feat: add dockerfile and script to perform fuzzing test on all swagger files and individual by vli11 · Pull Request #4569 · edgexfoundry/edgex-go

vli11 · 2023-05-16T18:29:16Z

If your build fails due to your commit message not passing the build checks, please review the guidelines here: https://github.com/edgexfoundry/edgex-go/blob/main/.github/Contributing.md

PR Checklist

Please check if your PR fulfills the following requirements:

I am not introducing a breaking change (if you are, flag in conventional commit message with BREAKING CHANGE: describing the break)
I am not introducing a new dependency (add notes below if you are)
I have added unit tests for the new feature or bug fix (if not, why?)
I have fully tested (add details below) this the new feature or bug fix (if not, why?)
I have opened a PR for the related docs change (if not, why?)

Testing Instructions

to build: docker build -f Dockerfile.fuzz -t fuzz-edgex-go:latest .
to run: docker run --net host -v $(pwd)/fuzz_results:/fuzz_results fuzz-edgex-go:latest

New Dependency Instructions (If applicable)

sonarqubecloud · 2023-05-16T18:32:19Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
2 Security Hotspots
1 Code Smell

No Coverage information
0.0% Duplication

bnevis-i · 2023-08-14T15:19:38Z

+
+RUN apk add --no-cache python3 py3-pip bash coreutils
+
+RUN wget https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz


Sonarqube is flagging this line:

https://sonarcloud.io/project/security_hotspots?pullRequest=4569&id=edgexfoundry_edgex-go&tab=how_to_fix

lenny-goodell · 2023-08-14T15:46:05Z

@vli11 , please add make targets for building and running .

docker-fuzz
- docker build -f Dockerfile.fuzz -t fuzz-edgex-go:latest .
fuxx-test
- docker run --net host -v $(pwd)/fuzz_results:/fuzz_results fuzz-edgex-go:latest

jim-wang-yutsung · 2023-08-14T16:19:10Z

+RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz"
+RUN tar -xvf v9.2.2.tar.gz && mv restler-fuzzer-9.2.2 restler-fuzzer


combine these two runs and delete gz file after mv

Actually, it is more efficient to just pipe the wget output into tar directly, and use tar options to manipulate the target directory

WORKDIR /restler-fuzzer RUN wget -q -O - (url.tar.gz) | tar xz --strip-components 1 && mkdir restler_bin`

that's great

bnevis-i · 2023-08-14T16:41:16Z

+RUN cd restler-fuzzer; mkdir -p restler_bin
+WORKDIR /restler-fuzzer


Suggested change

RUN cd restler-fuzzer; mkdir -p restler_bin

WORKDIR /restler-fuzzer

Combined into previous statement

bnevis-i · 2023-08-14T17:55:58Z

+RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz" && \
+    tar -xvf v9.2.2.tar.gz && \
+    mv restler-fuzzer-9.2.2 restler-fuzzer && \
+    rm v9.2.2.tar.gz && \
+    cd restler-fuzzer && \
+    mkdir -p restler_bin
+
+WORKDIR /restler-fuzzer


Suggested change

RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz" && \

tar -xvf v9.2.2.tar.gz && \

mv restler-fuzzer-9.2.2 restler-fuzzer && \

rm v9.2.2.tar.gz && \

cd restler-fuzzer && \

mkdir -p restler_bin

WORKDIR /restler-fuzzer

WORKDIR /restler-fuzzer

RUN wget -q -O - "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz" | \

tar xvf - --strip-components 1 && \

mkdir -p restler_bin

Dismissing my stale review.

bnevis-i · 2023-08-14T19:36:10Z

@vli11 You will have to squash and rebase this PR due to the Semantic PR check failing.

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual Closes: edgexfoundry#4568 Signed-off-by: Valina Li <valina.li@intel.com>

Signed-off-by: Valina Li <valina.li@intel.com>

bnevis-i

Re-approved.

jim-wang-yutsung

LGTM, except make test failed

lenny-goodell · 2023-08-15T16:00:11Z

LGTM, except make test failed

@vli11 , Hado lint failing on your new docker file.

vli11 · 2023-08-15T20:33:55Z

LGTM, except make test failed

@vli11 , Hado lint failing on your new docker file.

FROM mcr.microsoft.com/dotnet/sdk:6.0-alpine hadolint error: DL3026 error: Use only an allowed registry in the FROM image; but docker hub does have this official image https://hub.docker.com/_/microsoft-dotnet-sdk/https://hub.docker.com/_/microsoft-dotnet-sdk/. any suggestions? @lenny-intel @bnevis-i

bnevis-i · 2023-08-15T21:05:38Z

FROM mcr.microsoft.com/dotnet/sdk:6.0-alpine hadolint error: DL3026 error: Use only an allowed registry in the FROM image; but docker hub does have this official image https://hub.docker.com/_/microsoft-dotnet-sdk/https://hub.docker.com/_/microsoft-dotnet-sdk/. any suggestions? @lenny-intel @bnevis-i

I would ignore the error in .hadolint.yaml. https://github.com/edgexfoundry/edgex-go/blob/main/.hadolint.yml

Signed-off-by: Valina Li <valina.li@intel.com>

jim-wang-yutsung · 2023-08-15T21:34:25Z

LGTM, except make test failed

@vli11 , Hado lint failing on your new docker file.

FROM mcr.microsoft.com/dotnet/sdk:6.0-alpine hadolint error: DL3026 error: Use only an allowed registry in the FROM image; but docker hub does have this official image https://hub.docker.com/_/microsoft-dotnet-sdk/https://hub.docker.com/_/microsoft-dotnet-sdk/. any suggestions? @lenny-intel @bnevis-i

i wonder what is the reason that Microsoft doesn't publish the latest version to Docker hub. maybe the one in docker hub is stable version

Signed-off-by: Valina Li <valina.li@intel.com>

bnevis-i · 2023-08-15T21:43:39Z

i wonder what is the reason that Microsoft doesn't publish the latest version to Docker hub. maybe the one in docker hub is stable version

Because Microsoft has the better registry? (Probably true, it supports the latest OCI registry standards.)

bnevis-i

LGTM. Third time lucky?

Signed-off-by: Valina Li <valina.li@intel.com>

sonarqubecloud · 2023-08-15T22:04:03Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
1 Security Hotspot
0 Code Smells

No Coverage information
0.0% Duplication

jim-wang-yutsung

LGTM

lenny-goodell

LGTM

vli11 marked this pull request as draft May 16, 2023 18:29

vli11 self-assigned this May 16, 2023

vli11 force-pushed the fuzz_docker_script branch from 832011d to 67c93f7 Compare May 16, 2023 18:31

jim-wang-yutsung reviewed May 17, 2023

View reviewed changes

Comment thread Dockerfile.fuzz Outdated

Comment thread fuzzing_docker.sh Outdated

Comment thread fuzzing_docker.sh Outdated

Comment thread fuzzing_docker.sh Outdated

bnevis-i self-requested a review August 9, 2023 16:47

vli11 force-pushed the fuzz_docker_script branch from 68fae54 to 807f438 Compare August 12, 2023 00:56

vli11 changed the title ~~feat: core-data fuzzing dockerfile and script~~ feat: add dockerfile and script to perform fuzzing test on all swagger files and individual Aug 12, 2023

vli11 added the enhancement New feature or request label Aug 12, 2023

vli11 requested a review from lenny-goodell August 12, 2023 01:00

vli11 marked this pull request as ready for review August 12, 2023 01:00

This was referenced Aug 12, 2023

core-command swagger file has incorrect example and missing PUT parameters #4629

Closed

fix: Fix core command swagger #4630

Closed

fix: Fix core-command swagger file #4631

Merged

bnevis-i previously requested changes Aug 14, 2023

View reviewed changes

lenny-goodell requested changes Aug 14, 2023

View reviewed changes

Comment thread Dockerfile.fuzz Outdated

Comment thread fuzzing_docker.sh

jim-wang-yutsung requested changes Aug 14, 2023

View reviewed changes

bnevis-i reviewed Aug 14, 2023

View reviewed changes

jim-wang-yutsung reviewed Aug 14, 2023

View reviewed changes

Comment thread Dockerfile.fuzz Outdated

bnevis-i reviewed Aug 14, 2023

View reviewed changes

jim-wang-yutsung reviewed Aug 14, 2023

View reviewed changes

Comment thread fuzzing_docker.sh Outdated

jim-wang-yutsung requested changes Aug 14, 2023

View reviewed changes

Comment thread Makefile Outdated

bnevis-i previously approved these changes Aug 14, 2023

View reviewed changes

feat: add dockerfile and script to perform fuzzing test

00c7f83

feat: add dockerfile and script to perform fuzzing test on all swagger files and individual Closes: edgexfoundry#4568 Signed-off-by: Valina Li <valina.li@intel.com>

vli11 force-pushed the fuzz_docker_script branch from a0e06c8 to 00c7f83 Compare August 14, 2023 21:07

vli11 requested review from jim-wang-yutsung and lenny-goodell August 14, 2023 21:14

feat: add details and more clean up

4913631

Signed-off-by: Valina Li <valina.li@intel.com>

vli11 dismissed bnevis-i’s stale review via 4913631 August 14, 2023 23:31

bnevis-i previously approved these changes Aug 14, 2023

View reviewed changes

jim-wang-yutsung previously approved these changes Aug 14, 2023

View reviewed changes

lenny-goodell requested changes Aug 15, 2023

View reviewed changes

Comment thread Dockerfile.fuzz Outdated

Comment thread Dockerfile.fuzz Outdated

Comment thread Dockerfile.fuzz Outdated

Comment thread Dockerfile.fuzz Outdated

Comment thread Makefile Outdated

Comment thread Makefile Outdated

Comment thread Makefile Outdated

Comment thread fuzzing_docker.sh

feat: moved fuzz test related into fuzz_test directory

323adb0

Signed-off-by: Valina Li <valina.li@intel.com>

vli11 dismissed stale reviews from jim-wang-yutsung and bnevis-i via 323adb0 August 15, 2023 21:22

feat: fix hadolint problem

067ba46

Signed-off-by: Valina Li <valina.li@intel.com>

bnevis-i previously approved these changes Aug 15, 2023

View reviewed changes

vli11 requested review from jim-wang-yutsung and lenny-goodell August 15, 2023 21:47

jim-wang-yutsung requested changes Aug 15, 2023

View reviewed changes

Comment thread Makefile Outdated

jim-wang-yutsung reviewed Aug 15, 2023

View reviewed changes

Comment thread .hadolint.yml Outdated

feat: fix docker build command on docker-fuzz

402cc22

Signed-off-by: Valina Li <valina.li@intel.com>

vli11 dismissed bnevis-i’s stale review via 402cc22 August 15, 2023 21:58

feat: move hadolint ignore to local dockerfile

0440360

Signed-off-by: Valina Li <valina.li@intel.com>

jim-wang-yutsung approved these changes Aug 15, 2023

View reviewed changes

vli11 requested a review from bnevis-i August 15, 2023 22:10

bnevis-i removed their request for review August 15, 2023 22:11

bnevis-i approved these changes Aug 15, 2023

View reviewed changes

lenny-goodell approved these changes Aug 15, 2023

View reviewed changes

vli11 merged commit 6b7b8e6 into edgexfoundry:main Aug 15, 2023

bnevis-i mentioned this pull request Aug 15, 2023

Fuzzing for EdgeX REST/MQTT interfaces [ossf silver] edgexfoundry/edgex-taf#714

Open

5 tasks


		RUN apk add --no-cache python3 py3-pip bash coreutils

		RUN wget https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz

		RUN wget -q "https://github.com/microsoft/restler-fuzzer/archive/refs/tags/v9.2.2.tar.gz"
		RUN tar -xvf v9.2.2.tar.gz && mv restler-fuzzer-9.2.2 restler-fuzzer

		RUN cd restler-fuzzer; mkdir -p restler_bin
		WORKDIR /restler-fuzzer

Conversation

vli11 commented May 16, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Checklist

Testing Instructions

New Dependency Instructions (If applicable)

Uh oh!

sonarqubecloud Bot commented May 16, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bnevis-i Aug 14, 2023

Choose a reason for hiding this comment

Uh oh!

lenny-goodell commented Aug 14, 2023

Uh oh!

Uh oh!

Uh oh!

jim-wang-yutsung Aug 14, 2023

Choose a reason for hiding this comment

Uh oh!

bnevis-i Aug 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jim-wang-yutsung Aug 14, 2023

Choose a reason for hiding this comment

Uh oh!

bnevis-i Aug 14, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bnevis-i Aug 14, 2023

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bnevis-i commented Aug 14, 2023

Uh oh!

bnevis-i left a comment

Choose a reason for hiding this comment

Uh oh!

jim-wang-yutsung left a comment

Choose a reason for hiding this comment

Uh oh!

lenny-goodell commented Aug 15, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vli11 commented Aug 15, 2023

Uh oh!

bnevis-i commented Aug 15, 2023

Uh oh!

jim-wang-yutsung commented Aug 15, 2023

Uh oh!

bnevis-i commented Aug 15, 2023

Uh oh!

bnevis-i left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 15, 2023

Uh oh!

jim-wang-yutsung left a comment

Choose a reason for hiding this comment

Uh oh!

lenny-goodell left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

vli11 commented May 16, 2023 •

edited

Loading

bnevis-i Aug 14, 2023 •

edited

Loading