Skip to content

Conversation

@abhijit9040
Copy link
Contributor

This PR adds coverage-guided fuzz testing for capec_map_enricher.py to improve robustness when handling malformed or unexpected JSON/YAML input.

Key changes:

  • Added tests/scripts/capec_map_enricher_fuzzer.py using Atheris
  • Mocked filesystem I/O and CLI arguments to isolate enrichment logic
  • Fuzzed edge cases such as empty catalogs, malformed IDs, and varied version/edition inputs

Reference issue-#2165

@sydseter
Copy link
Collaborator

length=120 --max-complexity=10 --ignore=E203,W503
Loading .env environment variables...
./tests/scripts/capec_map_enricher_fuzzer.py:7:1: F401 'unittest.mock.MagicMock' imported but unused
./tests/scripts/capec_map_enricher_fuzzer.py:8:1: F401 'pathlib.Path' imported but unused

Copy link
Collaborator

@sydseter sydseter left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You have some style issues there.

@sydseter
Copy link
Collaborator

There is tje error:

File "capec_map_enricher_fuzzer.py", line 119, in test_main
File "capec_map_enricher_fuzzer.py", line 96, in test_main
File "unittest/mock.py", line 1430, in enter
File "pkgutil.py", line 715, in resolve_name
AttributeError: module 'scripts' has no attribute 'capec_map_enricher'

@abhijit9040
Copy link
Contributor Author

Hi @sydseter , can you my review my pr . If any changes needed .

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What did you change here? If you believe there is an issue please open separate pull-request. Pøease revert this so that it is easier to asess the fuzzing test.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here. If you believe there is an issue please open separate pull-request. Pøease revert this so that it is easier to asess the fuzzing test.

pnpm audit --prod
pnpm run coverage

- name: Smoke test
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems like this got lost in a merge? Could you just reset your commit and try to only commit the capec_map_enricher_fuzzer.py‎ file?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

git reset HEAD~7

@abhijit9040
Copy link
Contributor Author

Hi @sydseter,

I’ve cleaned up the PR as requested:

  • Clean history: Performed a git reset --hard and force-push. The PR now only includes tests/scripts/capec_map_enricher_fuzzer.py.
  • Fuzzer update: Switched to patch.object to ensure compatibility with ClusterFuzzLite (PyInstaller) .
  • ClusterFuzzLite check: The failure is due to a Docker API version issue in the GitHub runner environment, not related to the fuzzer code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants