Re: Fuzzing Django at Google OSS-Fuzz

2019-07-08 Thread Guido Vranken
You can use every email address (like security@dp), including non-Google e-mail addresses, but they will only receive notifications and will not be able to login to the OSS-Fuzz dashboard at https://oss-fuzz.com/. Adding more e-mail addresses is done by making a PR against OSS-Fuzz and changing the

Re: Fuzzing Django at Google OSS-Fuzz

2019-07-07 Thread Florian Apolloner
Hi Guido, wow. That would be very much appreciated. security@dp is just a google mailing list I fear. If you added me, would it be possible that I manage the other email addresses, or would you have to do that all? Also for now please do not add anyone without my sayso, I'll get in touch with y

Fuzzing Django at Google OSS-Fuzz

2019-07-06 Thread Guido Vranken
Dear group, I've built a Django fuzzer that can be used with Google OSS-Fuzz [1]. The current fuzzer harness calls a host of django.util.* and related functions with pseudo-random inputs. Fuzzing these functions can be useful to see if any untrusted input can cause slowdowns, hangs, excessive m