[HtmlSanitizer] Add fuzzing and mutation testing workflows - #64321

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

• Always add tests
• Keep backward compatibility (see https://symfony.com/bc).
• Bug fixes must be submitted against the lowest maintained branch where they apply (see https://symfony.com/releases)
• Features and deprecations must be submitted against the 8.1 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

I do not understand the unit / integration test failures. It doesn't seem likely that these changes could have caused them, as I did not touch the tests nor existing code inside src/.

(The static analysis failures make sense, because of how PHP-Fuzzer works. I'm not sure the best way to hack around it.)

Thanks for this, and thanks for your patience with how long it took to get an answer.

Closing. We would rather run this kind of analysis as an occasional audit than carry fuzzing and mutation testing as standing CI infrastructure, since the maintenance of a workflow is ours forever.

The wiring here shows why it is not free either. The fuzzer triggers on every pull request touching src/Symfony/**, which is close to every pull request, at 100000 runs per target with a four hour timeout, and targets are auto-discovered, so each component you added would multiply that. A crash found by one of those campaigns would then turn an unrelated contributor's PR red for something their change did not cause. The corpus does not persist between runs either, so every campaign restarts from the six seeds and never gets deeper, which is where the value of fuzzing actually comes from.

None of that is a criticism of fuzzing HtmlSanitizer, which is exactly the right component to point this at. Findings from campaigns you run on your side are very welcome: anything exploitable through https://symfony.com/security, the rest as regular bug reports.