From 20c128861375b37e6ffd4fb585c8d5ad3620fc8a Mon Sep 17 00:00:00 2001
From: Paulo Borges <paulovlb@google.com>
Date: Wed, 15 Jul 2026 19:22:19 +0000
Subject: [PATCH] Harden testcase safety check in long-lived bots

---
 .../_internal/bot/tasks/utasks/uworker_io.py           | 10 ++++++----
 .../tests/core/bot/tasks/utasks/minimize_task_test.py  |  3 ++-
 .../_internal/tests/test_libs/test_utils.py            |  1 +
 .../_internal/tests/test_libs/utask_helpers.py         |  2 +-
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/clusterfuzz/_internal/bot/tasks/utasks/uworker_io.py b/src/clusterfuzz/_internal/bot/tasks/utasks/uworker_io.py
index db71ebf0b86..05bfa929f56 100644
--- a/src/clusterfuzz/_internal/bot/tasks/utasks/uworker_io.py
+++ b/src/clusterfuzz/_internal/bot/tasks/utasks/uworker_io.py
@@ -237,10 +237,12 @@ def check_handling_testcase_safe(testcase):
   safely."""
   if testcase.trusted:
     return
-  if not environment.get_value('UNTRUSTED_UTASK'):
-    # TODO(https://b.corp.google.com/issues/328691756): Change this to
-    # log_fatal_and_exit once we are handling untrusted tasks properly.
-    logs.warning(f'Cannot handle {testcase.key.id()} in trusted task.')
+  if environment.is_uworker():
+    return
+
+  logs.log_fatal_and_exit(
+      f'Security Violation: Cannot handle untrusted testcase '
+      f'{testcase.key.id()} in long-lived bot.')
 
 
 def check_running_fuzzer_safe(fuzzer):
diff --git a/src/clusterfuzz/_internal/tests/core/bot/tasks/utasks/minimize_task_test.py b/src/clusterfuzz/_internal/tests/core/bot/tasks/utasks/minimize_task_test.py
index a4dd0a2046f..51347583db9 100644
--- a/src/clusterfuzz/_internal/tests/core/bot/tasks/utasks/minimize_task_test.py
+++ b/src/clusterfuzz/_internal/tests/core/bot/tasks/utasks/minimize_task_test.py
@@ -112,6 +112,7 @@ def setUp(self):
     """Set up."""
     super().setUp()
     environment.set_value('JOB_NAME', 'libfuzzer_asan_job')
+    environment.set_value('UWORKER', True)
 
     patcher = mock.patch(
         'clusterfuzz._internal.bot.fuzzers.libFuzzer.fuzzer.LibFuzzer.fuzzer_directory',
@@ -376,7 +377,7 @@ def test_check_app_path_exit(self, setup_testcase, preprocess_setup_testcase,
     setup_testcase.return_value = ([], '/path', None)
     del setup_build
     del check_app_path
-    testcase = data_types.Testcase()
+    testcase = data_types.Testcase(trusted=True)
     testcase.put()
     environment.set_value('FAIL_WAIT', 10)
     uworker_input = uworker_msg_pb2.Input(
diff --git a/src/clusterfuzz/_internal/tests/test_libs/test_utils.py b/src/clusterfuzz/_internal/tests/test_libs/test_utils.py
index 5048122163f..6b0d8e88381 100644
--- a/src/clusterfuzz/_internal/tests/test_libs/test_utils.py
+++ b/src/clusterfuzz/_internal/tests/test_libs/test_utils.py
@@ -63,6 +63,7 @@ def create_generic_testcase(created_days_ago=28):
   testcase.timestamp = CURRENT_TIME - datetime.timedelta(days=created_days_ago)
   testcase.project_name = 'project'
   testcase.platform = 'linux'
+  testcase.trusted = True
   testcase.put()
 
   return testcase
diff --git a/src/clusterfuzz/_internal/tests/test_libs/utask_helpers.py b/src/clusterfuzz/_internal/tests/test_libs/utask_helpers.py
index 174ffc1d537..d6470620a53 100644
--- a/src/clusterfuzz/_internal/tests/test_libs/utask_helpers.py
+++ b/src/clusterfuzz/_internal/tests/test_libs/utask_helpers.py
@@ -64,7 +64,7 @@ def setUp(self):
     self.uworker_env = commands.update_environment_for_job(environment_string)
     job.put()
     self.fuzz_target = 'test_fuzzer'
-    self.testcase = data_types.Testcase(job_type=self.job_type)
+    self.testcase = data_types.Testcase(job_type=self.job_type, trusted=True)
     self.testcase.fuzzed_keys = blobs.write_blob(
         os.path.join(TEST_LIBS_DATA_DIR,
                      'crash-adc83b19e793491b1c6ea0fd8b46cd9f32e592fc'))