You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
DOM fuzzing<br />
• DOM has a complex data structure, that carries the heavy load of modeling all possible operations enabled by modern HTML<br />
– JS – CSS<br />
• Lot of apis: Dom SPECIFICATIONS ARE DEFINED BY and divided in 4 different documents<br />
• Crossfuzz by michal zalewski is still the benchmark<br />
• Lot of mods, widespread coverage hard to spot new crashes<br />
• Nduja introduced some new concepts from DOM Level 2 and 3 specs and provided interesting results<br />
• BASIC WORKflow:<br />
Several namespaces<br />
ON simple elements<br />
And on collections<br />
Create<br />
random<br />
elements<br />
Tweak<br />
elements<br />
attributes<br />
Collect<br />
element<br />
reference<br />
Perform<br />
random<br />
mutations<br />
on DOM<br />
Trigger GC<br />
(e.g. Heap<br />
spray)<br />
Crawl DOM<br />
reference<br />
Define custom<br />
Events handlers<br />
Native JS structures or<br />
DOM collections<br />
Also on event handling<br />
routines
Change language