Add initial fuzzing test

Author: evilaliv3

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,4 @@
+FROM gcr.io/oss-fuzz-base/base-builder-python:v1
+COPY . $SRC/globaleaks-whistleblowing-software
+WORKDIR globaleaks-whistleblowing-software
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,31 @@
+#!/bin/bash -eu
+
+pip3 install -r backend/requirements.txt
+pip3 install ./backend
+
+# Build fuzzers into $OUT. These could be detected in other ways.
+for fuzzer in $(find $SRC -name 'fuzzer_*.py'); do
+  fuzzer_basename=$(basename -s .py $fuzzer)
+  fuzzer_package=${fuzzer_basename}.pkg
+
+  # To avoid issues with Python version conflicts, or changes in environment
+  # over time, we use pyinstaller to create a standalone
+  # package. Though not necessarily required for reproducing issues, this is
+  # required to keep fuzzers working properly.
+  pyinstaller --distpath $OUT --onefile --name $fuzzer_package $fuzzer
+
+  # Create execution wrapper. Atheris requires that certain libraries are
+  # preloaded, so this is also done here to ensure compatibility and simplify
+  # test case reproduction. Since this helper script is what will
+  # actually execute, it is also always required.
+  # NOTE: If you are fuzzing python-only code and do not have native C/C++
+  # extensions, then remove the LD_PRELOAD line below as preloading sanitizer
+  # library is not required and can lead to unexpected startup crashes.
+  echo "#!/bin/sh
+# LLVMFuzzerTestOneInput for fuzzer detection.
+this_dir=\$(dirname \"\$0\")
+LD_PRELOAD=\$this_dir/sanitizer_with_fuzzer.so \
+ASAN_OPTIONS=\$ASAN_OPTIONS:symbolize=1:external_symbolizer_path=\$this_dir/llvm-symbolizer:detect_leaks=0 \
+\$this_dir/$fuzzer_package \$@" > $OUT/$fuzzer_basename
+  chmod +x $OUT/$fuzzer_basename
+done

.clusterfuzzlite/project.yml

@@ -0,0 +1 @@
+language: python

.github/workflows/cflite.yml

@@ -0,0 +1,30 @@
+name: ClusterFuzzLite fuzzing
+
+on: [ push, pull_request ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  ClusterFuzzLite:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address]
+    steps:
+    - name: Build Fuzzers (${{ matrix.sanitizer }})
+      id: build
+      uses: google/clusterfuzzlite/actions/build_fuzzers@v1
+      with:
+        sanitizer: ${{ matrix.sanitizer }}
+        language: c
+        bad-build-check: false
+    - name: Run Fuzzers (${{ matrix.sanitizer }})
+      id: run
+      uses: google/clusterfuzzlite/actions/run_fuzzers@v1
+      with:
+        fuzz-seconds: 100
+        mode: 'code-change'
+        report-unreproducible-crashes: false
+        sanitizer: ${{ matrix.sanitizer }}

backend/globaleaks/tests/clearfuzzlite_fuzzer.py

@@ -0,0 +1,20 @@
+import atheris
+import sys
+from globaleaks.rest import api
+
+def fuzz_target(input_data: bytes):
+    # Convert the fuzzed byte input to a string
+    fuzz_input = input_data.decode(errors="ignore")
+
+    # Call the fuzz test handler function with the decoded string
+    fuzz_test_resolve_handler(fuzz_input)
+
+def main():
+    # Set up Atheris and pass the fuzz target function
+    atheris.Setup(sys.argv, fuzz_target)
+
+    # Start fuzzing
+    atheris.Fuzz()
+
+if __name__ == "__main__":
+    main()