Closed Bug 528561 (fuzz-xslt-xpath) Opened 15 years ago Closed 4 years ago

[meta] XSLT and XPATH fuzzer

Categories

(Core :: Fuzzing, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED

People

(Reporter: pvnick, Assigned: pvnick)

References

(Blocks 1 open bug)

Details

(Keywords: meta, sec-other, Whiteboard: [sg:nse meta])

Attachments

(2 files)

Attached file fuzz.htm
1. Edit fuzz.htm and change the following lines to match where you want the testcases to be stored:
    writeContents("C:\\mozilla\\work\\xsl\\xml0.xml", xmlCode);
    writeContents("C:\\mozilla\\work\\xsl\\xsl0.xml", xslCode);

2. Run the fuzzer until it crashes.

3. Edit test.htm and change the following lines to reflect where the testcases are stored:
    var xmlCode = readContents("C:\\mozilla\\work\\xsl\\xml" + index + ".xml");
    var domparse = new DOMParser();
    var xmlDoc = domparse.parseFromString(xmlCode,"text/xml");
    var xslCode = readContents("C:\\mozilla\\work\\xsl\\xsl" + index + ".xml");

4. Test.htm will reproduce the bug which is stored in xml0.xml and xsl0.xml. Reduce xml0.xml and xsl0.xml by hand. Notepad++ makes this easy by highlighting begining+ending tags.
Keywords: meta
Summary: XSLT fuzzer → XSLT and XPATH fuzzer
Whiteboard: [sg:nse] meta
Attached file test.htm
Whiteboard: [sg:nse] meta → [sg:nse meta]
Depends on: 528590
Depends on: 528963
Group: core-security → core-security-release
Component: Tracking → Platform Fuzzing Team
No longer blocks: fuzz

No action for a while, closing.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Alias: fuzz-xslt-xpath
Summary: XSLT and XPATH fuzzer → [meta] XSLT and XPATH fuzzer
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: