This is an automated email from the ASF dual-hosted git repository. robertlazarski pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/axis-axis2-java-core.git
commit d79a1f99ab286ad167c1f0ba5279e76b88ea789e Author: Robert Lazarski <[email protected]> AuthorDate: Mon Oct 12 08:28:49 2026 -1000 Point the fuzz module at the current snapshot instead of 2.0.0 The module sits outside the reactor and was fuzzing the 2.0.0 jars, so none of the 2.0.x hardening was covered. It now builds at the root pom's version with Java 17 and current Gson, and the jar has a fixed name for the docs. Co-Authored-By: Claude Opus 5.5 <[email protected]> --- modules/fuzz/README.md | 23 +++++++++-------------- modules/fuzz/pom.xml | 18 ++++++++++-------- modules/fuzz/run-fuzzers.sh | 2 +- src/site/xdoc/docs/OSS-FUZZ.md | 10 +++++----- 4 files changed, 25 insertions(+), 28 deletions(-) diff --git a/modules/fuzz/README.md b/modules/fuzz/README.md index 4d4991bac1..da595f3cdc 100644 --- a/modules/fuzz/README.md +++ b/modules/fuzz/README.md @@ -32,7 +32,8 @@ docker pull cifuzz/jazzer ```bash cd /path/to/axis-axis2-java-core -# Build all modules first +# Install the current snapshot jars first: this module is outside the reactor +# and fuzzes the Axis2 version given by its own <version> mvn install -DskipTests # Build the fuzz module @@ -44,37 +45,31 @@ mvn package ```bash # XML Parser Fuzzer -./jazzer --cp=target/axis2-fuzz-2.0.1-SNAPSHOT.jar \ +./jazzer --cp=target/axis2-fuzz.jar \ --target_class=org.apache.axis2.fuzz.XmlParserFuzzer \ --instrumentation_includes=org.apache.axiom.** \ -max_total_time=300 # JSON Parser Fuzzer -./jazzer --cp=target/axis2-fuzz-2.0.1-SNAPSHOT.jar \ +./jazzer --cp=target/axis2-fuzz.jar \ --target_class=org.apache.axis2.fuzz.JsonParserFuzzer \ --instrumentation_includes=com.google.gson.** \ -max_total_time=300 # HTTP Header Fuzzer -./jazzer --cp=target/axis2-fuzz-2.0.1-SNAPSHOT.jar \ +./jazzer --cp=target/axis2-fuzz.jar \ --target_class=org.apache.axis2.fuzz.HttpHeaderFuzzer \ --instrumentation_includes=org.apache.axis2.** \ -max_total_time=300 # URL Parser Fuzzer -./jazzer --cp=target/axis2-fuzz-2.0.1-SNAPSHOT.jar \ +./jazzer --cp=target/axis2-fuzz.jar \ --target_class=org.apache.axis2.fuzz.UrlParserFuzzer \ --instrumentation_includes=org.apache.axis2.** \ -max_total_time=300 ``` -### Run with JUnit (Regression Testing) - -The fuzzers can also be run as JUnit tests for CI integration: - -```bash -mvn test -Djazzer.fuzz=true -``` +`run-fuzzers.sh` runs all four in sequence. ## Understanding Output @@ -87,13 +82,13 @@ INFO: Seed: 1234567890 ### Crash Found ``` == Java Exception: java.lang.OutOfMemoryError - at org.apache.axiom.om.impl.builder.StAXOMBuilder.<init> + at org.apache.axiom.om.OMXMLBuilderFactory.createOMBuilder Crash file: crash-abc123def456 ``` The crash file contains the input that triggered the bug. Reproduce with: ```bash -./jazzer --cp=target/axis2-fuzz-2.0.1-SNAPSHOT.jar \ +./jazzer --cp=target/axis2-fuzz.jar \ --target_class=org.apache.axis2.fuzz.XmlParserFuzzer \ crash-abc123def456 ``` diff --git a/modules/fuzz/pom.xml b/modules/fuzz/pom.xml index dfef0045a5..15d1a9ca6e 100644 --- a/modules/fuzz/pom.xml +++ b/modules/fuzz/pom.xml @@ -24,7 +24,7 @@ <groupId>org.apache.axis2</groupId> <artifactId>axis2-fuzz</artifactId> - <version>2.0.1-SNAPSHOT</version> + <version>2.0.2-SNAPSHOT</version> <packaging>jar</packaging> <name>Apache Axis2 - Fuzz Testing</name> <description> @@ -39,11 +39,12 @@ </description> <properties> - <maven.compiler.source>11</maven.compiler.source> - <maven.compiler.target>11</maven.compiler.target> + <maven.compiler.release>17</maven.compiler.release> <jazzer.version>0.22.1</jazzer.version> - <!-- Use 2.0.0 release (March 2025) for standalone testing; change to ${project.version} when integrated --> - <axis2.test.version>2.0.0</axis2.test.version> + <!-- This module is outside the reactor, so the release plugin does not bump it: + keep <version> in step with the root pom so the fuzzers exercise current code. + Run "mvn install" at the root first to provide the snapshot jars. --> + <axis2.test.version>${project.version}</axis2.test.version> </properties> <dependencies> @@ -60,7 +61,7 @@ <scope>test</scope> </dependency> - <!-- Axis2 modules to fuzz (using released version for standalone testing) --> + <!-- Axis2 modules to fuzz --> <dependency> <groupId>org.apache.axis2</groupId> <artifactId>axis2-kernel</artifactId> @@ -77,7 +78,7 @@ <version>${axis2.test.version}</version> </dependency> - <!-- AXIOM for XML parsing (matches Axis2 2.0.0) --> + <!-- AXIOM for XML parsing (matches the root pom) --> <dependency> <groupId>org.apache.ws.commons.axiom</groupId> <artifactId>axiom-api</artifactId> @@ -93,7 +94,7 @@ <dependency> <groupId>com.google.code.gson</groupId> <artifactId>gson</artifactId> - <version>2.10.1</version> + <version>2.14.0</version> </dependency> <!-- Testing --> @@ -106,6 +107,7 @@ </dependencies> <build> + <finalName>axis2-fuzz</finalName> <plugins> <plugin> <groupId>org.apache.maven.plugins</groupId> diff --git a/modules/fuzz/run-fuzzers.sh b/modules/fuzz/run-fuzzers.sh index d182c6327d..e37568b9b3 100755 --- a/modules/fuzz/run-fuzzers.sh +++ b/modules/fuzz/run-fuzzers.sh @@ -31,7 +31,7 @@ set -e DURATION=${1:-60} # Default 60 seconds per fuzzer SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -JAR_PATH="${SCRIPT_DIR}/target/axis2-fuzz-2.0.1-SNAPSHOT.jar" +JAR_PATH="${SCRIPT_DIR}/target/axis2-fuzz.jar" # Find Jazzer JAZZER="${JAZZER_PATH:-jazzer}" diff --git a/src/site/xdoc/docs/OSS-FUZZ.md b/src/site/xdoc/docs/OSS-FUZZ.md index afb2b0a0c3..020bae5806 100644 --- a/src/site/xdoc/docs/OSS-FUZZ.md +++ b/src/site/xdoc/docs/OSS-FUZZ.md @@ -135,9 +135,9 @@ public static void fuzzerTestOneInput(FuzzedDataProvider data) { - **Jazzer**: Java fuzzing framework compatible with libFuzzer - https://github.com/CodeIntelligenceTesting/jazzer - Version: 0.22.1 -- **Axis2**: 2.0.0 (March 2025 release) +- **Axis2**: the current snapshot (the fuzz module's own `<version>`, kept in step with the root pom) - **AXIOM**: 2.0.0 -- **Gson**: 2.10.1 +- **Gson**: 2.14.0 ### Security Sanitizers @@ -234,7 +234,7 @@ Apache Axis2 qualifies on all criteria given its use in enterprise SOAP/REST ser ### Prerequisites -1. Java 11+ +1. Java 17+ 2. Maven 3.6+ 3. Jazzer (download from GitHub releases) @@ -249,7 +249,7 @@ mvn package -DskipTests ```bash JAVA_OPTS="" jazzer \ - --cp=target/axis2-fuzz-2.0.1-SNAPSHOT.jar \ + --cp=target/axis2-fuzz.jar \ --target_class=org.apache.axis2.fuzz.XmlParserFuzzer \ -max_total_time=3600 ``` @@ -287,4 +287,4 @@ Following Apache's coordinated disclosure policy. --- *Document created: February 5, 2026* -*Fuzz module tested against Axis2/Java 2.0.0* +*The February 2026 results above were run against Axis2/Java 2.0.0*
