On 06/25/2013 09:48 PM, Benjamin Poulain wrote:
On Tue, Jun 25, 2013 at 1:56 AM, Renáta Hodován
<[email protected] <mailto:[email protected]>> wrote:
as many of you know already I'm working on an universal web
fuzzer, which is able to generate random test cases for both svg,
html, css and js, and test them against any browser. With this
method we can catch crashes, assertions, memory corruptions and
all the funny things.
A few words about it: Fuzzinator learns from existing test cases
and based on this information it generates new tests that are
syntactically correct. Beside this randomized step I also put some
language specific knowledge into the tests too. Further details
about the theoretical background will be shared in a blogpost soon.
However the results are available in public already and they are
collected under a metabug in bugzilla:
https://bugs.webkit.org/show_bug.cgi?id=116980. So should any of
you feel like browsing or fixing them, don't hesitate to start
with it ;)
First, I would like to say welcome to our new fuzzing overlords. :)
Thanks :)
What is your plan for the tool itself? Is it opensource? Will it be
added to webkit.org <http://webkit.org>?
Experience shows our tools are the most useful when they are
completely automated behind maintained bots doing most of the jobs. Do
you have any long term plans like that?
Ultimately the goal of this project is to have an automated tool that is
running all day long and is reporting the discovered bugs. Actually this
is working locally on a few computers already, however automatically
sharing the results has technical and security issues. Currently the
received failing tests are too large to post without minimization to
bugzilla. On the other hand, reporting every found bug automatically and
immediately, regardless of its type (security or not), might not be a
wise thing. However, what's sure for now is that all found bugs will be
reported: security issues tagged appropriately, and others as publicly
visible.
Further plans are:
* extension with WebGL support
* mixing the a current fuzzers and generating complex but still coherent
webpages
* adding automatism to rebuild the browser under testing regularly
(e.g., fetching a binary built by a build bot slave linked to
webkit.org on a daily (or whatever) basis.)
* implementing automatism to minimise the found bugous input
Cheers,
Reni
Benjamin
_______________________________________________
webkit-dev mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-dev
