Re: test case generator for tidy
"Arnaud Desitter" <[email protected]>
| Newsgroups | gmane.comp.web.html-tidy.devel |
|---|---|
| Message-ID | <[email protected]> |
Just in case it is of interest, here is a (badly) modified version of Michal Zalewski's mangleme more suitable to tidy testing. Regards, ----- Original Message ----- From: "Arnaud Desitter" <[email protected]> To: <[email protected]> Sent: Monday, October 25, 2004 11:12 AM Subject: [Tidy-dev] test case generator for tidy > Hi, > > A tool reminiscent of "fuzz" that generates random HTML page in described > and available at: > http://www.securityfocus.com/archive/1/378632 > Its name is "mangleme". > > It quickly generated test cases that makes tidy crash (for instance, > see bug #1050684) or spin infinitely (see 1050673 and 1053626). > > With a bit of experimentation, it seems to be two general categories: > - crash due to dereferencing of NULL pointer. It is usually due to > attribute with no value. These bugs are easily fixed (see 1050684 > for instance). Tweaking mangleme to generates shorter attributes > names helps to simplify the test cases. > - infinite loops. Much harder to fix IMO. Disabling the attribute > generation in mangleme helps to generates simpler test cases. > It would be nice to add this test tool to the CVS repository. But > is not my decision. > > Regards, > > > > > > > ------------------------------------------------------- > This SF.net email is sponsored by: IT Product Guide on ITManagersJournal > Use IT products in your business? Tell us what you think of them. Give us > Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out > more > http://productguide.itmanagersjournal.com/guidepromo.tmpl > _______________________________________________ > Tidy-develop mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/tidy-develop >
mangle.cmd.c
(application/octet-stream, 2.5 KB)
/* HTML manglizer -------------- Copyright (C) 2004 by Michal Zalewski <[email protected]> HTML manglizer library. Logs random seeds to error-log; find the last entry before crash, then pass it to remangle.cgi to reproduce the problem. */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> #include <string.h> #include <time.h> #include "tags.h" #define R(x) (rand() % (x)) #define MAXTCOUNT 80 #define MAXPCOUNT 60 #define MAXSTR2 10 void make_up_value(void) { switch (R(31)) { case 0: printf("javascript:"); break; // case 1: printf("jar:"); break; case 2: printf("mk:"); break; case 3: printf("file:"); break; case 4: printf("http:"); break; case 5: printf("about:"); break; case 6: printf("_blank"); break; case 7: printf("_self"); break; case 8: printf("top"); break; case 9: printf("left"); break; case 10: printf("&"); break; case 11: printf(";"); break; case 12 ... 20: { int c = R(10) ? R(10) : (1 + R(MAXSTR2) * R(MAXSTR2)); char* x = malloc(c); memset(x,R(256),c); fwrite(x,c,1,stdout); free(x); break; } case 21: printf("%s","%n%n%n%n%n%n"); break; case 22: putchar('#'); break; case 23: putchar('*'); break; default: printf("%d",rand()); break; } } void random_tag(void) { int tn, tc; do tn = R(MAXTAGS); while (!tags[tn][0]); tc = R(MAXPCOUNT) + 1; putchar('<'); switch (R(10)) { case 0: putchar(R(256)); break; case 1: putchar('/'); } printf("%s", tags[tn][0]); #if 0 while (tc--) { int pn; switch (R(32)) { case 0: putchar(R(256)); case 1: break; default: putchar(' '); } do pn = R(MAXPARS-1) + 1; while (!tags[t]n[pn]); printf("%s", tags[tn][pn]); switch (R(32)) { case 0: putchar(R(256)); case 1: break; default: putchar('='); } make_up_value(); } #endif putchar('>'); //putchar('\n'); } int main(int argc,char** argv) { int tc; unsigned int seed; //printf("Content-Type: text/html\n\n<HTML>\n"); // printf("<HEAD>\n" // "<META HTTP-EQUIV=\"Refresh\" content=\"0;URL=mangle.cgi\">\n"); printf("<HEAD>\n"); seed = (time(0) ^ (getpid() << 16)); fprintf(stderr,"[%u] Mangle attempt 0x%08x (%s) -- %s\n", (int)time(0), seed, getenv("HTTP_USER_AGENT"), getenv("REMOTE_ADDR")); srand(seed); tc = R(MAXTCOUNT) + 1; while (tc--) random_tag(); fflush(0); return 0; }
testIt
(application/octet-stream, 233 B) - not displayed
tags.h
(application/octet-stream, 4.4 KB)
/* HTML manglizer -------------- Copyright (C) 2004 by Michal Zalewski <[email protected]> Tag and parameter list: guesstimating / reference compilation. */ #define MAXTAGS 80 #define MAXPARS 20 static char* tags[MAXTAGS][MAXPARS] = { { "A", "NAME", "HREF", "REF", "REV", "TITLE", "TARGET", "SHAPE", "onLoad", "STYLE", 0 }, { "APPLET", "CODEBASE", "CODE", "NAME", "ALIGN", "ALT", "HEIGHT", "WIDTH", "HSPACE", "VSPACE", "DOWNLOAD", "HEIGHT", "NAME", "TITLE", "onLoad", "STYLE", 0 }, { "AREA", "SHAPE", "ALT", "CO-ORDS", "HREF", "onLoad", "STYLE", 0 }, { "B", "onLoad", "STYLE", 0 }, { "BANNER", "onLoad", "STYLE", 0 }, { "BASE", "HREF", "TARGET", "onLoad", "STYLE", 0 }, { "BASEFONT", "SIZE", "onLoad", "STYLE", 0 }, { "BGSOUND", "SRC", "LOOP", "onLoad", "STYLE", 0 }, { "BQ", "CLEAR", "NOWRAP", "onLoad", "STYLE", 0 }, { "BODY", "BACKGROUND", "BGCOLOR", "TEXT", "LINK", "ALINK", "VLINK", "LEFTMARGIN", "TOPMARGIN", "BGPROPERTIES", "onLoad", "STYLE", 0 }, { "CAPTION", "ALIGN", "VALIGN", "onLoad", "STYLE", 0 }, { "CENTER", "onLoad", "STYLE", 0 }, { "COL", "ALIGN", "SPAN", "onLoad", "STYLE", 0 }, { "COLGROUP", "ALIGN", "VALIGN", "HALIGN", "WIDTH", "SPAN", "onLoad", "STYLE", 0 }, { "DIV", "ALIGN", "CLASS", "LANG", "onLoad", "STYLE", 0 }, { "EMBED", "SRC", "HEIGHT", "WIDTH", "UNITS", "NAME", "PALETTE", "onLoad", "STYLE", 0 }, { "FIG", "SRC", "ALIGN", "HEIGHT", "WIDTH", "UNITS", "IMAGEMAP", "onLoad", "STYLE", 0 }, { "FN", "ID", "onLoad", "STYLE", 0 }, { "FONT", "SIZE", "COLOR", "FACE", "onLoad", "STYLE", 0 }, { "FORM", "ACTION", "METHOD", "ENCTYPE", "TARGET", "SCRIPT", "onLoad", "STYLE", 0 }, { "FRAME", "SRC", "NAME", "MARGINWIDTH", "MARGINHEIGHT", "SCROLLING", "FRAMESPACING", "onLoad", "STYLE", 0 }, { "FRAMESET", "ROWS", "COLS", "onLoad", "STYLE", 0 }, { "H1", "SRC", "DINGBAT", "onLoad", "STYLE", 0 }, { "HEAD", "onLoad", "STYLE", 0 }, { "HR", "SRC", "SIZE", "WIDTH", "ALIGN", "COLOR", "onLoad", "STYLE", 0 }, { "HTML", "onLoad", "STYLE", 0 }, { "IFRAME", "ALIGN", "FRAMEBORDER", "HEIGHT", "MARGINHEIGHT", "MARGINWIDTH", "NAME", "SCROLLING", "SRC", "ADDRESS", "WIDTH", "onLoad", "STYLE", 0 }, { "IMG", "ALIGN", "ALT", "SRC", "BORDER", "DYNSRC", "HEIGHT", "HSPACE", "ISMAP", "LOOP", "LOWSRC", "START", "UNITS", "USEMAP", "WIDTH", "VSPACE", "onLoad", "STYLE", 0 }, { "INPUT", "TYPE", "NAME", "VALUE", "onLoad", "STYLE", 0 }, { "ISINDEX", "HREF", "PROMPT", "onLoad", "STYLE", 0 }, { "LI", "SRC", "DINGBAT", "SKIP", "TYPE", "VALUE", "onLoad", "STYLE", 0 }, { "LINK", "REL", "REV", "HREF", "TITLE", "onLoad", "STYLE", 0 }, { "MAP", "NAME", "onLoad", "STYLE", 0 }, { "MARQUEE", "ALIGN", "BEHAVIOR", "BGCOLOR", "DIRECTION", "HEIGHT", "HSPACE", "LOOP", "SCROLLAMOUNT", "SCROLLDELAY", "WIDTH", "VSPACE", "onLoad", "STYLE", 0 }, { "MENU", "onLoad", "STYLE", 0 }, { "META", "HTTP-EQUIV", "CONTENT", "NAME", "onLoad", "STYLE", 0 }, { "MULTICOL", "COLS", "GUTTER", "WIDTH", "onLoad", "STYLE", 0 }, { "NOFRAMES", "onLoad", "STYLE", 0 }, { "NOTE", "CLASS", "SRC", "onLoad", "STYLE", 0 }, { "OVERLAY", "SRC", "X", "Y", "HEIGHT", "WIDTH", "UNITS", "IMAGEMAP", "onLoad", "STYLE", 0 }, { "PARAM", "NAME", "VALUE", "onLoad", "STYLE", 0 }, { "RANGE", "FROM", "UNTIL", "onLoad", "STYLE", 0 }, { "SCRIPT", "LANGUAGE", "onLoad", "STYLE", 0 }, { "SELECT", "NAME", "SIZE", "MULTIPLE", "WIDTH", "HEIGHT", "UNITS", "onLoad", "STYLE", 0 }, { "OPTION", "VALUE", "SHAPE", "onLoad", "STYLE", 0 }, { "SPACER", "TYPE", "SIZE", "WIDTH", "HEIGHT", "ALIGN", "onLoad", "STYLE", 0 }, { "SPOT", "ID", "onLoad", "STYLE", 0 }, { "TAB", "INDENT", "TO", "ALIGN", "DP", "onLoad", "STYLE", 0 }, { "TABLE", "ALIGN", "WIDTH", "BORDER", "CELLPADDING", "CELLSPACING", "BGCOLOR", "VALIGN", "COLSPEC", "UNITS", "DP", "onLoad", "STYLE", 0 }, { "TBODY", "CLASS", "ID", "onLoad", "STYLE", 0 }, { "TD", "COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR", "onLoad", "STYLE", 0 }, { "TEXTAREA", "NAME", "COLS", "ROWS", "onLoad", "STYLE", 0 }, { "TEXTFLOW", "CLASS", "ID", "onLoad", "STYLE", 0 }, { "TFOOT", "COLSPAN", "ROWSPAN", "ALIGN", "VALIGN", "BGCOLOR", "onLoad", "STYLE", 0 }, { "TH", "ALIGN", "CLASS", "ID", "onLoad", "STYLE", 0 }, { "TITLE", "onLoad", "STYLE", 0 }, { "TR", "ALIGN", "VALIGN", "BGCOLOR", "CLASS", "onLoad", "STYLE", 0 }, { "UL", "SRC", "DINGBAT", "WRAP", "TYPE", "PLAIN", "onLoad", "STYLE", 0 }, { 0 } };