{"id":102283,"date":"2021-11-14T15:36:53","date_gmt":"2021-11-14T13:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-predstavil-sistemu-fuzzing-testirovaniya-clusterfuzzlite"},"modified":"2021-11-14T15:36:53","modified_gmt":"2021-11-14T13:36:53","slug":"google-predstavil-sistemu-fuzzing-testirovaniya-clusterfuzzlite","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/google-predstavil-sistemu-fuzzing-testirovaniya-clusterfuzzlite","title":{"rendered":"Google predstavil syst\u00e9m fuzzing testovania ClusterFuzzLite","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Spolo\u010dnos\u0165 Google predstavila projekt ClusterFuzzLite, ktor\u00fd umo\u017e\u0148uje organizova\u0165 fuzzingov\u00e9 testovanie k\u00f3du na v\u010dasn\u00e9 odha\u013eovanie potenci\u00e1lnych zranite\u013enost\u00ed po\u010das prev\u00e1dzky syst\u00e9mov nepretr\u017eitej integr\u00e1cie. V s\u00fa\u010dasnosti m\u00f4\u017ee by\u0165 ClusterFuzz vyu\u017e\u00edvan\u00fd na automatiz\u00e1ciu fuzzingov\u00e9ho testovania pull po\u017eiadaviek v GitHub Actions, v Google Cloud Build a v Prow, pri\u010dom sa o\u010dak\u00e1va, \u017ee v bud\u00facnosti pribudne podpora aj pre in\u00e9 CI syst\u00e9my. Projekt je zalo\u017een\u00fd na platforme ClusterFuzz, vytvorenej na koordin\u00e1ciu pr\u00e1ce klastrov fuzzingov\u00e9ho testovania, a je \u0161\u00edren\u00fd pod licenciou Apache 2.0. <\/p>\n
Je pozoruhodn\u00e9, \u017ee po zaveden\u00ed slu\u017eby OSS-Fuzz spolo\u010dnos\u0165ou Google v roku 2016 bolo do programu nepretr\u017eit\u00e9ho fuzzingov\u00e9ho testovania zapojen\u00fdch viac ako 500 d\u00f4le\u017eit\u00fdch otvoren\u00fdch projektov. Na z\u00e1klade vykonan\u00fdch kontrol bolo odstr\u00e1nen\u00fdch viac ako 6500 potvrden\u00fdch zranite\u013enost\u00ed a opraven\u00fdch viac ako 21 tis\u00edc ch\u00fdb. ClusterFuzzLite pokra\u010duje vo v\u00fdvoji mechanizmov fuzzingov\u00e9ho testovania s mo\u017enos\u0165ou v\u010dasn\u00e9ho odha\u013eovania probl\u00e9mov v \u0161t\u00e1diu recenzovania navrhovan\u00fdch zmien. ClusterFuzzLite u\u017e bol implementovan\u00fd do procesov recenzovania zmien v projektoch systemd a curl a umo\u017enil odha\u013eova\u0165 chyby, ktor\u00e9 boli prehliadnut\u00e9 statick\u00fdmi analyz\u00e1tormi a lintermi pou\u017e\u00edvan\u00fdmi v po\u010diato\u010dnej f\u00e1ze kontroly nov\u00e9ho k\u00f3du. <\/p>\n
ClusterFuzzLite podporuje testovanie projektov v jazykoch C, C++, Java (a in\u00fdch jazykoch na b\u00e1ze JVM), Go, Python, Rust a Swift. Fuzzingov\u00e9 testovanie sa vykon\u00e1va pomocou enginu LibFuzzer. Na odha\u013eovanie ch\u00fdb v spr\u00e1ve pam\u00e4te a anom\u00e1li\u00ed m\u00f4\u017eu by\u0165 tie\u017e vyu\u017e\u00edvan\u00e9 n\u00e1stroje AddressSanitizer, MemorySanitizer a UBSan (UndefinedBehaviorSanitizer). <\/p>\n
Hlavn\u00e9 mo\u017enosti ClusterFuzzLite: r\u00fdchla kontrola navrhovan\u00fdch zmien na odha\u013eovanie ch\u00fdb pred akceptovan\u00edm k\u00f3du; nahr\u00e1vanie spr\u00e1v o podmienkach vzniku p\u00e1dov; mo\u017enos\u0165 prechodu k podrobnej\u0161iemu fuzzingov\u00e9mu testovaniu na odha\u013eovanie hlb\u0161\u00edch ch\u00fdb, ktor\u00e9 sa neobjavili po kontrole zmien k\u00f3du; generovanie reportov o pokryt\u00ed na pos\u00fadenie pokrytia k\u00f3du pri testovan\u00ed; modul\u00e1rna architekt\u00fara umo\u017e\u0148uj\u00faca v\u00fdber potrebnej funkcionality. <\/p>\n
Pripom\u00edname, \u017ee pri fuzzingovom testovan\u00ed sa generuje tok v\u0161etk\u00fdch mo\u017en\u00fdch n\u00e1hodn\u00fdch kombin\u00e1ci\u00ed vstupn\u00fdch \u00fadajov, pribli\u017en\u00fdch k re\u00e1lnym d\u00e1tam (napr\u00edklad html str\u00e1nky s n\u00e1hodn\u00fdmi parametrami zna\u010diek, arch\u00edvy alebo obr\u00e1zky s anom\u00e1lnymi z\u00e1hlaviami at\u010f.), a zaznamen\u00e1vaj\u00fa sa mo\u017en\u00e9 zlyhania po\u010das ich spracovania. Ak nejak\u00e1 sekvencia vedie k p\u00e1du alebo nezodpoved\u00e1 o\u010dak\u00e1vanej reakcii, tak\u00e9to spr\u00e1vanie pravdepodobne nazna\u010duje chybu alebo zranite\u013enos\u0165. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"