DOM Range and Editor (designMode/execCommand/contentEditable) fuzzer

NEW
Assigned to

Status

()

Core
Platform Fuzzing Team
12 years ago
9 months ago

People

(Reporter: Jesse Ruderman, Assigned: Jesse Ruderman)

Tracking

(Depends on: 39 bugs, Blocks: 1 bug, {meta, sec-other})

Trunk
meta, sec-other
Points:
---
427322, 444036, 454746, 468202, 469014, 493641, 532808, 543651, 561940, 572617, 574238, 588278, 607001, 612994, 613816, 615033, 673849, 688945, 709429, 718282, 760879, 766416, 768756, 772668, 780725, 785211, 788929, 788936, 797054, 804099, 804835, 822734, 847136, 873681, 876826, 893333, 989711, 1072112, 1223673, 335995, 336081, 336091, 336096, 336104, 336381, 336715, 345837, 372094, 372284, 382046, 382057, 382210, 382527, 382778, 383208, 407053, 407062, 407072, 407074, 407079, 407256, 407259, 407277, 407818, 409990, 410230, 413712, 414178, 414689, 415394, 416264, 417384, 418923, 418928, 419563, 420439, 420620, 423514, 424027, 424276, 424289, 424300, 428275, 429960, 430124, 430628, 431086, 437170, 439258, 448161, 448993, 449006, 453406, 460876, 461049, 462897, 463356, 467686, 471246, 475132, 476087, 477333, 477740, 479360, 481097, 481139, 481557, 483346, 489270, 489477, 490768, 495170, 496011, 499844, 503709, 503936, 507566, 513375, 514098, 514779, 518739, 524252, 535041, 535632, 537041, 538466, 541013, 542136, 543645, 546530, 547367, 551635, 554230, 564652, 565125, 566216, 572598, 572822, 574244, 574558, 576719, 580504, 582138, 596870, 603490, 606432, 609821, 612018, 615015, 615450, 633709, 636074, 643786, 647471, 650572, 678820, 679459, 682463, 682650, 688996, 699353, 700090, 701724, 716456, 726364, 745494, 761861, 762183, 762764, 765109, 766025, 766305, 766360, 766387, 766413, 766426, 766471, 766795, 766845, 767169, 767561, 768748, 768765, 769008, 769967, 770710, 771639, 771749, 772282, 776323, 784905, 793866, 798963, 803924, 804784, 805668, 806755, 812929, 813919, 842132, 862309, 869038, 871849, 887631, 890760, 893515, 893823, 895264, 914346, 927558, 951860, 987023, 1072106, 1072137, 1134545, 1140198, 1140251, 1221332, 1244894, 1267099, 1283497, 1350772
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:nse meta])

Attachments

(4 obsolete attachments)

(Assignee)

Description

12 years ago
This fuzzer creates random DOM Range objects, selects them, and calls random execCommand functions.  It also tests most DOM Range functions.
(Assignee)

Comment 1

12 years ago
Created attachment 220613 [details]
messy WIP
Whiteboard: [sg:nse meta]
(Assignee)

Updated

12 years ago
Depends on: 336715
(Assignee)

Comment 2

12 years ago
Created attachment 224054 [details]
DOM Range and designMode fuzzer 1.0 (requires fuzz.js)

* Converted it to use fuzz.js (see bug 339948).
* Now works as a bookmarklet, by stuffing the page into an iframe.
Attachment #220613 - Attachment is obsolete: true
(Assignee)

Updated

12 years ago
(Assignee)

Comment 3

12 years ago
Joe, it would be great if you or someone else working on Editor could fix the crash bugs found with this fuzzer, bug 335995 and bug 336081, as well as a bug that seems to stop the fuzzer (or even the user) from making further changes to the document, bug 336091.  Once those three bugs are fixed, another round or two of fuzzing should tell us whether there are any easy-to-find security holes involving the execCommand API.
(Assignee)

Comment 4

12 years ago
Created attachment 226750 [details]
DOM Range and designMode fuzzer 2.0
Attachment #224054 - Attachment is obsolete: true
(Assignee)

Updated

12 years ago
Depends on: 345837
(Assignee)

Comment 5

11 years ago
Created attachment 242972 [details]
DOM Range and designMode fuzzer 3.0
Attachment #226750 - Attachment is obsolete: true
(Assignee)

Updated

11 years ago
Assignee: chofmann → jruderman
(Assignee)

Comment 6

11 years ago
Comment on attachment 242972 [details]
DOM Range and designMode fuzzer 3.0

New version in bug 339948.
Attachment #242972 - Attachment is obsolete: true
(Assignee)

Updated

11 years ago
Depends on: 372094
(Assignee)

Updated

11 years ago
Depends on: 372284
(Assignee)

Updated

11 years ago
Depends on: 382210
(Assignee)

Updated

11 years ago
Depends on: 382046, 382057
(Assignee)

Updated

11 years ago
Depends on: 382527
(Assignee)

Updated

11 years ago
Depends on: 382778
(Assignee)

Updated

11 years ago
Depends on: 383208
(Assignee)

Updated

10 years ago
Depends on: 407053
(Assignee)

Updated

10 years ago
Depends on: 407062
(Assignee)

Updated

10 years ago
Depends on: 407072
(Assignee)

Updated

10 years ago
Depends on: 407074
(Assignee)

Updated

10 years ago
Depends on: 407079
(Assignee)

Updated

10 years ago
Depends on: 407256
(Assignee)

Updated

10 years ago
Depends on: 407259
(Assignee)

Updated

10 years ago
Depends on: 407277
(Assignee)

Updated

10 years ago
Depends on: 407818
(Assignee)

Updated

10 years ago
Depends on: 409990
(Assignee)

Updated

10 years ago
Depends on: 410230
(Assignee)

Updated

10 years ago
Depends on: 413712
(Assignee)

Updated

10 years ago
Depends on: 414178
(Assignee)

Updated

10 years ago
Depends on: 414689
(Assignee)

Updated

10 years ago
Depends on: 415394
(Assignee)

Updated

10 years ago
Depends on: 416264
(Assignee)

Updated

10 years ago
Depends on: 417384
(Assignee)

Updated

10 years ago
Depends on: 418923
(Assignee)

Updated

10 years ago
Depends on: 418928
(Assignee)

Updated

10 years ago
Depends on: 419563
(Assignee)

Updated

10 years ago
Depends on: 420439
(Assignee)

Updated

10 years ago
Depends on: 420620
(Assignee)

Updated

10 years ago
Depends on: 423514
(Assignee)

Updated

10 years ago
Depends on: 424027
(Assignee)

Updated

10 years ago
Depends on: 424276
(Assignee)

Updated

10 years ago
Depends on: 424289
(Assignee)

Updated

10 years ago
Depends on: 424300
(Assignee)

Updated

10 years ago
Depends on: 427322
(Assignee)

Updated

10 years ago
Depends on: 428275
(Assignee)

Updated

10 years ago
Depends on: 429960
(Assignee)

Updated

10 years ago
Depends on: 430124
(Assignee)

Updated

10 years ago
Depends on: 430628
(Assignee)

Updated

10 years ago
Depends on: 431086
(Assignee)

Updated

10 years ago
Depends on: 437170
(Assignee)

Updated

10 years ago
Depends on: 439258
(Assignee)

Updated

10 years ago
Depends on: 444036
(Assignee)

Updated

10 years ago
Depends on: 448161
(Assignee)

Updated

10 years ago
Depends on: 448993
(Assignee)

Updated

10 years ago
Depends on: 449006
(Assignee)

Updated

9 years ago
Depends on: 453406
(Assignee)

Updated

9 years ago
Depends on: 454746
(Assignee)

Updated

9 years ago
(Assignee)

Updated

9 years ago
Depends on: 460876
(Assignee)

Updated

9 years ago
Depends on: 461049
(Assignee)

Updated

9 years ago
Depends on: 462897
(Assignee)

Updated

9 years ago
Depends on: 463356
(Assignee)

Updated

9 years ago
Depends on: 467686
(Assignee)

Updated

9 years ago
Depends on: 468202
(Assignee)

Updated

9 years ago
Depends on: 469014
(Assignee)

Updated

9 years ago
Depends on: 471246
(Assignee)

Updated

9 years ago
Depends on: 475132
(Assignee)

Updated

9 years ago
Depends on: 476087
(Assignee)

Updated

9 years ago
Depends on: 477333
(Assignee)

Updated

9 years ago
Depends on: 477740
(Assignee)

Updated

9 years ago
Depends on: 479360
(Assignee)

Updated

9 years ago
Depends on: 481097
(Assignee)

Updated

9 years ago
Depends on: 481139
(Assignee)

Updated

9 years ago
Depends on: 481557
(Assignee)

Updated

9 years ago
Depends on: 483346
(Assignee)

Updated

9 years ago
Depends on: 489270
(Assignee)

Updated

9 years ago
Depends on: 489477
(Assignee)

Updated

9 years ago
Depends on: 490768
(Assignee)

Updated

9 years ago
Depends on: 493641
(Assignee)

Updated

9 years ago
Depends on: 495170
(Assignee)

Updated

9 years ago
Depends on: 496011
(Assignee)

Updated

9 years ago
Depends on: 499844
(Assignee)

Updated

9 years ago
Depends on: 503709
(Assignee)

Updated

9 years ago
Depends on: 503936
(Assignee)

Updated

9 years ago
Depends on: 507566
(Assignee)

Updated

8 years ago
Depends on: 513375
(Assignee)

Updated

8 years ago
Depends on: 514098
(Assignee)

Updated

8 years ago
Depends on: 514779
(Assignee)

Updated

8 years ago
Depends on: 518739
(Assignee)

Updated

8 years ago
Depends on: 524252
(Assignee)

Updated

8 years ago
Depends on: 532808
(Assignee)

Updated

8 years ago
Summary: DOM Range and designMode execCommand fuzzer → DOM Range and Editor (designMode/execCommand/contentEditable) fuzzer
(Assignee)

Updated

8 years ago
Depends on: 535041
(Assignee)

Updated

8 years ago
Depends on: 535632
(Assignee)

Updated

8 years ago
Depends on: 537041
(Assignee)

Updated

8 years ago
Depends on: 538466
(Assignee)

Updated

8 years ago
Depends on: 541013
(Assignee)

Updated

8 years ago
Depends on: 542136
(Assignee)

Updated

8 years ago
Depends on: 543645
(Assignee)

Updated

8 years ago
Depends on: 543651

Updated

8 years ago
Depends on: 546530
(Assignee)

Updated

8 years ago
Depends on: 547367
(Assignee)

Updated

8 years ago
Depends on: 551635
(Assignee)

Updated

8 years ago
Depends on: 554230
(Assignee)

Updated

8 years ago
Depends on: 561940
(Assignee)

Updated

8 years ago
Depends on: 564652
(Assignee)

Updated

8 years ago
Depends on: 565125
(Assignee)

Updated

8 years ago
Depends on: 566216
(Assignee)

Updated

8 years ago
Depends on: 572598
(Assignee)

Updated

8 years ago
Depends on: 572617
(Assignee)

Updated

8 years ago
Depends on: 572822
(Assignee)

Updated

8 years ago
Depends on: 574238
(Assignee)

Updated

8 years ago
Depends on: 574244
(Assignee)

Updated

8 years ago
Depends on: 574558
(Assignee)

Updated

8 years ago
Depends on: 576719
(Assignee)

Updated

8 years ago
Depends on: 580504
(Assignee)

Updated

8 years ago
Depends on: 582138
(Assignee)

Updated

7 years ago
Depends on: 588278
(Assignee)

Updated

7 years ago
Depends on: 596870
(Assignee)

Updated

7 years ago
Depends on: 603490
(Assignee)

Updated

7 years ago
Depends on: 606432
(Assignee)

Updated

7 years ago
Depends on: 607001
(Assignee)

Updated

7 years ago
Depends on: 609821
(Assignee)

Updated

7 years ago
Depends on: 612018
(Assignee)

Updated

7 years ago
Depends on: 612994
(Assignee)

Updated

7 years ago
Depends on: 613816
(Assignee)

Updated

7 years ago
Depends on: 615015
(Assignee)

Updated

7 years ago
Depends on: 615033
(Assignee)

Updated

7 years ago
Depends on: 615450
(Assignee)

Updated

7 years ago
Depends on: 633709
(Assignee)

Updated

7 years ago
Depends on: 636074
(Assignee)

Updated

7 years ago
Depends on: 643786
(Assignee)

Updated

7 years ago
Depends on: 647471
(Assignee)

Updated

7 years ago
Depends on: 650572
(Assignee)

Updated

7 years ago
Depends on: 673849
(Assignee)

Updated

6 years ago
Depends on: 678820
(Assignee)

Updated

6 years ago
Depends on: 679459
(Assignee)

Updated

6 years ago
Depends on: 682463
(Assignee)

Updated

6 years ago
Depends on: 682650
(Assignee)

Updated

6 years ago
Depends on: 688945
(Assignee)

Updated

6 years ago
Depends on: 688996
(Assignee)

Updated

6 years ago
Depends on: 699353
(Assignee)

Updated

6 years ago
Depends on: 700090
(Assignee)

Updated

6 years ago
Depends on: 701724
(Assignee)

Updated

6 years ago
Depends on: 709429
(Assignee)

Updated

6 years ago
Depends on: 716456
(Assignee)

Updated

6 years ago
Depends on: 718282
(Assignee)

Updated

6 years ago
Depends on: 726364
(Assignee)

Updated

6 years ago
Depends on: 745494
Keywords: sec-other
(Assignee)

Updated

6 years ago
Depends on: 760879
(Assignee)

Updated

6 years ago
Depends on: 761861
(Assignee)

Updated

6 years ago
Depends on: 762183
(Assignee)

Updated

6 years ago
Depends on: 762764
(Assignee)

Updated

6 years ago
Depends on: 765109
(Assignee)

Updated

6 years ago
Depends on: 766025
(Assignee)

Updated

6 years ago
Depends on: 766305
(Assignee)

Updated

6 years ago
Depends on: 766360
(Assignee)

Updated

6 years ago
Depends on: 766387
(Assignee)

Updated

6 years ago
Depends on: 766413
(Assignee)

Updated

6 years ago
Depends on: 766416
(Assignee)

Updated

6 years ago
Depends on: 766426
(Assignee)

Updated

6 years ago
Depends on: 766471
(Assignee)

Updated

6 years ago
Depends on: 766795
(Assignee)

Updated

6 years ago
Depends on: 766845
(Assignee)

Updated

6 years ago
Depends on: 767169
(Assignee)

Updated

6 years ago
Depends on: 767561
(Assignee)

Updated

6 years ago
Depends on: 768748
(Assignee)

Updated

6 years ago
Depends on: 768756
(Assignee)

Updated

6 years ago
Depends on: 768765
(Assignee)

Updated

6 years ago
Depends on: 769008
(Assignee)

Updated

6 years ago
Depends on: 769967
(Assignee)

Updated

6 years ago
Depends on: 770710
(Assignee)

Updated

6 years ago
Depends on: 771639
(Assignee)

Updated

6 years ago
Depends on: 771749
(Assignee)

Updated

6 years ago
Depends on: 772282
(Assignee)

Updated

6 years ago
Depends on: 772668
(Assignee)

Updated

6 years ago
Depends on: 776323
(Assignee)

Updated

5 years ago
Depends on: 780725
(Assignee)

Updated

5 years ago
Depends on: 784905
(Assignee)

Updated

5 years ago
Depends on: 785211
(Assignee)

Updated

5 years ago
Depends on: 788929
(Assignee)

Updated

5 years ago
Depends on: 788936
(Assignee)

Updated

5 years ago
Depends on: 793866
(Assignee)

Updated

5 years ago
Depends on: 797054
(Assignee)

Updated

5 years ago
Depends on: 798963
(Assignee)

Updated

5 years ago
Depends on: 803924
(Assignee)

Updated

5 years ago
Depends on: 804099
(Assignee)

Updated

5 years ago
Depends on: 804784
(Assignee)

Updated

5 years ago
Depends on: 804835
(Assignee)

Updated

5 years ago
Depends on: 805668
(Assignee)

Updated

5 years ago
Depends on: 806755
(Assignee)

Updated

5 years ago
Depends on: 812929
(Assignee)

Updated

5 years ago
Depends on: 813919
(Assignee)

Updated

5 years ago
Depends on: 822734
(Assignee)

Updated

5 years ago
Depends on: 842132
(Assignee)

Updated

5 years ago
Depends on: 847136
(Assignee)

Updated

5 years ago
Depends on: 862309
(Assignee)

Updated

5 years ago
Depends on: 869038
(Assignee)

Updated

5 years ago
Depends on: 871849
(Assignee)

Updated

5 years ago
Depends on: 873681
(Assignee)

Updated

5 years ago
Depends on: 876826
(Assignee)

Updated

5 years ago
Depends on: 887631
(Assignee)

Updated

5 years ago
Depends on: 890760
(Assignee)

Updated

5 years ago
Depends on: 893333
(Assignee)

Updated

5 years ago
Depends on: 893515
(Assignee)

Updated

5 years ago
Depends on: 893823
(Assignee)

Updated

5 years ago
Depends on: 895264
(Assignee)

Updated

4 years ago
Depends on: 914346
(Assignee)

Updated

4 years ago
Depends on: 927558
(Assignee)

Updated

4 years ago
Depends on: 951860
(Assignee)

Updated

4 years ago
Depends on: 987023
(Assignee)

Updated

4 years ago
Depends on: 989711
(Assignee)

Updated

3 years ago
Depends on: 1072106
(Assignee)

Updated

3 years ago
Depends on: 1072112
(Assignee)

Updated

3 years ago
Depends on: 1072137
(Assignee)

Updated

3 years ago
Depends on: 1134545
(Assignee)

Updated

3 years ago
Depends on: 1140198
(Assignee)

Updated

3 years ago
Depends on: 1140251
(Assignee)

Updated

3 years ago
Blocks: 1172704
(Assignee)

Updated

3 years ago
No longer blocks: 316898
(Assignee)

Comment 7

2 years ago
I ended up splitting this into two DOMFuzz modules, but I'll keep tracking both their bugs here.

https://github.com/MozillaSecurity/funfuzz/blob/master/dom/fuzzer/modules/editor.js

https://github.com/MozillaSecurity/funfuzz/blob/master/dom/fuzzer/modules/range-and-selection.js
Group: core-security
(Assignee)

Updated

2 years ago
Depends on: 1221332
(Assignee)

Updated

2 years ago
Depends on: 1223673
(Assignee)

Updated

2 years ago
Depends on: 1244894
(Assignee)

Updated

2 years ago
Depends on: 1267099

Updated

2 years ago
Component: Tracking → Platform Fuzzing Team
(Assignee)

Updated

2 years ago
Depends on: 1283497
Depends on: 1350772
You need to log in before you can comment on or make changes to this bug.