From f7392394fdcf882c97199d35a65647f201f3129e Mon Sep 17 00:00:00 2001
From: Bond_009 <bond.009@outlook.com>
Date: Tue, 8 Jun 2021 22:22:32 +0200
Subject: [PATCH] Add fuzzing infra

---
 .gitignore                                    |  1 +
 fuzz/.gitignore                               |  1 +
 .../Emby.Server.Implementations.Fuzz.csproj   | 18 ++++++++++
 .../Program.cs                                | 32 ++++++++++++++++++
 .../test1.txt                                 |  1 +
 fuzz/Emby.Server.Implementations.Fuzz/fuzz.sh | 11 +++++++
 .../Jellyfin.Server.Fuzz.csproj               | 22 +++++++++++++
 fuzz/Jellyfin.Server.Fuzz/Program.cs          | 33 +++++++++++++++++++
 .../Testcases/UrlDecodeQueryFeature/test1.txt |  1 +
 fuzz/Jellyfin.Server.Fuzz/fuzz.sh             | 11 +++++++
 10 files changed, 131 insertions(+)
 create mode 100644 fuzz/.gitignore
 create mode 100644 fuzz/Emby.Server.Implementations.Fuzz/Emby.Server.Implementations.Fuzz.csproj
 create mode 100644 fuzz/Emby.Server.Implementations.Fuzz/Program.cs
 create mode 100644 fuzz/Emby.Server.Implementations.Fuzz/Testcases/PathExtensions.TryReplaceSubPath/test1.txt
 create mode 100755 fuzz/Emby.Server.Implementations.Fuzz/fuzz.sh
 create mode 100644 fuzz/Jellyfin.Server.Fuzz/Jellyfin.Server.Fuzz.csproj
 create mode 100644 fuzz/Jellyfin.Server.Fuzz/Program.cs
 create mode 100644 fuzz/Jellyfin.Server.Fuzz/Testcases/UrlDecodeQueryFeature/test1.txt
 create mode 100755 fuzz/Jellyfin.Server.Fuzz/fuzz.sh

diff --git a/.gitignore b/.gitignore
index 7cd3d0068..252210e57 100644
--- a/.gitignore
+++ b/.gitignore
@@ -268,6 +268,7 @@ doc/
 # Deployment artifacts
 dist
 *.exe
+*.dll
 
 # BenchmarkDotNet artifacts
 BenchmarkDotNet.Artifacts
diff --git a/fuzz/.gitignore b/fuzz/.gitignore
new file mode 100644
index 000000000..652de0a45
--- /dev/null
+++ b/fuzz/.gitignore
@@ -0,0 +1 @@
+Findings
diff --git a/fuzz/Emby.Server.Implementations.Fuzz/Emby.Server.Implementations.Fuzz.csproj b/fuzz/Emby.Server.Implementations.Fuzz/Emby.Server.Implementations.Fuzz.csproj
new file mode 100644
index 000000000..791cb140d
--- /dev/null
+++ b/fuzz/Emby.Server.Implementations.Fuzz/Emby.Server.Implementations.Fuzz.csproj
@@ -0,0 +1,18 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net5.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Reference Include="Emby.Server.Implementations">
+      <HintPath>Emby.Server.Implementations.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="SharpFuzz" Version="1.6.2" />
+  </ItemGroup>
+
+</Project>
diff --git a/fuzz/Emby.Server.Implementations.Fuzz/Program.cs b/fuzz/Emby.Server.Implementations.Fuzz/Program.cs
new file mode 100644
index 000000000..a4a6f5f54
--- /dev/null
+++ b/fuzz/Emby.Server.Implementations.Fuzz/Program.cs
@@ -0,0 +1,32 @@
+using System;
+using Emby.Server.Implementations.Library;
+using SharpFuzz;
+
+namespace Emby.Server.Implementations.Fuzz
+{
+    public static class Program
+    {
+        public static void Main(string[] args)
+        {
+            switch (args[0])
+            {
+                case "PathExtensions.TryReplaceSubPath": Run(PathExtensions_TryReplaceSubPath); return;
+                default: throw new ArgumentException($"Unknown fuzzing function: {args[0]}");
+            }
+        }
+
+        private static void Run(Action<string> action) => Fuzzer.OutOfProcess.Run(action);
+
+        private static void PathExtensions_TryReplaceSubPath(string data)
+        {
+            // Stupid, but it worked
+            var parts = data.Split(':');
+            if (parts.Length != 3)
+            {
+                return;
+            }
+
+            _ = PathExtensions.TryReplaceSubPath(parts[0], parts[1], parts[2], out _);
+        }
+    }
+}
diff --git a/fuzz/Emby.Server.Implementations.Fuzz/Testcases/PathExtensions.TryReplaceSubPath/test1.txt b/fuzz/Emby.Server.Implementations.Fuzz/Testcases/PathExtensions.TryReplaceSubPath/test1.txt
new file mode 100644
index 000000000..aacf973d6
--- /dev/null
+++ b/fuzz/Emby.Server.Implementations.Fuzz/Testcases/PathExtensions.TryReplaceSubPath/test1.txt
@@ -0,0 +1 @@
+/fuzz/Emby.Server.Implementations.Fuzz/Testcases/PathExtensions.TryReplaceSubPath/test1.txt/:/home/bond/dev/jellyfin/:/srv/jellyfin/
diff --git a/fuzz/Emby.Server.Implementations.Fuzz/fuzz.sh b/fuzz/Emby.Server.Implementations.Fuzz/fuzz.sh
new file mode 100755
index 000000000..244f73402
--- /dev/null
+++ b/fuzz/Emby.Server.Implementations.Fuzz/fuzz.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+dotnet build -c Release ../../Emby.Server.Implementations/Emby.Server.Implementations.csproj --output bin
+sharpfuzz bin/Emby.Server.Implementations.dll
+cp bin/Emby.Server.Implementations.dll .
+
+dotnet build
+mkdir -p Findings
+AFL_SKIP_BIN_CHECK=1 afl-fuzz -i "Testcases/$1" -o "Findings/$1" -t 5000 -m 10240 dotnet bin/Debug/net5.0/Emby.Server.Implementations.Fuzz.dll "$1"
diff --git a/fuzz/Jellyfin.Server.Fuzz/Jellyfin.Server.Fuzz.csproj b/fuzz/Jellyfin.Server.Fuzz/Jellyfin.Server.Fuzz.csproj
new file mode 100644
index 000000000..6fcfbae0e
--- /dev/null
+++ b/fuzz/Jellyfin.Server.Fuzz/Jellyfin.Server.Fuzz.csproj
@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net5.0</TargetFramework>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Reference Include="Jellyfin.Server">
+      <HintPath>jellyfin.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="../../MediaBrowser.Common/MediaBrowser.Common.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="SharpFuzz" Version="1.6.2" />
+  </ItemGroup>
+
+</Project>
diff --git a/fuzz/Jellyfin.Server.Fuzz/Program.cs b/fuzz/Jellyfin.Server.Fuzz/Program.cs
new file mode 100644
index 000000000..e47286c13
--- /dev/null
+++ b/fuzz/Jellyfin.Server.Fuzz/Program.cs
@@ -0,0 +1,33 @@
+using System;
+using System.Collections.Generic;
+using Jellyfin.Server.Middleware;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http.Features;
+using Microsoft.Extensions.Primitives;
+using SharpFuzz;
+
+namespace Emby.Server.Implementations.Fuzz
+{
+    public static class Program
+    {
+        public static void Main(string[] args)
+        {
+            switch (args[0])
+            {
+                case "UrlDecodeQueryFeature": Run(UrlDecodeQueryFeature); return;
+                default: throw new ArgumentException($"Unknown fuzzing function: {args[0]}");
+            }
+        }
+
+        private static void Run(Action<string> action) => Fuzzer.OutOfProcess.Run(action);
+
+        private static void UrlDecodeQueryFeature(string data)
+        {
+            var dict = new Dictionary<string, StringValues>
+            {
+                { data, StringValues.Empty }
+            };
+            _ = new UrlDecodeQueryFeature(new QueryFeature(new QueryCollection(dict)));
+        }
+    }
+}
diff --git a/fuzz/Jellyfin.Server.Fuzz/Testcases/UrlDecodeQueryFeature/test1.txt b/fuzz/Jellyfin.Server.Fuzz/Testcases/UrlDecodeQueryFeature/test1.txt
new file mode 100644
index 000000000..73f356b93
--- /dev/null
+++ b/fuzz/Jellyfin.Server.Fuzz/Testcases/UrlDecodeQueryFeature/test1.txt
@@ -0,0 +1 @@
+a%3D1%26b%3D2%26c%3D3
diff --git a/fuzz/Jellyfin.Server.Fuzz/fuzz.sh b/fuzz/Jellyfin.Server.Fuzz/fuzz.sh
new file mode 100755
index 000000000..ad81e2c35
--- /dev/null
+++ b/fuzz/Jellyfin.Server.Fuzz/fuzz.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+dotnet build -c Release ../../Jellyfin.Server/Jellyfin.Server.csproj --output bin
+sharpfuzz bin/jellyfin.dll
+cp bin/jellyfin.dll .
+
+dotnet build
+mkdir -p Findings
+AFL_SKIP_BIN_CHECK=1 afl-fuzz -i "Testcases/$1" -o "Findings/$1" -t 5000 -m 10240 dotnet bin/Debug/net5.0/Jellyfin.Server.Fuzz.dll "$1"