|
| 1 | +/* |
| 2 | + * Copyright 2023 Code Intelligence GmbH |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | + * you may not use this file except in compliance with the License. |
| 6 | + * You may obtain a copy of the License at |
| 7 | + * |
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | + * |
| 10 | + * Unless required by applicable law or agreed to in writing, software |
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | + * See the License for the specific language governing permissions and |
| 14 | + * limitations under the License. |
| 15 | + */ |
| 16 | + |
| 17 | +export class BugDetectorError extends Error {} |
| 18 | +// Register bug detectors based on the provided list of bug detectors |
| 19 | +// eslint-disable-next-line @typescript-eslint/ban-types |
| 20 | +import { registerPathTraversalBugDetectors } from "./path-traversal"; |
| 21 | + |
| 22 | +interface BugDetector { |
| 23 | + [key: string]: (callOriginalFn: boolean) => Promise<void>; |
| 24 | +} |
| 25 | + |
| 26 | +const bugDetectorRegistry: BugDetector = { |
| 27 | + pathTraversal: registerPathTraversalBugDetectors, |
| 28 | +}; |
| 29 | + |
| 30 | +/** |
| 31 | + * Registers bug detectors based on the provided list of bug detectors. |
| 32 | + */ |
| 33 | +export async function registerBugDetectors( |
| 34 | + detectorNames: string[] |
| 35 | +): Promise<void> { |
| 36 | + const registeredBugDetectors: Set<string> = new Set(); |
| 37 | + |
| 38 | + for (const detectorName of detectorNames) { |
| 39 | + if (registeredBugDetectors.has(detectorName)) { |
| 40 | + continue; |
| 41 | + } |
| 42 | + |
| 43 | + const detector = bugDetectorRegistry[detectorName]; |
| 44 | + if (detector) { |
| 45 | + registeredBugDetectors.add(detectorName); |
| 46 | + await detector(true); |
| 47 | + } else { |
| 48 | + console.error(`Unknown bug detector: ${detectorName}`); |
| 49 | + } |
| 50 | + } |
| 51 | +} |
| 52 | + |
| 53 | +/** |
| 54 | + * Replaces a built-in function with a custom implementation while preserving |
| 55 | + * the original function for potential use within the replacement function. |
| 56 | + * |
| 57 | + * @param moduleName - The name of the module containing the target function. |
| 58 | + * @param targetFnName - The name of the target function to be replaced. |
| 59 | + * @param replacementFn - The replacement function that will be called instead |
| 60 | + * of the original function. The first argument passed |
| 61 | + * to the replacement function will be the original function, |
| 62 | + * followed by any arguments that were originally passed |
| 63 | + * to the target function. |
| 64 | + * @returns A promise that resolves to the original function that was replaced. |
| 65 | + * @throws Will throw an error if the module cannot be imported. |
| 66 | + * |
| 67 | + * @example |
| 68 | + * const originalExec = await hookBuiltInFunction( |
| 69 | + * "child_process", |
| 70 | + * "exec", |
| 71 | + * (originalFn: Function, cmd: string, options: object, callback: Function) => { |
| 72 | + * console.log("Custom implementation called with command:", cmd); |
| 73 | + * return originalFn(cmd, options, callback); |
| 74 | + * } |
| 75 | + * ); |
| 76 | + */ |
| 77 | +export async function hookBuiltInFunction< |
| 78 | + // eslint-disable-next-line @typescript-eslint/ban-types |
| 79 | + F extends Function, |
| 80 | + // eslint-disable-next-line @typescript-eslint/ban-types |
| 81 | + K extends Function |
| 82 | +>(moduleName: string, targetFnName: string, replacementFn: F): Promise<K> { |
| 83 | + const { default: module } = await import(moduleName); |
| 84 | + const originalFn = module[targetFnName]; |
| 85 | + module[targetFnName] = (...args: unknown[]) => |
| 86 | + replacementFn(originalFn, ...args); |
| 87 | + return originalFn; |
| 88 | +} |
| 89 | + |
| 90 | +// The first error to be found by any bug detector will be saved here. |
| 91 | +// This is a global variable shared between the core-library (read, reset) and the bug detectors (write). |
| 92 | +// It will be reset after the fuzzer has processed an input (only relevant for modes where the fuzzing |
| 93 | +// continues after finding an error, e.g. fork mode, Jest regression mode, fuzzing that ignores errors mode, etc.). |
| 94 | +let firstBugDetectorError: BugDetectorError | undefined; |
| 95 | + |
| 96 | +export function getFirstBugDetectorError(): BugDetectorError | undefined { |
| 97 | + return firstBugDetectorError; |
| 98 | +} |
| 99 | + |
| 100 | +// Clear the error saved by the bug detector before the fuzzer continues with a new input. |
| 101 | +export function clearFirstBugDetectorError(): void { |
| 102 | + firstBugDetectorError = undefined; |
| 103 | +} |
| 104 | + |
| 105 | +export function saveFirstBugDetectorError( |
| 106 | + error: BugDetectorError, |
| 107 | + trimErrorStackLines = 0 |
| 108 | +): void { |
| 109 | + // After an error has been saved, ignore all subsequent errors. |
| 110 | + if (firstBugDetectorError) { |
| 111 | + return; |
| 112 | + } |
| 113 | + error.stack = error.stack?.split("\n").slice(trimErrorStackLines).join("\n"); |
| 114 | + firstBugDetectorError = error; |
| 115 | + throw error; |
| 116 | +} |
0 commit comments