Coverage Guided Javascript Fuzzer
Jsfuzz is coverage-guided fuzzer for testing javascript/nodejs packages.
Fuzzing for safe languages like nodejs is a powerful strategy for finding bugs like unhandled exceptions, logic bugs,
security bugs that arise from both logic bugs and Denial-of-Service caused by hangs and excessive memory usage.
Fuzzing can be seen as a powerful and efficient strategy in real-world software in addition to classic unit-tests.
The first step is to implement the following function (also called a fuzz target):
``javascript`
function fuzz(buf) {
// call your package with buf
}
module.exports = {
fuzz
};
Features of the fuzz target:
* Jsfuzz will call the fuzz target in an infinite loop with random data (according to the coverage guided algorithm) passed to buf( in a separate process).
* The function must catch and ignore any expected exceptions that arise when passing invalid input to the tested package.
* The fuzz target must call the test function/library with with the passed buffer or a transformation on the test buffer
if the structure is different or from different type.
* Fuzz functions can also implement application level checks to catch application/logical bugs - For example:
decode the buffer with the testable library, encode it again, and check that both results are equal. To communicate the results
the result/bug the function should throw an exception.
* jsfuzz will report any unhandled exceptions as crashes as well as inputs that hit the memory limit specified to jsfuzz
or hangs/they run more the the specified timeout limit per testcase.
Here is an example of a simple fuzz function for jpeg-js module.
`javascript
const jpeg = require('jpeg-js');
function fuzz(buf) {
try {
jpeg.decode(buf);
} catch (e) {
// Those are "valid" exceptions. we can't catch them in one line as
// jpeg-js doesn't export/inherit from one exception class/style.
if (e.message.indexOf('JPEG') !== -1 ||
e.message.indexOf('length octect') !== -1 ||
e.message.indexOf('Failed to') !== -1 ||
e.message.indexOf('DecoderBuffer') !== -1 ||
e.message.indexOf('invalid table spec') !== -1 ||
e.message.indexOf('SOI not found') !== -1) {
} else {
throw e;
}
}
}
module.exports = {
fuzz
};
`
The next step is to download js-fuzz and then run your fuzzer
`bash
npm i -g jsfuzz
jsfuzz ./examples/jpeg/fuzz.js corpus
This example quickly finds an infinite hang which takes all the memory in
.$3
Jsfuzz will generate and test various inputs in an infinite loop.
corpus is optional directory and will be used to
save the generated testcases so later runs can be started from the same point and provided as seed corpus.JsFuzz can also start with an empty directory (i.e no seed corpus) though some valid test-cases in the seed corpus
may speed up the fuzzing substantially.
jsfuzz tries to mimic some of the arguments and output style from libFuzzer.
More fuzz targets examples (for real and popular libraries) are located under the examples directory and
bugs that were found using those targets are listed in the trophies section.
$3
Coverage in Istanbul/NYC format is written to .nyc_output/out.json It can be viewer with
nyc cli. For example:`bash
nyc report --reporter=html --exclude-node-modules=false
`This will save the html report to
Currently this library is also ported to python via pythonfuzz
jsfuzz logic is heavily based on go-fuzz originally developed by Dmitry Vyukov's.
Which is in turn heavily based on Michal Zalewski AFL.
A previous take on that was done by https://github.com/connor4312/js-fuzz with a bit different design, coverage and
interface but it looks like it is currently unmaintained.
For coverage jsfuzz is using istanbuljs instrumentation and coverage library.
Contributions are welcome!:) There are still a lot of things to improve, and tests and features to add. We will slowly post those in the
issues section. Before doing any major contribution please open an issue so we can discuss and help guide the process before
any unnecessary work is done.
Feel free to add bugs that you found with jsfuzz to this list via pull-request