[DRAFT] Javascript Injection Fuzzer

fuzzers/jif/README.md

@@ -0,0 +1,20 @@
+# JIF - Javascript Injection Fuzzer
+
+## building
+
+* setup a chromium repo: https://www.chromium.org/developers/how-tos/get-the-code
+    * note that this will take several hours
+    * you MUST use revision: fc68e53944be7
+* `mv jif $root/chromium/src/headless/jif` (or symbolic link appropriately)
+* `cd $root/chromium/src`
+* `python3 tools/mb/mb.py gen -m chromium.fuzz -b 'Libfuzzer Upload Mac ASan' out/jif`
+*  apply patches in chromium_patches.diff
+* `cp args.gn $root/chromium/src/out/jif/` (modify this so the fixed path points to your directory!)
+* modify fixed path in `libafl_cc.rs` so it points to the correct place
+* `./make.sh` (first time will take several hours, after that about 1m)
+
+## running
+
+* `cd $root/chromium/src/out/jif`
+* `./jif --cores 0-3 --broker-port 1337 --harness harness.js -i corpus -x dict -o out`
+* to see arguments, run `./jif --help`

fuzzers/jif/allowlist.txt

@@ -0,0 +1,4 @@
+# Enable instrumentation for a whole folder
+src:*/blink/*
+# Enable instrumentation for all functions in those files
+fun:*

fuzzers/jif/args.gn

@@ -0,0 +1,17 @@
+dcheck_always_on = false
+enable_nacl = false
+ffmpeg_branding = "Chrome"
+is_asan = false
+is_component_build = true
+is_debug = false
+optimize_for_fuzzing = true
+pdf_enable_xfa = true
+proprietary_codecs = true
+use_goma = false
+use_libfuzzer = false
+use_external_fuzzing_engine = true
+sanitizer_coverage_flags = "trace-pc-guard,trace-cmp"
+clang_base_path = "/home/addisoncrump/Dokumente/xss-fuzzing/chromium/src/headless/jif/libjif/llvm/"
+clang_use_chrome_plugins = false
+mac_deployment_target="10.14.0"
+mac_sdk_path="/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk" # must be 12.3 or higher, use xcrun --show-sdk-path

fuzzers/jif/chromium_patches.diff

@@ -0,0 +1,78 @@
+diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
+index aee9abd99a..dc3beb026e 100644
+--- a/chrome/BUILD.gn
++++ b/chrome/BUILD.gn
+@@ -1105,6 +1105,8 @@ if (is_win) {
+       ":chrome_framework",
+       ":chrome_framework_create_bundle",
+       ":chrome_framework_shared_library",
++      "//headless:jif", # JIF
++      "//headless:headless_shared_sources", # JIF
+     ]
+
+     sources = [
+diff --git a/testing/libfuzzer/unittest_main.cc b/testing/libfuzzer/unittest_main.cc
+index 01a7af3253..27f2ec0c5a 100644
+--- a/testing/libfuzzer/unittest_main.cc
++++ b/testing/libfuzzer/unittest_main.cc
+@@ -32,7 +32,7 @@ std::vector<uint8_t> readFile(std::string path) {
+ size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
+   return 0;
+ }
+-
++/**
+ int main(int argc, char **argv) {
+   if (argc == 1) {
+     std::cerr
+@@ -57,3 +57,4 @@ int main(int argc, char **argv) {
+     LLVMFuzzerTestOneInput(v.data(), v.size());
+   }
+ }
++**/
+\ No newline at end of file
+
+diff --git a/headless/BUILD.gn b/headless/BUILD.gn
+index 2a44aec23d..4ea02324d5 100644
+--- a/headless/BUILD.gn
++++ b/headless/BUILD.gn
+@@ -18,6 +18,9 @@ import("//tools/grit/grit_rule.gni")
+ import("//tools/grit/repack.gni")
+ import("//tools/v8_context_snapshot/v8_context_snapshot.gni")
+
++
++
++
+ if (headless_use_policy) {
+   assert(headless_use_prefs,
+          "'headless_use_policy' requires 'headless_use_prefs'.")
+@@ -298,6 +301,7 @@ source_set("headless_shared_sources") {
+   visibility = [
+     ":headless_non_renderer",
+     ":headless_renderer",
++    ":jif", # JIF
+   ]
+   defines = []
+
+@@ -1063,3 +1067,22 @@ executable("headless_example") {
+
+   configs += [ ":headless_defines_config" ]
+ }
++
++
++# JIF
++
++import("//testing/libfuzzer/fuzzer_test.gni")
++
++ fuzzer_test("jif") {
++  sources = [ "jif/jif.cc" ]
++  deps = [
++     ":headless_shell_lib",
++     "//headless:headless_shared_sources",
++     "//headless:headless_non_renderer",
++     "//content",
++     "//sandbox",
++     "//skia",  # we need this to override font render hinting in headless build
++     "//ui/gfx/geometry",
++  ]
++  libs = ["jif/libjif/target/release/libjif.a"]
++ }