Breaking the Barrier of Dynamic Testing: Detect and Autoconfigure Entry Points With CI Spark

import com.code_intelligence.jazzer.api.FuzzedDataProvider;
import com.code_intelligence.jazzer.api.FuzzerSecurityIssueLow;

import com.google.gson.Gson;
import com.google.gson.JsonElement;
import com.google.json.JsonSanitizer;

public class ValidJsonFuzzer {
  private static Gson gson = new Gson();

  public static void fuzzerTestOneInput(FuzzedDataProvider data) {
    String input = data.consumeRemainingAsString();
    String output;
    try {
      output = JsonSanitizer.sanitize(input, 10);
    } catch (ArrayIndexOutOfBoundsException e) {
      // ArrayIndexOutOfBoundsException is expected if nesting depth is
      // exceeded.
      return;
    }

    // Check that the output is valid JSON. Invalid JSON may crash other parts
    // of the application that trust the output of the sanitizer.
    try {
      Gson gson = new Gson();
      gson.fromJson(output, JsonElement.class);
    } catch (Exception e) {
      throw new FuzzerSecurityIssueLow("Output is invalid JSON", e);
    }
  }
}

AI-generated test:

//package com.example;

import com.code_intelligence.jazzer.api.FuzzedDataProvider;
import com.code_intelligence.jazzer.junit.FuzzTest;
import com.google.json.JsonSanitizer;

public class JsonSanitizerFuzzingHarness {
    @FuzzTest
    public void fuzzJsonSanitizer(FuzzedDataProvider data) {
        String jsonInput = data.consumeRemainingAsString();
        JsonSanitizer.sanitize(jsonInput);
    }
}

With small guidance in the interactive mode (used LLM prompt: “I only want to catch ArrayIndexOutOfBoundsException as they're expected if the nesting depth is exceeded. Also, I want to ensure that the sanitized output never contains the substring </script>. Finally, validate the output.”

//package com.example;

import com.code_intelligence.jazzer.api.FuzzedDataProvider;
import com.code_intelligence.jazzer.junit.FuzzTest;
import com.google.json.JsonSanitizer;
import com.google.gson.Gson;
import com.google.gson.JsonSyntaxException;

public class JsonSanitizerFuzzingHarness {
    @FuzzTest
    public void fuzzJsonSanitizer(FuzzedDataProvider data) {
        try {
            String jsonInput = data.consumeRemainingAsString();
            String sanitizedOutput = JsonSanitizer.sanitize(jsonInput);
            
            // Check if sanitized output contains "</script>"
            if (sanitizedOutput.contains("</script>")) {
                throw new AssertionError("Sanitized output contains '</script>'");
            }
            
            // Verify if sanitized output is valid JSON
            try {
                new Gson().fromJson(sanitizedOutput, Object.class);
            } catch (JsonSyntaxException e) {
                throw new AssertionError("Sanitized output is not valid JSON");
            }
        } catch (ArrayIndexOutOfBoundsException e) {
            // Ignore ArrayIndexOutOfBoundsException as it may occur when the nesting depth is exceeded
    }
}

With only minimal effort about what specifics are interesting to us for this particular API, we have an almost identical fuzz harness to what has been implemented already. 

Tested Within Google’s OSS-Fuzz

CI Spark was first tested as part of our collaboration with Google’s OSS-Fuzz. The project aims to continuously ensure the security of open-source projects through continuous fuzz testing. As Code Intelligence provides the testing technology for JVM-based languages (Jazzer) and JavaScript (Jazzer.js), CI Spark was initially tested while onboarding JavaScript and Java projects. Early results proved that CI Spark enabled our engineers to condense the average workload needed to generate a fuzz test to a few hours or even minutes, depending on the project. 

Complementary to CI Spark, the Google Security team recently added similar functionality to OSS-Fuzz, with a focus on C/C++ just recently. While the main purpose of this new OSS-Fuzz addition is to keep securing open-source, CI Spark will be rolled out for commercial projects in the near future.

Next Steps

The results from using CI Spark are very encouraging and clearly demonstrate the automation potential of leveraging generative AI. However, this is just the beginning and there are still significant improvements that we are currently working on. Our next items on our roadmap include:

• Plug & Play system for different LLMs
  Support seamless choice of different LLMs to power CI Spark. New models appear with increasing speed and capabilities, which helps more experimentation to select the best model for the specific use case.

• Model fine-tuning for better results
  Our main focus has been refining our prompts to work with all available models. Next, we will explore fine-tuning existing open-source and commercial models for the specific task of generating high-quality fuzz tests. 

• Automatic validation of the fuzz tests
  An essential step to fully automate this process is to validate the quality of the generated test. To this end, we will build an evaluation framework to build and execute the generated test. Build errors and progress feedback will be then fed back to the AI to improve the test.
• Static analysis for candidate selection
  We will leverage whole-program static analysis to extract relevant candidates for fuzz tests. This analysis will identify APIs that are more likely to contain security issues and result in good code coverage.

• Identification of inadequately tested APIs
  Besides the aforementioned enhancements to our static analysis to better pinpoint suitable fuzzing candidates, we’re also investing into uncovering APIs that are inadequately tested. Whether they lack sufficient unit testing or have not been subjected to fuzz tests, our goal is to supplement these areas with additional fuzz tests. 

• Support for other languages
  
  

CI Spark Live Demo

In this recorded live demo, our co-founder and Chief Scientist, Khaled Yakdan, demonstrates how you can break the barriers of dynamic testing with CI Spark. Learn how CI Spark combines self-learning AI and LLMs to detect and configure entry points for feedback-based fuzzing automatically.