Continuous fuzzing by way of OSS-Fuzz about platformdirs HOT 12 CLOSED

I don't think we plan to do this ourselves. I don't fully understand how this would look, so perhaps you'd be interested in opening a PR and showing us the benefits, and what tare the benefits? Is there a good description of what a such integration entitles?

from platformdirs.

Apologies for the delay here!

The fuzzer I added for now is here: https://github.com/google/oss-fuzz/pull/8244/files#diff-d8851e58e8b63c88b3ad9b845fcd8becb9dbcfadebf9cc13b532e69e14a34776

In essence, a simple fuzzer that will explore most of the code in paltformdirs.

Since platformdirs is fairly small in size I think there will be limited findings. However, to give some insights on what it can find, an example of bug found by fuzzing is pallets/werkzeug#2494 -- This was found by the fuzzer in OSS-Fuzz (https://github.com/google/oss-fuzz/blob/master/projects/flask/fuzz_werkzeug_http.py) which showed the stack trace:

=== Uncaught Python exception: ===
  | ValueError: invalid literal for int() with base 10: '²'
  | Traceback (most recent call last):
  | File "fuzz_werkzeug_http.py", line 25, in TestOneInput
  | File "werkzeug/http.py", line 822, in parse_content_range_header

Although platformdirs is relatively small, OSS-Fuzz will help have a continuous monitoring solution on the project as well.

from platformdirs.

• This was found by the fuzzer in OSS-Fuzz (https://github.com/google/oss-fuzz/blob/master/projects/flask/fuzz_werkzeug_http.p)

This link does not work for me 🤔

from platformdirs.

• This was found by the fuzzer in OSS-Fuzz (https://github.com/google/oss-fuzz/blob/master/projects/flask/fuzz_werkzeug_http.p)

This link does not work for me thinking

Apologies -- edited it to work now (was missing y at the end).

from platformdirs.

So how we will get notified when things fail?

from platformdirs.

So how we will get notified when things fail?

by email:

"If you would like to integrate, the only thing I need is a list of email(s) that will get access to the data produced by OSS-Fuzz, such as bug reports, coverage reports and more stats."

Note the email(s) should be affiliated with a Google account as authentication is done that way

from platformdirs.

So given that do you need anything more here? Or we can close this then?

from platformdirs.

Yes, given that then there is nothing more here. Later, I could move the fuzzers upstream but we can do that after

from platformdirs.

It's on my profile 👍

from platformdirs.

It's on my profile +1

Awesome, thanks!

from platformdirs.

@gaborbernat I just noticed you also maintain filelock, would you be okay with me doing the same for filelock?

from platformdirs.

Yes

from platformdirs.