googleprojectzero / fuzzilli

A JavaScript Engine Fuzzer
Apache License 2.0
1.86k stars 300 forks source link

Allow adding additional ObjectGroups to environment using Profile #419

Closed 0xedward closed 6 months ago

0xedward commented 6 months ago

As far as I'm aware, currently the only way to add additional ObjectGroups to the JS environment requires maintaining a separate fork of Fuzzilli. I thought allowing users of Fuzzilli to supply additional ObjectGroups in their Profiles would remove the need to maintain a separate fork to have a different JS environment from the main branch of Fuzzilli.

An example of a fork that could've benefited from this change is fuzzilli4wasm

Example use case

For Hermes, we want to fuzz the TextEncoder web API (https://github.com/facebook/hermes/commit/3863a36a53005dd1e6d39ea0d4ef5573bafde910, https://github.com/facebook/hermes/commit/7f9d9d5e44e2df5170f33d1604bea3b085f40e39, https://github.com/facebook/hermes/commit/14790c925cadce5eff7e604d7640d6d5451fb7cc):

// HermesProfile.swift
import Fuzzilli

let TextEncoderConstructor = ILType.object(ofGroup: "TextEncoder", withProperties: ["encoding"], withMethods: ["encodeInto", "encode"])

let hermesProfile = Profile(

    // ...

    additionalBuiltins: [
        "TextEncoder"           : TextEncoderConstructor,
    ],

    additionalObjectGroups: [
        ObjectGroup(
            name: "TextEncoder",
            instanceType: TextEncoderConstructor,
            properties: [
                "encoding"      : .jsString,
            ],
            methods: [
                "encodeInto"    : [.string] => .jsTypedArray("Uint8Array"),
                "encode"        : [.string, .iterable] => .object(), // Just an example, but .iterable should be a Uint8Array instead
            ]),
    ],

    // ...
)

Test plan

  1. Updated Fuzzilli.JavaScriptEnvironment.groups and Fuzzilli.JavaScriptEnvironment.builtinTypes access control modifiers from private to public
  2. Added print statements to print environment.groups and environment.builtinTypes in FuzzilliCli/main.swift
  3. Ran Fuzzilli - swift run FuzzilliCli --profile=hermes ../fuzzilli_build/bin/fuzzilli --storagePath=./corpus --logLevel=verbose
  4. Checked that TextEncoder is in the output for environment.groups and environment.builtinTypes
0xedward commented 6 months ago

Thanks for the review, Carl! :)