CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/jazzer-jvm-fuzzing

Author and run Jazzer - Code Intelligence's JVM coverage-guided fuzzer built on libFuzzer. Covers Maven / Gradle / standalone JAR installation, the @FuzzTest annotation (JUnit 5 integration), typed parameter mutation (String, primitives, byte[]), built-in JVM sanitisers (SSRF / path traversal / OS command injection / deserialization gadget / ReDoS), and the JAZZER_FUZZ=1 env var to switch between regression and fuzzing modes. Use for fuzz testing Java / Kotlin libraries - particularly effective against parsing, deserialization, and HTTP-handling code.

70

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

sanitisers-and-ci.mdreferences/

Jazzer: JVM sanitisers and CI

Deep reference for jazzer-jvm-fuzzing. The core install / authoring / running workflow lives in the skill spine; this file holds the full JVM-sanitiser catalogue and the CI job.

JVM sanitisers

Per Jazzer README, built-in detectors fire on security-relevant misuse:

SanitiserWhat it catches
DeserializationUntrusted ObjectInputStream / XStream / Kryo input → gadget execution
SSRFURL constructed from untrusted input pointing at internal infrastructure
Path traversal.. / encoded variants in file path arguments
OS command injectionRuntime.exec / ProcessBuilder with concatenated input
ReDoSCatastrophic-backtracking regex constructed from untrusted input
LDAP injectionLDAP query string concatenation
Naming contextJNDI lookup with untrusted name
SQL injection (via Hibernate / direct JDBC)Query string concatenation

These run automatically - no additional configuration. Disable selectively via --disabled_hooks=....

CI integration

- uses: actions/setup-java@v5
  with: { java-version: '17', distribution: 'temurin' }
- name: Run unit tests + regression fuzz inputs
  run: mvn test
- name: Smoke fuzz (3 min per target)
  run: |
    for cls in $(grep -rl "@FuzzTest" src/test/java/ | \
                 sed 's|src/test/java/||; s|/|.|g; s|.java||'); do
      JAZZER_FUZZ=180 mvn test -Dtest=$cls || true
    done
- uses: actions/upload-artifact@v4
  with:
    name: jazzer-crashes
    path: |
      crash-*
      src/test/resources/**/*

|| true is continue-on-crash: a finding does not fail the job, so the loop still fuzzes every target - triage findings from the uploaded jazzer-crashes artifact. To hard-fail the build on new findings instead, drop || true (the first crash then fails the step).

references

sanitisers-and-ci.md

SKILL.md

tile.json