feat: Fuzz Testing RubyParser (#3736)

Signed-off-by: Joydeep Tripathy <[email protected]>

Author: joydeep049

fuzz/fuzz_gemfile_lock.py

@@ -0,0 +1,93 @@
+# Copyright (C) 2023 Intel Corporation
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import sys
+import tempfile
+from pathlib import Path
+
+import atheris
+import atheris_libprotobuf_mutator
+from google.protobuf.json_format import MessageToDict
+
+import fuzz.generated.gemfile_lock_pb2 as gemfile_lock_pb2
+from cve_bin_tool.cvedb import CVEDB
+from cve_bin_tool.log import LOGGER
+
+with atheris.instrument_imports():
+    from cve_bin_tool.parsers.ruby import RubyParser
+
+cve_db = CVEDB()
+logger = LOGGER.getChild("Fuzz")
+
+
+def GemfileLockBuilder(data):
+    json_data = MessageToDict(
+        data, preserving_proto_field_name=True, including_default_value_fields=True
+    )
+
+    with open(file_path, "w") as f:
+        for git_pkg in json_data.get("git_packages", []):
+            f.write("GIT\n")
+            f.write(f'  remote: {git_pkg.get("remote", "")}\n')
+            f.write(f'  revision: {git_pkg.get("revision", "")}\n')
+            if git_pkg.get("branch"):
+                f.write(f'  branch: {git_pkg.get("branch", "")}\n')
+            f.write("  specs:\n")
+            for spec in git_pkg.get("specs", []):
+                f.write(f'    {spec.get("name", "")} ({spec.get("version", "")})\n')
+                for dep in spec.get("dependencies", []):
+                    f.write(f"      {dep}\n")
+
+        # Handling PATH packages
+        for path_pkg in json_data.get("path_packages", []):
+            f.write("PATH\n")
+            f.write(f'  remote: {path_pkg.get("remote", "")}\n')
+            f.write("  specs:\n")
+            for spec in path_pkg.get("specs", []):
+                f.write(f'    {spec.get("name", "")} ({spec.get("version", "")})\n')
+                for dep in spec.get("dependencies", []):
+                    f.write(f"      {dep}\n")
+
+        # Handling GEM packages
+        for gem_pkg in json_data.get("gem_packages", []):
+            f.write("GEM\n")
+            f.write(f'  remote: {gem_pkg.get("remote", "")}\n')
+            f.write("  specs:\n")
+            for spec in gem_pkg.get("specs", []):
+                f.write(f'    {spec.get("name", "")} ({spec.get("version", "")})\n')
+                for dep in spec.get("dependencies", []):
+                    f.write(f"      {dep}\n")
+
+        # Handling platforms
+        f.write("PLATFORMS\n")
+        for platform in json_data.get("platforms", []):
+            f.write(f"  {platform}\n")
+
+        # Handling dependencies
+        f.write("DEPENDENCIES\n")
+        for dep in json_data.get("dependencies", []):
+            f.write(f"  {dep}\n")
+
+        # Handling bundled with
+        bundled_with = json_data.get("bundled_with", "")
+        if bundled_with:
+            f.write(f"BUNDLED WITH\n   {bundled_with}\n")
+
+
+def TestParseData(data):
+    try:
+        GemfileLockBuilder(data)
+
+        ruby_parser = RubyParser(cve_db, logger)
+        ruby_parser.run_checker(file_path)
+
+    except SystemExit:
+        return
+
+
+file_path = str(Path(tempfile.mkdtemp(prefix="cve-bin-tool-")) / "Gemfile.lock")
+
+atheris_libprotobuf_mutator.Setup(
+    sys.argv, TestParseData, proto=gemfile_lock_pb2.GemfileLock
+)
+atheris.Fuzz()

fuzz/generated/gemfile_lock_pb2.py

@@ -0,0 +1,41 @@
+// Copyright (C) 2023 Intel Corporation
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+syntax = "proto3";
+
+// Represents the state of a GIT package
+message GitPackage {
+    string remote = 1;
+    string revision = 2;
+    string branch = 3;
+    repeated Spec specs = 4;
+}
+
+// Represents the state of a PATH package
+message PathPackage {
+    string remote = 1;
+    repeated Spec specs = 2;
+}
+
+// Represents a spec in a package
+message Spec {
+    string name = 1;
+    string version = 2;
+    repeated string dependencies = 3;
+}
+
+// Represents the state of a GEM package
+message GemPackage {
+    string remote = 1;
+    repeated Spec specs = 2;
+}
+
+// Represents the entire Gemfile.lock file
+message GemfileLock {
+    repeated GitPackage git_packages = 1;
+    repeated PathPackage path_packages = 2;
+    repeated GemPackage gem_packages = 3;
+    repeated string platforms = 4;
+    repeated string dependencies = 5;
+    string bundled_with = 6;
+}