search

AzureAD / microsoft-authentication-library-for-python

Microsoft Authentication Library (MSAL) for Python makes it easy to authenticate to Microsoft Entra ID. General docs are available here https://learn.microsoft.com/entra/msal/python/ Stable APIs are documented here https://msal-python.readthedocs.io. Questions can be asked on www.stackoverflow.com with tag "msal" + "python".
https://stackoverflow.com/questions/tagged/azure-ad-msal+python
Other
770 stars 192 forks source link

Fuzzing integration by way of OSS-Fuzz #486

Closed DavidKorczynski closed 2 years ago

DavidKorczynski commented 2 years ago

Hi,

I was wondering if you would like to integrate continuous fuzzing by way of OSS-Fuzz? In this PR https://github.com/google/oss-fuzz/pull/7754 we do exactly this, namely created the necessary logic from an OSS-Fuzz perspective.

Essentially, OSS-Fuzz is a free service run by Google that performs continuous fuzzing of important open source projects. The only expectation of integrating into OSS-Fuzz is that bugs will be fixed. This is not a "hard" requirement in that no one enforces this and the main point is if bugs are not fixed then it is a waste of resources to run the fuzzers, which we would like to avoid.

If you would like to integrate, the only thing I need is as list of email(s) that will get access to the data produced by OSS-Fuzz, such as bug reports, coverage reports and more stats. Notice the emails affiliated with the project will be public in the OSS-Fuzz repo, as they will be part of a configuration file.

rayluo commented 2 years ago

If you would like to integrate, the only thing I need is as list of email(s) that will get access to the data produced by OSS-Fuzz, such as bug reports, coverage reports and more stats. Notice the emails affiliated with the project will be public in the OSS-Fuzz repo, as they will be part of a configuration file.

Are you talking about adding the email(s) to here? Sure. Go ahead to use my email, which you can find in my profile and/or my commits. By the way, are those existing emails in your current PR intended to be there?

When OSS-Fuzz finds bugs in the test subject (MSAL in this case), do we as the project maintainers need to periodically check your OSS-Fuzz bug list? Will OSS-Fuzz proactively send notifications to my email? Or, even better, can OSS-Fuzz create github issues to the corresponding upstream OSS projects? That way would be more reliable in the long term, after the initial individuals eventually moving out of the project.

I have some other specific questions on OSS-Fuzz. I'll leave comments into your PR there.

DavidKorczynski commented 2 years ago

Are you talking about adding the email(s) to here? Sure. Go ahead to use my email, which you can find in my profile and/or my commits. By the way, are those existing emails in your current PR intended to be there?

Thanks Ray, will do! The existing emails are there just for us to help with the integration, for example, there may be something in the set up that breaks or similar when the fuzzers start running to continuously. Am happy to remove if you prefer but it's for us to assist in case of any mishappeninngs!

When OSS-Fuzz finds bugs in the test subject (MSAL in this case), do we as the project maintainers need to periodically check your OSS-Fuzz bug list? Will OSS-Fuzz proactively send notifications to my email? Or, even better, can OSS-Fuzz create github issues to the corresponding upstream OSS projects? That way would be more reliable in the long term, after the initial individuals eventually moving out of the project.

You will receive notifications by email! OSS-Fuzz is working on getting issues reported by way of Github and I expect that to be more stable soon!

I have some other specific questions on OSS-Fuzz. I'll leave comments into your PR there.

Got it, I answered over there!

rayluo commented 2 years ago

By the way, are those existing emails in your current PR intended to be there?

The existing emails are there just for us to help with the integration, for example, there may be something in the set up that breaks or similar when the fuzzers start running to continuously. Am happy to remove if you prefer but it's for us to assist in case of any mishappeninngs!

You do not have to remove them if those setup are useful to you. I was just not sure whether they were copy-and-paste errors. :-)