✨ Support multiple fuzz configs per language; add Python Hypothesis#4957
Open
Fieldnote-Echo wants to merge 5 commits intoossf:mainfrom
Open
✨ Support multiple fuzz configs per language; add Python Hypothesis#4957Fieldnote-Echo wants to merge 5 commits intoossf:mainfrom
Fieldnote-Echo wants to merge 5 commits intoossf:mainfrom
Conversation
Adds the string constant for Python property-based testing detection, following the naming convention of PropertyBasedHaskell, PropertyBasedElixir, etc. Signed-off-by: Fieldnote-Echo <nelson@projectnavi.ai>
Changes languageFuzzSpecs from map[LanguageName]languageFuzzConfig to map[LanguageName][]languageFuzzConfig, enabling detection of multiple fuzzing tools for a single language. Refactors checkFuzzFunc to accept a config directly, and updates Fuzzing() to iterate over all configs for each prominent language. Adds Python Hypothesis (property-based testing) detection alongside existing Atheris detection. Uses word-boundary anchor to prevent false positives from hypothesis-prefixed packages. Fixes ossf#4549 Signed-off-by: Fieldnote-Echo <nelson@projectnavi.ai>
Adapts Test_fuzzFileAndFuncMatchPattern and Test_checkFuzzFunc for the new []languageFuzzConfig slice type. Adds test cases for Python Hypothesis detection: - from hypothesis import (from import) - import hypothesis (direct import) - from hypothesis.strategies import (submodule import) - import atheris (Atheris still works) - import pytest (no fuzzing, negative case) - from hypothesis_auto import (prefix false positive, negative case) - import atheris + from hypothesis import (dual detection) All existing language test cases (Go, Haskell, Erlang, Elixir, Gleam, JavaScript, TypeScript, C#, F#) continue to pass. Signed-off-by: Fieldnote-Echo <nelson@projectnavi.ai>
Signed-off-by: Fieldnote-Echo <nelson@projectnavi.ai>
Fieldnote-Echo
requested review from
jeffmendoza and
justaugustus
and removed request for
a team
dosubot
bot
added
the
size:L
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Refactors the language fuzzer detection to support multiple fuzzer configs per language, then adds Python Hypothesis (property-based testing) detection alongside existing Atheris detection.
What is the current behavior?
languageFuzzSpecsmaps onelanguageFuzzConfigper language. Python projects using Hypothesis — the dominant Python property-based testing library — receive 0/10 on the Fuzzing check because only Atheris is detected.What is the new behavior (if this is a feature change)?
languageFuzzSpecsnow maps to[]languageFuzzConfig(slice), supporting multiple fuzzer configs per language(from|import)\s+hypothesis\bregex (word-boundary anchored to prevent false positives from hypothesis-prefixed packages likehypothesis_auto)checkFuzzFuncrefactored to accept a config directly;Fuzzing()iterates configs per languageThe multi-config refactor is the infrastructure contribution — it unblocks any future "add a second fuzzer for language X" PR without further refactoring.
Which issue(s) this PR fixes
Fixes #4549
Special notes for your reviewer
The
checkFuzzFuncsignature change from(c, lang)to(c, config)touches the call path for every language. All existing language test cases (Go, Haskell, Erlang, Elixir, Gleam, JavaScript, TypeScript, C#, F#) continue to pass after the refactor — 55 tests total, 0 regressions.New test cases cover:
from hypothesis import,import hypothesis,from hypothesis.strategies import(submodule), Atheris backwards compatibility, no-match negative case,hypothesis_autofalse-positive prevention (word boundary), and dual Atheris+Hypothesis detection in the same file.Does this PR introduce a user-facing change?