1.7 KiB
Fuzz-testing of various parsers and mocked examples
A secure web server must be capable of receiving mass amount of malicious input without misbehaving or performing illegal actions, such as stepping outside of a memory block or otherwise spilling the beans.
Continuous fuzzing under various sanitizers is done as part of the Google OSS-Fuzz project:
- UndefinedBehaviorSanitizer
- AddressSanitizer
- MemorySanitizer
Currently the following parts are individually fuzzed:
- WebSocket handshake generator
- WebSocket message parser
- WebSocket extensions parser & negotiator
- WebSocket permessage-deflate compression/inflation helper
- Http parser
- Http method/url router
- Pub/sub "topic tree"
While entire (mocked) examples are fuzzed:
- HelloWorld
- EchoServer
- BroadcastingEchoServer
Fuzzing at the syscall level is done using libEpollFuzzer for:
- EchoServer
No defects or issues are left unfixed, covered up or otherwise neglected. In fact we cannot cover up security issues as OSS-Fuzz automatically and publicly reports security issues as they happen.
Here is the list of public issues (issues are kept private for 90 days or until fixed): https://bugs.chromium.org/p/oss-fuzz/issues/list?q=label%3AProj-uwebsockets&can=1
Currently we are at 99.5% function coverage, ~90% line coverage and OSS-Fuzz is reporting zero issues in our codebase whatsoever. The goal is to approach 100% total coverage.
Security rewards
Google have sent us thousands of USD for the integration with OSS-Fuzz - we continue working on bettering the testing with every new release.