Weblate/weblate
0
0
Fork 0
mirror of https://github.com/WeblateOrg/weblate.git synced 2026-07-26 14:23:58 +08:00
Code Issues Projects Releases Packages Activity Actions 7
weblate/fuzzing
History
Exact
Michal Čihař 1826011030 chore: migrate ruff suppressions to human-readable names 
These are easier to understand when reading the code. The feature is in
preview mode since ruff 0.15.17.
2026-06-14 21:56:11 +02:00
..
corpus chore(ci): extend fyzzing setup 2026-04-29 11:10:13 +02:00
tests chore: migrate ruff suppressions to human-readable names 2026-06-14 21:56:11 +02:00
__init__.py
atheris_compat.py feat(ci): improve fuzzing setup 2026-04-23 11:55:12 +02:00
bootstrap.py
findings_reporter.py chore: migrate ruff suppressions to human-readable names 2026-06-14 21:56:11 +02:00
README.md feat(ci): improve fyzzing setup 2026-05-12 11:00:25 +02:00
runner.py feat(ci): ingest fuzzing errors to Sentry 2026-04-27 15:22:08 +02:00
sentry.py feat(ci): improve fyzzing setup 2026-05-12 11:00:25 +02:00
targets.py chore(ci): extend fyzzing setup 2026-04-29 11:10:13 +02:00
urls.py

README.md

Weblate Fuzzing

This directory contains parser-focused fuzz targets for high-risk input surfaces in Weblate:

  • translation_formats
  • webhooks
  • backups
  • markup
  • memory_import
  • ssh

The targets are packaged through a shared atheris runner so ClusterFuzzLite only needs to bundle the Python environment once.

Local Runs

Use the existing virtual environment and point the runner at one target and its seed corpus:

CI_DB_HOST=127.0.0.1 CI_DB_USER=weblate CI_DB_PASSWORD=weblate \
  .venv/bin/python fuzzing/runner.py translation_formats \
  fuzzing/corpus/translation_formats -runs=0

Replace translation_formats with any target name listed above.

Sentry reporting

Batch fuzzing can report findings to Sentry when the SENTRY_FUZZING_DSN GitHub Actions secret is configured. The fuzzing runner captures unexpected Python exceptions directly so Sentry keeps the original traceback and target metadata. It attaches the fuzz input to the captured Sentry event, capped at 1 MiB, so the reproducer is available without enabling local variable capture. The batch workflow also reports ClusterFuzzLite SARIF and crash summaries as a fallback for failures that do not raise a Python exception, such as sanitizer aborts, OOMs, and timeouts.

PR fuzzing does not report to Sentry because secrets are not available for untrusted fork pull requests. Both fuzzing workflows print a human-readable findings report in the GitHub Actions log and step summary, and upload crash summary artifacts.

Seed Corpora

fuzzing/corpus/<target>/ contains small seed inputs intended to get each target past basic parsing and into format-specific logic quickly. The corpus is kept intentionally small; larger mutation corpora should come from ClusterFuzzLite batch runs.