Skip to content

Commit c2f70d8

Browse files
0roman0roman
authored
[log4j2] intitial integration (#7016)
1 parent 5015790 commit c2f70d8

File tree

4 files changed

+143
-0
lines changed

4 files changed

+143
-0
lines changed

‎projects/log4j2/Dockerfile

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Copyright 2021 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
################################################################################
16+
17+
FROM gcr.io/oss-fuzz-base/base-builder-jvm
18+
19+
RUN curl -L https://downloads.apache.org/maven/maven-3/3.6.3/binaries/apache-maven-3.6.3-bin.zip -o maven.zip && \
20+
unzip maven.zip -d $SRC/maven && \
21+
rm -rf maven.zip
22+
23+
ENV MVN $SRC/maven/apache-maven-3.6.3/bin/mvn
24+
25+
RUN git clone --depth 1 https://github.com/apache/logging-log4j2
26+
27+
COPY build.sh $SRC/
28+
COPY Log4jFuzzer.java $SRC/
29+
WORKDIR $SRC/logging-log4j2

‎projects/log4j2/Log4jFuzzer.java

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
2+
// Copyright 2021 Google LLC
3+
//
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
//
8+
// http://www.apache.org/licenses/LICENSE-2.0
9+
//
10+
// Unless required by applicable law or agreed to in writing, software
11+
// distributed under the License is distributed on an "AS IS" BASIS,
12+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
// See the License for the specific language governing permissions and
14+
// limitations under the License.
15+
//
16+
////////////////////////////////////////////////////////////////////////////////
17+
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
18+
import org.apache.logging.log4j.Level;
19+
import org.apache.logging.log4j.LogManager;
20+
import org.apache.logging.log4j.Logger;
21+
import org.apache.logging.log4j.core.appender.FileAppender;
22+
import org.apache.logging.log4j.core.config.Configurator;
23+
import org.apache.logging.log4j.core.config.builder.api.AppenderComponentBuilder;
24+
import org.apache.logging.log4j.core.config.builder.api.RootLoggerComponentBuilder;
25+
import org.apache.logging.log4j.core.config.builder.impl.DefaultConfigurationBuilder;
26+
import org.apache.logging.log4j.status.StatusLogger;
27+
28+
// This fuzzer reproduces the log4j RCE vulnerability CVE-2021-44228.
29+
public class Log4jFuzzer {
30+
private final static Logger log = LogManager.getLogger(Log4jFuzzer.class.getName());
31+
32+
public static void fuzzerTestOneInput(FuzzedDataProvider data) {
33+
log.error(data.consumeRemainingAsString());
34+
}
35+
36+
public static void fuzzerInitialize() {
37+
// Install a logger that constructs the log message, but never prints it.
38+
// This noticeably increases the fuzzing performance
39+
DefaultConfigurationBuilder configBuilder = new DefaultConfigurationBuilder();
40+
AppenderComponentBuilder fuzzingAppender = configBuilder.newAppender("nullAppender", FileAppender.PLUGIN_NAME);
41+
fuzzingAppender.addAttribute("fileName", "/dev/null");
42+
configBuilder.add(fuzzingAppender);
43+
RootLoggerComponentBuilder rootLogger = configBuilder.newRootLogger();
44+
rootLogger.add(configBuilder.newAppenderRef("nullAppender"));
45+
configBuilder.add(rootLogger);
46+
Configurator.reconfigure(configBuilder.build());
47+
48+
// Disable logging of exceptions caught in log4j itself.
49+
StatusLogger.getLogger().reset();
50+
StatusLogger.getLogger().setLevel(Level.OFF);
51+
}
52+
}

‎projects/log4j2/build.sh

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash -eu
2+
# Copyright 2021 Google Inc.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
#
16+
################################################################################
17+
18+
MAVEN_ARGS="-DskipTests --no-transfer-progress"
19+
$MVN package -pl log4j-api,log4j-plugins,log4j-core $MAVEN_ARGS
20+
CURRENT_VERSION=$($MVN org.apache.maven.plugins:maven-help-plugin:3.2.0:evaluate \
21+
-Dexpression=project.version -q -DforceStdout)
22+
cp "log4j-core/target/log4j-core-$CURRENT_VERSION.jar" $OUT/log4j-core.jar
23+
cp "log4j-api/target/log4j-api-$CURRENT_VERSION.jar" $OUT/log4j-api.jar
24+
cp "log4j-plugins/target/log4j-plugins-$CURRENT_VERSION.jar" $OUT/log4j-plugins.jar
25+
26+
ALL_JARS="log4j-core.jar log4j-api.jar log4j-plugins.jar"
27+
28+
# The classpath at build-time includes the project jars in $OUT as well as the
29+
# Jazzer API. Additionally, include $OUT itself to pick up
30+
# BufferedImageLuminanceSource.
31+
BUILD_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "$OUT/%s:"):$JAZZER_API_PATH:$OUT
32+
33+
# All .jar and .class files lie in the same directory as the fuzzer at runtime.
34+
RUNTIME_CLASSPATH=$(echo $ALL_JARS | xargs printf -- "\$this_dir/%s:"):\$this_dir
35+
36+
for fuzzer in $(find $SRC -name '*Fuzzer.java'); do
37+
fuzzer_basename=$(basename -s .java $fuzzer)
38+
javac -cp $BUILD_CLASSPATH $fuzzer
39+
cp $SRC/$fuzzer_basename*.class $OUT/
40+
41+
# Create an execution wrapper that executes Jazzer with the correct arguments.
42+
echo "#!/bin/sh
43+
# LLVMFuzzerTestOneInput for fuzzer detection.
44+
this_dir=\$(dirname \"\$0\")
45+
LD_LIBRARY_PATH=\"$JVM_LD_LIBRARY_PATH\":\$this_dir \
46+
\$this_dir/jazzer_driver --agent_path=\$this_dir/jazzer_agent_deploy.jar \
47+
--cp=$RUNTIME_CLASSPATH \
48+
--target_class=$fuzzer_basename \
49+
--jvm_args=\"-Xmx2048m\" \
50+
\$@" > $OUT/$fuzzer_basename
51+
chmod u+x $OUT/$fuzzer_basename
52+
done

‎projects/log4j2/project.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
homepage: "https://logging.apache.org/log4j/2.x/"
2+
language: jvm
3+
primary_contact: "[email protected]"
4+
auto_ccs:
5+
- "[email protected]"
6+
fuzzing_engines:
7+
- libfuzzer
8+
main_repo: "https://github.com/apache/logging-log4j2"
9+
sanitizers:
10+
- address

0 commit comments

Comments
 (0)