From 8622aaa7199c2ca854cb84d60ae6eda85ff8055e Mon Sep 17 00:00:00 2001
From: serge-sans-paille <sergesanspaille@free.fr>
Date: Wed, 5 Feb 2025 22:01:44 +0100
Subject: [PATCH] attrs: basic fuzzing setup

Fuzz creation of classes with various Unicode identifiers

attrs has a critically score of 0.70292 according to

        https://www.googleapis.com/download/storage/v1/b/ossf-criticality-score/o/2024.12.25%2F224906%2Fall.csv?generation=1736309219475649&alt=media

It has 5.4k stars on github and more than 11M of downloads per day based
on https://pypistats.org/packages/attrs
---
 projects/attrs/Dockerfile    | 21 ++++++++++++
 projects/attrs/build.sh      | 21 ++++++++++++
 projects/attrs/fuzz_attrs.py | 64 ++++++++++++++++++++++++++++++++++++
 projects/attrs/project.yaml  |  9 +++++
 4 files changed, 115 insertions(+)
 create mode 100644 projects/attrs/Dockerfile
 create mode 100644 projects/attrs/build.sh
 create mode 100644 projects/attrs/fuzz_attrs.py
 create mode 100644 projects/attrs/project.yaml

diff --git a/projects/attrs/Dockerfile b/projects/attrs/Dockerfile
new file mode 100644
index 000000000000..bc16ab075098
--- /dev/null
+++ b/projects/attrs/Dockerfile
@@ -0,0 +1,21 @@
+#!/usr/bin/python3
+
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+##########################################################################
+FROM gcr.io/oss-fuzz-base/base-builder-python
+RUN git clone https://github.com/python-attrs/attrs.git
+COPY *.sh *py $SRC/
+WORKDIR $SRC/attrs
diff --git a/projects/attrs/build.sh b/projects/attrs/build.sh
new file mode 100644
index 000000000000..5be09bc37268
--- /dev/null
+++ b/projects/attrs/build.sh
@@ -0,0 +1,21 @@
+#!/bin/bash -eu
+
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+##########################################################################
+pip3 install .
+for fuzzer in $(find $SRC -name 'fuzz_*.py'); do
+  compile_python_fuzzer $fuzzer --hidden-import=html.parser
+done
diff --git a/projects/attrs/fuzz_attrs.py b/projects/attrs/fuzz_attrs.py
new file mode 100644
index 000000000000..ed3e8acdcc92
--- /dev/null
+++ b/projects/attrs/fuzz_attrs.py
@@ -0,0 +1,64 @@
+#!/usr/bin/python3
+
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+##########################################################################
+import sys
+import atheris
+
+import attrs
+import ast
+from string import ascii_letters
+
+def consumeIdentifier(fdp):
+    return fdp.ConsumeUnicode(8)
+
+@atheris.instrument_func
+def TestOneInput(data):
+  fdp = atheris.FuzzedDataProvider(data)
+  clsname = consumeIdentifier(fdp)
+  attrcount = fdp.ConsumeIntInRange(0, 12)
+  attrnames = [consumeIdentifier(fdp)
+               for _ in range(attrcount)]
+  attrvalues = [None] * attrcount
+
+  # Create class from attrs.make_class
+  try:
+    C0 = attrs.make_class(clsname, attrnames)
+  except Exception as e:
+      if any(not name.isidentifier() for name in [clsname] + attrnames):
+          return
+      raise
+  c0 = C0(**{k: v for k, v in zip(attrnames, attrvalues)})
+  d0 = attrs.asdict(c0)
+  c0_p = C0(**d0)
+  assert c0 == c0_p
+
+  # Create class from attrs.define
+  C1 = attrs.define(type(clsname, (), {f: attrs.field() for f in attrnames}))
+  c1 = C1(**{k: v for k, v in zip(attrnames, attrvalues)})
+  d1 = attrs.asdict(c1)
+  c1_p = C1(**d1)
+  assert c1 == c1_p
+
+
+def main():
+  atheris.instrument_all()
+  atheris.Setup(sys.argv, TestOneInput)
+  atheris.Fuzz()
+
+
+if __name__ == "__main__":
+  main()
diff --git a/projects/attrs/project.yaml b/projects/attrs/project.yaml
new file mode 100644
index 000000000000..12e77819df33
--- /dev/null
+++ b/projects/attrs/project.yaml
@@ -0,0 +1,9 @@
+fuzzing_engines:
+- libfuzzer
+homepage: https://www.attrs.org
+language: python
+main_repo: https://github.com/python-attrs/attrs.git
+sanitizers:
+- address
+vendor_ccs:
+- sergesanspaille@free.fr