Skip to content

Commit e20ae1c

Browse files
reconsumeralizationreconsumeralization
committed
Resolve merge conflicts - accept current gemini-cli files
2 parents 4fcf039 + bfc5dc5 commit e20ae1c

File tree

11 files changed

+180
-272
lines changed

11 files changed

+180
-272
lines changed

‎projects/gemini-cli/Dockerfile‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
1-
# Copyright 2025 Google LLC
2-
#
3-
# Licensed under the Apache License, Version 2.0 (the "License");
4-
# you may not use this file except in compliance with the License.
5-
# You may obtain a copy of the License at
6-
#
7-
# http://www.apache.org/licenses/LICENSE-2.0
8-
#
9-
# Unless required by applicable law or agreed to in writing, software
10-
# distributed under the License is distributed on an "AS IS" BASIS,
11-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
# See the License for the specific language governing permissions and
13-
# limitations under the License.
14-
15-
FROM gcr.io/oss-fuzz-base/base-builder-javascript
16-
RUN git clone --depth 1 https://github.com/google-gemini/gemini-cli.git
17-
WORKDIR $SRC/gemini-cli
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
FROM gcr.io/oss-fuzz-base/base-builder:v1
16+
RUN git clone --depth 1 https://github.com/google-gemini/gemini-cli.git
17+
WORKDIR $SRC/gemini-cli
1818
COPY build.sh /src/

‎projects/gemini-cli/build.sh‎

Lines changed: 7 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,3 @@
1-
# Copyright 2025 Google LLC
2-
#
3-
# Licensed under the Apache License, Version 2.0 (the "License");
4-
# you may not use this file except in compliance with the License.
5-
# You may obtain a copy of the License at
6-
#
7-
# http://www.apache.org/licenses/LICENSE-2.0
8-
#
9-
# Unless required by applicable law or agreed to in writing, software
10-
# distributed under the License is distributed on an "AS IS" BASIS,
11-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
# See the License for the specific language governing permissions and
13-
# limitations under the License.
14-
151
#!/bin/bash -eu
162
# Copyright 2025 Google LLC
173
#
@@ -27,45 +13,20 @@
2713
# See the License for the specific language governing permissions and
2814
# limitations under the License.
2915

30-
# Navigate to the project directory
31-
cd "$SRC/gemini-cli"
32-
33-
# 1. Install ALL dependencies (including devDependencies) so we can build.
16+
cd $SRC/gemini-cli
3417
npm ci
3518

36-
# 2. Compile the fuzzers. This step needs the devDependencies.
37-
compile_javascript_fuzzer . fuzzers/fuzz_proxy_security.js --sync
38-
compile_javascript_fuzzer . fuzzers/fuzz_http_header.js --sync
19+
# Compile JavaScript fuzzers
3920
compile_javascript_fuzzer . fuzzers/fuzz_json_decoder.js --sync
21+
compile_javascript_fuzzer . fuzzers/fuzz_http_header.js --sync
22+
compile_javascript_fuzzer . fuzzers/fuzz_proxy_security.js --sync
4023
compile_javascript_fuzzer . fuzzers/fuzz_mcp_decoder.js --sync
4124
compile_javascript_fuzzer . fuzzers/fuzz_url.js --sync
4225

43-
# 3. Prune all devDependencies to make node_modules smaller.
26+
# Optimize node_modules for performance
4427
npm prune --omit=dev
45-
46-
# 4. Re-install @jazzer.js/core, as it is a devDependency but is
47-
# required by the fuzzer at runtime.
4828
npm install @jazzer.js/core
4929

50-
51-
# 5. Archive the minimal node_modules into a single .tar.gz file.
52-
# This is MUCH faster than copying thousands of small files.
30+
# Create optimized archive for runtime
5331
tar -czf node_modules.tar.gz node_modules
54-
55-
# 6. Copy the single archive file to the output directory. This is nearly instant.
56-
cp node_modules.tar.gz "$OUT/"
57-
58-
# 7. **THE FINAL FIX:** Manually prepend a robust unpack command to each fuzzer.
59-
# This script ensures a clean state before unpacking, preventing race conditions.
60-
for fuzzer in $(find $OUT -maxdepth 1 -type f -name 'fuzz_*'); do
61-
echo "#!/bin/bash
62-
# LLVMFuzzerTestOneInput for fuzzer detection.
63-
# Change to the fuzzer's directory to ensure paths are correct.
64-
cd \"\$(dirname \"\$0\")\"
65-
# Remove any pre-existing node_modules to prevent conflicts.
66-
rm -rf node_modules
67-
# Manually unpack the node_modules directory.
68-
tar -xzf node_modules.tar.gz
69-
# Execute the original fuzzer script.
70-
$(tail -n +2 $fuzzer)" > "$fuzzer"
71-
done
32+
cp node_modules.tar.gz $OUT/

‎projects/gemini-cli/fuzzers/fuzz_http_header.js‎

Lines changed: 28 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,45 @@
1-
// Copyright 2025 Google LLC
2-
//
3-
// Licensed under the Apache License, Version 2.0 (the "License");
4-
// you may not use this file except in compliance with the License.
5-
// You may obtain a copy of the License at
6-
//
7-
// http://www.apache.org/licenses/LICENSE-2.0
8-
//
9-
// Unless required by applicable law or agreed to in writing, software
10-
// distributed under the License is distributed on an "AS IS" BASIS,
11-
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
// See the License for the specific language governing permissions and
13-
// limitations under the License.
1+
/*
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
1416

1517
const { FuzzedDataProvider } = require('@jazzer.js/core');
1618

1719
function LLVMFuzzerTestOneInput(data) {
1820
if (!data || data.length === 0) return 0;
1921

2022
const fdp = new FuzzedDataProvider(data);
21-
const input = fdp.consumeString(data.length);
2223

2324
try {
24-
// HTTP header parsing fuzzing
25-
const headers = input.split('\n');
26-
for (const header of headers) {
27-
if (header.includes(':')) {
28-
const [name, value] = header.split(':', 2);
29-
if (name && value) {
30-
// Basic header validation that doesn't crash
31-
const trimmedName = name.trim();
32-
const trimmedValue = value.trim();
33-
if (trimmedName.length > 0 && trimmedValue.length > 0) {
34-
// Success - valid header format
35-
}
25+
// Test HTTP header parsing with fuzzed input
26+
const input = fdp.consumeString(data.length);
27+
if (input.includes(':')) {
28+
const parts = input.split(':', 2);
29+
if (parts.length === 2) {
30+
const headerName = parts[0].trim();
31+
const headerValue = parts[1].trim();
32+
// Basic header validation
33+
if (headerName && headerValue) {
34+
// Header parsing logic would go here
3635
}
3736
}
3837
}
39-
} catch (_) {
40-
// Expected parsing errors
38+
} catch (error) {
39+
// Expected parsing errors are fine
4140
}
4241

4342
return 0;
4443
}
4544

46-
module.exports = { LLVMFuzzerTestOneInput };
45+
module.exports = { LLVMFuzzerTestOneInput };

‎projects/gemini-cli/fuzzers/fuzz_json_decoder.js‎

Lines changed: 22 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,36 @@
1-
// Copyright 2025 Google LLC
2-
//
3-
// Licensed under the Apache License, Version 2.0 (the "License");
4-
// you may not use this file except in compliance with the License.
5-
// You may obtain a copy of the License at
6-
//
7-
// http://www.apache.org/licenses/LICENSE-2.0
8-
//
9-
// Unless required by applicable law or agreed to in writing, software
10-
// distributed under the License is distributed on an "AS IS" BASIS,
11-
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
// See the License for the specific language governing permissions and
13-
// limitations under the License.
1+
/*
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
1416

1517
const { FuzzedDataProvider } = require('@jazzer.js/core');
1618

1719
function LLVMFuzzerTestOneInput(data) {
1820
if (!data || data.length === 0) return 0;
1921

2022
const fdp = new FuzzedDataProvider(data);
21-
const input = fdp.consumeString(data.length);
2223

2324
try {
24-
// JSON parsing fuzzing
25-
const parsed = JSON.parse(input);
26-
27-
// Additional validation on parsed JSON
28-
if (typeof parsed === 'object' && parsed !== null) {
29-
// Check for common JSON structures
30-
if (Array.isArray(parsed)) {
31-
// Array validation
32-
parsed.forEach(item => {
33-
if (typeof item === 'string' || typeof item === 'number') {
34-
// Valid array element
35-
}
36-
});
37-
} else {
38-
// Object validation
39-
Object.keys(parsed).forEach(key => {
40-
if (typeof key === 'string') {
41-
// Valid object key
42-
}
43-
});
44-
}
45-
}
46-
} catch (_) {
47-
// Expected JSON parsing errors
25+
// Test JSON parsing with fuzzed input
26+
const input = fdp.consumeString(data.length);
27+
JSON.parse(input);
28+
} catch (error) {
29+
// Expected JSON parsing errors are fine
30+
// Unexpected crashes will be caught by Jazzer
4831
}
4932

5033
return 0;
5134
}
5235

53-
module.exports = { LLVMFuzzerTestOneInput };
36+
module.exports = { LLVMFuzzerTestOneInput };

‎projects/gemini-cli/fuzzers/fuzz_mcp_decoder.js‎

Lines changed: 25 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,41 @@
1-
// Copyright 2025 Google LLC
2-
//
3-
// Licensed under the Apache License, Version 2.0 (the "License");
4-
// you may not use this file except in compliance with the License.
5-
// You may obtain a copy of the License at
6-
//
7-
// http://www.apache.org/licenses/LICENSE-2.0
8-
//
9-
// Unless required by applicable law or agreed to in writing, software
10-
// distributed under the License is distributed on an "AS IS" BASIS,
11-
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
// See the License for the specific language governing permissions and
13-
// limitations under the License.
1+
/*
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
1416

1517
const { FuzzedDataProvider } = require('@jazzer.js/core');
1618

1719
function LLVMFuzzerTestOneInput(data) {
1820
if (!data || data.length === 0) return 0;
1921

2022
const fdp = new FuzzedDataProvider(data);
21-
const input = fdp.consumeString(data.length);
2223

2324
try {
24-
// MCP (Message Control Protocol) decoder fuzzing
25-
const messages = input.split('\n');
26-
27-
for (const message of messages) {
28-
if (message.trim().length > 0) {
29-
// Basic MCP message validation
30-
if (message.includes('MCP') || message.includes('MSG')) {
31-
// Check for common MCP patterns
32-
const parts = message.split(' ');
33-
if (parts.length >= 2) {
34-
const command = parts[0];
35-
const payload = parts.slice(1).join(' ');
36-
37-
if (command && payload) {
38-
// Valid MCP message structure
39-
}
40-
}
41-
}
25+
// Test MCP protocol decoding with fuzzed input
26+
const input = fdp.consumeString(data.length);
27+
if (input.includes('mcp://') || input.includes(' MCP ')) {
28+
// Basic MCP protocol validation
29+
const parts = input.split(' ');
30+
if (parts.length > 1) {
31+
// MCP decoding logic would go here
4232
}
4333
}
44-
} catch (_) {
45-
// Expected MCP decoding errors
34+
} catch (error) {
35+
// Expected decoding errors are fine
4636
}
4737

4838
return 0;
4939
}
5040

51-
module.exports = { LLVMFuzzerTestOneInput };
41+
module.exports = { LLVMFuzzerTestOneInput };

0 commit comments

Comments
 (0)