search

square / moshi

A modern JSON library for Kotlin and Java.
https://square.github.io/moshi/1.x/
Apache License 2.0
9.74k stars 758 forks source link

Integrate fuzzing into Moshi by way of OSS-Fuzz #1413

Open DavidKorczynski opened 2 years ago

DavidKorczynski commented 2 years ago

Hi!

I was wondering if you would be interested in getting Moshi fuzzed by OSS-Fuzz? Fuzzing is a technique for stress-testing applications for bugs and vulnerabilities, and OSS-Fuzz is a free service run by Google for fuzzing important open source projects. It would be great to get Moshi integrated with OSS-Fuzz. OSS-Fuzz will run the fuzzers continuously and report back with bug reports when bugs are found. These reports will have full stack traces, input triggers and more. If you are interested, then the only thing needed is an email(s) connected to a Google account that can be used for receiving the bugs reports, which can be put in the configuration file (project.yaml) over at the OSS-Fuzz repository.

I have set up an initial integration with OSS-Fuzz here: https://github.com/google/oss-fuzz/pull/6734 and this PR on the OSS-Fuzz repository includes a simple initial fuzzer. We can always extend with more fuzzers if you are happy to integrate. I would just need an email and then get this PR merged, following that we should be good to go and down the line we can also migrate fuzzers from OSS-Fuzz to Moshi owns repository.

ZacSweers commented 2 years ago

This would be up to the square folks - @swankjesse @JakeWharton