code: /*
   * Copyright (c) 2017-2018 The Regents of the University of California
   * Copyright (c) 2020-2021 Rohan Padhye
   *
   * All rights reserved.
   *
   * Redistribution and use in source and binary forms, with or without
   * modification, are permitted provided that the following conditions are
   * met:
   *
   * 1. Redistributions of source code must retain the above copyright
   * notice, this list of conditions and the following disclaimer.
   *
   * 2. Redistributions in binary form must reproduce the above copyright
   * notice, this list of conditions and the following disclaimer in the
   * documentation and/or other materials provided with the distribution.
   *
   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
   * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
   * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
   * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
   * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
   * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
   * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
   * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   */
  package edu.berkeley.cs.jqf.plugin;
  
  import java.io.File;
  import java.io.FileNotFoundException;
  import java.io.IOException;
  import java.io.PrintStream;
  import java.net.MalformedURLException;
  import java.net.URLClassLoader;
  import java.time.Duration;
  import java.time.format.DateTimeParseException;
  import java.util.List;
  import java.util.Random;
  
  import edu.berkeley.cs.jqf.fuzz.ei.ExecutionIndexingGuidance;
  import edu.berkeley.cs.jqf.fuzz.ei.ZestGuidance;
  import edu.berkeley.cs.jqf.fuzz.guidance.GuidanceException;
  import edu.berkeley.cs.jqf.fuzz.junit.GuidedFuzzing;
  import edu.berkeley.cs.jqf.instrument.InstrumentingClassLoader;
  import org.apache.maven.artifact.DependencyResolutionRequiredException;
  import org.apache.maven.plugin.AbstractMojo;
  import org.apache.maven.plugin.MojoExecutionException;
  import org.apache.maven.plugin.MojoFailureException;
  import org.apache.maven.plugin.logging.Log;
  import org.apache.maven.plugins.annotations.LifecyclePhase;
  import org.apache.maven.plugins.annotations.Mojo;
  import org.apache.maven.plugins.annotations.Parameter;
  import org.apache.maven.plugins.annotations.ResolutionScope;
  import org.apache.maven.project.MavenProject;
  import org.junit.runner.Result;
  
  import static edu.berkeley.cs.jqf.instrument.InstrumentingClassLoader.stringsToUrls;
  
  /**
   * Maven plugin for feedback-directed fuzzing using JQF.
   *
   * <p>Performs code-coverage-guided generator-based fuzz testing
   * using a provided entry point.</p>
   *
   * @author Rohan Padhye
   */
  @Mojo(name="fuzz",
          requiresDependencyResolution= ResolutionScope.TEST,
          defaultPhase=LifecyclePhase.VERIFY)
  public class FuzzGoal extends AbstractMojo {
  
      @Parameter(defaultValue="${project}", required=true, readonly=true)
      MavenProject project;
  
      @Parameter(property="target", defaultValue="${project.build.directory}", readonly=true)
      private File target;
  
      /**
       * The fully-qualified name of the test class containing methods
       * to fuzz.
       *
       * <p>This class will be loaded using the Maven project's test
       * classpath. It must be annotated with {@code @RunWith(JQF.class)}</p>
       */
      @Parameter(property="class", required=true)
      private String testClassName;
  
      /**
       * The name of the method to fuzz.
       *
       * <p>This method must be annotated with {@code @Fuzz}, and take
       * one or more arguments (with optional junit-quickcheck
       * annotations) whose values will be fuzzed by JQF.</p>
       *
       * <p>If more than one method of this name exists in the
       * test class or if the method is not declared
       * {@code public void}, then the fuzzer will not launch.</p>
       */
      @Parameter(property="method", required=true)
      private String testMethod;
  
      /**
       * Comma-separated list of FQN prefixes to exclude from
       * coverage instrumentation.
       *
       * <p>Example: <code>org/mozilla/javascript/gen,org/slf4j/logger</code>,
       * will exclude classes auto-generated by Mozilla Rhino's CodeGen and
       * logging classes.</p>
       */
      @Parameter(property="excludes")
      private String excludes;
  
      /**
       * Comma-separated list of FQN prefixes to forcibly include,
       * even if they match an exclude.
       *
       * <p>Typically, these will be a longer prefix than a prefix
       * in the excludes clauses.</p>
       */
      @Parameter(property="includes")
      private String includes;
  
      /**
       * The duration of time for which to run fuzzing.
       *
       * <p>
       * If neither this property nor {@code trials} are provided, the fuzzing
       * session is run for an unlimited time until the process is terminated by the
       * user (e.g. via kill or CTRL+C).
       * </p>
       *
       * <p>
       * Valid time durations are non-empty strings in the format [Nh][Nm][Ns], such
       * as "60s" or "2h30m".
       * </p>
       */
      @Parameter(property="time")
      private String time;
  
      /**
       * The number of trials for which to run fuzzing.
       *
       * <p>
       * If neither this property nor {@code time} are provided, the fuzzing
       * session is run for an unlimited time until the process is terminated by the
       * user (e.g. via kill or CTRL+C).
       * </p>
       */ 
      @Parameter(property="trials")
      private Long trials;
  
      /**
       * A number to seed the source of randomness in the fuzzing algorithm.
       *
       * <p>
       * Setting this to any value will make the result of running the same fuzzer
       * with on the same input the same. This is useful for testing the fuzzer, but
       * shouldn't be used on code attempting to find real bugs. By default, the
       * seed is chosen randomly based on system state.
       * </p>
       */
      @Parameter(property="randomSeed")
      private Long randomSeed;
      
      /**
       * Whether to generate inputs blindly without taking into
       * account coverage feedback. Blind input generation is equivalent
       * to running QuickCheck.
       *
       * <p>If this property is set to <code>true</code>, then the fuzzing
       * algorithm does not maintain a queue. Every input is randomly
       * generated from scratch. The program under test is still instrumented
       * in order to provide coverage statistics. This mode is mainly useful
       * for comparing coverage-guided fuzzing with plain-old QuickCheck. </p>
       */
      @Parameter(property="blind")
      private boolean blind;
  
      /**
       * The fuzzing engine.
       *
       * <p>One of 'zest' and 'zeal'. Default is 'zest'.</p>
       */
      @Parameter(property="engine", defaultValue="zest")
      private String engine;
  
      /**
       * Whether to disable code-coverage instrumentation.
       *
       * <p>Disabling instrumentation speeds up test case execution, but
       * provides no feedback about code coverage in the status screen and
       * to the fuzzing guidance.</p>
       *
       * <p>This setting only makes sense when used with {@code -Dblind}.</p>
       *
       */
      @Parameter(property="noCov")
      private boolean disableCoverage;
  
      /**
       * The name of the input directory containing seed files.
       *
       * <p>If not provided, then fuzzing starts with randomly generated
       * initial inputs.</p>
       */
      @Parameter(property="in")
      private String inputDirectory;
  
      /**
       * The name of the output directory where fuzzing results will
       * be stored.
       *
       * <p>The directory will be created inside the standard Maven
       * project build directory.</p>
       *
       * <p>If not provided, defaults to
       * <em>jqf-fuzz/${testClassName}/${$testMethod}</em>.</p>
       */
      @Parameter(property="out")
      private String outputDirectory;
  
      /**
       * Whether to save ALL inputs generated during fuzzing, even
       * the ones that do not have any unique code coverage.
       *
       * <p>This setting leads to a very large number of files being
       * created in the output directory, and could potentially
       * reduce the overall performance of fuzzing.</p>
       */
      @Parameter(property="saveAll")
      private boolean saveAll;
  
      /**
       * Weather to use libFuzzer like output instead of AFL like stats
       * screen
       *
       * <p>If this property is set to <code>true</>, then output will look like libFuzzer output
       * https://llvm.org/docs/LibFuzzer.html#output
       * .</p>
       */
      @Parameter(property="libFuzzerCompatOutput")
      private String libFuzzerCompatOutput;
  
      /**
       * Whether to avoid printing fuzzing statistics progress in the console.
       *
       * <p>If not provided, defaults to {@code false}.</p>
       */
      @Parameter(property="quiet")
      private boolean quiet;
    
      /**
       * Whether to stop fuzzing once a crash is found.
       *
       * <p>If this property is set to <code>true</code>, then the fuzzing
       * will exit on first crash. Useful for continuous fuzzing when you dont wont to consume resource
       * once a crash is found. Also fuzzing will be more effective once the crash is fixed.</p>
       */
      @Parameter(property="exitOnCrash")
      private String exitOnCrash;
  
      /**
       * The timeout for each individual trial, in milliseconds.
       *
       * <p>If not provided, defaults to 0 (unlimited).</p>
       */
      @Parameter(property="runTimeout")
      private int runTimeout;
  
      /**
       * Whether to bound size of inputs being mutated by the fuzzer.
       *
       * <p>If this property is set to true, then the fuzzing engine
       * will treat inputs as fixed-size arrays of bytes
       * rather than as an infinite stream of pseudo-random choices. This option
       * is appropriate when fuzzing test methods that take a single
       * argument of type {@link java.io.InputStream} and that also provide a
       * set of seed inputs via the `in' property.</p>
       *
       * <p>If not provided, defaults to {@code false}.</p>
       */
      @Parameter(property="fixedSize")
      private boolean fixedSizeInputs;
  
  
      @Override
      public void execute() throws MojoExecutionException, MojoFailureException {
          ClassLoader loader;
          ZestGuidance guidance;
          Log log = getLog();
          PrintStream out = log.isDebugEnabled() ? System.out : null;
          Result result;
  
          // Configure classes to instrument
          if (excludes != null) {
              System.setProperty("janala.excludes", excludes);
          }
          if (includes != null) {
              System.setProperty("janala.includes", includes);
          }
  
          // Configure Zest Guidance
          if (saveAll) {
              System.setProperty("jqf.ei.SAVE_ALL_INPUTS", "true");
          }
          if (libFuzzerCompatOutput != null) {
              System.setProperty("jqf.ei.LIBFUZZER_COMPAT_OUTPUT", libFuzzerCompatOutput);
          }
          if (quiet) {
              System.setProperty("jqf.ei.QUIET_MODE", "true");
          }
          if (exitOnCrash != null) {
              System.setProperty("jqf.ei.EXIT_ON_CRASH", exitOnCrash);
          }
          if (runTimeout > 0) {
              System.setProperty("jqf.ei.TIMEOUT", String.valueOf(runTimeout));
          }
          if (fixedSizeInputs) {
              System.setProperty("jqf.ei.GENERATE_EOF_WHEN_OUT", String.valueOf(true));
          }
  
          Duration duration = null;
          if (time != null && !time.isEmpty()) {
              try {
                  duration = Duration.parse("PT"+time);
              } catch (DateTimeParseException e) {
                  throw new MojoExecutionException("Invalid time duration: " + time);
              }
          }
  
          if (outputDirectory == null || outputDirectory.isEmpty()) {
              outputDirectory = "fuzz-results" + File.separator + testClassName + File.separator + testMethod;
          }
  
          try {
              List<String> classpathElements = project.getTestClasspathElements();
  
              if (disableCoverage) {
                  loader = new URLClassLoader(
                          stringsToUrls(classpathElements.toArray(new String[0])),
                          getClass().getClassLoader());
  
              } else {
                  loader = new InstrumentingClassLoader(
                          classpathElements.toArray(new String[0]),
                          getClass().getClassLoader());
              }
          } catch (DependencyResolutionRequiredException|MalformedURLException e) {
              throw new MojoExecutionException("Could not get project classpath", e);
          }
  
          File resultsDir = new File(target, outputDirectory);
          String targetName = testClassName + "#" + testMethod;
          File seedsDir = inputDirectory == null ? null : new File(inputDirectory);
          Random rnd = randomSeed != null ? new Random(randomSeed) : new Random();
          try {
              switch (engine) {
                  case "zest":
                      guidance = new ZestGuidance(targetName, duration, trials, resultsDir, seedsDir, rnd);
                      break;
                  case "zeal":
                      System.setProperty("jqf.tracing.TRACE_GENERATORS", "true");
                      System.setProperty("jqf.tracing.MATCH_CALLEE_NAMES", "true");
                      guidance = new ExecutionIndexingGuidance(targetName, duration, trials, resultsDir, seedsDir, rnd);
                      break;
                  default:
                      throw new MojoExecutionException("Unknown fuzzing engine: " + engine);
              }
              guidance.setBlind(blind);
          } catch (FileNotFoundException e) {
              throw new MojoExecutionException("File not found", e);
          } catch (IOException e) {
              throw new MojoExecutionException("I/O error", e);
          }
  
          try {
              result = GuidedFuzzing.run(testClassName, testMethod, loader, guidance, out);
          } catch (ClassNotFoundException e) {
              throw new MojoExecutionException("Could not load test class", e);
          } catch (IllegalArgumentException e) {
              throw new MojoExecutionException("Bad request", e);
          } catch (RuntimeException e) {
              throw new MojoExecutionException("Internal error", e);
          }
  
          if (!result.wasSuccessful()) {
              Throwable e = result.getFailures().get(0).getException();
              if (result.getFailureCount() == 1) {
                  if (e instanceof GuidanceException) {
                      throw new MojoExecutionException("Internal error", e);
                  }
              }
              throw new MojoFailureException(String.format("Fuzzing resulted in the test failing on " +
                      "%d input(s). Possible bugs found. " +
                      "Use mvn jqf:repro to reproduce failing test cases from %s/failures. ",
                      result.getFailureCount(), resultsDir) +
                      "Sample exception included with this message.", e);
          }
      }
  }
  