build: Fix cifuzz and improve fuzz tests' reliability

internal/notifier/alertmanager_fuzz_test.go

@@ -0,0 +1,69 @@
+/*
+Copyright 2020 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package notifier
+
+import (
+	"context"
+	"crypto/x509"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	fuzz "github.com/AdaLogics/go-fuzz-headers"
+	eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
+)
+
+func Fuzz_AlertManager(f *testing.F) {
+	f.Add("update", "", "", []byte{}, []byte("{}"))
+	f.Add("something", "", "else", []byte{}, []byte(""))
+
+	f.Fuzz(func(t *testing.T,
+		commitStatus, urlSuffix, summary string, seed, response []byte) {
+
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Write(response)
+			io.Copy(io.Discard, r.Body)
+			r.Body.Close()
+		}))
+		defer ts.Close()
+
+		var cert x509.CertPool
+		_ = fuzz.NewConsumer(seed).GenerateStruct(&cert)
+
+		alertmanager, err := NewAlertmanager(fmt.Sprintf("%s/%s", ts.URL, urlSuffix), "", &cert)
+		if err != nil {
+			return
+		}
+
+		event := eventv1.Event{}
+
+		// Try to fuzz the event object, but if it fails (not enough seed),
+		// ignore it, as other inputs are also being used in this test.
+		_ = fuzz.NewConsumer(seed).GenerateStruct(&event)
+
+		if event.Metadata == nil && (commitStatus != "" || summary != "") {
+			event.Metadata = map[string]string{
+				"commit_status": commitStatus,
+				"summary":       summary,
+			}
+		}
+
+		_ = alertmanager.Post(context.TODO(), event)
+	})
+}

internal/notifier/alertmanager_test.go

@@ -18,18 +18,13 @@ package notifier
 
 import (
 	"context"
-	"crypto/x509"
 	"encoding/json"
-	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 
-	eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
 	"github.com/stretchr/testify/require"
-
-	fuzz "github.com/AdaLogics/go-fuzz-headers"
 )
 
 func TestAlertmanager_Post(t *testing.T) {
@@ -49,42 +44,3 @@ func TestAlertmanager_Post(t *testing.T) {
 	err = alertmanager.Post(context.TODO(), testEvent())
 	require.NoError(t, err)
 }
-
-func Fuzz_AlertManager(f *testing.F) {
-	f.Add("update", "", "", []byte{}, []byte("{}"))
-	f.Add("something", "", "else", []byte{}, []byte(""))
-
-	f.Fuzz(func(t *testing.T,
-		commitStatus, urlSuffix, summary string, seed, response []byte) {
-
-		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			w.Write(response)
-			io.Copy(io.Discard, r.Body)
-			r.Body.Close()
-		}))
-		defer ts.Close()
-
-		var cert x509.CertPool
-		_ = fuzz.NewConsumer(seed).GenerateStruct(&cert)
-
-		alertmanager, err := NewAlertmanager(fmt.Sprintf("%s/%s", ts.URL, urlSuffix), "", &cert)
-		if err != nil {
-			return
-		}
-
-		event := eventv1.Event{}
-
-		// Try to fuzz the event object, but if it fails (not enough seed),
-		// ignore it, as other inputs are also being used in this test.
-		_ = fuzz.NewConsumer(seed).GenerateStruct(&event)
-
-		if event.Metadata == nil && (commitStatus != "" || summary != "") {
-			event.Metadata = map[string]string{
-				"commit_status": commitStatus,
-				"summary":       summary,
-			}
-		}
-
-		_ = alertmanager.Post(context.TODO(), event)
-	})
-}

internal/notifier/azure_devops_fuzz_test.go

@@ -0,0 +1,78 @@
+/*
+Copyright 2020 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package notifier
+
+import (
+	"context"
+	"crypto/x509"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	fuzz "github.com/AdaLogics/go-fuzz-headers"
+	eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
+)
+
+const apiLocations = `{"count":0,"value":[{"area":"","id":"428dd4fb-fda5-4722-af02-9313b80305da","routeTemplate":"","resourceName":"","maxVersion":"6.0","minVersion":"5.0","releasedVersion":"6.0"}]}`
+
+func Fuzz_AzureDevOps(f *testing.F) {
+	f.Add("alakazam", "org/proj/_git/repo", "revision/dsa123a", "error", "", []byte{}, []byte(`{"count":1,"value":[{"state":"error","description":"","context":{"genre":"fluxcd","name":"/"}}]}`))
+	f.Add("alakazam", "org/proj/_git/repo", "revision/dsa123a", "info", "", []byte{}, []byte(`{"count":1,"value":[{"state":"info","description":"","context":{"genre":"fluxcd","name":"/"}}]}`))
+	f.Add("alakazam", "org/proj/_git/repo", "revision/dsa123a", "info", "", []byte{}, []byte(`{"count":0,"value":[]}`))
+	f.Add("alakazam", "org/proj/_git/repo", "", "", "Progressing", []byte{}, []byte{})
+
+	f.Fuzz(func(t *testing.T,
+		token, urlSuffix, revision, severity, reason string, seed, response []byte) {
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if strings.HasSuffix(r.URL.Path, "_apis") {
+				w.Write([]byte(apiLocations))
+			} else {
+				w.Write(response)
+			}
+
+			io.Copy(io.Discard, r.Body)
+			r.Body.Close()
+		}))
+		defer ts.Close()
+
+		var cert x509.CertPool
+		_ = fuzz.NewConsumer(seed).GenerateStruct(&cert)
+
+		azureDevOps, err := NewAzureDevOps(fmt.Sprintf("%s/%s", ts.URL, urlSuffix), token, &cert)
+		if err != nil {
+			return
+		}
+
+		event := eventv1.Event{}
+
+		// Try to fuzz the event object, but if it fails (not enough seed),
+		// ignore it, as other inputs are also being used in this test.
+		_ = fuzz.NewConsumer(seed).GenerateStruct(&event)
+
+		if event.Metadata == nil && (revision != "") {
+			event.Metadata = map[string]string{
+				"revision": revision,
+			}
+		}
+		event.Severity = severity
+
+		_ = azureDevOps.Post(context.TODO(), event)
+	})
+}

internal/notifier/azure_devops_test.go

@@ -17,20 +17,10 @@ limitations under the License.
 package notifier
 
 import (
-	"context"
-	"crypto/x509"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
 	"testing"
 
-	eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
 	"github.com/microsoft/azure-devops-go-api/azuredevops/v6/git"
 	"github.com/stretchr/testify/assert"
-
-	fuzz "github.com/AdaLogics/go-fuzz-headers"
 )
 
 func TestNewAzureDevOpsBasic(t *testing.T) {
@@ -70,53 +60,6 @@ func TestDuplicateAzureDevOpsStatus(t *testing.T) {
 	}
 }
 
-const apiLocations = `{"count":0,"value":[{"area":"","id":"428dd4fb-fda5-4722-af02-9313b80305da","routeTemplate":"","resourceName":"","maxVersion":"6.0","minVersion":"5.0","releasedVersion":"6.0"}]}`
-
-func Fuzz_AzureDevOps(f *testing.F) {
-	f.Add("alakazam", "org/proj/_git/repo", "revision/dsa123a", "error", "", []byte{}, []byte(`{"count":1,"value":[{"state":"error","description":"","context":{"genre":"fluxcd","name":"/"}}]}`))
-	f.Add("alakazam", "org/proj/_git/repo", "revision/dsa123a", "info", "", []byte{}, []byte(`{"count":1,"value":[{"state":"info","description":"","context":{"genre":"fluxcd","name":"/"}}]}`))
-	f.Add("alakazam", "org/proj/_git/repo", "revision/dsa123a", "info", "", []byte{}, []byte(`{"count":0,"value":[]}`))
-	f.Add("alakazam", "org/proj/_git/repo", "", "", "Progressing", []byte{}, []byte{})
-
-	f.Fuzz(func(t *testing.T,
-		token, urlSuffix, revision, severity, reason string, seed, response []byte) {
-		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			if strings.HasSuffix(r.URL.Path, "_apis") {
-				w.Write([]byte(apiLocations))
-			} else {
-				w.Write(response)
-			}
-
-			io.Copy(io.Discard, r.Body)
-			r.Body.Close()
-		}))
-		defer ts.Close()
-
-		var cert x509.CertPool
-		_ = fuzz.NewConsumer(seed).GenerateStruct(&cert)
-
-		azureDevOps, err := NewAzureDevOps(fmt.Sprintf("%s/%s", ts.URL, urlSuffix), token, &cert)
-		if err != nil {
-			return
-		}
-
-		event := eventv1.Event{}
-
-		// Try to fuzz the event object, but if it fails (not enough seed),
-		// ignore it, as other inputs are also being used in this test.
-		_ = fuzz.NewConsumer(seed).GenerateStruct(&event)
-
-		if event.Metadata == nil && (revision != "") {
-			event.Metadata = map[string]string{
-				"revision": revision,
-			}
-		}
-		event.Severity = severity
-
-		_ = azureDevOps.Post(context.TODO(), event)
-	})
-}
-
 func azStatus(state git.GitStatusState, context string, description string) *git.GitStatus {
 	genre := "fluxcd"
 	return &git.GitStatus{

internal/notifier/bitbucket_fuzz_test.go

@@ -0,0 +1,77 @@
+/*
+Copyright 2020 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package notifier
+
+import (
+	"context"
+	"crypto/x509"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	fuzz "github.com/AdaLogics/go-fuzz-headers"
+	eventv1 "github.com/fluxcd/pkg/apis/event/v1beta1"
+)
+
+func Fuzz_Bitbucket(f *testing.F) {
+	f.Add("user:pass", "org/repo", "revision/dsa123a", "info", []byte{}, []byte(`{"state":"SUCCESSFUL","description":"","key":"","name":"","url":""}`))
+	f.Add("user:pass", "org/repo", "revision/dsa123a", "error", []byte{}, []byte(`{}`))
+
+	f.Fuzz(func(t *testing.T,
+		token, urlSuffix, revision, severity string, seed, response []byte) {
+
+		ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			io.Copy(io.Discard, r.Body)
+			w.Write(response)
+			r.Body.Close()
+		}))
+		defer ts.Close()
+
+		var cert x509.CertPool
+		_ = fuzz.NewConsumer(seed).GenerateStruct(&cert)
+
+		bitbucket, err := NewBitbucket(fmt.Sprintf("%s/%s", ts.URL, urlSuffix), token, &cert)
+		if err != nil {
+			return
+		}
+
+		apiUrl, err := url.Parse(ts.URL)
+		if err != nil {
+			t.Fatalf("cannot parse api base URL: %v", err)
+		}
+		// Ensure the call does not go to bitbucket and fuzzes the response.
+		bitbucket.Client.SetApiBaseURL(*apiUrl)
+
+		event := eventv1.Event{}
+
+		// Try to fuzz the event object, but if it fails (not enough seed),
+		// ignore it, as other inputs are also being used in this test.
+		_ = fuzz.NewConsumer(seed).GenerateStruct(&event)
+
+		if event.Metadata == nil && (revision != "") {
+			event.Metadata = map[string]string{
+				"revision": revision,
+			}
+		}
+		event.Severity = severity
+
+		_ = bitbucket.Post(context.TODO(), event)
+	})
+}