Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adds custom executor, major refactor of fuzzer.rs #49

Draft
wants to merge 23 commits into
base: main
Choose a base branch
from
Draft

Adds custom executor, major refactor of fuzzer.rs #49

wants to merge 23 commits into from
+592 −484

Conversation

grebnetiew
Copy link
Contributor

This adds the SequenceExecutor, which takes care of executing inputs.
This has some advantages over using the LibAFL executors:

  • Harness is no longer a lambda which captures half of the locals in fuzz(). Instead it's a method of the executor, and the HTTP client, authentication and cookie machinery as well as the stats tracking are now fields of the executor. This improves readability and ease of later refactors.
  • When updating the stats in post_exec, we now get the event manager as a function argument from the fuzzer. We used to rely on some pointer magic from inprocess_get_event_manager, which is kind of necessary when binary fuzzing (we never did that) and working against the LibAFL executor design instead of with it (we did do that unwittingly).

Closes #12

@github-actions GitHub Actions
Copy link

github-actions bot commented Dec 4, 2024 •
edited
Loading

Sigrid maintainability feedback

⚠️ Your code did not improve maintainability towards your objective of 4.0 stars

Show details

Sigrid compared your code against the baseline of 2025-01-16.

👍 What went well?

You fixed or improved 1 refactoring candidates.

Risk System property Location
🔴 Unit Size
(Improved)		 WuppieFuzz/src/fuzzer.rs
fuzz()

👎 What could be better?

Unfortunately, 11 refactoring candidates were introduced or got worse.

Risk System property Location
🔴 Duplication
(Introduced)		 WuppieFuzz/src/reporting/mod.rs (lines 34-39)
WuppieFuzz/src/reporting/mod.rs (lines 74-79)
WuppieFuzz/src/reporting/sqlite.rs (lines 175-180)
🔴 Duplication
(Introduced)		 WuppieFuzz/src/reporting/mod.rs (lines 19-24)
WuppieFuzz/src/reporting/mod.rs (lines 49-54)
🔴 Duplication
(Introduced)		 WuppieFuzz/src/executor.rs (lines 32-38)
WuppieFuzz/src/reproducer.rs (lines 13-19)
🟠 Unit Size
(Introduced)		 WuppieFuzz/src/executor.rs
post_exec(FuzzerState,OpenApiInput,EM)
🟠 Unit Interfacing
(Introduced)		 WuppieFuzz/src/reporting/mod.rs
get_current_test_case_file_name(OpenApiFuzzerState,any,any,rands,any,any)
🟡 Unit Size
(Introduced)		 WuppieFuzz/src/reporting/sqlite.rs
Reporting.report_request(OpenApiRequest,CurlRequest,Oafs,usize)
🟡 Unit Complexity
(Introduced)		 WuppieFuzz/src/executor.rs
post_exec(FuzzerState,OpenApiInput,EM)
🟡 Unit Complexity
(Introduced)		 WuppieFuzz/src/fuzzer.rs
fuzz()
⚫️ + 3 more

📚 Remaining technical debt

4 refactoring candidates didn't get better or worse, but are still present in the code you touched.

View this system in Sigrid** to explore your technical debt

⭐️ Sigrid ratings

System property System on 2025-01-16 Before changes New/changed code
Volume 5.4 N/A N/A
Duplication 4.1 4.4 4.2
Unit Size 2.1 1.2 1.7
Unit Complexity 2.9 5.5 1.5
Unit Interfacing 2.0 3.5 0.9
Module Coupling 3.3 5.5 5.5
Component Independence 5.4 N/A N/A
Component Entanglement N/A N/A N/A
Maintainability 3.6 4.2 3.0

💬 Did you find this feedback helpful?

We would like to know your thoughts to make Sigrid better.
Your username will remain confidential throughout the process.

View this system in Sigrid

@grebnetiew
Copy link
Contributor Author

grebnetiew commented Dec 5, 2024 •
edited by ThomasTNO
Loading

  • Finish moving the stop check to the executor
    • Check in pre-exec if stop_request was made, and stop in that case
    • maybe also move the entire construction of manual_interrupt

@ThomasTNO
Copy link
Contributor

ThomasTNO commented Dec 6, 2024 •
edited by grebnetiew
Loading

  • Ensure --report works again
thread 'main' panicked at src/reporting/mod.rs:86:6:
State is gone??

@ThomasTNO
Copy link
Contributor

This should also close #30

@ThomasTNO ThomasTNO mentioned this pull request Dec 6, 2024
Merged
dependabot bot and others added 6 commits January 15, 2025 12:12
@dependabot
chore(deps): bump the all-dependencies group across 1 directory with …
ebd330f 
…15 updates

Bumps the all-dependencies group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.93` | `1.0.95` |
| [chrono](https://github.com/chronotope/chrono) | `0.4.38` | `0.4.39` |
| [clap](https://github.com/clap-rs/clap) | `4.5.21` | `4.5.26` |
| [cookie](https://github.com/SergioBenitez/cookie-rs) | `0.17.0` | `0.18.1` |
| [cookie_store](https://github.com/pfernie/cookie_store) | `0.20.0` | `0.21.1` |
| [env_logger](https://github.com/rust-cli/env_logger) | `0.11.5` | `0.11.6` |
| [log](https://github.com/rust-lang/log) | `0.4.22` | `0.4.25` |
| [petgraph](https://github.com/petgraph/petgraph) | `0.6.5` | `0.7.1` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.12.9` | `0.12.12` |
| [reqwest_cookie_store](https://github.com/pfernie/reqwest_cookie_store) | `0.7.0` | `0.8.0` |
| [rusqlite](https://github.com/rusqlite/rusqlite) | `0.31.0` | `0.32.1` |
| [serde](https://github.com/serde-rs/serde) | `1.0.215` | `1.0.217` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.133` | `1.0.135` |
| [tempfile](https://github.com/Stebalien/tempfile) | `3.14.0` | `3.15.0` |
| [unicode-truncate](https://github.com/Aetf/unicode-truncate) | `1.1.0` | `2.0.0` |



Updates `anyhow` from 1.0.93 to 1.0.95
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.93...1.0.95)

Updates `chrono` from 0.4.38 to 0.4.39
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.38...v0.4.39)

Updates `clap` from 4.5.21 to 4.5.26
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.21...clap_complete-v4.5.26)

Updates `cookie` from 0.17.0 to 0.18.1
- [Changelog](https://github.com/rwf2/cookie-rs/blob/master/CHANGELOG.md)
- [Commits](rwf2/cookie-rs@0.17.0...0.18.1)

Updates `cookie_store` from 0.20.0 to 0.21.1
- [Changelog](https://github.com/pfernie/cookie_store/blob/master/CHANGELOG.md)
- [Commits](pfernie/cookie_store@v0.20.0...v0.21.1)

Updates `env_logger` from 0.11.5 to 0.11.6
- [Release notes](https://github.com/rust-cli/env_logger/releases)
- [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md)
- [Commits](rust-cli/env_logger@v0.11.5...v0.11.6)

Updates `log` from 0.4.22 to 0.4.25
- [Release notes](https://github.com/rust-lang/log/releases)
- [Changelog](https://github.com/rust-lang/log/blob/master/CHANGELOG.md)
- [Commits](rust-lang/log@0.4.22...0.4.25)

Updates `petgraph` from 0.6.5 to 0.7.1
- [Changelog](https://github.com/petgraph/petgraph/blob/master/RELEASES.rst)
- [Commits](https://github.com/petgraph/petgraph/compare/[email protected]@v0.7.1)

Updates `reqwest` from 0.12.9 to 0.12.12
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.12.9...v0.12.12)

Updates `reqwest_cookie_store` from 0.7.0 to 0.8.0
- [Changelog](https://github.com/pfernie/reqwest_cookie_store/blob/main/CHANGELOG.md)
- [Commits](pfernie/reqwest_cookie_store@v0.7.0...v0.8.0)

Updates `rusqlite` from 0.31.0 to 0.32.1
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](rusqlite/rusqlite@v0.31.0...v0.32.1)

Updates `serde` from 1.0.215 to 1.0.217
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.215...v1.0.217)

Updates `serde_json` from 1.0.133 to 1.0.135
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.133...v1.0.135)

Updates `tempfile` from 3.14.0 to 3.15.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](Stebalien/tempfile@v3.14.0...v3.15.0)

Updates `unicode-truncate` from 1.1.0 to 2.0.0
- [Release notes](https://github.com/Aetf/unicode-truncate/releases)
- [Changelog](https://github.com/Aetf/unicode-truncate/blob/master/CHANGELOG.md)
- [Commits](Aetf/unicode-truncate@v1.1.0...v2.0.0)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: chrono
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: clap
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: cookie
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: cookie_store
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: env_logger
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: log
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: petgraph
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: reqwest
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: reqwest_cookie_store
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: rusqlite
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: serde
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: serde_json
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: tempfile
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: unicode-truncate
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@grebnetiew
Cargo clippy nightly suggestions
b17335f
@grebnetiew
updates SBOM
c8d91eb
@grebnetiew
Merge branch '1dcbdependabot/cargo/all-dependencies-91f9eeee57' into …
3629886 
…executor
@grebnetiew
some import reordering
b96704a
@grebnetiew
Fix --report by looping state through harness into reporting
012f477
@grebnetiew grebnetiew requested a review from ThomasTNO January 16, 2025 14:21
@ThomasTNO
Copy link
Contributor

I still need to review this. We should add a changelog, But I suggest to first release v1.1.2. Next I will make a release including this for v1.2.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ThomasTNO ThomasTNO Awaiting requested review from ThomasTNO

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Implement custom executor
2 participants
@grebnetiew @ThomasTNO