Skip to content

Make Jazzer tests safer / make dangerous tests opt-in #971

Description

@Marcono1234

See #932 (comment)

It seems some of Jazzer's own tests, especially related to the sanitizers, are inherently unsafe and could in the worst case damage the OS they are running on.

For example:

  • OsCommandInjectionProcessBuilder, OsCommandInjectionRuntimeExec: run arbitrary OS commands
  • ExpressionLanguageInjection, LdapDnInjection, LdapSearchInjection, ObjectInputStreamDeserialization, XPathInjection: run arbitrary code in the worst case?
  • SsrfHttpClient, SsrfSocketConnect, SsrfSocketConnectToHost (?), SsrfUrlConnection: send network requests to arbitrary hosts

I am not completely sure for all of them, and maybe there are more problematic tests.

If possible it would be good to edit or extend these tests so that they don't perform any potentionally dangerous actions (e.g. by using dummy implementations, similar to how it is done for the ScriptEngineInjection test, or using no-op method hooks as suggested in #932 (comment)).
Or if that cannot be avoided, make the tests opt-in (with an explicit command line option, e.g. --enable-dangerous-tests) and then only run them on CI?

What do you think?

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions