blob: a0ad07fe2cc2ccc4f4c44285130185187f3afe03 [file] [log] [blame]
#!/usr/bin/env ruby
# iExploder browser Harness (test a single web browser)
#
# Copyright 2010 Thomas Stromberg - All Rights Reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
#----------------------------------------------------------------------------
# PLEASE NOTE:
#
# You must disable automatic session restoring for this to be useful.
#
# chrome --incognito
# opera --nosession -newprivatetab
# firefox -private
require 'cgi'
require 'open-uri'
require 'optparse'
require './iexploder.rb'
require './scanner.rb'
MAC_CRASH_PATH = "#{ENV['HOME']}/Library/Logs/CrashReporter"
TESTCASE_URL = "http://127.0.0.1:3100/iexploder.cgi"
class BrowserHarness
def initialize(port, config_path, log_dir, test_dir, watchdog_timer, scan_timer)
@app_base_url = "http://127.0.0.1:#{port}/"
@app_url = "#{@app_base_url}iexploder.cgi"
@port = port
@log_dir = log_dir
@server_log_path = "#{log_dir}/iexploder_webserver-#{port}.log"
@client_log_path = "#{log_dir}/iexploder_harness-#{port}.log"
@test_dir = test_dir
@watchdog_timer = watchdog_timer
@scan_timer = scan_timer
@config_path = config_path
@ie = IExploder.new(@config_path)
@ie.cgi_url = @app_url
@browser_id = nil
@browser_name = nil
msg("Client log: #{@client_log_path}")
msg("Server log: #{@server_log_path}")
@server_pid = launch_server()
end
def msg(text)
now = Time.now()
msg = ">>> #{@browser_name}:#{@port} | #{now}: #{text}"
puts msg
STDOUT.flush
f = File.open(@client_log_path, 'a')
f.puts msg
f.close
end
def launch_server()
args = ['./webserver.rb', "-p#{@port}", "-c#{@config_path}", "-l#{@server_log_path}"]
pids = fork { exec(*args) }
msg("Server args: #{args.inspect}")
msg("Server pid: #{pids.inspect}")
return pids
end
def launch_browser(args, url)
if ! File.exist?(args[0])
msg("First argument does not appear to be an executable file: #{args[0]}")
kill_server()
exit
end
browser = File.basename(args[0])
@browser_name = File.basename(browser)
if browser =~ /\.app$/
pids = launch_mac_browser(args, url)
else
pids = launch_posix_browser(args, url)
end
sleep(@scan_timer * 3)
if ! File.size?(@server_log_path)
puts "#{@server_log_path} was never written to. Unable to launch browser?"
kill_server()
exit
end
return pids
end
def launch_posix_browser(args, url)
browser = File.basename(args[0])
msg("Killing browser processes: #{browser}")
system("pkill #{browser} && pkill -9 #{browser}")
args = args + [url]
msg("Launching browser: #{args.inspect}")
browser_pid = fork {
exec(*args)
}
return [browser_pid]
end
def find_pids(text)
# Only tested on Mac OS X.
pids = []
`ps -x`.each do |proc_line|
if proc_line =~ /^ *(\d+).*#{text}/
pid = $1.to_i
# Do not include yourself.
if pid != Process.pid
pids << $1.to_i
end
end
end
return pids
end
def launch_mac_browser(args, url)
# This is dedicated to Safari.
if args.length > 1
msg(".app type launches do not support arguments, ignoring #{args[1..99].inspect}")
end
browser = args[0]
pids = find_pids(browser)
if pids
kill_pids(find_pids(browser))
sleep(2)
end
command = "open -a \"#{browser}\" \"#{url}\""
msg(".app open command: #{command}")
system(command)
return find_pids(browser)
end
def kill_pids(pids)
pids.each do |pid|
msg("Killing #{pid}")
begin
Process.kill("INT", pid)
sleep(0.5)
Process.kill("KILL", pid)
rescue
sleep(0.1)
end
end
end
def encode_browser()
return @browser_id.gsub(' ', '_').gsub(';', '').gsub('/', '-').gsub(/[\(\):\!\@\#\$\%\^\&\*\+=\{\}\[\]\'\"\<\>\?\|\\]/, '').gsub(/_$/, '').gsub(/^_/, '')
end
def kill_server()
kill_pids([@server_pid])
end
def parse_test_url(value)
current_vars = nil
test_num = nil
subtest_data = nil
lookup_values = false
if value =~ /iexploder.cgi(.*)/
current_vars = $1
if current_vars =~ /[&\?]t=(\d+)/
test_num = $1
end
if current_vars =~ /[&\?]s=([\d_,]+)/
subtest_data = $1
end
if current_vars =~ /[&\?]l=(\w+)/
lookup_value = $1
end
else
msg("Unable to parse url in #{value}")
return [nil, nil, nil, nil]
end
return [current_vars, test_num, subtest_data, lookup_value]
end
def check_log_status()
timestamp, uri, user_agent = open("#{@app_base_url}last_page.cgi").read().chomp.split(' ')
age = (Time.now() - timestamp.to_i).to_i
if not @browser_id
@browser_id = CGI.unescape(user_agent)
msg("My browser is #{@browser_id}")
end
return [age, uri]
end
def save_testcase(url, case_type=nil)
msg("Saving testcase: #{url}")
vars, test_num, subtest_data, lookup_value = parse_test_url(url)
if not case_type
case_type = 'testcase'
end
testcase_name = ([case_type, encode_browser(), 'TEST', test_num, subtest_data].join('-')).gsub(/-$/, '') + ".html"
testcase_path = "#{@test_dir}/#{testcase_name}"
data = open(url).read()
# Slow down our redirection time, and replace our testcase urls.
data.gsub!(/0;URL=\/iexploder.*?\"/, "1;URL=#{testcase_name}\"")
data.gsub!(/window\.location=\"\/iexploder.*?\"/, "window\.location=\"#{testcase_name}\"")
# I wish I did not have to do this, but the reality is that I can't imitate header fuzzing
# without a webservice in the backend. Change all URL's to use a well known localhost
# port.
data.gsub!(/\/iexploder.cgi/, TESTCASE_URL)
f = File.open(testcase_path, 'w')
f.write(data)
f.close
msg("Wrote testcase #{testcase_path}")
return testcase_path
end
def calculate_next_url(test_num, subtest_data)
@ie.test_num = test_num.to_i
@ie.subtest_data = subtest_data
if subtest_data and subtest_data.length > 0
(width, offsets) = @ie.parseSubTestData(subtest_data)
# We increment within combo_creator
(width, offsets, lines) = combine_combo_creator(@ie.config['html_tags_per_page'], width, offsets)
return @ie.generateTestUrl(@ie.nextTestNum(), width, offsets)
else
return @ie.generateTestUrl(@ie.nextTestNum())
end
end
def find_crash_logs(max_age)
crashed_files = []
check_files = Dir.glob("*core*")
if File.exists?(MAC_CRASH_PATH)
check_files = check_files + Dir.glob("#{MAC_CRASH_PATH}/*.*")
end
check_files.each do |file|
mtime = File.stat(file).mtime
age = (Time.now() - mtime).to_i
if age < max_age
msg("#{file} is only #{age}s old: #{mtime}")
crashed_files << file
end
end
return crashed_files
end
def test_browser(args, test_num, random_mode=false)
# NOTE: random_mode is not yet supported.
browser_pids = []
subtest_data = nil
@ie.test_num = test_num
@ie.random_mode = random_mode
next_url = @ie.generateTestUrl(test_num)
while next_url
msg("Starting at: #{next_url}")
if browser_pids
kill_pids(browser_pids)
end
browser_pids = launch_browser(args, next_url)
test_is_running = true
crash_files = []
while test_is_running
sleep(@scan_timer)
begin
age, request_uri = check_log_status()
rescue
msg("Failed to get status. webserver likely crashed.")
kill_pids([@server_pid])
@server_pid = launch_server()
next_url = @ie.generateTestUrl(test_num)
test_is_running = false
next
end
vars, test_num, subtest_data, lookup_value = parse_test_url(request_uri)
if lookup_value == 'survived_redirect'
msg("We survived #{vars}. Bummer, could not repeat crash. Moving on.")
test_is_running = false
next_url = calculate_next_url(test_num, subtest_data)
next
elsif age > @watchdog_timer
msg("Stuck at #{vars}, waited for #{@watchdog_timer}s. Killing browser.")
kill_pids(browser_pids)
current_url = "#{@app_url}#{vars}"
# save_testcase(current_url, 'possible')
crash_files = find_crash_logs(@watchdog_timer + (@scan_timer * 2))
if crash_files.length > 0
msg("Found recent crash logs: #{crash_files.inspect} - last page: #{current_url}")
end
if vars =~ /THE_END/
msg("We hung at the end. Saving a testcase just in case.")
save_testcase(current_url)
next_url = calculate_next_url(test_num, nil)
test_is_running = false
next
end
# This is for subtesting
if subtest_data
if lookup_value
msg("Confirmed crashing/hanging page at #{current_url} - saving testcase.")
save_testcase(current_url)
next_url = calculate_next_url(test_num, nil)
test_is_running = false
next
else
msg("Stopped at #{current_url}. Attempting to reproduce simplified crash/hang condition.")
browser_pids = launch_browser(args, "#{current_url}&l=test_redirect")
end
# Normal testing goes here
else
if lookup_value
msg("Reproducible crash/hang at #{current_url}, generating smaller test case.")
url = current_url.gsub(/&l=(\w+)/, '')
browser_pids = launch_browser(args, "#{url}&s=0")
else
msg("Stopped at #{current_url}. Attempting to reproduce crash/hang condition.")
browser_pids = launch_browser(args, "#{current_url}&l=test_redirect")
end
end
elsif age > @scan_timer
msg("Waiting for #{vars} to finish loading... (#{age}s of #{@watchdog_timer}s)")
end
end
end
end
end
if $0 == __FILE__
options = {
:port => rand(16000).to_i + 16000,
:test_dir => File.dirname($0) + '/../output',
:log_dir => File.dirname($0) + '/../output',
:test_num => nil,
:watchdog_timer => 60,
:scan_timer => 5,
:config_path => 'config.yaml',
:random_mode => false
}
optparse = OptionParser.new do |opts|
opts.banner = "Usage: browser_harness.rb [options] -- <browser path> <browser options>"
opts.on( '-t', '--test NUM', 'Test to start at' ) { |test_num| options[:test_num] = test_num.to_i }
opts.on( '-p', '--port NUM', 'Listen on TCP port NUM (random)' ) { |port| options[:port] = port.to_i }
opts.on( '-c', '--config PATH', 'Use PATH for configuration file' ) { |path| options[:config_path] = path }
opts.on( '-d', '--testdir PATH', 'Use PATH to save testcases (/tmp)' ) { |path| options[:test_dir] = path }
opts.on( '-l', '--logdir PATH', 'Use PATH to save logs (/tmp)' ) { |path| options[:log_dir] = path }
opts.on( '-w', '--watchdog NUM', 'How many seconds to wait for pages to load (45s)' ) { |sec| options[:watchdog_timer] = sec.to_i }
opts.on( '-r', '--random', 'Generate test numbers pseudo-randomly' ) { options[:random_mode] = true }
opts.on( '-s', '--scan NUM', 'How often to check for new log data (5s)' ) { |sec| options[:scan_timer] = sec.to_i }
opts.on( '-h', '--help', 'Display this screen' ) { puts opts; exit }
end
optparse.parse!
if options[:port] == 0
puts "Unable to parse port option. Try adding -- as an argument before you specify your browser location."
exit
end
if ARGV.length < 1
puts "No browser specified. Perhaps you need some --help?"
exit
end
puts "options: #{options.inspect}"
puts "browser: #{ARGV.inspect}"
harness = BrowserHarness.new(
options[:port],
options[:config_path],
options[:log_dir],
options[:test_dir],
options[:watchdog_timer],
options[:scan_timer]
)
harness.test_browser(ARGV, options[:test_num], options[:random_mode])
end