Skip to content
This repository has been archived by the owner on Nov 7, 2022. It is now read-only.

security/all: fuzz input formats with any parsing #354

Open
odeke-em opened this issue Jan 28, 2019 · 2 comments
Open

security/all: fuzz input formats with any parsing #354

odeke-em opened this issue Jan 28, 2019 · 2 comments
Assignees

Comments

@odeke-em
Copy link
Member

In this repository, we've got a bunch of parsers and converters between various formats. The parsing problems and crashes have been reported by users or by us during integration testing. However, evidently we are human and can't exhaust combinations or inputs that can be sent by malicious actors. In order for us to deploy this software to production, it would be great for us to pass in automated inputs and fuzz the living heavens out of the service and fix issues as we encounter them.

There is https://github.com/dvyukov/go-fuzz that we can use, as well as others.

Perhaps let's keep this issue open for cycles of testing and fixing.

@odeke-em
Copy link
Member Author

odeke-em commented Mar 2, 2019

I started working on this but encountered an issue with go-fuzz and go modules dvyukov/go-fuzz#195 (comment) so that's stalled for now.

@flands flands added the BLOCKED label Mar 2, 2019
@flands flands added this to the 0.1.4 milestone Mar 2, 2019
@flands flands modified the milestones: 0.1.4, 0.2.0 Mar 14, 2019
@flands flands removed this from the 0.1.5 milestone Mar 28, 2019
@flands
Copy link
Contributor

flands commented Jul 3, 2019

@tigrannajaryan @pjanotti do we plan to do this in OpenTelemetry Service?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants