forked from MozillaSecurity/funfuzz
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathgen-proxy.js
More file actions
132 lines (119 loc) · 4.56 KB
/
gen-proxy.js
File metadata and controls
132 lines (119 loc) · 4.56 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
// In addition, can always use "undefined" or makeFunction
// Forwarding proxy code based on http://wiki.ecmascript.org/doku.php?id=harmony:proxies "Example: a no-op forwarding proxy"
// The letter 'x' is special.
var proxyHandlerProperties = {
getOwnPropertyDescriptor: {
empty: "function(){}",
forward: "function(name) { var desc = Object.getOwnPropertyDescriptor(x); desc.configurable = true; return desc; }",
throwing: "function(name) { return {get: function() { throw 4; }, set: function() { throw 5; }}; }",
},
getPropertyDescriptor: {
empty: "function(){}",
forward: "function(name) { var desc = Object.getPropertyDescriptor(x); desc.configurable = true; return desc; }",
throwing: "function(name) { return {get: function() { throw 4; }, set: function() { throw 5; }}; }",
},
defineProperty: {
empty: "function(){}",
forward: "function(name, desc) { Object.defineProperty(x, name, desc); }"
},
getOwnPropertyNames: {
empty: "function() { return []; }",
forward: "function() { return Object.getOwnPropertyNames(x); }"
},
delete: {
empty: "function() { return true; }",
yes: "function() { return true; }",
no: "function() { return false; }",
forward: "function(name) { return delete x[name]; }"
},
fix: {
empty: "function() { return []; }",
yes: "function() { return []; }",
no: "function() { }",
forward: "function() { if (Object.isFrozen(x)) { return Object.getOwnProperties(x); } }"
},
has: {
empty: "function() { return false; }",
yes: "function() { return true; }",
no: "function() { return false; }",
forward: "function(name) { return name in x; }"
},
hasOwn: {
empty: "function() { return false; }",
yes: "function() { return true; }",
no: "function() { return false; }",
forward: "function(name) { return Object.prototype.hasOwnProperty.call(x, name); }"
},
get: {
empty: "function() { return undefined }",
forward: "function(receiver, name) { return x[name]; }",
bind: "function(receiver, name) { var prop = x[name]; return (typeof prop) === 'function' ? prop.bind(x) : prop; }"
},
set: {
empty: "function() { return true; }",
yes: "function() { return true; }",
no: "function() { return false; }",
forward: "function(receiver, name, val) { x[name] = val; return true; }"
},
iterate: {
empty: "function() { return (function() { throw StopIteration; }); }",
forward: "function() { return (function() { for (var name in x) { yield name; } })(); }"
},
enumerate: {
empty: "function() { return []; }",
forward: "function() { var result = []; for (var name in x) { result.push(name); }; return result; }"
},
keys: {
empty: "function() { return []; }",
forward: "function() { return Object.keys(x); }"
}
};
function makeProxyHandlerFactory(d, b)
{
if (rnd(TOTALLY_RANDOM) == 2) return totallyRandom(d, b);
if (d < 1)
return "({/*TOODEEP*/})";
try { // in case we screwed Object.prototype, breaking proxyHandlerProperties
var preferred = Random.index(["empty", "forward", "yes", "no", "bind", "throwing"]);
var fallback = Random.index(["empty", "forward"]);
var fidelity = rnd(10);
var handlerFactoryText = "(function handlerFactory(x) {";
handlerFactoryText += "return {";
if (rnd(2)) {
// handlerFactory has an argument 'x'
bp = b.concat(['x']);
} else {
// handlerFactory has no argument
handlerFactoryText = handlerFactoryText.replace(/x/, "");
bp = b;
}
for (var p in proxyHandlerProperties) {
var funText;
if (proxyHandlerProperties[p][preferred] && rnd(10) <= fidelity) {
funText = proxyMunge(proxyHandlerProperties[p][preferred], p);
} else {
switch(rnd(7)) {
case 0: funText = makeFunction(d - 3, bp); break;
case 1: funText = "undefined"; break;
case 2: funText = "function() { throw 3; }"; break;
default: funText = proxyMunge(proxyHandlerProperties[p][fallback], p);
}
}
handlerFactoryText += p + ": " + funText + ", ";
}
handlerFactoryText += "}; })";
return handlerFactoryText;
} catch(e) {
return "({/* :( */})";
}
}
function proxyMunge(funText, p)
{
//funText = funText.replace(/\{/, "{ var yum = 'PCAL'; dumpln(yum + 'LED: " + p + "');");
return funText;
}
function makeProxyHandler(d, b)
{
if (rnd(TOTALLY_RANDOM) == 2) return totallyRandom(d, b);
return makeProxyHandlerFactory(d, b) + "(" + makeExpr(d - 3, b) + ")";
}