7 ms·

Fuzzing Ladybird with tools from Google Project Zero

522 points by awesomekling 3y ago

LeFantome 3y ago
This comment is being left from Ladybird. Hacker News works in Ladybird now. I use Ladybird for the few minutes a day that I surf sites like Hacker News and OSnews. It is slow. It is fragile. But it works. That alone is amazing given how young the project is and how they have written literally everything from scratch. I am really looking forward to Ladybird maturing.
- awesomekling 3y ago
  Now that's what I call early adoptering! :^)
tetris11 3y ago
They've implemented SVG? This project is coming along faster than I thought. I watch enraptured
- awesomekling 3y ago
  Yes, we have implemented a decent chunk of the SVG specification, although lots of things are still missing (animations is a big one) :)
  - jancsika 3y ago
    I'm curious how you handle the things that are between SVG specs 1.1 and 2. Because AFAICT both Chrome and Firefox decided not to implement SVG 2. Yet both have grabbed a common selection of changes from SVG 2 and implemented them. E.g., myRect.style.x = '50px' will work in both Chrome and Firefox, even though SVG 1.1 doesn't allow for this because "x" isn't a presentation attribute (and only presentation attributes are supposed to have corresponding CSS properties). Relevant to animations-- the fact that Chrome and Firefox allow most (all?) SVG attributes as css props lets the user do a nice end run around SVG animations. They can just treat the SVG objects as if they were HTML and use the web animations API to animate them.
    - awesomekling 3y ago
      We're working based on SVG 2 and basically ignoring SVG 1.1. I was unsure about the best approach here, so I asked Nikolas Zimmermann (original author of SVG support in WebKit) and his advice was to do exactly this. :)
      - jancsika 3y ago
        That makes sense. I was going to ask if you were prioritizing the SVG 2 features that are already implemented in Chrome and Firefox. But it appears the W3C has removed a lot of the new ones I remember from the spec (path data bearings, mesh gradients), and that both Chrome and Firefox have implemented a good amount of the existing spec like tabindex and friends. (Ok, here's one-- "inline-size" and others for doing auto-wrapping text in SVG. Looks to be unimplemented anywhere.)
classichasclass 3y ago
And thus demonstrated is the value of lots of different implementations of a spec. Already one hole found in the spec in just this article, and I'm sure there will be/were more.
- awesomekling 3y ago
  Yes indeed! We've found and reported lots of issues in the various HTML, CSS and JS specs. Multiple independent implementations are crucial for the long-term health of the web platform, so we're trying to do our part! :)
  - Avamander 3y ago
    > Multiple independent implementations are crucial for the long-term health of the web platform, so we're trying to do our part! :) It's really great that you're doing this work. This principle also applies to many other specs. I've implemented a few and found multiple issues with real-world impact.
  - de4np 3y ago
    Awesome! Thank you for being the change you want to see. Inspiring to say the least, great work!
- spencerchubb 3y ago
  Why couldn't the fuzzer be used to discover the bug in the popular browsers?
  - summerlight 3y ago
    https://github.com/google/clusterfuzz https://github.com/google/clusterfuzz At least Chromium has integrated multiple different fuzzers into their regular development workflow and found lots of bugs even before going public.
  - TomNomNom 3y ago
    A bug in the spec doesn't necessarily mean there will be a noticeable bug in the browsers; e.g. a crash. The browsers may have been written to "work" / not crash over adhering strictly to the spec.
holsta 3y ago
I am secretly hopeful Ladybird can take over the world some day. Don't tell anyone.
- deleted 3y ago
  [deleted]
tflol 3y ago
"fuzzing ladybird" is such a delightfully barbaric combination of words
- riwsky 3y ago
  Like some vaguely un-PC insult from an alternate-reality Scotland
- deleted 3y ago
  [deleted]
DustinBrett 3y ago
I love that this project keeps showing how possible it is for a small group to make something amazing. This would be very hard to do in a company with stakeholders.
- pvg 3y ago
  The project is cool but this post makes me wonder whether this particular approach - starting with something that "does an okay job with well-formed web content" and then trying to work backwards to fix spec and de facto browser behaviour and potential security issues can actually result in a production browser. Which is fine, one can always go back and redo things, especially in a hobby project but it's hard to escape the vague feeling some of this stuff might need to be architected in from the get go.
  - ramijames 3y ago
    I don't know. It kind of feels like they are replicating real user (developer) behavior by producing lots and lots of weird, low-quality, and not-to-spec code that a parser will likely have to deal with. By doing so they are simply exposing bugs that real users (bad developers) would have done anyway. Seems like a totally legit way to test a complex product. No assumptions. Just lots of randomized nonsense that shows reality.
    - pvg 3y ago
      I'm not talking about the fuzzing but the design approach. As in, can you make a real browser starting with a kind of 'happy path' implementation and then retrofitting it do be a real browser. That part I'm somewhat skeptical of. It's a totally sensible way to learn to make a real browser, no doubt.
      - DontSignAnytng 3y ago
        What a weird comment on their progress and being transparent. Better have a demo working and itterate on it right? By your way how one even finish anything?
rvz 3y ago
[flagged]
- yjftsjthsd-h 3y ago
  Agreed; make sure that when you publish it you submit it to HN.
yafetn 3y ago
A little off topic: what happened to the hacking videos on YouTube? Used to look forward to them but I haven’t seen a new one in a while.
- awesomekling 3y ago
  To be perfectly honest, after uploading well over 1000 videos, I got a little tired of it. I still post monthly update videos, but it's been months since the last hacking video. I'm still working on Ladybird every day, and I also manage two full time engineers now, thanks to the generous sponsorships we got from Shopify & others last year. :)
  - yafetn 3y ago
    Fair enough, and that totally makes sense. I guess I just miss the “Well, hello friends…” :)
  - slekker 3y ago
    I absolutely loved the JIT series, but fair enough!
    - bjc 3y ago
      Me too. I'm currently watching the emulator hacking playlist https://www.youtube.com/playlist?list=PLMOpZvQB55bfk92aBKZ8p4FfZKpAKOI0R https://www.youtube.com/playlist?list=PLMOpZvQB55bfk92aBKZ8p...
  - dsshakey 3y ago
    Glad to hear you're doing the right thing by yourself. I regularly go back and watch some of the mini series, or porting videos. I refer many graduate engineers to learn from your high display of clarity and pragmatism that you constantly display. If the hacking comes back some day, I'll be delighted, but just wanted to say thanks for the fact that we have such a wonderful backlog thanks to your long term efforts.
  - tredre3 3y ago
aapoalas 3y ago
Will Ladybird make an appearance in Web Engines Hackfest this year?
beefnugs 3y ago
Interesting thanks. What bothers me though is that almost all developers do exactly what you see in issue #1: We found it! fix committed done! Nope, you should understand exactly what went wrong: assuming parents must exist... Now search the entire codebase for the same kind of mistakes. Use your creative brain to figure out where else same thing can happen. It will never be in just done place. All modern software is unreliable bug ridden nightmare, mostly because of capitalism constraints yes... but it is possible to do better
efitz 3y ago
For issue #3, it might also be a good idea to have a maxdepth mechanism in gradients that point to other gradients; this would be a defense in depth control vs some error or limitation in your “have I seen this reference before” logic. I’m not familiar with SVG gradients; maybe there is a reason to have reference chains of these 1000 links long, but I’d bet that if you ever encounter this in the wild then it’s an attack or a fuzzer.
- efitz 3y ago
  Btw in the anti malware space I saw this type of structure abuse all the time and I never saw a legitimate case more than 5 units deep.
deleted 3y ago
[deleted]

522 points by awesomekling 3y ago

This comment is being left from Ladybird. Hacker News works in Ladybird now. I use Ladybird for the few minutes a day that I surf sites like Hacker News and OSnews. It is slow. It is fragile. But it works. That alone is amazing given how young the project is and how they have written literally everything from scratch. I am really looking forward to Ladybird maturing.

awesomekling 3y ago
Now that's what I call early adoptering! :^)

tetris11 3y ago

They've implemented SVG? This project is coming along faster than I thought. I watch enraptured

awesomekling 3y ago
Yes, we have implemented a decent chunk of the SVG specification, although lots of things are still missing (animations is a big one) :)
- jancsika 3y ago
  I'm curious how you handle the things that are between SVG specs 1.1 and 2. Because AFAICT both Chrome and Firefox decided not to implement SVG 2. Yet both have grabbed a common selection of changes from SVG 2 and implemented them. E.g., myRect.style.x = '50px' will work in both Chrome and Firefox, even though SVG 1.1 doesn't allow for this because "x" isn't a presentation attribute (and only presentation attributes are supposed to have corresponding CSS properties). Relevant to animations-- the fact that Chrome and Firefox allow most (all?) SVG attributes as css props lets the user do a nice end run around SVG animations. They can just treat the SVG objects as if they were HTML and use the web animations API to animate them.
  - awesomekling 3y ago
    We're working based on SVG 2 and basically ignoring SVG 1.1. I was unsure about the best approach here, so I asked Nikolas Zimmermann (original author of SVG support in WebKit) and his advice was to do exactly this. :)
    - jancsika 3y ago
      That makes sense. I was going to ask if you were prioritizing the SVG 2 features that are already implemented in Chrome and Firefox. But it appears the W3C has removed a lot of the new ones I remember from the spec (path data bearings, mesh gradients), and that both Chrome and Firefox have implemented a good amount of the existing spec like tabindex and friends. (Ok, here's one-- "inline-size" and others for doing auto-wrapping text in SVG. Looks to be unimplemented anywhere.)

classichasclass 3y ago

And thus demonstrated is the value of lots of different implementations of a spec. Already one hole found in the spec in just this article, and I'm sure there will be/were more.

awesomekling 3y ago
Yes indeed! We've found and reported lots of issues in the various HTML, CSS and JS specs. Multiple independent implementations are crucial for the long-term health of the web platform, so we're trying to do our part! :)
- Avamander 3y ago
  > Multiple independent implementations are crucial for the long-term health of the web platform, so we're trying to do our part! :) It's really great that you're doing this work. This principle also applies to many other specs. I've implemented a few and found multiple issues with real-world impact.
- de4np 3y ago
  Awesome! Thank you for being the change you want to see. Inspiring to say the least, great work!
spencerchubb 3y ago
Why couldn't the fuzzer be used to discover the bug in the popular browsers?
- summerlight 3y ago
  https://github.com/google/clusterfuzz https://github.com/google/clusterfuzz At least Chromium has integrated multiple different fuzzers into their regular development workflow and found lots of bugs even before going public.
- TomNomNom 3y ago
  A bug in the spec doesn't necessarily mean there will be a noticeable bug in the browsers; e.g. a crash. The browsers may have been written to "work" / not crash over adhering strictly to the spec.

holsta 3y ago

I am secretly hopeful Ladybird can take over the world some day. Don't tell anyone.

deleted 3y ago
[deleted]

tflol 3y ago

"fuzzing ladybird" is such a delightfully barbaric combination of words

riwsky 3y ago
Like some vaguely un-PC insult from an alternate-reality Scotland
deleted 3y ago
[deleted]

DustinBrett 3y ago

I love that this project keeps showing how possible it is for a small group to make something amazing. This would be very hard to do in a company with stakeholders.

pvg 3y ago
The project is cool but this post makes me wonder whether this particular approach - starting with something that "does an okay job with well-formed web content" and then trying to work backwards to fix spec and de facto browser behaviour and potential security issues can actually result in a production browser. Which is fine, one can always go back and redo things, especially in a hobby project but it's hard to escape the vague feeling some of this stuff might need to be architected in from the get go.
- ramijames 3y ago
  I don't know. It kind of feels like they are replicating real user (developer) behavior by producing lots and lots of weird, low-quality, and not-to-spec code that a parser will likely have to deal with. By doing so they are simply exposing bugs that real users (bad developers) would have done anyway. Seems like a totally legit way to test a complex product. No assumptions. Just lots of randomized nonsense that shows reality.
  - pvg 3y ago
    I'm not talking about the fuzzing but the design approach. As in, can you make a real browser starting with a kind of 'happy path' implementation and then retrofitting it do be a real browser. That part I'm somewhat skeptical of. It's a totally sensible way to learn to make a real browser, no doubt.
    - DontSignAnytng 3y ago
      What a weird comment on their progress and being transparent. Better have a demo working and itterate on it right? By your way how one even finish anything?

rvz 3y ago

[flagged]

yjftsjthsd-h 3y ago
Agreed; make sure that when you publish it you submit it to HN.

yafetn 3y ago

A little off topic: what happened to the hacking videos on YouTube? Used to look forward to them but I haven’t seen a new one in a while.

awesomekling 3y ago
To be perfectly honest, after uploading well over 1000 videos, I got a little tired of it. I still post monthly update videos, but it's been months since the last hacking video. I'm still working on Ladybird every day, and I also manage two full time engineers now, thanks to the generous sponsorships we got from Shopify & others last year. :)
- yafetn 3y ago
  Fair enough, and that totally makes sense. I guess I just miss the “Well, hello friends…” :)
- slekker 3y ago
  I absolutely loved the JIT series, but fair enough!
  - bjc 3y ago
    Me too. I'm currently watching the emulator hacking playlist https://www.youtube.com/playlist?list=PLMOpZvQB55bfk92aBKZ8p4FfZKpAKOI0R https://www.youtube.com/playlist?list=PLMOpZvQB55bfk92aBKZ8p...
- dsshakey 3y ago
  Glad to hear you're doing the right thing by yourself. I regularly go back and watch some of the mini series, or porting videos. I refer many graduate engineers to learn from your high display of clarity and pragmatism that you constantly display. If the hacking comes back some day, I'll be delighted, but just wanted to say thanks for the fact that we have such a wonderful backlog thanks to your long term efforts.
- tredre3 3y ago

aapoalas 3y ago

Will Ladybird make an appearance in Web Engines Hackfest this year?

beefnugs 3y ago

Interesting thanks. What bothers me though is that almost all developers do exactly what you see in issue #1: We found it! fix committed done! Nope, you should understand exactly what went wrong: assuming parents must exist... Now search the entire codebase for the same kind of mistakes. Use your creative brain to figure out where else same thing can happen. It will never be in just done place. All modern software is unreliable bug ridden nightmare, mostly because of capitalism constraints yes... but it is possible to do better

efitz 3y ago

For issue #3, it might also be a good idea to have a maxdepth mechanism in gradients that point to other gradients; this would be a defense in depth control vs some error or limitation in your “have I seen this reference before” logic. I’m not familiar with SVG gradients; maybe there is a reason to have reference chains of these 1000 links long, but I’d bet that if you ever encounter this in the wild then it’s an attack or a fuzzer.

efitz 3y ago
Btw in the anti malware space I saw this type of structure abuse all the time and I never saw a legitimate case more than 5 units deep.

deleted 3y ago

[deleted]