-
Notifications
You must be signed in to change notification settings - Fork 162
Open
Description
See #932 (comment)
It seems some of Jazzer's own tests, especially related to the sanitizers, are inherently unsafe and could in the worst case damage the OS they are running on.
For example:
OsCommandInjectionProcessBuilder
,OsCommandInjectionRuntimeExec
: run arbitrary OS commandsExpressionLanguageInjection
,LdapDnInjection
,LdapSearchInjection
,ObjectInputStreamDeserialization
,XPathInjection
: run arbitrary code in the worst case?SsrfHttpClient
,SsrfSocketConnect
,SsrfSocketConnectToHost
(?),SsrfUrlConnection
: send network requests to arbitrary hosts
I am not completely sure for all of them, and maybe there are more problematic tests.
If possible it would be good to edit or extend these tests so that they don't perform any potentionally dangerous actions (e.g. by using dummy implementations, similar to how it is done for the ScriptEngineInjection
test, or using no-op method hooks as suggested in #932 (comment)).
Or if that cannot be avoided, make the tests opt-in (with an explicit command line option, e.g. --enable-dangerous-tests
) and then only run them on CI?
What do you think?
Metadata
Metadata
Assignees
Labels
No labels