Skip to content

Commit

Permalink
Enhance OSS-Fuzz vuln import script
Browse files Browse the repository at this point in the history
Refactor the script to import failed OSS-Fuzz vulns for manual fixup. Improvements include code organization, error handling, and YAML formatting.
  • Loading branch information
imSanko authored Dec 24, 2024
1 parent 05e242c commit 24fef7d
Showing 1 changed file with 28 additions and 32 deletions.
60 changes: 28 additions & 32 deletions scripts/import.py
Original file line number Diff line number Diff line change
@@ -1,54 +1,50 @@
# Script to import failed OSS-Fuzz vulns for manual fixup.
Python
import json
import os
import sys
import urllib.error
import urllib.request

import yaml

_BUCKET = 'oss-fuzz-osv-vulns'
_VULN_URL = f'https://{_BUCKET}.storage.googleapis.com/issue'
_ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

class YamlDumper(yaml.SafeDumper):
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
self.add_representer(str, self.yaml_str_representer)

def _yaml_str_representer(dumper, data):
"""YAML str representer override."""
if '\n' in data:
return dumper.represent_scalar('tag:yaml.org,2002:str', data, style='|')
return dumper.represent_scalar('tag:yaml.org,2002:str', data)


class _YamlDumper(yaml.SafeDumper):
"""Overridden dumper to to use | for multiline strings."""


_YamlDumper.add_representer(str, _yaml_str_representer)
def yaml_str_representer(self, dumper, data):
if '\n' in data:
return dumper.represent_scalar('tag:yaml.org,2002:str', data, style='|')
return dumper.represent_scalar('tag:yaml.org,2002:str', data)


def main():
if len(sys.argv) < 2:
print(f'Usage: {sys.argv[0]} <oss-fuzz issue_id>')
if len(sys.argv) != 2:
print(f'Usage: {sys.argv[0]} <oss-fuzz issue_id>')
sys.exit(1)

issue_id = sys.argv[1]
try:
data = urllib.request.urlopen(f'{_VULN_URL}/{issue_id}.json').read()
except urllib.error.HTTPError:
print('Vuln does not exist. OSS-Fuzz bugs need to '
'be marked as security to be included.', file=sys.stderr)
return
issue_id = sys.argv[1]
try:
with urllib.request.urlopen(f'{_VULN_URL}/{issue_id}.json') as response:
data = json.loads(response.read())
except urllib.error.HTTPError:
print('Vuln does not exist. OSS-Fuzz bugs need to '
'be marked as security to be included.', file=sys.stderr)
sys.exit(1)

data = json.loads(data)
project_name = data['package']['name']
project_dir = os.path.join(_ROOT_DIR, 'vulns', project_name)
os.makedirs(project_dir, exist_ok=True)
vuln_path = os.path.join(project_dir, issue_id + '.yaml')
project_name = data['package']['name']
project_dir = os.path.join(_ROOT_DIR, 'vulns', project_name)
os.makedirs(project_dir, exist_ok=True)
vuln_path = os.path.join(project_dir, issue_id + '.yaml')

with open(vuln_path, 'w') as handle:
yaml.dump(data, handle, sort_keys=False, Dumper=_YamlDumper)
with open(vuln_path, 'w') as handle:
yaml.dump(data, handle, sort_keys=False, Dumper=YamlDumper)

print('Vuln written to', os.path.relpath(vuln_path, os.getcwd()))
print('Vuln written to', os.path.relpath(vuln_path, os.getcwd()))


if __name__ == '__main__':
main()
main()

0 comments on commit 24fef7d

Please sign in to comment.