Getting More Confident with Your Security Helper Libraries Thanks to Go Fuzzing
summary
Go fuzzing (Go 1.18) is used to prove and extend fixes for a real path traversal in Grafana OSS by generating thousands of inputs until predicates fail, producing concrete failing cases and test corpus. A quick patch that adds a leading slash becomes covered by fuzz tests but one unit test is not enough, fuzzing finds bypasses in a symlink/relative-path helper and forces rework of validation logic. Integration in CI and exporting fuzz corpora validate fixes over time and surface surprising edge cases. path traversal in Grafana OSS
AI-written summary · about
chapters (10)
- 0:00Start
- 3:36filepath.Clean is tricky
- 5:13The vulnerable code
- 7:03The fixed code
- 11:09Go Fuzzing example 1: validation logic
- 13:38Go Fuzzing example 1: fixing the predicates
- 15:40Go Fuzzing example 2: validation logic
- 18:33Go Fuzzing example 2: finding a corner case
- 19:35Writing predicates can be challenging
- 23:06Key takeaways
related talks
27mPractical Fuzzing in Go
44mFuzzing in Go: Fear, Despair, Acceptance and the Long-Awaited Success
18mFuzzing in Go
44mFuzzing in Go: Fear, Despair, Acceptance and Long-Awaited Success ☠️
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
01h 15mMake your programs more reliable with Fuzzing
25mHow fuzzing helps to find bugs
25mExploring Some Essential Security Checks for Any Open Source Go Project