feat: update fuzzing check for memory-safe languages#4950
Open
garvit-bhattt wants to merge 2 commits intoossf:mainfrom
Open
feat: update fuzzing check for memory-safe languages#4950garvit-bhattt wants to merge 2 commits intoossf:mainfrom
garvit-bhattt wants to merge 2 commits intoossf:mainfrom
Conversation
This update ensures that projects exclusively using memory-safe languages are not penalized for lacking fuzzers. Changes include: - Added HasMemoryUnsafeLanguage utility in clients/languages.go to centralize language safety policy. - Updated Fuzzing check to return an Inconclusive (N/A) result for memory-safe-only projects without fuzzers. - Added comprehensive unit tests for language safety and evaluation logic. - Updated documentation in docs/checks/internal/checks.yaml. Note: Full go test ./... reveals pre-existing failures in checks/fileparser and checks/raw which are unrelated to these changes.
garvit-bhattt
requested review from
AdamKorcz and
justaugustus
and removed request for
a team
dosubot
bot
added
the
size:L
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Feature / Improvement
PR title follows the guidelines:
feat: update fuzzing check for memory-safe languagesWhat is the current behavior?
Projects that exclusively use memory-safe languages (e.g., Go, Rust, Java, Python) and do not have detected fuzzers currently receive a failing score of 0 for the Fuzzing check.
What is the new behavior?
Projects exclusively using memory-safe languages without detected fuzzers will now receive an Inconclusive (N/A) result.
This change aligns with OpenSSF best practices, as fuzzing is primarily critical for memory-unsafe languages (C, C++, Objective-C, Objective-C++).
Key Implementation Details
HasMemoryUnsafeLanguageutility inclients/languages.goto maintain a consistent memory safety policy.Tests
Which issue(s) this PR fixes
Fixes #4649 — Maybe too strict to give a 0 for missing fuzzing tooling for memory safe language.
Special Notes for Reviewers
clients/languages.go, making it reusable for other checks (e.g., binary artifact analysis) in the future.go test ./...suite (specifically inchecks/fileparserandchecks/raw) are pre-existing and unrelated to these changes.