Fuzz every parser of untrusted input

How to do it

Use a coverage-guided fuzzer on file, header and message parsers, such as Go's built-in go test -fuzz, cargo-fuzz for Rust or Jazzer for Java. Use property-based tests, such as Hypothesis or fast-check, to state rules that must hold for any input. Run the fuzzer for a fixed time in CI, such as five minutes with -fuzztime=5m, and keep the inputs that found bugs. Static analysis and dependency scans belong to Scan every change for known mistakes, and attacks on the running app to the rest of that playbook. Parsers that rebuild objects need extra care, as Never rebuild objects from untrusted data says.

Examples

JavaScript example

// fast-check: decoding what we encoded always gives the original back
import fc from 'fast-check';
fc.assert(fc.property(fc.string(), text => decode(encode(text)) === text));

Python example

# Hypothesis
from hypothesis import given, strategies as st

@given(st.text())
def test_decoding_what_we_encoded_gives_it_back(text):
    assert decode(encode(text)) == text

Go example

// Go native fuzzing
func FuzzRoundTrip(f *testing.F) {
    f.Add("hello")
    f.Fuzz(func(t *testing.T, text string) {
        if decode(encode(text)) != text {
            t.Fatalf("round trip changed %q", text)
        }
    })
}

How to check

The fuzz job runs in CI for its set time and finds no crash. Every past crash input is stored and passes as a unit test.

Sources

• NIST SP 800-218: Secure Software Development Framework

Related rules

• SEC-8 Scan every change for known mistakes in Adversarial testing
• APS-8 Never rebuild objects from untrusted data in Application security
• STK-112 Write new code in a memory-safe language in Software choices
• APS-7 Turn off external entities in XML in Application security