mirror of
https://github.com/FuzzingLabs/fuzzforge_ai.git
synced 2026-05-20 20:54:44 +02:00
60ca088ecf
* feat: Complete migration from Prefect to Temporal BREAKING CHANGE: Replaces Prefect workflow orchestration with Temporal ## Major Changes - Replace Prefect with Temporal for workflow orchestration - Implement vertical worker architecture (rust, android) - Replace Docker registry with MinIO for unified storage - Refactor activities to be co-located with workflows - Update all API endpoints for Temporal compatibility ## Infrastructure - New: docker-compose.temporal.yaml (Temporal + MinIO + workers) - New: workers/ directory with rust and android vertical workers - New: backend/src/temporal/ (manager, discovery) - New: backend/src/storage/ (S3-cached storage with MinIO) - New: backend/toolbox/common/ (shared storage activities) - Deleted: docker-compose.yaml (old Prefect setup) - Deleted: backend/src/core/prefect_manager.py - Deleted: backend/src/services/prefect_stats_monitor.py - Deleted: Docker registry and insecure-registries requirement ## Workflows - Migrated: security_assessment workflow to Temporal - New: rust_test workflow (example/test workflow) - Deleted: secret_detection_scan (Prefect-based, to be reimplemented) - Activities now co-located with workflows for independent testing ## API Changes - Updated: backend/src/api/workflows.py (Temporal submission) - Updated: backend/src/api/runs.py (Temporal status/results) - Updated: backend/src/main.py (727 lines, TemporalManager integration) - Updated: All 16 MCP tools to use TemporalManager ## Testing - ✅ All services healthy (Temporal, PostgreSQL, MinIO, workers, backend) - ✅ All API endpoints functional - ✅ End-to-end workflow test passed (72 findings from vulnerable_app) - ✅ MinIO storage integration working (target upload/download, results) - ✅ Worker activity discovery working (6 activities registered) - ✅ Tarball extraction working - ✅ SARIF report generation working ## Documentation - ARCHITECTURE.md: Complete Temporal architecture documentation - QUICKSTART_TEMPORAL.md: Getting started guide - MIGRATION_DECISION.md: Why we chose Temporal over Prefect - IMPLEMENTATION_STATUS.md: Migration progress tracking - workers/README.md: Worker development guide ## Dependencies - Added: temporalio>=1.6.0 - Added: boto3>=1.34.0 (MinIO S3 client) - Removed: prefect>=3.4.18 * feat: Add Python fuzzing vertical with Atheris integration This commit implements a complete Python fuzzing workflow using Atheris: ## Python Worker (workers/python/) - Dockerfile with Python 3.11, Atheris, and build tools - Generic worker.py for dynamic workflow discovery - requirements.txt with temporalio, boto3, atheris dependencies - Added to docker-compose.temporal.yaml with dedicated cache volume ## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/) - Reusable module extending BaseModule - Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py) - Recursive search to find targets in nested directories - Dynamically loads TestOneInput() function - Configurable max_iterations and timeout - Real-time stats callback support for live monitoring - Returns findings as ModuleFinding objects ## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/) - Temporal workflow for orchestrating fuzzing - Downloads user code from MinIO - Executes AtherisFuzzer module - Uploads results to MinIO - Cleans up cache after execution - metadata.yaml with vertical: python for routing ## Test Project (test_projects/python_fuzz_waterfall/) - Demonstrates stateful waterfall vulnerability - main.py with check_secret() that leaks progress - fuzz_target.py with Atheris TestOneInput() harness - Complete README with usage instructions ## Backend Fixes - Fixed parameter merging in REST API endpoints (workflows.py) - Changed workflow parameter passing from positional args to kwargs (manager.py) - Default parameters now properly merged with user parameters ## Testing ✅ Worker discovered AtherisFuzzingWorkflow ✅ Workflow executed end-to-end successfully ✅ Fuzz target auto-discovered in nested directories ✅ Atheris ran 100,000 iterations ✅ Results uploaded and cache cleaned * chore: Complete Temporal migration with updated CLI/SDK/docs This commit includes all remaining Temporal migration changes: ## CLI Updates (cli/) - Updated workflow execution commands for Temporal - Enhanced error handling and exceptions - Updated dependencies in uv.lock ## SDK Updates (sdk/) - Client methods updated for Temporal workflows - Updated models for new workflow execution - Updated dependencies in uv.lock ## Documentation Updates (docs/) - Architecture documentation for Temporal - Workflow concept documentation - Resource management documentation (new) - Debugging guide (new) - Updated tutorials and how-to guides - Troubleshooting updates ## README Updates - Main README with Temporal instructions - Backend README - CLI README - SDK README ## Other - Updated IMPLEMENTATION_STATUS.md - Removed old vulnerable_app.tar.gz These changes complete the Temporal migration and ensure the CLI/SDK work correctly with the new backend. * fix: Use positional args instead of kwargs for Temporal workflows The Temporal Python SDK's start_workflow() method doesn't accept a 'kwargs' parameter. Workflows must receive parameters as positional arguments via the 'args' parameter. Changed from: args=workflow_args # Positional arguments This fixes the error: TypeError: Client.start_workflow() got an unexpected keyword argument 'kwargs' Workflows now correctly receive parameters in order: - security_assessment: [target_id, scanner_config, analyzer_config, reporter_config] - atheris_fuzzing: [target_id, target_file, max_iterations, timeout_seconds] - rust_test: [target_id, test_message] * fix: Filter metadata-only parameters from workflow arguments SecurityAssessmentWorkflow was receiving 7 arguments instead of 2-5. The issue was that target_path and volume_mode from default_parameters were being passed to the workflow, when they should only be used by the system for configuration. Now filters out metadata-only parameters (target_path, volume_mode) before passing arguments to workflow execution. * refactor: Remove Prefect leftovers and volume mounting legacy Complete cleanup of Prefect migration artifacts: Backend: - Delete registry.py and workflow_discovery.py (Prefect-specific files) - Remove Docker validation from setup.py (no longer needed) - Remove ResourceLimits and VolumeMount models - Remove target_path and volume_mode from WorkflowSubmission - Remove supported_volume_modes from API and discovery - Clean up metadata.yaml files (remove volume/path fields) - Simplify parameter filtering in manager.py SDK: - Remove volume_mode parameter from client methods - Remove ResourceLimits and VolumeMount models - Remove Prefect error patterns from docker_logs.py - Clean up WorkflowSubmission and WorkflowMetadata models CLI: - Remove Volume Modes display from workflow info All removed features are Prefect-specific or Docker volume mounting artifacts. Temporal workflows use MinIO storage exclusively. * feat: Add comprehensive test suite and benchmark infrastructure - Add 68 unit tests for fuzzer, scanner, and analyzer modules - Implement pytest-based test infrastructure with fixtures - Add 6 performance benchmarks with category-specific thresholds - Configure GitHub Actions for automated testing and benchmarking - Add test and benchmark documentation Test coverage: - AtherisFuzzer: 8 tests - CargoFuzzer: 14 tests - FileScanner: 22 tests - SecurityAnalyzer: 24 tests All tests passing (68/68) All benchmarks passing (6/6) * fix: Resolve all ruff linting violations across codebase Fixed 27 ruff violations in 12 files: - Removed unused imports (Depends, Dict, Any, Optional, etc.) - Fixed undefined workflow_info variable in workflows.py - Removed dead code with undefined variables in atheris_fuzzer.py - Changed f-string to regular string where no placeholders used All files now pass ruff checks for CI/CD compliance. * fix: Configure CI for unit tests only - Renamed docker-compose.temporal.yaml → docker-compose.yml for CI compatibility - Commented out integration-tests job (no integration tests yet) - Updated test-summary to only depend on lint and unit-tests CI will now run successfully with 68 unit tests. Integration tests can be added later. * feat: Add CI/CD integration with ephemeral deployment model Implements comprehensive CI/CD support for FuzzForge with on-demand worker management: **Worker Management (v0.7.0)** - Add WorkerManager for automatic worker lifecycle control - Auto-start workers from stopped state when workflows execute - Auto-stop workers after workflow completion - Health checks and startup timeout handling (90s default) **CI/CD Features** - `--fail-on` flag: Fail builds based on SARIF severity levels (error/warning/note/info) - `--export-sarif` flag: Export findings in SARIF 2.1.0 format - `--auto-start`/`--auto-stop` flags: Control worker lifecycle - Exit code propagation: Returns 1 on blocking findings, 0 on success **Exit Code Fix** - Add `except typer.Exit: raise` handlers at 3 critical locations - Move worker cleanup to finally block for guaranteed execution - Exit codes now propagate correctly even when build fails **CI Scripts & Examples** - ci-start.sh: Start FuzzForge services with health checks - ci-stop.sh: Clean shutdown with volume preservation option - GitHub Actions workflow example (security-scan.yml) - GitLab CI pipeline example (.gitlab-ci.example.yml) - docker-compose.ci.yml: CI-optimized compose file with profiles **OSS-Fuzz Integration** - New ossfuzz_campaign workflow for running OSS-Fuzz projects - OSS-Fuzz worker with Docker-in-Docker support - Configurable campaign duration and project selection **Documentation** - Comprehensive CI/CD integration guide (docs/how-to/cicd-integration.md) - Updated architecture docs with worker lifecycle details - Updated workspace isolation documentation - CLI README with worker management examples **SDK Enhancements** - Add get_workflow_worker_info() endpoint - Worker vertical metadata in workflow responses **Testing** - All workflows tested: security_assessment, atheris_fuzzing, secret_detection, cargo_fuzzing - All monitoring commands tested: stats, crashes, status, finding - Full CI pipeline simulation verified - Exit codes verified for success/failure scenarios Ephemeral CI/CD model: ~3-4GB RAM, ~60-90s startup, runs entirely in CI containers. * fix: Resolve ruff linting violations in CI/CD code - Remove unused variables (run_id, defaults, result) - Remove unused imports - Fix f-string without placeholders All CI/CD integration files now pass ruff checks.
327 lines
8.8 KiB
Python
327 lines
8.8 KiB
Python
"""
|
|
Utility functions for the FuzzForge SDK.
|
|
|
|
Provides helper functions for path validation, SARIF processing,
|
|
volume mount creation, and other common operations.
|
|
"""
|
|
# Copyright (c) 2025 FuzzingLabs
|
|
#
|
|
# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
|
|
# at the root of this repository for details.
|
|
#
|
|
# After the Change Date (four years from publication), this version of the
|
|
# Licensed Work will be made available under the Apache License, Version 2.0.
|
|
# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Additional attribution and requirements are provided in the NOTICE file.
|
|
|
|
|
|
import os
|
|
import json
|
|
from pathlib import Path
|
|
from typing import Dict, Any, List, Optional, Union
|
|
|
|
from .models import WorkflowSubmission
|
|
from .exceptions import ValidationError
|
|
|
|
|
|
def validate_absolute_path(path: Union[str, Path]) -> Path:
|
|
"""
|
|
Validate that a path is absolute and exists.
|
|
|
|
Args:
|
|
path: Path to validate
|
|
|
|
Returns:
|
|
Validated Path object
|
|
|
|
Raises:
|
|
ValidationError: If path is not absolute or doesn't exist
|
|
"""
|
|
path_obj = Path(path)
|
|
|
|
if not path_obj.is_absolute():
|
|
raise ValidationError(f"Path must be absolute: {path}")
|
|
|
|
if not path_obj.exists():
|
|
raise ValidationError(f"Path does not exist: {path}")
|
|
|
|
return path_obj
|
|
|
|
|
|
def create_workflow_submission(
|
|
parameters: Optional[Dict[str, Any]] = None,
|
|
timeout: Optional[int] = None
|
|
) -> WorkflowSubmission:
|
|
"""
|
|
Create a workflow submission.
|
|
|
|
Note: This function is deprecated. Use client.submit_workflow_with_upload() instead
|
|
which handles file uploads automatically.
|
|
|
|
Args:
|
|
parameters: Workflow-specific parameters
|
|
timeout: Execution timeout in seconds
|
|
|
|
Returns:
|
|
WorkflowSubmission object
|
|
|
|
Raises:
|
|
ValidationError: If parameters are invalid
|
|
"""
|
|
# Validate timeout
|
|
if timeout is not None:
|
|
if timeout < 1 or timeout > 604800: # Max 7 days
|
|
raise ValidationError(f"Timeout must be between 1 and 604800 seconds: {timeout}")
|
|
|
|
return WorkflowSubmission(
|
|
parameters=parameters or {},
|
|
timeout=timeout
|
|
)
|
|
|
|
|
|
def extract_sarif_results(sarif_data: Dict[str, Any]) -> List[Dict[str, Any]]:
|
|
"""
|
|
Extract results from SARIF format findings.
|
|
|
|
Args:
|
|
sarif_data: SARIF formatted data
|
|
|
|
Returns:
|
|
List of result objects from SARIF
|
|
|
|
Raises:
|
|
ValidationError: If SARIF data is malformed
|
|
"""
|
|
if not isinstance(sarif_data, dict):
|
|
raise ValidationError("SARIF data must be a dictionary")
|
|
|
|
runs = sarif_data.get("runs", [])
|
|
if not isinstance(runs, list):
|
|
raise ValidationError("SARIF runs must be a list")
|
|
|
|
results = []
|
|
for run in runs:
|
|
if not isinstance(run, dict):
|
|
continue
|
|
|
|
run_results = run.get("results", [])
|
|
if isinstance(run_results, list):
|
|
results.extend(run_results)
|
|
|
|
return results
|
|
|
|
|
|
def count_sarif_severity_levels(sarif_data: Dict[str, Any]) -> Dict[str, int]:
|
|
"""
|
|
Count findings by severity level in SARIF data.
|
|
|
|
Args:
|
|
sarif_data: SARIF formatted data
|
|
|
|
Returns:
|
|
Dictionary mapping severity levels to counts
|
|
"""
|
|
results = extract_sarif_results(sarif_data)
|
|
severity_counts = {"error": 0, "warning": 0, "note": 0, "info": 0}
|
|
|
|
for result in results:
|
|
level = result.get("level", "warning")
|
|
if level in severity_counts:
|
|
severity_counts[level] += 1
|
|
else:
|
|
# Default unknown levels to warning
|
|
severity_counts["warning"] += 1
|
|
|
|
return severity_counts
|
|
|
|
|
|
def format_sarif_summary(sarif_data: Dict[str, Any]) -> str:
|
|
"""
|
|
Create a human-readable summary of SARIF findings.
|
|
|
|
Args:
|
|
sarif_data: SARIF formatted data
|
|
|
|
Returns:
|
|
Formatted summary string
|
|
"""
|
|
severity_counts = count_sarif_severity_levels(sarif_data)
|
|
total_findings = sum(severity_counts.values())
|
|
|
|
if total_findings == 0:
|
|
return "No findings detected."
|
|
|
|
summary_parts = [f"Total findings: {total_findings}"]
|
|
|
|
for level, count in severity_counts.items():
|
|
if count > 0:
|
|
summary_parts.append(f"{level.title()}: {count}")
|
|
|
|
return " | ".join(summary_parts)
|
|
|
|
|
|
def save_sarif_to_file(sarif_data: Dict[str, Any], file_path: Union[str, Path]) -> None:
|
|
"""
|
|
Save SARIF data to a JSON file.
|
|
|
|
Args:
|
|
sarif_data: SARIF formatted data
|
|
file_path: Path to save the file
|
|
|
|
Raises:
|
|
ValidationError: If file cannot be written
|
|
"""
|
|
try:
|
|
path_obj = Path(file_path)
|
|
# Create parent directories if they don't exist
|
|
path_obj.parent.mkdir(parents=True, exist_ok=True)
|
|
|
|
with open(path_obj, 'w', encoding='utf-8') as f:
|
|
json.dump(sarif_data, f, indent=2, ensure_ascii=False)
|
|
|
|
except (OSError, json.JSONEncodeError) as e:
|
|
raise ValidationError(f"Failed to save SARIF file: {e}")
|
|
|
|
|
|
def format_duration(seconds: int) -> str:
|
|
"""
|
|
Format duration in seconds to human-readable string.
|
|
|
|
Args:
|
|
seconds: Duration in seconds
|
|
|
|
Returns:
|
|
Formatted duration string
|
|
"""
|
|
if seconds < 60:
|
|
return f"{seconds}s"
|
|
elif seconds < 3600:
|
|
minutes, secs = divmod(seconds, 60)
|
|
return f"{minutes}m {secs}s"
|
|
else:
|
|
hours, remainder = divmod(seconds, 3600)
|
|
minutes, secs = divmod(remainder, 60)
|
|
return f"{hours}h {minutes}m {secs}s"
|
|
|
|
|
|
def format_execution_rate(executions_per_sec: float) -> str:
|
|
"""
|
|
Format execution rate for display.
|
|
|
|
Args:
|
|
executions_per_sec: Executions per second
|
|
|
|
Returns:
|
|
Formatted rate string
|
|
"""
|
|
if executions_per_sec < 1:
|
|
return f"{executions_per_sec:.2f} exec/s"
|
|
elif executions_per_sec < 1000:
|
|
return f"{executions_per_sec:.1f} exec/s"
|
|
else:
|
|
return f"{executions_per_sec/1000:.1f}k exec/s"
|
|
|
|
|
|
def format_memory_size(size_bytes: int) -> str:
|
|
"""
|
|
Format memory size in bytes to human-readable string.
|
|
|
|
Args:
|
|
size_bytes: Size in bytes
|
|
|
|
Returns:
|
|
Formatted size string
|
|
"""
|
|
for unit in ['B', 'KB', 'MB', 'GB', 'TB']:
|
|
if size_bytes < 1024.0:
|
|
return f"{size_bytes:.1f} {unit}"
|
|
size_bytes /= 1024.0
|
|
return f"{size_bytes:.1f} PB"
|
|
|
|
|
|
def get_project_files(
|
|
project_path: Union[str, Path],
|
|
extensions: Optional[List[str]] = None,
|
|
exclude_dirs: Optional[List[str]] = None
|
|
) -> List[Path]:
|
|
"""
|
|
Get list of files in a project directory.
|
|
|
|
Args:
|
|
project_path: Path to project directory
|
|
extensions: List of file extensions to include (e.g., ['.py', '.js'])
|
|
exclude_dirs: List of directory names to exclude (e.g., ['.git', 'node_modules'])
|
|
|
|
Returns:
|
|
List of file paths
|
|
|
|
Raises:
|
|
ValidationError: If project path is invalid
|
|
"""
|
|
project_path_obj = validate_absolute_path(project_path)
|
|
|
|
if not project_path_obj.is_dir():
|
|
raise ValidationError(f"Project path must be a directory: {project_path}")
|
|
|
|
exclude_dirs = exclude_dirs or ['.git', '__pycache__', 'node_modules', '.pytest_cache']
|
|
extensions = extensions or []
|
|
|
|
files = []
|
|
|
|
for root, dirs, filenames in os.walk(project_path_obj):
|
|
# Remove excluded directories from search
|
|
dirs[:] = [d for d in dirs if d not in exclude_dirs]
|
|
|
|
root_path = Path(root)
|
|
|
|
for filename in filenames:
|
|
file_path = root_path / filename
|
|
|
|
# Filter by extensions if specified
|
|
if extensions and not any(filename.endswith(ext) for ext in extensions):
|
|
continue
|
|
|
|
files.append(file_path)
|
|
|
|
return sorted(files)
|
|
|
|
|
|
def estimate_analysis_time(
|
|
project_path: Union[str, Path],
|
|
workflow_type: str = "static"
|
|
) -> int:
|
|
"""
|
|
Estimate analysis time based on project size and workflow type.
|
|
|
|
Args:
|
|
project_path: Path to project directory
|
|
workflow_type: Type of workflow ("static", "dynamic", "fuzzing")
|
|
|
|
Returns:
|
|
Estimated time in seconds
|
|
|
|
Raises:
|
|
ValidationError: If project path is invalid
|
|
"""
|
|
files = get_project_files(project_path)
|
|
total_size = sum(f.stat().st_size for f in files if f.exists())
|
|
|
|
# Base estimates (very rough)
|
|
if workflow_type == "static":
|
|
# ~1MB per second for static analysis
|
|
base_time = max(30, total_size // (1024 * 1024))
|
|
elif workflow_type == "dynamic":
|
|
# Dynamic analysis is slower
|
|
base_time = max(60, total_size // (512 * 1024))
|
|
elif workflow_type == "fuzzing":
|
|
# Fuzzing can run for hours/days
|
|
base_time = 3600 # Default to 1 hour
|
|
else:
|
|
# Unknown workflow type
|
|
base_time = max(60, total_size // (1024 * 1024))
|
|
|
|
# Factor in number of files
|
|
file_factor = max(1, len(files) // 100)
|
|
|
|
return base_time * file_factor |