Weblate/weblate
0
0
Fork 0
mirror of https://github.com/WeblateOrg/weblate.git synced 2026-07-27 22:46:38 +08:00
Code Issues Projects Releases Packages Activity Actions 5
weblate/fuzzing
History
Exact
Michal Čihař 5b42ece51d chore(ci): extend fyzzing setup 
- avoid copying whole git history to the container
- add xss testing for markdown renderer
2026-04-29 11:10:13 +02:00
..
corpus chore(ci): extend fyzzing setup 2026-04-29 11:10:13 +02:00
tests chore(ci): extend fyzzing setup 2026-04-29 11:10:13 +02:00
__init__.py
atheris_compat.py feat(ci): improve fuzzing setup 2026-04-23 11:55:12 +02:00
bootstrap.py
README.md feat(ci): ingest fuzzing errors to Sentry 2026-04-27 15:22:08 +02:00
runner.py feat(ci): ingest fuzzing errors to Sentry 2026-04-27 15:22:08 +02:00
sentry.py feat(ci): ingest fuzzing errors to Sentry 2026-04-27 15:22:08 +02:00
sentry_reporter.py feat(ci): ingest fuzzing errors to Sentry 2026-04-27 15:22:08 +02:00
targets.py chore(ci): extend fyzzing setup 2026-04-29 11:10:13 +02:00
urls.py

README.md

Weblate Fuzzing

This directory contains parser-focused fuzz targets for high-risk input surfaces in Weblate:

  • translation_formats
  • webhooks
  • backups
  • markup
  • memory_import
  • ssh

The targets are packaged through a shared atheris runner so ClusterFuzzLite only needs to bundle the Python environment once.

Local Runs

Use the existing virtual environment and point the runner at one target and its seed corpus:

CI_DB_HOST=127.0.0.1 CI_DB_USER=weblate CI_DB_PASSWORD=weblate \
  .venv/bin/python fuzzing/runner.py translation_formats \
  fuzzing/corpus/translation_formats -runs=0

Replace translation_formats with any target name listed above.

Sentry reporting

Batch fuzzing can report findings to Sentry when the SENTRY_FUZZING_DSN GitHub Actions secret is configured. The fuzzing runner captures unexpected Python exceptions directly so Sentry keeps the original traceback and target metadata. The batch workflow also reports ClusterFuzzLite SARIF and crash summaries as a fallback for failures that do not raise a Python exception, such as sanitizer aborts, OOMs, and timeouts.

PR fuzzing does not report to Sentry because secrets are not available for untrusted fork pull requests. It continues to expose SARIF and crash summary artifacts in GitHub Actions.

Seed Corpora

fuzzing/corpus/<target>/ contains small seed inputs intended to get each target past basic parsing and into format-specific logic quickly. The corpus is kept intentionally small; larger mutation corpora should come from ClusterFuzzLite batch runs.