Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow adding additional ObjectGroups to environment using Profile #419

Merged
merged 1 commit into from
Mar 5, 2024
Merged

Allow adding additional ObjectGroups to environment using Profile #419

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/DuktapeProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,5 +54,7 @@ let duktapeProfile = Profile(

],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/JSCProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,5 +115,7 @@ let jscProfile = Profile(
"ensureArrayStorage" : .function([] => .anything),
],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/JerryscriptProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,5 +50,7 @@ let jerryscriptProfile = Profile(
"placeholder" : .function([] => .undefined),
],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
1 change: 1 addition & 0 deletions Sources/FuzzilliCli/Profiles/Profile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ struct Profile {
let disabledMutators: [String]

let additionalBuiltins: [String: ILType]
let additionalObjectGroups: [ObjectGroup]

// An optional post-processor that is executed for every sample generated for fuzzing and can modify it.
let optionalPostProcessor: FuzzingPostProcessor?
Expand Down
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/QjsProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,5 +47,7 @@ let qjsProfile = Profile(
"placeholder" : .function([] => .undefined)
],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/QtjsProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,5 +59,7 @@ let qtjsProfile = Profile(
"gc" : .function([] => .undefined),
],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/Serenity.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,5 +43,7 @@ let serenityProfile = Profile(
"gc": .function([] => .undefined)
],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/SpidermonkeyProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,5 +106,7 @@ let spidermonkeyProfile = Profile(

],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
1 change: 1 addition & 0 deletions Sources/FuzzilliCli/Profiles/V8HoleFuzzingProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,5 +102,6 @@ let v8HoleFuzzingProfile = Profile(
"d8" : .object(),
"Worker" : .constructor([.anything, .object()] => .object(withMethods: ["postMessage","getMessage"])),
],
additionalObjectGroups: [],
optionalPostProcessor: nil
)
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/V8Profile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -598,5 +598,7 @@ let v8Profile = Profile(
"Worker" : .constructor([.anything, .object()] => .object(withMethods: ["postMessage","getMessage"])),
],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
2 changes: 2 additions & 0 deletions Sources/FuzzilliCli/Profiles/XSProfile.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,5 +50,7 @@ let xsProfile = Profile(
"placeholder" : .function([] => .undefined),
],

additionalObjectGroups: [],

optionalPostProcessor: nil
)
8 changes: 7 additions & 1 deletion Sources/FuzzilliCli/main.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -438,7 +438,13 @@ func makeFuzzer(with configuration: Configuration) -> Fuzzer {
}

// The environment containing available builtins, property names, and method names.
let environment = JavaScriptEnvironment(additionalBuiltins: profile.additionalBuiltins, additionalObjectGroups: [])
let environment = JavaScriptEnvironment(additionalBuiltins: profile.additionalBuiltins, additionalObjectGroups: profile.additionalObjectGroups)
if !profile.additionalBuiltins.isEmpty {
logger.verbose("Loaded additional builtins from profile: \(profile.additionalBuiltins.map { $0.key })")
}
if !profile.additionalObjectGroups.isEmpty {
logger.verbose("Loaded additional ObjectGroups from profile: \(profile.additionalObjectGroups.map { $0.name })")
Comment on lines +443 to +446
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
logger.verbose("Loaded additional builtins from profile: \(profile.additionalBuiltins.map { $0.key })")
}
if !profile.additionalObjectGroups.isEmpty {
logger.verbose("Loaded additional ObjectGroups from profile: \(profile.additionalObjectGroups.map { $0.name })")
logger.info("Loaded additional builtins from profile: \(profile.additionalBuiltins.map { $0.key })")
}
if !profile.additionalObjectGroups.isEmpty {
logger.info("Loaded additional ObjectGroups from profile: \(profile.additionalObjectGroups.map { $0.name })")

What are your thoughts on using logger.info instead logger.verbose here?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this logging is necessary as we will also print all registered builtins in the initialize function in the JavaScriptEnvironment. So if you want to keep this for visibility then we should use .verbose, otherwise I think we could also drop this, your choice :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, I noticed that initialize in JavaScriptEnvironment prints all the registered builtins and objectGroups. Since we fuzz using quite a few Fuzzilli profiles, I think we'd find it helpful to have which of the objectGroups and builtins were loaded from the profile without having to search through the full list of objectGroups and builtins in our logs

}

// A lifter to translate FuzzIL programs to JavaScript.
let lifter = JavaScriptLifter(prefix: profile.codePrefix,
Expand Down
3 changes: 2 additions & 1 deletion Targets/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,4 +71,5 @@ Once a profile has been made, it also needs to be added to the list in [Profile.
- `additionalProgramTemplates`: Additional [program templates](../Docs/HowFuzzilliWorks.md#program-templates) for the fuzzer to generate programs from. Examples for ProgramTemplates can be found in [ProgramTemplates.swift](../Sources/Fuzzilli/CodeGen/ProgramTemplates.swift)
- `disabledCodeGenerators`: List of code generators to disable. The current list of code generators is in [CodeGenerators.swift](../Sources/Fuzzilli/CodeGen/CodeGenerators.swift) with their respective weights in [CodeGeneratorWeights.swift](../Sources/Fuzzilli/CodeGen/CodeGeneratorsWeights.swift).
- `disabledMutators`: List of mutators to disable, in other words, the mutators in this list will not be selected to mutate input during the fuzzing loop. The current list of enabled mutators is in [FuzzilliCli/main.swift](../Sources/FuzzilliCli/main.swift)
- `additionalBuiltins`: Additional unique builtins for the JS engine. The list does not have to be exhaustive, but should include functionality likely to cause bugs. An example would be a function that triggers garbage collection.
- `additionalBuiltins`: Additional unique builtins for the JS engine. The list does not have to be exhaustive, but should include functionality likely to cause bugs. An example would be a function that triggers garbage collection.
- `additionalObjectGroups`: Additional unique [ObjectGroup](../Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift)s for the JS engine. Examples for ObjectGroups can be found in [JavaScriptEnvironment.swift](../Sources/Fuzzilli/Environment/JavaScriptEnvironment.swift)
Loading