[jira] [Commented] (TIKA-3083) Consider adding a fuzzing module

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

[jira] [Commented] (TIKA-3083) Consider adding a fuzzing module

Clark Perkins (Jira)

    [ https://issues.apache.org/jira/browse/TIKA-3083?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17091940#comment-17091940 ]

Hudson commented on TIKA-3083:
------------------------------

SUCCESS: Integrated in Jenkins build tika-branch-1x #335 (See [https://builds.apache.org/job/tika-branch-1x/335/])
TIKA-3083 -- add fuzzing module (tallison: [https://github.com/apache/tika/commit/904a947c726619e9f6dca01164016cc806854751])
* (add) tika-fuzzing/src/test/resources/test-documents/heavy_hang.xml
* (add) tika-fuzzing/src/test/java/TestFuzzingCLI.java
* (add) tika-fuzzing/src/main/resources/META-INF/services/org.apache.tika.fuzzing.Transformer
* (add) tika-fuzzing/src/test/resources/test-documents/system_exit.xml
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/pdf/EvilCOSWriter.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/pdf/PDFTransformerConfig.java
* (edit) pom.xml
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/cli/FuzzingCLIConfig.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/general/GeneralTransformer.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/Transformer.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/general/ByteDeleter.java
* (add) tika-fuzzing/src/test/resources/test-documents/null_pointer.xml
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/cli/FuzzOne.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/exceptions/CantFuzzException.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/general/ByteInjector.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/general/Truncator.java
* (add) tika-fuzzing/pom.xml
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/general/ByteFlipper.java
* (add) tika-fuzzing/src/test/java/TestTransformer.java
* (add) tika-fuzzing/src/main/resources/log4j.properties
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/pdf/PDFTransformer.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/AutoDetectTransformer.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/general/SpanSwapper.java
* (add) tika-fuzzing/src/main/java/org/apache/tika/fuzzing/cli/FuzzingCLI.java


> Consider adding a fuzzing module
> --------------------------------
>
>                 Key: TIKA-3083
>                 URL: https://issues.apache.org/jira/browse/TIKA-3083
>             Project: Tika
>          Issue Type: Task
>            Reporter: Tim Allison
>            Assignee: Tim Allison
>            Priority: Major
>             Fix For: 1.25
>
>
> I think it would be useful to add a new module for fuzzing.  We should eventually integrate grownup/mature fuzzers (jqf), but we can start with cheap 'n easy mangling.
> The reason to add this to tika and not have it as a separate project, is that I think there will eventually be file format specific fuzzers for file formats that rely on compressed streams, e.g. PDF, docx, where mangling a literal byte in the file is a good first step, but it might also be useful to mangle bytes within the streams or implement faulty/malicious compressors or inject malfeasance at other levels.
> I'm not set on adding this to Tika.  If there are objections/recommendations, please share.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)