Skip to content

[VRP] Harden testcase safety check in long-lived bots - #5368

Merged
PauloVLB merged 4 commits into
masterfrom
vrp-untrusted-testcase-safety
Sep 2, 2026
Merged

PauloVLB merged 4 commits into
masterfrom
vrp-untrusted-testcase-safety

Conversation

@PauloVLB

@PauloVLB PauloVLB commented Jul 15, 2026

Copy link
Copy Markdown
Collaborator

Problem

Long-lived bots shouldn't be handling untrusted testcases locally (like during minimization, analyze, regression or variant tasks). The old check used the UNTRUSTED_UTASK env var with just a warning, which wasn't reliable.

Proposed Solution

Harden check_handling_testcase_safe in uworker_io.py to check testcase.trusted and environment.is_uworker(). If a long-lived bot (is_uworker() is False) tries to handle an untrusted testcase, it will immediately exit with a fatal error. Also aligned its behavior and return values with check_running_fuzzer_safe.

Notes on TODOs

  • Removed the TODO in task_creation.py (create_variant_tasks_if_needed) because untrusted testcase handling is already covered.
  • Updated the TODO in corpus_pruning_task.py to specify "engine fuzzing": the untrusted testcases we are supporting are strictly for blackbox fuzzing, which do not reach the corpus prunning task.

Testing

  • Added unit tests in uworker_io_test.py covering trusted testcases, untrusted testcases on uworkers, and fatal exits on long-lived bots.
  • Updated test helpers (test_utils.py, utask_helpers.py, minimize_task_test.py) to default testcases to trusted=True so unrelated tests don't trigger the fatal safety check.

@PauloVLB
PauloVLB force-pushed the vrp-untrusted-testcase-safety branch 5 times, most recently from 627f503 to 6a39d40 Compare July 16, 2026 20:37
@PauloVLB
PauloVLB changed the base branch from master to vrp-untrusted-testcases-from-fuzzers July 16, 2026 20:39
@PauloVLB
PauloVLB force-pushed the vrp-untrusted-testcase-safety branch from 6a39d40 to 20c1288 Compare July 16, 2026 20:59
@PauloVLB
PauloVLB force-pushed the vrp-untrusted-testcase-safety branch from 20c1288 to 3f3929c Compare August 10, 2026 14:13
Base automatically changed from vrp-untrusted-testcases-from-fuzzers to master August 12, 2026 16:22
@PauloVLB
PauloVLB force-pushed the vrp-untrusted-testcase-safety branch 6 times, most recently from 0c32e20 to 91ca0c6 Compare August 28, 2026 18:58
@PauloVLB
PauloVLB marked this pull request as ready for review August 28, 2026 19:01
@PauloVLB
PauloVLB requested a review from a team as a code owner August 28, 2026 19:01
@PauloVLB
PauloVLB requested a review from dylanjew August 28, 2026 19:02
Comment thread src/clusterfuzz/_internal/bot/tasks/utasks/uworker_io.py
Comment thread src/clusterfuzz/_internal/bot/tasks/task_creation.py
@PauloVLB
PauloVLB force-pushed the vrp-untrusted-testcase-safety branch from 91ca0c6 to 40ad82f Compare August 31, 2026 13:39
Comment thread src/clusterfuzz/_internal/bot/tasks/task_creation.py
Comment thread src/clusterfuzz/_internal/bot/tasks/utasks/corpus_pruning_task.py Outdated
@PauloVLB
PauloVLB force-pushed the vrp-untrusted-testcase-safety branch from 40ad82f to 1bea54b Compare September 2, 2026 13:38
@PauloVLB
PauloVLB merged commit b49127c into master Sep 2, 2026
15 checks passed
@PauloVLB
PauloVLB deleted the vrp-untrusted-testcase-safety branch September 2, 2026 14:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants