You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by "vishalcoc44 (via GitHub)" <gi...@apache.org> on 2026/03/08 10:18:05 UTC
[PR] [fuzz] Integrate CIFuzz GitHub Action for continuous security testing [poi]
vishalcoc44 opened a new pull request, #1028:
URL: https://github.com/apache/poi/pull/1028
I'm adding **CIFuzz** GitHub Action to automatically fuzz new contributions and prevent regressions.
- **Continuous Security**: Every PR will now be fuzzed for 10 minutes using the existing OSS-Fuzz infrastructure.
- **Ideal Integration**: This completes the "Ideal Integration" requirement for Google OSS-Fuzz, ensuring long-term maintenance of the fuzzer health.
- **Regression Testing**: Identified bugs (like the RLE decompression crash) will be caught automatically if re-introduced.
### Validation
- The workflow correctly references the `apache-poi` project on OSS-Fuzz.
- It triggers on Pull Requests targeting `trunk` and `5.5.x`.
@centic9
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] [fuzz] Integrate CIFuzz GitHub Action for continuous security testing [poi]
Posted by "vishalcoc44 (via GitHub)" <gi...@apache.org>.
vishalcoc44 commented on PR #1028:
URL: https://github.com/apache/poi/pull/1028#issuecomment-4031494738
> I'm -1 on this.
>
> I'm really concerned that GitHub will eventually limit ASF projects.
>
> I don't see why we need to fuzz every commit or PR. A complete waste of electricity, water, human time analysing the results.
> I'm -1 on this.
>
> I'm really concerned that GitHub will eventually limit ASF projects.
>
> I don't see why we need to fuzz every commit or PR. A complete waste of electricity, water, human time analysing the results.
Hi @pjfanning,
Thank you for your feedback, I do understand your concerns regarding CI resource usage and environmental impact.
Proposed Compromise: Scoped Automated Fuzzing Instead of running on every commit, the
workflow has been updated to use strictly scoped path filtering. It will now only trigger if changes are made to core logic in:
poi/src/main/java/**
poi-ooxml/src/main/java/**
poi-scratchpad/src/main/java/**
poi-fuzz/src/main/java/**
so changes to documentation, tests, build scripts (Gradle/Ant), and examples will not trigger the fuzzer.
Additionally:
Strict 10-minute cap: The run is truncated to exactly 600 seconds. It is just a smoke test to catch regressions early, not a long-running process, so clfuzz reports crashes only during that specific pr
Low Impact: This is a small fraction of the total CI time compared to the full build and test suite, but provides a critical security safety net.
we can still reduce the scope further if needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] [fuzz] Integrate CIFuzz GitHub Action for continuous security testing [poi]
Posted by "vishalcoc44 (via GitHub)" <gi...@apache.org>.
vishalcoc44 commented on PR #1028:
URL: https://github.com/apache/poi/pull/1028#issuecomment-4031580527
> afaic.
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] [fuzz] Integrate CIFuzz GitHub Action for continuous security testing [poi]
Posted by "vishalcoc44 (via GitHub)" <gi...@apache.org>.
vishalcoc44 commented on PR #1028:
URL: https://github.com/apache/poi/pull/1028#issuecomment-4031582467
> Change the workflow to workflow_dispatch only and I'll merge it but running on every PR is crazy afaic.
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] [fuzz] Integrate CIFuzz GitHub Action for continuous security testing [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning merged PR #1028:
URL: https://github.com/apache/poi/pull/1028
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] [fuzz] Integrate CIFuzz GitHub Action for continuous security testing [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #1028:
URL: https://github.com/apache/poi/pull/1028#issuecomment-4030861823
I'm -1 on this.
I'm really concerned that GitHub will eventually limit ASF projects.
I don't see why we need to fuzz every commit or PR. A complete waste of electricity, water, human time analysing the results.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] [fuzz] Integrate CIFuzz GitHub Action for continuous security testing [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #1028:
URL: https://github.com/apache/poi/pull/1028#issuecomment-4031528421
Change the workflow to workflow_dispatch only and I'll merge it but running on every PR is crazy afaic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org