core: add ability to specify output directory (#1976)

DavidKorczynski · web-flow · commit 3ba97001f64e · 2025-01-15T13:42:29.000Z
* core: add ability to specify output directory

Signed-off-by: David Korczynski &lt;david@adalogics.com&gt;

* nit

Signed-off-by: David Korczynski &lt;david@adalogics.com&gt;

* nit

Signed-off-by: David Korczynski &lt;david@adalogics.com&gt;

* nit

Signed-off-by: David Korczynski &lt;david@adalogics.com&gt;

* nit

Signed-off-by: David Korczynski &lt;david@adalogics.com&gt;

---------

Signed-off-by: David Korczynski &lt;david@adalogics.com&gt;
diff --git a/src/fuzz_introspector/analyses/annotated_cfg.py b/src/fuzz_introspector/analyses/annotated_cfg.py
@@ -54,7 +54,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir: str) -> str:
         """
         Creates the HTML of the calltree. Returns the HTML as a string.
         """
@@ -142,7 +143,7 @@ def analysis_func(self,
 
         # Write the results to the json report
         json_report.add_analysis_json_str_as_dict_to_report(
-            self.get_name(), self.get_json_string_result())
+            self.get_name(), self.get_json_string_result(), out_dir)
         return ""
 
     def get_profile_sourcefile(self, profile, func_name):
diff --git a/src/fuzz_introspector/analyses/bug_digestor.py b/src/fuzz_introspector/analyses/bug_digestor.py
@@ -53,7 +53,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         """Digests and creates HTML about bugs found by the fuzzers."""
         logger.info(f" - Running analysis {self.get_name()}")
         input_bugs = data_loader.try_load_input_bugs()
diff --git a/src/fuzz_introspector/analyses/calltree_analysis.py b/src/fuzz_introspector/analyses/calltree_analysis.py
@@ -62,7 +62,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         """
         Creates the HTML of the calltree. Returns the HTML as a string.
         """
@@ -88,7 +89,8 @@ def _get_span_row(self, ct_idx_str, indentation, node, demangled_name,
         </span>"""
         return span_row
 
-    def create_calltree(self, profile: fuzzer_profile.FuzzerProfile) -> str:
+    def create_calltree(self, profile: fuzzer_profile.FuzzerProfile,
+                        out_dir) -> str:
         logger.info("In calltree")
         # Generate HTML for the calltree
         calltree_html_string = "<h1>Fuzzer calltree</h1>"
@@ -190,10 +192,12 @@ def create_calltree(self, profile: fuzzer_profile.FuzzerProfile) -> str:
 
         # Write the HTML to a file called calltree_view_XX.html where XX is a counter.
         calltree_file_idx = 0
-        calltree_html_file = f"calltree_view_{calltree_file_idx}.html"
+        calltree_html_file = os.path.join(
+            out_dir, f"calltree_view_{calltree_file_idx}.html")
         while os.path.isfile(calltree_html_file):
             calltree_file_idx += 1
-            calltree_html_file = f"calltree_view_{calltree_file_idx}.html"
+            calltree_html_file = os.path.join(
+                out_dir, f"calltree_view_{calltree_file_idx}.html")
 
         self.html_create_dedicated_calltree_file(
             calltree_html_string,
diff --git a/src/fuzz_introspector/analyses/driver_synthesizer.py b/src/fuzz_introspector/analyses/driver_synthesizer.py
@@ -63,6 +63,7 @@ def analysis_func(self,
                       basefolder: str,
                       coverage_url: str,
                       conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir,
                       fuzz_targets=None) -> str:
         logger.info(f" - Running analysis {self.get_name()}")
         html_string = ""
diff --git a/src/fuzz_introspector/analyses/engine_input.py b/src/fuzz_introspector/analyses/engine_input.py
@@ -53,7 +53,8 @@ def analysis_func(self,
                       project_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         logger.info(f" - Running analysis {self.get_name()}")
 
         if not self.display_html:
@@ -80,7 +81,8 @@ def analysis_func(self,
 
             # Create dictionary section
             html_string += self.get_dictionary_section(profiles[profile_idx],
-                                                       table_of_contents)
+                                                       table_of_contents,
+                                                       out_dir)
 
             html_string += "<br>"
 
@@ -98,7 +100,8 @@ def analysis_func(self,
 
         return html_string
 
-    def get_dictionary(self, profile: fuzzer_profile.FuzzerProfile) -> str:
+    def get_dictionary(self, profile: fuzzer_profile.FuzzerProfile,
+                       out_dir) -> str:
         """Extracts a fuzzer dictionary"""
         kn = 0
         dictionary_content = ""
@@ -118,12 +121,13 @@ def get_dictionary(self, profile: fuzzer_profile.FuzzerProfile) -> str:
                 kn += 1
         self.set_json_string_result(json.dumps(dictionary))
         json_report.add_analysis_json_str_as_dict_to_report(
-            self.get_name(), self.get_json_string_result())
+            self.get_name(), self.get_json_string_result(), out_dir)
         return dictionary_content
 
     def get_dictionary_section(
             self, profile: fuzzer_profile.FuzzerProfile,
-            table_of_contents: html_helpers.HtmlTableOfContents) -> str:
+            table_of_contents: html_helpers.HtmlTableOfContents,
+            out_dir) -> str:
         """
         Returns a HTML string with dictionary content, and adds the section
         link to the table_of_contents.
@@ -133,7 +137,7 @@ def get_dictionary_section(
             "Dictionary", html_helpers.HTML_HEADING.H3, table_of_contents)
         html_string += "<p>Use this with the libFuzzer -dict=DICT.file flag</p>"
         html_string += "<pre><code class='language-clike'>"
-        html_string += self.get_dictionary(profile)
+        html_string += self.get_dictionary(profile, out_dir)
         html_string += "</code></pre>"
         return html_string
 
diff --git a/src/fuzz_introspector/analyses/filepath_analyser.py b/src/fuzz_introspector/analyses/filepath_analyser.py
@@ -56,7 +56,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         logger.info(f" - Running analysis {self.get_name()}")
 
         all_proj_files = self.all_files_targeted(proj_profile)
diff --git a/src/fuzz_introspector/analyses/function_call_analyser.py b/src/fuzz_introspector/analyses/function_call_analyser.py
@@ -146,7 +146,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         """
         Performs an analysis for all third party API call in the target project.
         Finds the set of third party API call in the project code and provide
diff --git a/src/fuzz_introspector/analyses/metadata.py b/src/fuzz_introspector/analyses/metadata.py
@@ -51,7 +51,8 @@ def analysis_func(self,
                       project_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         logger.info(f" - Running analysis {self.get_name()}")
 
         html_string = ""
diff --git a/src/fuzz_introspector/analyses/optimal_targets.py b/src/fuzz_introspector/analyses/optimal_targets.py
@@ -133,6 +133,7 @@ def analysis_func(self,
                       basefolder: str,
                       coverage_url: str,
                       conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir,
                       should_synthetise: bool = False) -> str:
         """
         Performs an analysis based on optimal target selection.
@@ -161,7 +162,7 @@ def analysis_func(self,
             proj_profile)
         html_string += self.get_optimal_target_section(
             optimal_target_functions, table_of_contents, tables, coverage_url,
-            profiles[0].target_lang)
+            out_dir, profiles[0].target_lang)
 
         # Create section for how the state of the project will be if
         # the optimal target functions are hit.
@@ -290,6 +291,7 @@ def get_optimal_target_section(
             table_of_contents: html_helpers.HtmlTableOfContents,
             tables: List[str],
             coverage_url: str,
+            out_dir,
             target_lang: str = 'c-cpp') -> str:
         # Table with details about optimal target functions
         html_string = html_helpers.html_add_header_with_link(
@@ -349,7 +351,7 @@ def get_optimal_target_section(
         self.set_json_string_result(json.dumps(json_dict))
 
         json_report.add_analysis_json_str_as_dict_to_report(
-            self.get_name(), self.get_json_string_result())
+            self.get_name(), self.get_json_string_result(), out_dir)
         html_string += ("</table>\n")
         return html_string
 
diff --git a/src/fuzz_introspector/analyses/runtime_coverage_analysis.py b/src/fuzz_introspector/analyses/runtime_coverage_analysis.py
@@ -49,7 +49,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         logger.info(f" - Running analysis {self.get_name()}")
 
         html_string = ""
diff --git a/src/fuzz_introspector/analyses/sinks_analyser.py b/src/fuzz_introspector/analyses/sinks_analyser.py
@@ -625,7 +625,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir) -> str:
         """
         Performs an analysis based on the sink function discovery and analysis.
         Show all possible sensitive sink functions/methods for each supported
@@ -777,7 +778,7 @@ def analysis_func(self,
         html_string += "</div>"  # report-box
 
         json_report.add_analysis_json_str_as_dict_to_report(
-            self.get_name(), self.get_json_string_result())
+            self.get_name(), self.get_json_string_result(), out_dir)
 
         logger.info(f" - Finish running analysis {self.get_name()}")
 
diff --git a/src/fuzz_introspector/analysis.py b/src/fuzz_introspector/analysis.py
@@ -55,7 +55,10 @@ def __init__(self, language, target_folder, coverage_url):
         self.base_folder = target_folder
         self.coverage_url = coverage_url
 
-    def load_data_files(self, parallelise=True, correlation_file=None):
+    def load_data_files(self,
+                        parallelise=True,
+                        correlation_file=None,
+                        out_dir: str = ''):
         """Generates the `proj_profile` and `profiles` elements of this class
         based on the raw data given as arguments. This function must be called
         before any real use of `IntrospectionProject` can happen.
@@ -111,7 +114,8 @@ def load_data_files(self, parallelise=True, correlation_file=None):
 
         for profile in self.profiles:
             overlay_calltree_with_coverage(profile, self.proj_profile,
-                                           self.coverage_url, self.base_folder)
+                                           self.coverage_url, self.base_folder,
+                                           out_dir)
         # Load all debug files
         self.debug_files = data_loader.load_all_debug_files(self.base_folder)
 
@@ -121,7 +125,7 @@ def load_data_files(self, parallelise=True, correlation_file=None):
         self.debug_function_files = data_loader.find_all_debug_function_files(
             self.base_folder)
 
-    def load_debug_report(self):
+    def load_debug_report(self, out_dir):
         """Load and digest debug information."""
         self.debug_report = debug_info.load_debug_report(self.debug_files)
 
@@ -156,11 +160,11 @@ def load_debug_report(self):
         # Extract the raw function signature. This propagates types into all of
         # the debug functions.
         debug_info.correlate_debugged_function_to_debug_types(
-            self.debug_all_types, self.debug_all_functions)
+            self.debug_all_types, self.debug_all_functions, out_dir)
 
-    def dump_debug_report(self):
+    def dump_debug_report(self, out_dir):
         if self.debug_report is not None:
-            debug_info.dump_debug_report(self.debug_report)
+            debug_info.dump_debug_report(self.debug_report, out_dir)
 
 
 class AnalysisInterface(abc.ABC):
@@ -175,7 +179,8 @@ def analysis_func(self,
                       proj_profile: project_profile.MergedProjectProfile,
                       profiles: List[fuzzer_profile.FuzzerProfile],
                       basefolder: str, coverage_url: str,
-                      conclusions: List[html_helpers.HTMLConclusion]) -> str:
+                      conclusions: List[html_helpers.HTMLConclusion],
+                      out_dir: str) -> str:
         """Entrypoint for analysis instance. This function can have side effects
         on many of the arguments passed to it.
 
@@ -430,7 +435,7 @@ def get_parent_callsite_link(node, callstack, profile, target_coverage_url):
 def overlay_calltree_with_coverage(
         profile: fuzzer_profile.FuzzerProfile,
         proj_profile: project_profile.MergedProjectProfile, coverage_url: str,
-        basefolder: str) -> None:
+        basefolder: str, out_dir) -> None:
     # We use the callstack to keep track of all function parents. We need this
     # when looking up if a callsite was hit or not. This is because the coverage
     # information about a callsite is located in coverage data of the function
@@ -572,7 +577,8 @@ def overlay_calltree_with_coverage(
 
     json_report.add_branch_blocker_key_value_to_report(profile.identifier,
                                                        'branch_blockers',
-                                                       branch_blockers_list)
+                                                       branch_blockers_list,
+                                                       out_dir)
 
 
 def update_branch_complexities(
diff --git a/src/fuzz_introspector/commands.py b/src/fuzz_introspector/commands.py
@@ -49,22 +49,29 @@ def end_to_end(args) -> int:
     if not args.language:
         args.language = utils.detect_language(args.target_dir)
 
+    if args.out_dir:
+        out_dir = args.out_dir
+    else:
+        out_dir = os.getcwd()
+
     oss_fuzz.analyse_folder(language=args.language,
                             directory=args.target_dir,
                             entrypoint='LLVMFuzzerTestOneInput',
-                            out=args.out_dir)
+                            out=out_dir)
 
     if 'c' in args.language:
         language = 'c-cpp'
     else:
         language = args.language
-    return run_analysis_on_dir(target_folder=os.getcwd(),
+
+    return run_analysis_on_dir(target_folder=out_dir,
                                coverage_url=args.coverage_url,
                                analyses_to_run=[],
                                correlation_file='',
                                enable_all_analyses=False,
                                report_name=args.name,
-                               language=language)
+                               language=language,
+                               out_dir=out_dir)
 
 
 def run_analysis_on_dir(target_folder: str,
@@ -76,7 +83,8 @@ def run_analysis_on_dir(target_folder: str,
                         language: str,
                         output_json: Optional[List[str]] = None,
                         parallelise: bool = True,
-                        dump_files: bool = True) -> int:
+                        dump_files: bool = True,
+                        out_dir: str = '') -> int:
     """Runs Fuzz Introspector analysis from based on the results
     from a frontend run. The primary task is to aggregate the data
     and generate a HTML report."""
@@ -90,14 +98,18 @@ def run_analysis_on_dir(target_folder: str,
 
     introspection_proj = analysis.IntrospectionProject(language, target_folder,
                                                        coverage_url)
-    introspection_proj.load_data_files(parallelise, correlation_file)
+    introspection_proj.load_data_files(parallelise, correlation_file, out_dir)
 
     logger.info("Analyses to run: %s", str(analyses_to_run))
     logger.info("[+] Creating HTML report")
     if output_json is None:
         output_json = []
-    html_report.create_html_report(introspection_proj, analyses_to_run,
-                                   output_json, report_name, dump_files)
+    html_report.create_html_report(introspection_proj,
+                                   analyses_to_run,
+                                   output_json,
+                                   report_name,
+                                   dump_files,
+                                   out_dir=out_dir)
 
     return constants.APP_EXIT_SUCCESS
 
diff --git a/src/fuzz_introspector/datatypes/fuzzer_profile.py b/src/fuzz_introspector/datatypes/fuzzer_profile.py
@@ -451,7 +451,7 @@ def get_cov_metrics(
         except Exception:
             return None, None, None
 
-    def write_stats_to_summary_file(self) -> None:
+    def write_stats_to_summary_file(self, out_dir) -> None:
         file_target_count = len(
             self.file_targets) if self.file_targets is not None else 0
         json_report.add_fuzzer_key_value_to_report(
@@ -460,7 +460,7 @@ def write_stats_to_summary_file(self) -> None:
                 "total-cyclomatic-complexity":
                 self.total_cyclomatic_complexity,
                 "file-target-count": file_target_count,
-            })
+            }, out_dir)
 
     def _set_all_reached_functions(self) -> None:
         """Sets self.functions_reached_by_fuzzer to all functions reached by
diff --git a/src/fuzz_introspector/datatypes/project_profile.py b/src/fuzz_introspector/datatypes/project_profile.py
@@ -392,7 +392,7 @@ def get_function_callpaths(
                         result_name_list.append(name_list)
         return (result_list, result_name_list)
 
-    def write_stats_to_summary_file(self) -> None:
+    def write_stats_to_summary_file(self, out_dir) -> None:
         (total_complexity, complexity_reached, complexity_unreached,
          reached_complexity_percentage,
          unreached_complexity_percentage) = self.get_complexity_summaries()
@@ -424,9 +424,9 @@ def write_stats_to_summary_file(self) -> None:
                 'unreached-function-percentage': unreached_func_percentage,
                 'code-coverage-function-count': len(covered_funcs),
                 'code-coverage-function-percentage': cov_percentage
-            })
+            }, out_dir)
         json_report.add_project_key_value_to_report(
-            'overview', {'language': self.target_lang})
+            'overview', {'language': self.target_lang}, out_dir)
 
     def _set_basefolder(self) -> None:
         """Identifies a common path-prefix amongst source files in. This is
diff --git a/src/fuzz_introspector/debug_info.py b/src/fuzz_introspector/debug_info.py
diff --git a/src/fuzz_introspector/html_helpers.py b/src/fuzz_introspector/html_helpers.py
diff --git a/src/fuzz_introspector/html_report.py b/src/fuzz_introspector/html_report.py
diff --git a/src/fuzz_introspector/json_report.py b/src/fuzz_introspector/json_report.py
diff --git a/src/fuzz_introspector/utils.py b/src/fuzz_introspector/utils.py
