def __reinit(self):
self._elem_ids = []
self._css_classes = []
self._form_ids = []
self._canvas_ids = []
self._header_ids = []
self._map_names = []
self._used_tags = set()
self._html_page = HtmlPage()
def __init__(self, seed, starting_elements, html_depth, html_max_attr, canvas_size, js_block_size, function_count, file_type, media_folder="NONE"):
self._logger = logging.getLogger(__name__)
self._html_fuzzer = Html5Fuzzer(int(seed), int(starting_elements), int(html_depth), int(html_max_attr), file_type)
self._canvas_fuzzer = CanvasFuzzer(int(canvas_size))
self._css_fuzzer = CssFuzzer(int(seed))
random.seed(int(seed)) if int(seed) != 0 else random.seed()
self._size = int(js_block_size)
self._function_count = int(function_count)
self._file_type = file_type
self._js_objects = {}
self._media_folder = media_folder
self.__init_js_object_dict()
self._js_default_functions = []
self._js_event_listener = []
self._js_array_functions = []
max_funcs = min((self._size / 10), 20)
for i in range(max_funcs):
self._js_array_functions.append("array_func_" + str(i))
self._js_event_listener.append("event_handler_" + str(i))
self._html_page = HtmlPage()
def __init__(self, seed, elements, max_depth, max_attr, file_type):
self._logger = logging.getLogger(__name__)
if int(seed) == 0:
random.seed()
else:
random.seed(int(seed))
self._css_classes = []
self._elem_ids = []
self._form_ids = []
self._canvas_ids = []
self._header_ids = []
self._map_names = []
self._file_type = file_type
self._embed_sources_list = []
self._max_attr = int(max_attr)
self._max_depth = int(max_depth)
self._elements = int(elements)
self._head = ""
self._body = ""
self._used_tags = set()
self._html_page = HtmlPage()
class Html5Fuzzer(Fuzzer):
TYPES_DICT = {'APP_DATA': None, 'BOOL': FuzzValues.BOOL, 'BUTTON_TYPE': FuzzValues.BUTTON_TYPE,
'CHAR': FuzzValues.CHARS, 'CHARACTER_SET': FuzzValues.CHARACTER_SET,
'COORDS': None, 'CROSSORIGIN': 'TODO', 'CSS': None,
'CSS_CLASS': None, 'DATALIST_ID': None, 'DATETIME': None, 'TEXT_DIRECTION': FuzzValues.TEXT_DIRECTION,
'INPUT_TYPE': FuzzValues.INPUT_TYPES,
'ELEM_ID' : None, 'FORM_ID': None, 'FORM_METHOD': FuzzValues.FORM_METHOD,
'FORM_TARGET': FuzzValues.FORM_TARGET, 'FORM_ENCTYPE': FuzzValues.FORM_ENCTYPE,
'HEADER_ID': None, 'HTML_CODE': None, 'HTTP_EQUIV': FuzzValues.HTTP_EQUIV, 'INT': FuzzValues.INTS,
'ID': None, 'KEYTYPE': 'TODO',
'LANG': FuzzValues.LANG_CODES, 'MAP_NAME': None, 'MEDIA_TYPE': FuzzValues.MEDIA_TYPE,
'MEDIA_QUERY': None, 'MENU': None, 'METADATA_NAME': FuzzValues.METADATA_NAME,
'ONOFF': FuzzValues.ONOFF, 'PURE_INT': FuzzValues.PURE_INTS,
'PIXELS': FuzzValues.INTS, 'PRELOAD': FuzzValues.PRELOAD,
'REGEXP': None,
'REL': FuzzValues.REL, 'SCROLLING': FuzzValues.SCROLLING, 'SHAPE': FuzzValues.SHAPE,
'SANDBOX': FuzzValues.SANDBOX, 'SORTED': FuzzValues.SORTED, 'STRING': FuzzValues.STRINGS,
'SRC': None,
'TABLE_SCOPE': FuzzValues.TABLE_SCOPE, 'TARGET': FuzzValues.TARGET,
'TRACK_KIND': FuzzValues.TRACK_KIND, 'URL': None, 'WRAP': FuzzValues.WRAP,
'YESNO': FuzzValues.YESNO}
# Not supported by major browser: MEDIA_QUERY MENU
# TODO: DATALIST_ID, REGEXP, URL ... dl creation ...
NO_SINGLE_USE_TAGS = ['head', 'body', 'th', 'tr', 'td', 'tfoot', 'tbody', 'thead', 'title', 'dt', 'dd']
NO_CHILD_LIST = ['select', 'time', 'iframe', 'style', 'canvas']
def __init__(self, seed, elements, max_depth, max_attr, file_type):
self._logger = logging.getLogger(__name__)
if int(seed) == 0:
random.seed()
else:
random.seed(int(seed))
self._css_classes = []
self._elem_ids = []
self._form_ids = []
self._canvas_ids = []
self._header_ids = []
self._map_names = []
self._file_type = file_type
self._embed_sources_list = []
self._max_attr = int(max_attr)
self._max_depth = int(max_depth)
self._elements = int(elements)
self._head = ""
self._body = ""
self._used_tags = set()
self._html_page = HtmlPage()
@classmethod
def from_list(cls, params):
pass # TODO: implement
@property
def embed_sources_list(self):
return self._embed_sources_list
@embed_sources_list.setter
def embed_sources_list(self, sources_list):
self._embed_sources_list = sources_list
def add_embed_source(self, item):
self.embed_sources_list.append(item)
def file_type(self):
return self._file_type
def set_seed(self, seed):
random.seed(int(seed))
def prng_state(self):
return random.getstate()
def set_state(self, state):
random.setstate(state)
def create_testcases(self, count, directory):
pass
def __reinit(self):
self._elem_ids = []
self._css_classes = []
self._form_ids = []
self._canvas_ids = []
self._header_ids = []
self._map_names = []
self._used_tags = set()
self._html_page = HtmlPage()
def fuzz(self):
self.__reinit()
count = 0
tag, self._head, close_head = self.__build_tag("head")
tag, title_open, title_close = self.__build_tag("title", ignore_outer_tag=True)
self._head += title_open + random.choice(FuzzValues.STRINGS) + title_close + "\r\n"
self._head += "<link rel=\"stylesheet\" href=\"TESTCASE.css\">\r\n"
self._head += "<script type='text/javascript'>\r\nSCRIPT_BODY\r\n</script>\r\n"
tag, self._body, close_body = self.__build_tag("body")
self._body = self._body[:-2] + " onload=\"eval(setTimeout(function () { startup(); }, 200))\">\r\n"
self._body += "HELLO WORLD!\r\n<br>"
while self._elements >= count:
closing_list = []
for i in range(random.randint(1, self._max_depth)):
tag, open_tag, close_tag = self.__build_tag()
count += 1
if HTML5_OBJECTS[tag]['outer_tag'] is not None\
and HTML5_OBJECTS[tag]['outer_tag'] == "head": # Tags only allowed in head
self._head += open_tag + random.choice(FuzzValues.STRINGS) + close_tag + "\r\n"
else: # default body tags
self._body += open_tag + random.choice(FuzzValues.STRINGS) + "\r\n"
closing_list.append(close_tag if tag != "br" else "")
if tag in self.NO_CHILD_LIST: # don't go deeper if tag is in no child list
break
closing_list.reverse()
for close_tag in closing_list:
self._body += close_tag + "\r\n"
if len(self._canvas_ids) == 0:
tag, open_tag, close_tag = self.__build_tag('canvas')
self._body += open_tag + close_tag + "\r\n"
for source in self.embed_sources_list:
self._body += "<embed src=\"" + source + "\">\r\n"
html = "<!DOCTYPE html>\r\n<html>\r\n" + self._head + close_head + "\r\n" + self._body + close_body + "\r\n" + \
"</html>\r\n"
self._html_page.set_raw_html(html)
return self._html_page
def get_some_html_code(self, length):
code = ""
for i in range(length):
tag = random.choice(HTML5_OBJECTS.keys())
while HTML5_OBJECTS[tag]['outer_tag'] is not None:
tag = random.choice(HTML5_OBJECTS.keys())
tag, open_tag, close_tag = self.__build_tag(tag)
code += open_tag + random.choice(FuzzValues.INTERESTING_VALUES) + close_tag + "\n"
return code
def __build_tag(self, tag=None, ignore_outer_tag=False):
open_tag = ""
close_tag = ""
elem_id = "id" + str(len(self._elem_ids))
self._elem_ids.append(elem_id)
if tag is None:
tags = [x for x in HTML5_OBJECTS.keys() if x not in self.NO_SINGLE_USE_TAGS]
tag = random.choice(tags)
self._used_tags.add(tag)
if tag == "table":
self._html_page.add_element(elem_id, tag)
return "table", self.__build_table(), ""
elif tag == "dl":
# self._html_page.add_element(elem_id, tag)
return "dl", self.__build_dl(), ""
self._html_page.add_element(elem_id, tag)
if tag == "canvas":
self._canvas_ids.append(elem_id)
close_tag += "</" + tag + ">"
if HTML5_OBJECTS[tag]['outer_tag'] is not None and not ignore_outer_tag:
if "head" not in HTML5_OBJECTS[tag]['outer_tag']:
ignore, open_tag, close_tag_out = self.__build_tag(random.choice(HTML5_OBJECTS[tag]['outer_tag']))
close_tag += close_tag_out
open_tag += "<" + tag + " id=\"" + elem_id + "\""
if tag == "form":
self._form_ids.append(elem_id)
elif tag == "th":
self._header_ids.append(elem_id)
attribs_avail = HTML5_OBJECTS[tag]['attr']
max_tag_attr = len(attribs_avail.keys())
attr_count = random.randint(1, self._max_attr) if self._max_attr < max_tag_attr else \
random.randint(1, max_tag_attr)
attribs = set()
if HTML5_OBJECTS[tag]['req_attr'] is not None:
for attr in HTML5_OBJECTS[tag]['req_attr']:
attribs.add(attr)
while len(attribs) < attr_count:
attribs.add(random.choice(attribs_avail.keys()))
for attr in attribs:
if attribs_avail[attr] is None: # Attributes without value
open_tag += " " + attr
else:
open_tag += " " + attr + "=\""
if self.TYPES_DICT[attribs_avail[attr]] is not None: # attributes with value from lists
if tag == 'map' and attr == 'name':
name = "map" + str(len(self._map_names))
self._map_names.append(name)
open_tag += name
else:
open_tag += random.choice(self.TYPES_DICT[attribs_avail[attr]])
else: # attributes with value from runtime sources
open_tag += self.__get_value(attribs_avail[attr])
open_tag += "\""
open_tag += "> "
return tag, open_tag, close_tag
def __build_table(self):
table = ""
tag, open_table, close_table = self.__build_tag("table", ignore_outer_tag=True)
table += open_table + "\r\n"
# Table header
tag, open_thead, close_thead = self.__build_tag("thead", ignore_outer_tag=True)
table += open_thead + "\r\n"
tag, open_tr, close_tr = self.__build_tag("tr", ignore_outer_tag=True)
table += open_tr + "\r\n"
for i in range(random.randint(1, self._max_depth)):
tag, open_th, close_th = self.__build_tag("th", ignore_outer_tag=True)
table += open_th +random.choice(FuzzValues.STRINGS) + close_th + "\r\n"
table += close_tr + "\r\n" + close_thead + "\r\n"
# Table foot
tag, open_tfoot, close_tfoot = self.__build_tag("tfoot", ignore_outer_tag=True)
table += open_tfoot + "\r\n"
tag, open_tr, close_tr = self.__build_tag("tr", ignore_outer_tag=True)
table += open_tr + "\r\n"
for i in range(random.randint(1, self._max_depth)):
tag, open_td, close_td = self.__build_tag("td", ignore_outer_tag=True)
table += open_td + random.choice(FuzzValues.STRINGS) + close_td + "\r\n"
table += close_tr + "\r\n" + close_tfoot + "\r\n"
# Table body
tag, open_tbody, close_tbody = self.__build_tag("tbody", ignore_outer_tag=True)
table += open_tbody + "\r\n"
for i in range(random.randint(1, self._max_depth)):
tag, open_tr, close_tr = self.__build_tag("tr", ignore_outer_tag=True)
table += open_tr + "\r\n"
for i in range(random.randint(1, self._max_depth)):
tag, open_td, close_td = self.__build_tag("td", ignore_outer_tag=True)
table += open_td + random.choice(FuzzValues.STRINGS) + close_td + "\r\n"
table += close_tr + "\r\n"
table += close_tbody + "\r\n"
table += close_table
return table
def __build_dl(self):
return ""
def __get_value(self, attr_type): # TODO: Complete
if attr_type == "APP_DATA":
pass
elif attr_type == "COORDS":
return self.__get_coords()
elif attr_type == "CSS":
return self.__get_style()
elif attr_type == "CSS_CLASS":
self.__add_css_class()
return random.choice(self._html_page.get_css_class_names())
elif attr_type == "DATETIME":
return self.__get_datetime()
elif attr_type == "ELEM_ID":
return self.__get_elem_id()
elif attr_type == "FORM_ID":
return self.__get_form_id() if len(self._form_ids) > 0 else "none"
elif attr_type == "URL":
return "http://127.0.0.1:8080"
elif attr_type == "SRC":
return self._embed_sources_list.pop() if self._embed_sources_list is not None and self._embed_sources_list else ""
return ""
def __get_app_data(self):
return "data-" + random.choice(FuzzValues.STRINGS)
def __get_coords(self):
if random.choice([1, 2]) == 1:
return random.choice(FuzzValues.INTS) + "," + random.choice(FuzzValues.INTS) + "," + \
random.choice(FuzzValues.INTS)
else:
return random.choice(FuzzValues.INTS) + "," + random.choice(FuzzValues.INTS) + "," + \
random.choice(FuzzValues.INTS) + "," + random.choice(FuzzValues.INTS)
def __get_style(self):
count = random.randint(2, 10)
ret_val = ""
for i in range(count):
style_pick = random.choice(CSS_STYLES)
value = random.choice(style_pick[1:])
ret_val += style_pick[0] + ":" + value + ";"
return ret_val
def __add_css_class(self):
class_name = "style_class_" + str(len(self._css_classes))
self._html_page.add_css_class_name(class_name)
return class_name
def __get_datetime(self):
return str(random.randint(0, 9999)) + "-" + str(random.randint(0, 99)) + "-" + str(random.randint(0, 99)) + \
" " + str(random.randint(0, 99)) + ":" + str(random.randint(0, 99))
def __get_elem_id(self):
return random.choice(self._elem_ids)
def __get_form_id(self):
return random.choice(self._form_ids)
def __get_header_id(self):
return random.choice(self._header_ids)
def __gen_html_code(self): # TODO: Implement
pass
def __get_map_name(self):
return random.choice(self._map_names)
def __get_url(self, mediatype):
pass
class JsFuzzer(Fuzzer):
NAME = "js_fuzzer"
CONFIG_PARAMS = ['seed', 'starting_elements', 'html_depth', 'html_max_attr', 'canvas_size', 'js_block_size',
'function_count', 'file_type', 'media_folder']
CALLING_COMMENT = "//CALLING COMMENT"
FIRST_ARRAY_LENGTH = 5
FUNCTION_TYPES = ['default', 'event', 'array']
SPECIAL_PARAMETERS = ['JS_ARRAY', 'JS_DOM_CHILD_ELEMENT']
def __init__(self, seed, starting_elements, html_depth, html_max_attr, canvas_size, js_block_size, function_count, file_type, media_folder="NONE"):
self._logger = logging.getLogger(__name__)
self._html_fuzzer = Html5Fuzzer(int(seed), int(starting_elements), int(html_depth), int(html_max_attr), file_type)
self._canvas_fuzzer = CanvasFuzzer(int(canvas_size))
self._css_fuzzer = CssFuzzer(int(seed))
random.seed(int(seed)) if int(seed) != 0 else random.seed()
self._size = int(js_block_size)
self._function_count = int(function_count)
self._file_type = file_type
self._js_objects = {}
self._media_folder = media_folder
self.__init_js_object_dict()
self._js_default_functions = []
self._js_event_listener = []
self._js_array_functions = []
max_funcs = min((self._size / 10), 20)
for i in range(max_funcs):
self._js_array_functions.append("array_func_" + str(i))
self._js_event_listener.append("event_handler_" + str(i))
self._html_page = HtmlPage()
def __init_js_object_dict(self):
for js_obj_type in JS_OBJECTS:
self._js_objects[js_obj_type] = []
@property
def file_type(self):
return self._file_type
@classmethod
def from_list(cls, params):
return cls(params[0], params[1], params[2], params[3], params[4], params[5], params[6], params[7], params[8])
@property
def prng_state(self):
return random.getstate
def set_state(self, state):
random.setstate(state)
def create_testcases(self, count, directory):
self.clear_folder(directory)
media_file_names = []
byte_mutation_fuzzers = []
if self._media_folder is not "NONE":
media_folder_listing = os.listdir(self._media_folder)
for i in range(8):
file_name = random.choice(media_folder_listing)
media_file_names.append(file_name)
byte_mutation_fuzzers.append(ByteMutation(self._media_folder + "/" + file_name, 5, 50, 0, file_name.split(".")[1]))
for i in range(count):
test_name = "/test" + str(i) if i > 9 else "/test0" + str(i)
fuzzer_number = 0
for byte_mutation_fuzzer in byte_mutation_fuzzers:
fuzz_data_file_name = test_name + "_" + str(fuzzer_number) + "." + byte_mutation_fuzzer.file_type
fuzz_data = byte_mutation_fuzzer.fuzz()
with open(directory + fuzz_data_file_name, 'wb+') as data_fd:
data_fd.write(fuzz_data)
self._html_fuzzer.add_embed_source(fuzz_data_file_name.replace("/", ""))
fuzzer_number += 1
with open(directory + test_name + "." + self._file_type, "wb+") as html_fd, open(directory + test_name + ".css", "wb+") as css_fd:
html, css = self.fuzz()
html = html.replace("TESTCASE", test_name)
html_fd.write(html)
css_fd.write(css)
self._html_fuzzer.embed_sources_list = []
def set_seed(self, seed):
pass
def __reinit(self):
self._js_objects = {}
self.__init_js_object_dict()
self._js_default_functions = []
def fuzz(self):
self._html_page = self._html_fuzzer.fuzz()
tags = self._html_page.get_elements_by_html_tag().keys()
css_class_names = self._html_page.get_css_class_names()
self._css_fuzzer.set_options(tags, css_class_names)
css = self._css_fuzzer.fuzz()
code = ""
code += self.__init_js_objects(self._html_page)
i = 0
func_size = self._size / self._function_count
while i < self._size:
code += self.__build_function("default", func_size)
i += func_size
for func_name in self._js_event_listener:
code += self.__build_function("event", func_size, func_name)
for func_name in self._js_array_functions:
code += self.__build_function("array", func_size, func_name)
code += self.__add_event_dispatcher()
for canvas_id in self._html_page.get_elements_by_html_tag()['canvas']:
self._canvas_fuzzer.set_canvas_id(canvas_id)
self._js_default_functions.append("func_" + canvas_id)
code += self._canvas_fuzzer.fuzz()
call_block = ""
for func_name in self._js_default_functions:
choice = random.randint(1, 20)
if choice < 15:
call_block += "\t" + func_name + "();\n"
else:
call_block += "\t" + JsWindow.setTimeout(func_name + "();", 100) + "\n"
call_block += "\t" + "event_firing();\n"
call_block += "\t" + "location.reload();\n"
code = code.replace(self.CALLING_COMMENT, call_block)
html = self._html_page.get_raw_html()
html = html.replace("SCRIPT_BODY", code)
self.__reinit()
return html, css
def test(self):
self._html_page = self._html_fuzzer.fuzz()
tags = self._html_page.get_elements_by_html_tag().keys()
css_class_names = self._html_page.get_css_class_names()
self._css_fuzzer.set_options(tags, css_class_names)
css = self._css_fuzzer.fuzz()
code = ""
code += self.__init_js_objects(self._html_page)
for i in range(30):
code += self.__build_assignment2() + "\n"
return code
def __init_js_objects(self, html_page):
available_dom_elements = html_page.get_elements_by_id()
code = "function startup() {\n"
for element_id in available_dom_elements.keys():
code += "\telem_" + element_id + " = " + JsDocument.getElementById(element_id) + ";\n"
self._js_objects['JS_DOM_ELEMENT'].append(JsDomElement("elem_" + element_id,
available_dom_elements[element_id]))
# Init a Object of each type
for i in range(0, 5):
code += "\t" + self.__build_js_array(self.FIRST_ARRAY_LENGTH)
code += "\t" + self.__add_js_string()
code += "\t" + self.__add_js_number()
code += "\t" + self.__add_js_object()
code += self.CALLING_COMMENT + "\n"
code += "}\n"
return code
# region Little Helper
def __build_js_array(self, length):
array_obj_list = []
for i in range(length):
js_obj = self.__get_an_js_object()
array_obj_list.append(js_obj)
js_array = JsArray(self.__get_js_array_name(), array_obj_list)
self._js_objects['JS_ARRAY'].append(js_array)
return js_array.newArray() + ";\n"
def __add_js_string(self):
js_str = JsString(self.__get_js_string_name())
self._js_objects['JS_STRING'].append(js_str)
return js_str.newString(random.choice(FuzzValues.STRINGS)) + ";\n"
def __add_js_number(self):
js_number = JsNumber(self.__get_js_number_name())
self._js_objects['JS_NUMBER'].append(js_number)
return js_number.newNumber(random.choice(FuzzValues.INTS)) + ";\n"
def __add_js_dom_element(self):
var_name = "elem_" + str(len(self._js_objects['JS_DOM_ELEMENT']))
html_type = random.choice(HTML5_OBJECTS.keys())
js_dom_element = JsDomElement(var_name, html_type)
self._js_objects['JS_DOM_ELEMENT'].append(js_dom_element)
return var_name + " = " + JsDocument.createElement(html_type) + ";\n"
def __add_js_object(self):
var_name = self.__get_js_object_name()
self._js_objects['JS_OBJECT'].append(JsObject(var_name))
available_types = self._js_objects.keys()
available_types.remove('JS_OBJECT')
js_obj_type = random.choice(available_types)
return var_name + " = " + (random.choice(self._js_objects[js_obj_type])).name + ";\n"
def __get_js_dom_element_name(self):
return "elem_" + str(len(self._js_objects['JS_DOM_ELEMENT']))
def __get_js_string_name(self):
return "str_" + str(len((self._js_objects['JS_STRING'])))
def __get_js_number_name(self):
return "number_" + str(len(self._js_objects['JS_NUMBER']))
def __get_js_array_name(self):
return "array_" + str(len(self._js_objects['JS_ARRAY']))
def __get_js_object_name(self):
return "object_" + str(len(self._js_objects['JS_OBJECT']))
def __get_an_js_object(self):
usable_object = self._js_objects.keys()
usable_object.remove('JS_OBJECT')
js_obj_type = 'JS_STRING' # random.choice(usable_object)
while not self._js_objects[js_obj_type]:
js_obj_type = random.choice(self._js_objects.keys())
js_obj = random.choice(self._js_objects[js_obj_type])
return js_obj
@staticmethod
def __check_params_for_optional(parameter_list):
for param in parameter_list:
if "*" in param:
return True
return False
# endregion
def __build_function(self, func_type, length, func_name=None):
code = ""
func_end = ""
block_length = length / 10
if func_type == 'default':
func_name = "func_" + str(len(self._js_default_functions))
self._js_default_functions.append(func_name)
code += "function " + func_name + "() { \n"
func_end = "}\n"
elif func_type == "array" or "event":
code += "function " + func_name + "(x) { \n"
func_end = "\treturn x;\n}\n" if func_type == "array" else "}\n"
for i in range(length):
choice = random.randint(1, 20)
if choice <= 10:
code += "\t" + self.__build_assignment()
elif 10 < choice < 15:
code += self.__build_if_statement_block(block_length)
i += block_length
elif choice > 15:
code += self.__build_for_loop_block(block_length)
i += block_length
code += func_end
return code
def __build_if_statement_block(self, length):
code = "\tif " + self.__create_bool_expression() + "{ \n"
for i in range(length):
code += "\t\t" + self.__build_assignment(False)
code += "\t}\n"
return "\t" + JsGlobal.try_catch_block("\n" + code)
# TODO: iterate over the array
def __build_for_loop_block(self, length):
code = "\tfor (var i = 0; i < " + (random.choice(self._js_objects['JS_ARRAY'])).length() + ";i++) {\n"
for i in range(length):
code += "\t\t" + self.__build_assignment(False)
code += "\t}\n"
return "\t" + JsGlobal.try_catch_block("\n" + code)
# TODO: build assignments but keep the JsArray Objects functional (array elements)
# TODO: also keep the JsDomElement functional (children and so on)
def __build_assignment2(self, try_catch=True):
code = ""
choice = random.randint(1, 20)
js_obj = self.__get_an_js_object()
js_method_name = random.choice(js_obj.methods_and_properties.keys())
js_obj_method = js_obj.methods_and_properties[js_method_name]['method']
js_method_ret_val = js_obj.methods_and_properties[js_method_name]['ret_val']
js_method_parameters = js_obj.methods_and_properties[js_method_name]['parameters']
special_param = (False, None)
star_param = False
if js_method_parameters is not None:
for param in js_method_parameters:
if param in self.SPECIAL_PARAMETERS:
special_param = (True, param)
elif '*' in param:
star_param = True
# region Default assignment
if ((star_param and choice <= 10) or (not star_param)) and not special_param[0]:
# TODO: going deeper,
# TODO: e.g for strings call a method on a method call on method call and add it inside or outside
if js_method_parameters is None or star_param:
code += js_obj_method()
else:
parameters = self.__get_params(js_obj, js_method_parameters)
code += js_obj_method(*parameters)
js_method_ret_val = 'JS_NUMBER' if js_method_ret_val == "INT" or js_method_ret_val == "FLOAT" else js_method_ret_val
if js_method_ret_val == "JS_DOM_ELEMENT":
new_js_obj = JsDomElement(self.__get_js_dom_element_name()) if choice < 10 else random.choice(self._js_objects['JS_DOM_ELEMENT'])
# region JS_STRING
elif js_method_ret_val == "JS_STRING":
new_js_obj = JsString(self.__get_js_string_name()) if choice < 10 else random.choice(self._js_objects['JS_STRING'])
if choice > 15:
add_js_str_obj = random.choice(self._js_objects['JS_STRING'])
second_obj_code = add_js_str_obj.name
for i in range(choice % 10):
js_str_func = random.choice(js_obj.methods_and_properties_by_return_type['JS_STRING'])
add_js_str_func = random.choice(add_js_str_obj.methods_and_properties_by_return_type['JS_STRING'])
if js_str_func['parameters'] is not None and \
not self.__check_params_for_optional(js_str_func['parameters']):
js_str_func_parameters = self.__get_params(js_obj, js_str_func['parameters'])
code = "(" + code + ")" + (js_str_func['method'](*js_str_func_parameters)).replace(js_obj.name, "")
else:
code = "(" + code + ")" + (js_str_func['method']()).replace(js_obj.name, "")
if add_js_str_func['parameters'] is not None and \
not self.__check_params_for_optional(add_js_str_func['parameters']):
add_js_str_func_parameters = self.__get_params(js_obj, add_js_str_func['parameters'])
second_obj_code = "(" + second_obj_code + ")" + (add_js_str_func['method'](*add_js_str_func_parameters)).replace(add_js_str_obj.name, "")
else:
second_obj_code = "(" + second_obj_code + ")" + (add_js_str_func['method']()).replace(add_js_str_obj.name, "")
code = code + " + " + second_obj_code
# endregion
elif js_method_ret_val == "JS_NUMBER":
new_js_obj = JsNumber(self.__get_js_number_name()) if choice < 10 else random.choice(self._js_objects['JS_NUMBER'])
pass
elif js_method_ret_val == "JS_ARRAY":
new_js_obj = JsArray(self.__get_js_array_name()) if choice < 10 else random.choice(self._js_objects['JS_ARRAY'])
pass
else: # it's a js_object
new_js_obj = JsObject(self.__get_js_object_name()) if choice < 10 else random.choice(self._js_objects['JS_OBJECT'])
pass
code = new_js_obj.name + " = " + code
# endregion
# region properties setting
elif star_param and choice > 10:
print("Star param")
parameters = self.__get_params(js_obj, js_method_parameters)
code = js_obj_method(*parameters)
# endregion
# region JS_ARRAY or JS_DOM_CHILD_ELEMENT
elif special_param[0]:
print("Special param")
pass
# endregion
return code
def __build_assignment(self, try_catch=True):
choice = random.randint(1, 20)
js_obj = self.__get_an_js_object()
js_function_name = random.choice(js_obj.methods_and_properties.keys())
if js_function_name == "removeChild" or js_function_name == "replaceChild":
children = js_obj.get_children()
if not children:
js_function_name = "appendChild"
js_obj_function = js_obj.methods_and_properties[js_function_name]
parameters = js_obj_function['parameters']
ret_val = js_obj_function['ret_val']
optional = False
if parameters is not None:
for params in parameters:
if "*" in params:
if choice > 8:
parameters = None
else:
optional = True
if parameters is not None:
params = self.__get_params(js_obj, js_obj_function['parameters'])
code = js_obj_function['method'](*params)
else:
code = js_obj_function['method']()
# TODO: how to involve operators in numbers and strings ...
if not optional:
ret_val = "JS_STRING" if ret_val == "STRING" else ret_val
ret_val = "JS_NUMBER" if ret_val == "INT" or ret_val == "EXP_FLOAT" or ret_val == "FLOAT" else ret_val
if ret_val == "JS_DOM_ELEMENT":
new_js_obj = JsDomElement(self.__get_js_dom_element_name()) if choice < 10 else random.choice(self._js_objects['JS_DOM_ELEMENT'])
self._js_objects['JS_DOM_ELEMENT'].append(new_js_obj)
elif ret_val == "JS_STRING":
new_js_obj = JsString(self.__get_js_string_name()) if choice < 10 else random.choice(self._js_objects['JS_STRING'])
self._js_objects['JS_STRING'].append(new_js_obj)
if choice >= 15:
js_str = random.choice(self._js_objects['JS_STRING'])
js_str_func = random.choice(js_str.methods_and_properties_by_return_type['JS_STRING'])
js_str_func_params = self.__get_params(js_str, js_str_func['parameters']) if js_str_func['parameters'] is not None else None
code += " + " + js_str_func['method'](*js_str_func_params) if js_str_func['parameters'] is not None else " + " + js_str_func['method']()
elif ret_val == "JS_NUMBER":
new_js_obj = JsNumber(self.__get_js_number_name()) if choice < 10 else random.choice(self._js_objects['JS_NUMBER'])
self._js_objects['JS_NUMBER'].append(new_js_obj)
if choice >= 15:
number_operator = random.choice(JsNumber.OPERATORS)
js_number = random.choice(self._js_objects['JS_NUMBER'])
code += " " + number_operator + " " + js_number.name
elif ret_val == "JS_ARRAY":
new_js_obj = JsArray(self.__get_js_array_name()) if choice < 10 else random.choice(self._js_objects['JS_ARRAY'])
self._js_objects['JS_ARRAY'].append(new_js_obj)
else:
new_js_obj = JsObject(self.__get_js_object_name()) if choice < 10 else random.choice(self._js_objects['JS_OBJECT'])
self._js_objects['JS_OBJECT'].append(new_js_obj)
code = new_js_obj.name + " = " + code
return JsGlobal.try_catch_block(code + "; ") if try_catch else code + ";\n"
def __get_params(self, calling_obj, param_list):
ret_params = []
for param in param_list:
if param == 'BOOL':
switch = random.choice([0, 1])
if switch == 0:
ret_params.append(self.__create_bool_expression())
elif switch == 1:
ret_params.append(random.choice(FuzzValues.BOOL))
elif param == 'CLASS_NAME':
ret_params.append(random.choice(self._html_page.get_css_class_names()))
elif param == 'CSS_SELECTOR': # Build a tag, tag, tag style selector
# TODO: Work through the CSS Selector reference
count = random.randint(1, 10)
css_selector = ""
for i in range(count):
css_selector += random.choice(self._html_page.get_elements_by_html_tag().keys()) + ","
css_selector = css_selector[:-1] # remove the comma
ret_params.append(random.choice(css_selector))
elif param == 'CSS_STYLE':
style = random.choice(CSS_STYLES)
ret_params.append(style[0])
ret_params.append(random.choice(style[1:]))
elif param == 'EVENT':
ret_params.append(random.choice(DomObjectTypes.DOM_EVENTS))
elif param == 'HTML_ATTR':
html_attr = random.choice(HTML5_GLOBAL_ATTR.keys())
ret_params.append(html_attr)
if 'HTML_ATTR_VAL' in param_list:
if HTML5_GLOBAL_ATTR[html_attr] == "CSS_CLASS":
ret_params.append(random.choice(self._html_page.get_css_class_names()))
elif html_attr == "style":
style = random.choice(CSS_STYLES)
ret_params.append(style[0] + " " + random.choice(style[1:]))
else:
ret_params.append(random.choice(Html5Fuzzer.TYPES_DICT[HTML5_GLOBAL_ATTR[html_attr]]))
elif param == 'HTML_ATTR_VAL':
continue
elif param == 'HTML_CODE':
count = random.randint(1, 10)
ret_params.append(self._html_fuzzer.get_some_html_code(count))
elif param == 'HTML_TAG':
ret_params.append(random.choice(HTML5_OBJECTS.keys()))
elif param == 'INT':
switch = random.choice([0, 1])
if switch == 1: # Get a JS_Number ID
ret_params.append((random.choice(self._js_objects['JS_NUMBER'])).name)
else: # Get one from FuzzValues
ret_params.append(random.choice(FuzzValues.PURE_INTS))
elif param == 'JS_ARRAY':
ret_params.append(random.choice(self._js_objects['JS_ARRAY']))
elif param == 'JS_DOM_ELEMENT':
ret_params.append((random.choice(self._js_objects['JS_DOM_ELEMENT'])).name)
elif param == 'JS_DOM_CHILD_ELEMENT':
if not calling_obj.get_children():
ret_params.append((random.choice(self._js_objects['JS_DOM_ELEMENT'])).name)
else:
ret_params.append(random.choice(calling_obj.get_children()))
elif param == 'JS_EVENT_LISTENER':
ret_params.append(random.choice(self._js_event_listener))
elif param == 'JS_ARRAY_FUNCTION':
ret_params.append(random.choice(self._js_array_functions))
elif param == 'JS_OBJECT':
obj_type = random.choice(self._js_objects.keys())
ret_params.append((random.choice(self._js_objects[obj_type])).name)
elif param == 'LANG':
ret_params.append(random.choice(FuzzValues.LANG_CODES))
elif param == 'NAMESPACE_URI':
# TODO: think about namespace URIs
ret_params.append("localhost")
elif param == 'NUMBER':
ret_params.append(random.choice(FuzzValues.INTS))
elif param == 'REGEX':
# TODO: Build a regex builder method
ret_params.append("g/[*]+/")
elif param == 'JS_STRING':
switch = random.choice([0, 1])
if switch == 0:
ret_params.append((random.choice(self._js_objects['JS_STRING'])).name)
else:
ret_params.append(random.choice(FuzzValues.STRINGS))
elif param == 'TEXT_DIRECTION':
ret_params.append(random.choice(FuzzValues.TEXT_DIRECTION))
elif param == 'UNICODE_VALUE_LIST':
value = random.randint(0x0000, 0xFFFF)
ret_params.append(format(value, '04x'))
return ret_params
def __create_bool_expression(self):
code = "("
operator = random.choice(JsGlobal.BOOL_OPERATORS)
operand_type = random.choice(self._js_objects.keys())
operand1 = random.choice(self._js_objects[operand_type])
operand2 = random.choice(self._js_objects[operand_type])
same_ret_val = [x for x in operand1.methods_and_properties_by_return_type.keys() if x in operand2.methods_and_properties_by_return_type.keys()]
ret_val = random.choice(same_ret_val)
operand1_func = random.choice(operand1.methods_and_properties_by_return_type[ret_val])
operand2_func = random.choice(operand2.methods_and_properties_by_return_type[ret_val])
operand1_param = self.__get_params(operand1, operand1_func['parameters']) if operand1_func['parameters'] is not None and '*' not in ("" + x for x in operand1_func['parameters']) else None
operand2_param = self.__get_params(operand2, operand2_func['parameters']) if operand2_func['parameters'] is not None and '*' not in ("" + x for x in operand2_func['parameters'])else None
code += operand1_func['method'](*operand1_param) if operand1_param is not None else operand1_func['method']()
code += operator
code += operand2_func['method'](*operand2_param) if operand2_param is not None else operand2_func['method']()
code += ")"
return code
def __add_event_dispatcher(self):
code = "function event_firing() {\n"
for elem in self._js_objects['JS_DOM_ELEMENT']:
for event in elem.registered_events.keys():
if 'DOM' in event:
continue
elif event == 'click':
code += JsGlobal.try_catch_block(elem.click() + "\n", "ex")
elif event == 'error':
pass
elif event == 'load':
pass
elif event == 'scroll':
code += JsGlobal.try_catch_block(elem.scrollLeft() + " = 10;" + "\n", "ex")
elif event == 'resize' or event == 'change':
code += JsGlobal.try_catch_block(elem.innerHtml() + " = \"" + "A" * 100 + "\";\n", "ex")
elif event == 'focus' or event == 'focusin':
code += JsGlobal.try_catch_block(elem.focus() + "\n", "ex")
elif event == 'blur':
code += JsGlobal.try_catch_block(elem.blur() + "\n", "ex")
elif event == 'select':
code += JsGlobal.try_catch_block(elem.select() + "\n", "ex")
code += "}\n"
return code