Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Introduce fuzz testing to make sure Radius parsers are robust and not vulnerable. #8105

Open
nithyatsu opened this issue Dec 4, 2024 · 2 comments
Labels
needs-more-information This issue needs more information.

Comments

@nithyatsu
Copy link
Contributor

nithyatsu commented Dec 4, 2024

We use custom parsers to parse Radius-related resource IDs and do not use any other custom parsers. Radius resource ids are a custom string format that can be parsed from untrusted data. The parser is a shared component.

We should use fuzzing to validate that Radius parser does not accept anything other than a valid Radius resource ID and make sure there are no bugs and vulnerabilities.

AB#13777

@brooke-hamilton
Copy link
Contributor

@nithyatsu can you add some acceptance criteria (for example, when does the fuzz testing run, or other questions that would help us understand. Are we trying to prevent DDOS or ensure correctness?)

If this is coming from the threat model, can you link to that part of the model so that we know the impact and motivation for doing this work, which will help us prioritize.

@brooke-hamilton brooke-hamilton added the needs-more-information This issue needs more information. label Dec 5, 2024
@radius-triage-bot
Copy link

👋 @nithyatsu we need more information.

To help us investigate further, we need additional information to reproduce or understand this issue. Please ensure you have steps to reproduce and information about your OS, rad CLI version, and runtime version.

A project maintainer will reply on this issue soon to ask for additional specifics if needed.

For more information on our triage process please visit our triage overview

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs-more-information This issue needs more information.
Projects
None yet
Development

No branches or pull requests

2 participants