-
Notifications
You must be signed in to change notification settings - Fork 158
path traversal followup #943
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
c675743
to
235057d
Compare
c7e4b96
to
be1a252
Compare
18fbda6
to
fa61ef4
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds an interface to control file path traversal sanitization, allowing users to set both a fuzzing target and a predicate to allow/deny file path access through the BugDetectors API.
Key changes:
- Adds
setFilePathTraversalTarget
andsetFilePathTraversalAllowPath
methods to the BugDetectors API - Refactors the file path traversal sanitizer to use atomic references instead of system properties
- Introduces comprehensive test coverage for the new API
Reviewed Changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.
Show a summary per file
File | Description |
---|---|
BugDetectors.java | Adds new file path traversal configuration methods and refactors existing network connection logic |
FilePathTraversal.java | Complete rewrite replacing system properties with atomic references and improving path handling |
FilePathTraversalPass.java | New test file for valid path traversal scenarios |
FilePathTraversalCrash.java | New test file for expected crashes and security findings |
FilePathTraversalTest.java | Unit tests for path conversion utilities |
AbsoluteFilePathTraversal.java | Updated to use new BugDetectors API |
FilePathTraversal.java (test) | Simplified test to remove unused parameters |
BUILD.bazel files | Updated test configurations and visibility rules |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/FilePathTraversal.java
Show resolved
Hide resolved
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/FilePathTraversal.java
Show resolved
Hide resolved
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/FilePathTraversal.java
Outdated
Show resolved
Hide resolved
fa61ef4
to
5b88bbf
Compare
This adds an interface to control the file traversal sanitizer:
setFilePathTraversalTarget(Supplier<Path>)
--- sets the fuzzing targetsetFilePathTraversalAllowPath(Predicate<Path>)
--- a user function that allows/denies file path accessBoth can be used to confine the sanitizer configuration to a specific part of the fuzz test. As for example here: