Skip to main content
SpringerLink
Log in

Fuzzing JavaScript Engine APIs

  • Conference paper
  • First Online:
Integrated Formal Methods (IFM 2016)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 9681))

Included in the following conference series:

Abstract

JavaScript is one of the most wide-spread programming languages: it drives the web applications in browsers, it runs on server side, and it gets to the embedded world as well. Because of its prevalence, ensuring the correctness of its execution engines is highly important. One of the hardest parts to test in an execution environment is the API exposed by the engine. Thus, we focus on fuzz testing of JavaScript engine APIs in this paper. We formally define a graph representation that is suited to describe type information in an engine, explain how to build such graphs, and describe how to use them for API fuzz testing. Our experimental evaluation of the techniques on a real-life in-use JavaScript engine shows that the introduced approach gives better coverage than available existing fuzzing techniques and could also find valid issues in the tested system.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 69.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 89.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://nodejs.org/.

  2. 2.

    http://duktape.org/.

  3. 3.

    http://www.jerryscript.net/.

  4. 4.

    http://www.iotjs.net/.

  5. 5.

    https://graph-tool.skewed.de/.

  6. 6.

    https://webkit.org/.

  7. 7.

    http://www.gtk.org/.

  8. 8.

    http://gcovr.com/.

  9. 9.

    https://github.com/MozillaSecurity/funfuzz/.

References

  1. Anderson, C.L.: Type inference for JavaScript. Ph.D. thesis, University of London, Imperial College London, Department of Computing (2006)

    Google Scholar 

  2. Chugh, R., Herman, D., Jhala, R.: Dependent types for JavaScript. In: Proceedings of the ACM International Conference on Object Oriented Programming Systems Languages and Applications (OOPSLA 2012), pp. 587–606. ACM (2012)

    Google Scholar 

  3. Ecma International: ECMAScript Language Specification (ECMA-262), 5.1st edn., June 2011

    Google Scholar 

  4. Franzen, D., Aspinall, D.: Towards an amortized type system for JavaScript. In: Proceedings of the 6th International Symposium on Symbolic Computation in Software Science (SCSS 2014). EPiC Series in Computer Science, vol. 30, pp. 12–26. EasyChair (2014)

    Google Scholar 

  5. Godefroid, P., Kiezun, A., Levin, M.Y.: Grammar-based whitebox fuzzing. In: Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI 2008), pp. 206–215. ACM (2008)

    Google Scholar 

  6. Holler, C., Herzig, K., Zeller, A.: Fuzzing with code fragments. In: 21st USENIX Security Symposium, pp. 445–458. USENIX (2012)

    Google Scholar 

  7. Jensen, S.H., Møller, A., Thiemann, P.: Type analysis for JavaScript. In: Palsberg, J., Su, Z. (eds.) SAS 2009. LNCS, vol. 5673, pp. 238–255. Springer, Heidelberg (2009)

    Chapter  Google Scholar 

  8. Microsoft Corporation: Security development lifecycle (verification phase). https://www.microsoft.com/en-us/sdl/default.aspx

  9. Purdom, P.: A sentence generator for testing parsers. BIT Numer. Math. 12(3), 366–375 (1972)

    Article  MathSciNet  MATH  Google Scholar 

  10. Sen, K., Kalasapur, S., Brutch, T., Gibbs, S.: Jalangi: A selective record-replay and dynamic analysis framework for JavaScript. In: Proceedings of the 9th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE 2013), pp. 488–498. ACM (2013)

    Google Scholar 

  11. Sutton, M., Greene, A., Amini, P.: Fuzzing: Brute Force Vulnerability Discovery. Addison-Wesley, Boston (2007)

    Google Scholar 

  12. Takanen, A., DeMott, J., Miller, C.: Fuzzing for Software Security Testing and Quality Assurance, chap. Foreword, Artech House (2008)

    Google Scholar 

  13. Thiemann, P.: Towards a type system for analyzing JavaScript programs. In: Sagiv, M. (ed.) ESOP 2005. LNCS, vol. 3444, pp. 408–422. Springer, Heidelberg (2005)

    Chapter  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Software Engineering, University of Szeged, Dugonics tér 13., 6720, Szeged, Hungary

    Renáta Hodován & Ákos Kiss

Authors
  1. Renáta Hodován
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Ákos Kiss
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Renáta Hodován .

Editor information

Editors and Affiliations

  1. RWTH Aachen University, Aachen, Germany

    Erika Ábrahám

  2. University of Twente, Enschede, Overijssel, The Netherlands

    Marieke Huisman

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer International Publishing Switzerland

About this paper

Cite this paper

Hodován, R., Kiss, Á. (2016). Fuzzing JavaScript Engine APIs. In: Ábrahám, E., Huisman, M. (eds) Integrated Formal Methods. IFM 2016. Lecture Notes in Computer Science(), vol 9681. Springer, Cham. https://doi.org/10.1007/978-3-319-33693-0_27

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-33693-0_27

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-33692-3

  • Online ISBN: 978-3-319-33693-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation