Skip to content

Make Jazzer tests safer / make dangerous tests opt-in #971

@Marcono1234

Description

@Marcono1234

See #932 (comment)

It seems some of Jazzer's own tests, especially related to the sanitizers, are inherently unsafe and could in the worst case damage the OS they are running on.

For example:

  • OsCommandInjectionProcessBuilder, OsCommandInjectionRuntimeExec: run arbitrary OS commands
  • ExpressionLanguageInjection, LdapDnInjection, LdapSearchInjection, ObjectInputStreamDeserialization, XPathInjection: run arbitrary code in the worst case?
  • SsrfHttpClient, SsrfSocketConnect, SsrfSocketConnectToHost (?), SsrfUrlConnection: send network requests to arbitrary hosts

I am not completely sure for all of them, and maybe there are more problematic tests.

If possible it would be good to edit or extend these tests so that they don't perform any potentionally dangerous actions (e.g. by using dummy implementations, similar to how it is done for the ScriptEngineInjection test, or using no-op method hooks as suggested in #932 (comment)).
Or if that cannot be avoided, make the tests opt-in (with an explicit command line option, e.g. --enable-dangerous-tests) and then only run them on CI?

What do you think?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions