All Projects → PingCAP-QE → go-sqlancer

PingCAP-QE / go-sqlancer

Licence: other
go-sqlancer

Programming Languages

go
31211 projects - #10 most used programming language
Makefile
30231 projects

Projects that are alternatives of or similar to go-sqlancer

Sqlancer
Detecting Logic Bugs in DBMS
Stars: ✭ 672 (+1001.64%)
Mutual labels:  fuzzing, tidb
FuSeBMC
FuSeBMC is a novel Energy-Efficient Test Generator that exploits fuzzing and BMC engines to detect security vulnerabilities in real-world C programs.
Stars: ✭ 26 (-57.38%)
Mutual labels:  fuzzing
flink-tidb-rdw
A sample of Flink TiDB Realtime Datawarehouse.
Stars: ✭ 71 (+16.39%)
Mutual labels:  tidb
fuzza
Customizable TCP fuzzing tool to test for remote buffer overflows.
Stars: ✭ 29 (-52.46%)
Mutual labels:  fuzzing
microgp4
A multi-purpose extensible self-adaptive evolutionary tool
Stars: ✭ 21 (-65.57%)
Mutual labels:  fuzzing
sandsifter
The x86 processor fuzzer
Stars: ✭ 21 (-65.57%)
Mutual labels:  fuzzing
doona
Network based protocol fuzzer
Stars: ✭ 64 (+4.92%)
Mutual labels:  fuzzing
PingCAP
Scripts for TiDB
Stars: ✭ 13 (-78.69%)
Mutual labels:  tidb
healer
Kernel fuzzer inspired by Syzkaller.
Stars: ✭ 194 (+218.03%)
Mutual labels:  fuzzing
dizzy-legacy
Network and USB protocol fuzzing toolkit.
Stars: ✭ 35 (-42.62%)
Mutual labels:  fuzzing
AEGPaper
Automatic Exploit Generation Paper
Stars: ✭ 30 (-50.82%)
Mutual labels:  fuzzing
transferdb
TransferDB 支持异构数据库 schema 转换、全量数据导出导入以及增量数据同步功能( Oracle 数据库 -> MySQL/TiDB 数据库)
Stars: ✭ 30 (-50.82%)
Mutual labels:  tidb
leaky-paths
A collection of special paths linked to major web CVEs, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.
Stars: ✭ 507 (+731.15%)
Mutual labels:  fuzzing
rust-verification-tools
RVT is a collection of tools/libraries to support both static and dynamic verification of Rust programs.
Stars: ✭ 237 (+288.52%)
Mutual labels:  fuzzing
Kirenenko
Super Fast Concolic Execution Engine based on Source Code Taint Tracing
Stars: ✭ 84 (+37.7%)
Mutual labels:  fuzzing
lagopus
Distributed fuzzing platform
Stars: ✭ 28 (-54.1%)
Mutual labels:  fuzzing
evine
Interactive CLI Web Crawler
Stars: ✭ 140 (+129.51%)
Mutual labels:  fuzzing
katnip
Extension library for the Kitty fuzzing framework
Stars: ✭ 73 (+19.67%)
Mutual labels:  fuzzing
ML4Sec-papers
Research papers on ML for security
Stars: ✭ 27 (-55.74%)
Mutual labels:  fuzzing
fuzzing-tutorial
Curated list of classic fuzzing books, papers about fuzzing at information security top conferences over the years, commonly used fuzzing tools, and resources that can help us use fuzzer easily.
Stars: ✭ 74 (+21.31%)
Mutual labels:  fuzzing

Go-sqlancer

Test Go Report Card

Inspired by Manuel Rigger's paper Testing Database Engines via Pivoted Query Synthesis.

Testing approaches

Go-sqlancer has supported Pivoted Query Synthesis (PQS), Non-optimizing Reference Engine Construction (NoREC) and Ternary Logic Partitioning (TLP). You can use -mode to specify the testing approach.

Quickstart

make
bin/go-sqlancer -dsn "root:@tcp(127.0.0.1:4000)/"

And other flags you can set:

Usage of go-sqlancer:
  -approach string
        use NoRec or PQS method or both, split by vertical bar (default "pqs|norec|tlp")
  -depth int
        sql depth (default 1)
  -dsn string
        dsn of target db for testing
  -duration duration
        fuzz duration (default 5h0m0s)
  -enable-expr-idx
        enable create expression index
  -enable-hint
        enable sql hint for TiDB
  -log-level string
        set log level: info, warn, error, debug [default: info] (default "info")
  -silent
        silent when verify failed
  -view-count int
        count of views to be created (default 10)

Supported Statement

Functions & Operators

XOR, AND, OR, NOT, GT, LT, NE, EQ, GE, LE, IF, CASE, IN, BETWEEN, etc.

create table t(a float);
insert t values(NULL);
select * from t where (!(a and a)) is null;

---
tidb> select * from t where (!(a and a)) is null;
Empty set (0.00 sec)
----
mysql> select * from t where (!(a and a)) is null;
+------+
| a    |
+------+
| NULL |
+------+
1 row in set (0.00 sec)
---
create table t0(c0 int);
insert into t0 values(null);

---
tidb> select * from t0 where ((!(1.5071004017670217e-01=t0.c0))) IS NULL;
Empty set (0.00 sec)

tidb> select ((!(1.5071004017670217e-01=null))) IS NULL;
+--------------------------------------------+
| ((!(1.5071004017670217e-01=null))) IS NULL |
+--------------------------------------------+
|                                          1 |
+--------------------------------------------+
1 row in set (0.00 sec)
create table t(c int);
insert into t values(1), (NULL);

---
tidb> select c, c = 0.5 from t;
+------+---------+
| c    | c = 0.5 |
+------+---------+
|    1 |       0 |
| NULL |       0 |
+------+---------+
2 rows in set (0.01 sec)
---
mysql> select c, c = 0.5 from t;
+------+---------+
| c    | c = 0.5 |
+------+---------+
|    1 |       0 |
| NULL |    NULL |
+------+---------+
2 rows in set (0.00 sec)
mysql> desc table_int_float;
+-----------+---------+------+------+---------+----------------+
| Field     | Type    | Null | Key  | Default | Extra          |
+-----------+---------+------+------+---------+----------------+
| id        | int(16) | NO   | PRI  | NULL    | auto_increment |
| col_int   | int(16) | YES  |      | NULL    |                |
| col_float | float   | YES  | MUL  | NULL    |                |
+-----------+---------+------+------+---------+----------------+
3 rows in set (0.00 sec)
mysql> select col_float from table_varchar_float;
+-----------+
| col_float |
+-----------+
|      NULL |
+-----------+

---
tidb> SELECT * FROM table_varchar_float WHERE !(table_varchar_float.col_float and 1) IS NULL;
Empty set (0.00 sec)

View

Table partition

create table t(id int not null auto_increment, col_int int not null, col_float float, primary key(id, col_int)) partition by range(col_int) (partition p0 values less than (100), partition pn values less than (MAXVALUE));
insert into t values(1, 10, 1), (101, 100, 101);

---
tidb> SELECT /*+ use_cascades(TRUE)*/ * from t;
Empty set (0.00 sec)

tidb> SELECT * from t;
+-----+---------+-----------+
| id  | col_int | col_float |
+-----+---------+-----------+
| 101 |     100 |       101 |
|   1 |      10 |         1 |
+-----+---------+-----------+
2 rows in set (0.00 sec)

SQL Hint

  • hash_agg
  • stream_agg
  • agg_to_cop
  • read_consistent_replica
  • no_index_merge
  • use_toja
  • enable_plan_cache
  • use_cascades
  • hash_join
  • merge_join
  • inl_join
  • memory_quota
  • max_execution_time
  • use_index
  • ignore_index
  • use_index_merge
  • qb_name
  • time_range
  • read_from_storage
  • query_type
  • inl_hash_join
  • inl_merge_join

Issues found by go-sqlancer

Fuzz Issues

Notes

For experimental features in tidb, you need add some configs on tiup startup

[experimental]
allow-expression-index = true
allow-auto-random = true
tiup playground nightly --db.config path/to/config/file
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].