Commit 41d4239

dist: bionic

language: java

services:

- docker

env:

global:

# This is FUZZIT_API_KEY. see https://docs.travis-ci.com/user/environment-variables/#encrypting-environment-variables for how to create secrets in Travis. you can also create this environment variable in travis dashboard

secure: "vuAoiozUO/335kehSHLR/biDYJnPgB0setWuk2GHxCL9cFsbllBllB2TRgY+LqXnb8jV5cK74Xd6nw/nJytjJeeNDYB7MoCPBkQ3uFdzx79KV4OTHy03YDoW4hNp/49N6OwjEoQhdQzI+nuHyIYKmlmvW6r0M5tlO/RMsuD4LDA8PRLcPG3MTZ1/XQTlpX528YpcO0ADixJs8wvxrTpC06LTo4ieOZQtsYuxJJaVHs14no+qmvF90sLzG2A+SPgdkFmxaUbVp11tswuxo05DeA7epveYsLG1CT12ZLWPBG5FPFVJaL47bz66SciTQKZP+z6SHtIp5Q+bI91IwitOC5r69OlcpcUXKlmQ3GDlP5RRMVef4ZFRJGGEaWU9EXUMD11SbH8RGkf9PMCE8tc/TlWm+MAuww1hVLWW5dM4ttLb9jOBt4OvsiSC+mIEVDi2k9964mZ69YeiYKjPtf5vpx76uS8gR2R6LhsQruPKEwoy0A2/a3L33RtlXBlKURt5YJQuV535KjsVZx5aQUEkDcbNuQHO0HrmrS/rXWUWHEu4xb33nqFypCaB7qgaID2aqKa1TGv6g3aWRmkpqA+ohNSJ80w8EMDBhWwxvHqV2jS4x+XQDaaGvz7Bi3H56keYk4HXhT4Ex8/8jUizzs8Yr5j+glwRhsFrs8WKehpVYt0="

jobs:

include:

- stage: Build, Unit-Tests & Fuzz-Tests

go: 1.12.x

script:

- ./fuzzit.sh fuzzing

[](https://travis-ci.org/fuzzitdev/example-java)

[](https://fuzzit.dev)

[](https://slack.fuzzit.dev)

This is an example of how to integrate your [JQF](https://github.com/rohanpadhye/jqf) targets with the

[Fuzzit](https://fuzzit.dev) Continuous Fuzzing Platform (Java support is currently in Beta).

This example will show the following steps:

* [Building and running a simple JQF target locally](#building-jqf-target)

* [Integrate the JQF target with Fuzzit via Travis-CI](#integrating-with-fuzzit-from-ci)

Result:

* Fuzzit will run the fuzz targets continuously on a daily basis with the latest release.

* Fuzzit will run regression tests on every pull-request with the generated corpus and crashes to catch bugs early on.

Coverage Guided Structure Aware Fuzzing for Java can help find both complex bugs, as well as correctness bugs.

Java is a safe language so memory corruption bugs are very unlikely to happen, but some bugs can still have security

implications.

This tutorial focuses less on how to build JQF targets and more on how to integrate the targets with Fuzzit. A lot of

great information is available at the [JQF Wiki](https://github.com/rohanpadhye/jqf/wiki/Fuzzing-with-Zest).

The targets that are currently supported on Fuzzit are targets that utilize the

[JQF+Zest](https://github.com/rohanpadhye/jqf/wiki/Fuzzing-with-Zest) engine.

The bug is located at `ParseComplex.Java` in the following code

package dev.fuzzit.examplejava;

public class ParseComplex {

public static boolean parse(String data) {

if (data.length() > 4) {

return false;

}

return data.charAt(0) == 'F' &&

data.charAt(1) == 'U' &&

data.charAt(2) == 'Z' &&

data.charAt(3) == 'Z';

}

}

This is a VERY simple case for the sake of the example the author made a mistake.

and Instead of `data.length() > 4 ` the correct code should be `data.length() < 4`.

the fuzzer is located at `ParseComplexFuzz.Java` in the following code:

import org.junit.runner.RunWith;

import edu.berkeley.cs.jqf.fuzz.Fuzz;

import edu.berkeley.cs.jqf.fuzz.JQF;

@RunWith(JQF.class)

public class ParseComplexFuzz {

@Fuzz

public void fuzz(String data) {

ParseComplex.parse(data);

}

}

This is pretty straight forward the fuzzer will generate the psudo random string via data according to

the coverage feedback

git clone https://github.com/fuzzitdev/example-java

docker run -v `pwd`:/app -it maven:3.6.1-jdk-12 /bin/bash

cd /app

curl -o zest-cli.jar https://storage.googleapis.com/public-fuzzit/jqf-fuzz-1.3-SNAPSHOT-zest-cli.jar

mvn package

java -jar zest-cli.jar -e ./target/example-java-1.0-SNAPSHOT-fat-tests.jar dev.fuzzit.examplejava.ParseComplexTest fuzz

Will print the following output and stacktrace:

You can see 1 crash is instantly found. Results are saved by default to target/fuzz-results

For the possible command-lines for ZestCLI you can run `java -jar zest-cli.jar --help`

The best way to integrate with Fuzzit is by adding a two stages in your Continuous Build system

(like Travis, CircleCI, Github Actions or any other CI).

Fuzzing stage:

* Build a package containing the fuzz targets together with all dependencies. This can be done using the assembly plugin like in this repository

* Download `fuzzit` cli

* Authenticate via passing `FUZZIT_API_KEY` environment variable

* Create a fuzzing job by uploading the fuzzing target

Regression stage (This stage in Java is currently in Alpha and will be rolled out to Public beta in the upcoming week)

* Build a fuzzing target

* Download `fuzzit` cli

* Authenticate via passing `FUZZIT_API_KEY` environment variable OR defining the corpus as public. This way

No authentication would be require and regression can be used for [forked PRs](https://docs.travis-ci.com/user/pull-requests#pull-requests-and-security-restrictions) as well

* Create a local regression fuzzing job - This will pull all the generated corpuses and run them through

the fuzzing binary. If new bugs are introduced this will fail the CI and alert

Here is the relevant snippet from the [fuzzit.sh](https://github.com/fuzzitdev/example-java/blob/master/fuzzit.sh)

which is being run by [.travis.yml](https://github.com/fuzzitdev/example-java/blob/master/.travis.yml)

wget -q -O fuzzit https://github.com/fuzzitdev/fuzzit/releases/download/v2.4.35/fuzzit_Linux_x86_64

chmod a+x fuzzit

./fuzzit create job --engine jqf --type ${1} --args "dev.fuzzit.examplejava.ParseComplexTest fuzz" fuzzitdev/parse-complex ./target/example-java-1.0-SNAPSHOT-fat-tests.jar

```

In production it is advised to download a pinned version of the [CLI](https://github.com/fuzzitdev/fuzzit)

like in the example. In development you can use the latest version:

https://github.com/fuzzitdev/fuzzit/releases/latest/download/fuzzit_${OS}_${ARCH}.

Valid values for `${OS}` are: `Linux`, `Darwin`, `Windows`.

Valid values for `${ARCH}` are: `x86_64` and `i386`.

mvn package

wget -q -O fuzzit https://github.com/fuzzitdev/fuzzit/releases/download/v2.4.51/fuzzit_Linux_x86_64

chmod a+x fuzzit

./fuzzit create job --engine jqf --type ${1} --args "dev.fuzzit.examplejava.ParseComplexTest fuzz" fuzzitdev/parse-complex ./target/example-java-1.0-SNAPSHOT-fat-tests.jar

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

<modelVersion>4.0.0</modelVersion>

<groupId>dev.fuzzit.example-java</groupId>

<artifactId>example-java</artifactId>

<version>1.0-SNAPSHOT</version>

<dependencies>

<dependency>

<groupId>junit</groupId>

<artifactId>junit</artifactId>

<version>4.12</version>

</dependency>

<dependency>

<groupId>com.pholser</groupId>

<artifactId>junit-quickcheck-generators</artifactId>

<version>0.8</version>

</dependency>

<dependency>

<groupId>com.pholser</groupId>

<artifactId>junit-quickcheck-core</artifactId>

<version>0.8</version>

</dependency>

<dependency>

<groupId>edu.berkeley.cs.jqf</groupId>

<artifactId>jqf-fuzz</artifactId>

<version>1.2</version>

</dependency>

</dependencies>

<properties>

<maven.compiler.source>1.7</maven.compiler.source>

<maven.compiler.target>1.7</maven.compiler.target>

</properties>

<build>

<plugins>

<plugin>

<groupId>edu.berkeley.cs.jqf</groupId>

<artifactId>jqf-maven-plugin</artifactId>

<version>1.2</version>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-surefire-plugin</artifactId>

<version>2.19.1</version>

<configuration>

<skipTests>true</skipTests>

</configuration>

</plugin>

<plugin>

<artifactId>maven-assembly-plugin</artifactId>

<version>3.1.1</version>

<configuration>

<descriptors>

<descriptor>src/main/assembly/assembly.xml</descriptor>

</descriptors>

</configuration>

<executions>

<execution>

<id>make-assembly</id>

<phase>package</phase>

<goals>

<goal>single</goal>

</goals>

</execution>

</executions>

</plugin>

</plugins>

</build>

</project>

<assembly

xmlns="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/plugins/maven-assembly-plugin/assembly/1.1.3 http://maven.apache.org/xsd/assembly-1.1.3.xsd">

<id>fat-tests</id>

<formats>

<format>jar</format>

</formats>

<includeBaseDirectory>false</includeBaseDirectory>

<dependencySets>

<dependencySet>

<outputDirectory>/</outputDirectory>

<useProjectArtifact>true</useProjectArtifact>

<unpack>true</unpack>

<scope>test</scope>

</dependencySet>

</dependencySets>

<fileSets>

<fileSet>

<directory>${project.build.directory}/test-classes</directory>

<outputDirectory>/</outputDirectory>

</fileSet>

</fileSets>

</assembly>

package dev.fuzzit.examplejava;

public class ParseComplex {

public static boolean parse(String data) {

if (data.length() > 4) {

return false;

}

return data.charAt(0) == 'F' &&

data.charAt(1) == 'U' &&

data.charAt(2) == 'Z' &&

data.charAt(3) == 'Z';

}

}

package dev.fuzzit.examplejava;

public class ParseMain {

public static void main(String [] args) {

System.out.println("hello world");

}

}

package dev.fuzzit.examplejava;

import org.junit.runner.RunWith;

import edu.berkeley.cs.jqf.fuzz.Fuzz;

import edu.berkeley.cs.jqf.fuzz.JQF;

@RunWith(JQF.class)

public class ParseComplexTest {

@Fuzz

public void fuzz(String data)

{

ParseComplex.parse(data);

}

}