googleprojectzero / domato

DOM fuzzer
https://googleprojectzero.blogspot.ch/2017/09/the-great-dom-fuzz-off-of-2017.html
Apache License 2.0
1.69k stars 278 forks source link

Add support for PHP #27

Closed jvoisin closed 4 years ago

jvoisin commented 4 years ago

This commit was inspired (but completely rewritten) by https://blog.jmpesp.org/2020/01/fuzzing-php-with-domato.html

The php_generated.txt file was generated via parse_types.py

googlebot commented 4 years ago

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

:memo: Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it! and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

jvoisin commented 4 years ago

`@googlebot I signed it!

googlebot commented 4 years ago

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

ifratric commented 4 years ago

Thanks, looks cool!

A couple of notes:

  1. Callbacks are currently unused (<fuzzfunction> always point to phpinfo). Generating callback code in a similar manner to the main function could potentially expose additional bugs, especially if callbacks get access to the same variables / can mess up stuff that the caller didn't expect.

  2. Currently, the return vallues from the function / method calls are ignored. In cases where function / method calls return non-trivial types, wouldn't it be better to store these return values in variables and use them as function arguments in later calls or potentially call methods on these "generated" objects?

jvoisin commented 4 years ago

I wanted to keep the pull-request simple. I added your suggestions (and the other items on my todo-list) in the README.md file.

ifratric commented 4 years ago

Alright, merging as is for now. Thanks!