin complains about multiple manifests, even if the `ManifestResourceTransformer` is used.
It also complains about JPMS encapsulation, so let's remove it.
##########
log4j-core-fuzz-test/src/main/java/org/apache/logging/log4j/core/fuzz/PatternLayoutFuzzer.java:
##########
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.core.fuzz;
+
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.createLoggerContext;
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.fuzzLogger;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.LoggerContext;
+import org.apache.logging.log4j.fuzz.EncodingAppender;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.Log4jLoggerFacade;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.LoggerFacade;
+
+public final class PatternLayoutFuzzer {
+
+ private static final LoggerFacade LOGGER = createLogger();
+
+ private static LoggerFacade createLogger() {
+ final LoggerContext loggerContext =
+ createLoggerContext(EncodingAppender.PLUGIN_NAME, configBuilder -> configBuilder
+ .newLayout("PatternLayout")
+ // Enforce using a single message-based converter, i.e., `MessagePatternConverter`
+ .addAttribute("pattern", "%m"));
+ final Logger logger = loggerContext.getLogger(PatternLayoutFuzzer.class);
+ return new Log4jLoggerFacade(logger);
+ }
+
+ public static void fuzzerTestOneInput(final FuzzedDataProvider dataProvider) {
+ fuzzLogger(LOGGER, dataProvider);
+ }
Review Comment:
I would expect this test to close the `LoggerContext`.
##########
log4j-layout-template-json-fuzz-test/src/main/java/org/apache/logging/log4j/layout/template/json/fuzz/JsonTemplateLayoutFuzzer.java:
##########
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.layout.template.json.fuzz;
+
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.createLoggerContext;
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.fuzzLogger;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.LoggerContext;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.Log4jLoggerFacade;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.LoggerFacade;
+import org.apache.logging.log4j.fuzz.JsonEncodingAppender;
+
+public final class JsonTemplateLayoutFuzzer {
+
+ private static final LoggerFacade LOGGER = createLogger();
+
+ private static LoggerFacade createLogger() {
+ final LoggerContext loggerContext = createLoggerContext(
+ JsonEncodingAppender.PLUGIN_NAME, configBuilder -> configBuilder.newLayout("JsonTemplateLayout"));
+ final Logger logger = loggerContext.getLogger(JsonTemplateLayoutFuzzer.class);
+ return new Log4jLoggerFacade(logger);
+ }
+
+ public static void fuzzerTestOneInput(final FuzzedDataProvider dataProvider) {
+ fuzzLogger(LOGGER, dataProvider);
+ }
Review Comment:
Same as above: the `LoggerContext` might not be closed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Google OSS-Fuzz integration (logging-log4j2)
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz commented on PR #2949:
URL: https://github.com/apache/logging-log4j2/pull/2949#issuecomment-2355915513
> @ppkarwasz, what do your FQCN fixes address in the context of fuzzing?
Probably nothing, I just wanted to give a good example to users, if they apply the code somewhere else.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Google OSS-Fuzz integration (logging-log4j2)
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy merged PR #2949:
URL: https://github.com/apache/logging-log4j2/pull/2949
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Google OSS-Fuzz integration (logging-log4j2)
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on PR #2949:
URL: https://github.com/apache/logging-log4j2/pull/2949#issuecomment-2355853380
@ppkarwasz, what do your FQCN fixes address in the context of fuzzing?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Google OSS-Fuzz integration (logging-log4j2)
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #2949:
URL: https://github.com/apache/logging-log4j2/pull/2949#discussion_r1763714368
##########
log4j-fuzz-test/src/main/java/org/apache/logging/log4j/fuzz/FuzzingUtil.java:
##########
@@ -0,0 +1,190 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.fuzz;
+
+import static java.util.Objects.requireNonNull;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import edu.umd.cs.findbugs.annotations.Nullable;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+import java.util.stream.Stream;
+import org.apache.logging.log4j.Level;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.LoggerContext;
+import org.apache.logging.log4j.core.config.Configuration;
+import org.apache.logging.log4j.core.config.Configurator;
+import org.apache.logging.log4j.core.config.builder.api.AppenderComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilder;
+import org.apache.logging.log4j.core.config.builder.api.ConfigurationBuilderFactory;
+import org.apache.logging.log4j.core.config.builder.api.LayoutComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.api.RootLoggerComponentBuilder;
+import org.apache.logging.log4j.core.config.builder.impl.BuiltConfiguration;
+import org.apache.logging.log4j.util.Strings;
+
+public final class FuzzingUtil {
+
+ private static final int MAX_STRING_LENGTH = 30;
+
+ public static LoggerContext createLoggerContext(
+ final String appenderPluginName,
+ final Function<ConfigurationBuilder<?>, LayoutComponentBuilder> layoutSupplier) {
+
+ // Create the configuration builder
+ final ConfigurationBuilder<BuiltConfiguration> configBuilder =
+ ConfigurationBuilderFactory.newConfigurationBuilder();
+
+ // Create the appender configuration
+ final String appenderName = "FUZZING_APPENDER";
+ final LayoutComponentBuilder layoutComponentBuilder = layoutSupplier.apply(configBuilder);
+ final AppenderComponentBuilder appenderComponentBuilder =
+ configBuilder.newAppender(appenderName, appenderPluginName).add(layoutComponentBuilder);
+
+ // Create the root logger configuration
+ final RootLoggerComponentBuilder loggerComponentBuilder =
+ configBuilder.newRootLogger(Level.ALL).add(configBuilder.newAppenderRef(appenderName));
+
+ // Create the conclusive configuration (uninitialized!)
+ final Configuration config = configBuilder
+ .setStatusLevel(Level.OFF)
+ .add(appenderComponentBuilder)
+ .add(loggerComponentBuilder)
+ .build(false);
+
+ // Initialize the configuration
+ return Configurator.initialize(config);
Review Comment:
Fixed in d8622d9ce6bfcf256bc55a987fb5381afc65a437.
##########
log4j-core-fuzz-test/src/main/java/org/apache/logging/log4j/core/fuzz/PatternLayoutFuzzer.java:
##########
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.core.fuzz;
+
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.createLoggerContext;
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.fuzzLogger;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.LoggerContext;
+import org.apache.logging.log4j.fuzz.EncodingAppender;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.Log4jLoggerFacade;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.LoggerFacade;
+
+public final class PatternLayoutFuzzer {
+
+ private static final LoggerFacade LOGGER = createLogger();
+
+ private static LoggerFacade createLogger() {
+ final LoggerContext loggerContext =
+ createLoggerContext(EncodingAppender.PLUGIN_NAME, configBuilder -> configBuilder
+ .newLayout("PatternLayout")
+ // Enforce using a single message-based converter, i.e., `MessagePatternConverter`
+ .addAttribute("pattern", "%m"));
+ final Logger logger = loggerContext.getLogger(PatternLayoutFuzzer.class);
+ return new Log4jLoggerFacade(logger);
+ }
+
+ public static void fuzzerTestOneInput(final FuzzedDataProvider dataProvider) {
+ fuzzLogger(LOGGER, dataProvider);
+ }
Review Comment:
Fixed in d8622d9ce6bfcf256bc55a987fb5381afc65a437.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Google OSS-Fuzz integration (logging-log4j2)
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #2949:
URL: https://github.com/apache/logging-log4j2/pull/2949#discussion_r1763714624
##########
log4j-layout-template-json-fuzz-test/src/main/java/org/apache/logging/log4j/layout/template/json/fuzz/JsonTemplateLayoutFuzzer.java:
##########
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to you under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.logging.log4j.layout.template.json.fuzz;
+
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.createLoggerContext;
+import static org.apache.logging.log4j.fuzz.FuzzingUtil.fuzzLogger;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.core.LoggerContext;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.Log4jLoggerFacade;
+import org.apache.logging.log4j.fuzz.FuzzingUtil.LoggerFacade;
+import org.apache.logging.log4j.fuzz.JsonEncodingAppender;
+
+public final class JsonTemplateLayoutFuzzer {
+
+ private static final LoggerFacade LOGGER = createLogger();
+
+ private static LoggerFacade createLogger() {
+ final LoggerContext loggerContext = createLoggerContext(
+ JsonEncodingAppender.PLUGIN_NAME, configBuilder -> configBuilder.newLayout("JsonTemplateLayout"));
+ final Logger logger = loggerContext.getLogger(JsonTemplateLayoutFuzzer.class);
+ return new Log4jLoggerFacade(logger);
+ }
+
+ public static void fuzzerTestOneInput(final FuzzedDataProvider dataProvider) {
+ fuzzLogger(LOGGER, dataProvider);
+ }
Review Comment:
Fixed in d8622d9ce6bfcf256bc55a987fb5381afc65a437.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org