Fuzzy test system and method for WASM module in JavaScript engine

Abstract

The invention provides a fuzzy test system and method for a WASM module in a JavaScript engine, the system is composed of a seed generation module, a target engine adaptation module and a fuzzy test module cooperatively, and the seed generation module designs a seed generation algorithm in combination with the new characteristics of the WASM. The algorithm not only strengthens the coverage range of WASM and JavaScript interaction, but also ensures that a test sample generated by variation has semantic correctness through dynamic parameter adjustment and grammar constraint. And the target engine adaptation module accurately identifies potential cross-border access and type confusion vulnerabilities by adopting weighted coverage rate feedback and an additional correctness check mechanism. The fuzz test module efficiently finds and reproduces security problems in the engine. According to the method, vulnerabilities such as memory destruction and cross-border access existing in the WASM module in the JavaScript engine can be quickly positioned, key guarantee is provided for Web security, JavaScript engine developers and security researchers are helped to quickly troubleshoot potential safety hazards, the test efficiency and the vulnerability discovery number are increased, and the security of the JavaScript engine is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of computer network space security, and in particular to a fuzzy testing system and method for detecting WASM module vulnerabilities in a JavaScript engine. Background Art

[0002] With the rapid development of Internet technology, web browsers have become an indispensable tool for modern users in their daily lives. Over the past few decades, the Web has evolved from simple static web pages to a highly dynamic and interactive application platform. Modern web applications rely heavily on JavaScript to handle client-side logic, such as user interaction, data validation, and dynamic content rendering.

[0003] As the core component for interpreting and executing JavaScript code, JavaScript engine is an indispensable part of modern web browsers. Almost all mainstream browsers have their own JavaScript engine. In addition, in addition to traditional web browsers, JavaScript engine is also widely used in many other fields. For example, Node.js is a server-side runtime environment built on Google's V8 engine, which supports developers to write server-side applications using JavaScript.

[0004] Today's JavaScript engines are no longer just simple interpreters. By using various compilation and optimization techniques, they can efficiently process complex JavaScript code, thereby providing developers and users with high-performance and high-reliability services in multiple fields such as browsers, servers, desktop applications, and mobile applications.

[0005] WASM (WebAssembly) is a low-level bytecode format originally developed by the W3C WebAssembly Working Group to improve the performance and cross-platform nature of Web applications. It allows developers to compile programming languages ​​such as C, C++, and Rust into bytecodes and execute them directly in the browser, which can bring close to native performance. WASM was originally designed to break through the performance bottleneck faced by JavaScript in certain high-performance computing tasks, while enhancing the flexibility of Web development.

[0006] WASM works closely with JavaScript, running in the same environment and sharing resources such as memory and execution environment. This close relationship makes WASM an important part of the JavaScript engine. WASM shares memory with JavaScript, which means that the WASM module can manipulate data with the help of the memory buffer passed by JavaScript, and JavaScript can also directly read and write this data. Although this memory sharing mechanism improves performance, it also hides security risks. For example, if there is a memory corruption vulnerability in the WASM module, an attacker may trigger the vulnerability to manipulate shared memory and then attack the structure in JavaScript.

[0007] The WASM standard is in a process of rapid iterative evolution. With the continuous proposal and implementation of new proposals, the functionality of WASM continues to expand. While these new proposals enrich the functionality and application scope of WASM, they also provide attackers with more potential attack surfaces. Take the WebAssembly GC proposal as an example. The proposal aims to make WASM and the garbage collection mechanism of the JavaScript engine more closely integrated to improve the interoperability between the two. Although this feature enables WASM to manage complex data structures more efficiently, it also increases the complexity of shared memory between WASM and JavaScript, which may cause new problems.

[0008] As JavaScript engines become more stable in terms of parsing, compiling, optimizing, and executing JavaScript code, the rapidly iterative WASM module has become a huge security risk for JavaScript engines. Therefore, identifying vulnerabilities in WASM modules has become a key part of ensuring the security of JavaScript engines. However, there is currently no universal vulnerability mining method that can cover new WASM proposals, new features, and the interaction between WASM and JavaScript.

[0009] Through searching patent documents, it was found that the invention patent with publication number CN116436644A discloses a large-scale network vulnerability rapid scanning method and system based on multiple engines. First, the scanning features of Masscan port scanner, Nmap scanner and Nessus vulnerability scanner are combined to build a vulnerability scanning tool chain; then, through the automatic control of the vulnerability scanning engine, multiple task instances are run at the same time using Docker technology to achieve the fusion of multiple vulnerability scanning engines; finally, the scanning data is analyzed and stored using multi-source heterogeneous data fusion technology, thereby providing rapid vulnerability scanning for the network. This patent focuses on network vulnerability scanning, using multiple engines and multiple technologies for scanning and management. It does not involve fuzz testing of the WASM module in the JavaScript engine and related complex vulnerability mining technologies.

[0010] In summary, in response to the above-mentioned problems of the prior art, studying a fuzz testing system and method for the WASM module in the JavaScript engine has become a key task that needs to be solved urgently. Summary of the invention

[0011] In view of the defects in the prior art, the object of the present invention is to provide a fuzz testing system and method for the WASM module in the JavaScript engine.

[0012] According to the present invention, a fuzz testing system for a WASM module in a JavaScript engine includes: a seed generation module, a target engine adaptation module and a fuzz testing module;

[0013] The seed generation module is used to generate an initialization seed set;

[0014] The target engine adaptation module adds coverage collection function and correctness detection mechanism to the JavaScript engine of the test target to obtain a modified new engine;

[0015] The fuzz testing module is used to screen, mutate and perform fuzz testing operations on the initialization seed set and output vulnerability reports;

[0016] The seed generation and mutation module, the target engine adaptation module and the fuzz testing module operate in coordination with each other through a data interface.

[0017] Preferably, the seed generation module first generates a WASM seed in combination with the characteristics of the WASM module, then generates a JavaScript seed based on the WASM seed, and finally concatenates the WASM seed and the JavaScript seed to generate an initialization seed set for fuzz testing. The seed generation module includes WASM seed generation and JavaScript seed generation.

[0018] Preferably, in WASM seed generation, by analyzing the latest WASM specifications and related proposal documents, a syntax tree and semantic model supporting the above-mentioned new features are constructed, and code snippets covering the latest features are automatically generated based on the syntax tree and semantic model. Complex structures, nested types and shared memory operations are introduced in the generation process to expand the coverage of code logic and output WASM seeds with high grammatical and semantic correctness.

[0019] Preferably, in JavaScript seed generation, the WASM seed is taken as input to generate a JavaScript seed that interacts with the WASM seed in different ways such as exception handling, function calls, and shared memory.

[0020] Preferably, the target engine adaptation module accepts the JavaScript engine of the test target as input, and adds coverage feedback code and correctness detection code to the test target program through the plugging technology.

[0021] Preferably, the process of adding coverage feedback code through the instrumentation technology is: taking the JavaScript engine of the test target as input, adding code at the control flow transfer point such as the jump function call, and outputting the intermediate engine after modification. The intermediate engine automatically collects the running path of the program when running, and assigns weights to different functional modules to guide the test focus;

[0022] The process of adding correctness detection code through the instrumentation technology is: take the intermediate engine as input, add code to the memory reading and writing, and variable modification, and output the new engine after modification. When the new engine is executed, it will automatically check the size and type of the buffer and shared memory when encountering memory reading and writing operations. If a problem is encountered, an exception will be triggered, and the program's running path will be automatically collected.

[0023] Preferably, the fuzz testing module takes the initialization seed set as input, uses the seed mutator to screen and mutate the initialization seed set, then executes the seed in the new engine, records the anomalies of the program running, and finally verifies the vulnerabilities of the abnormal seeds and outputs the vulnerability report. The fuzz testing module includes a seed screening algorithm, a seed mutation algorithm, a fuzz tester and a vulnerability verification.

[0024] Preferably, the seed screening algorithm takes the initialization seed set as input, screens the seeds according to indicators such as semantic correctness and instructions contained therein, and outputs a high-quality seed set;

[0025] The seed mutation algorithm takes seeds randomly selected from the high-quality seed set as input, adopts a local mutation strategy based on the syntax tree, mutates the seeds in a small range, and outputs the seeds to be tested;

[0026] The fuzz tester takes the seed to be tested as input and runs the new engine for fuzz testing. The fuzz test runs based on the fork mode. When a program exception occurs during the execution of the new engine, the seed that caused the exception is output;

[0027] Vulnerability verification takes the seed that causes the anomaly as input, executes the new engine multiple times for testing, verifies the reproducibility of the anomaly, and outputs a vulnerability report if the anomaly is reproducible.

[0028] The present invention also provides a vulnerability detection method for a WASM module in a JavaScript engine, comprising the following steps:

[0029] Step S1, using the syntax tree and semantic model that supports the WASM module characteristics, generating a WASM seed, and recording the functions, shared memory and objects in the WASM seed according to the corresponding semantics, and outputting the WASM seed set;

[0030] Step S2, randomly selecting a seed from the WASM seed set as input, using a JavaScript sample generator to generate a JavaScript seed that interacts with the WASM module in different ways such as exception handling, function call, and shared memory, and outputting a JavaScript seed set;

[0031] Step S3, concatenating the WASM seed set and the JavaScript seed set to form a combined sample, randomly selecting their respective optimization levels for the combined sample, and outputting a test seed set for fuzz testing;

[0032] Step S4, taking the JavaScript engine of the test target as input, adding code at the jump function call control flow transfer to implement the insertion of coverage feedback code, and obtaining an intermediate engine, which automatically collects the program's running path when running;

[0033] Step S5, taking the intermediate engine as input, adding correctness check code to the memory read / write and variable modification. When the code is executed, if it encounters memory read / write operations, it will automatically check the size and type of the buffer and shared memory. If a problem is encountered, an exception will be triggered and a new engine will be output;

[0034] Step S6, taking the test seed set as input, screening the seeds in the test seed set, retaining the seeds that can trigger more branch paths, verifying the semantic correctness of the seeds, and outputting a high-quality seed set;

[0035] Step S7, taking the high-quality seed set as input, randomly selecting seeds from the set for mutation, obtaining mutated seeds, submitting the mutated seeds to the new engine for execution, and automatically counting the code coverage when the new engine is running. If the coverage increases, the corresponding seeds are added to the high-quality seed set, and the correctness detection code added by the instrumentation automatically checks whether there are problems when the new engine is running. If there are problems, an exception is triggered; if a seed triggers an exception during execution, the exception is recorded and the seed that caused the exception is output;

[0036] Step S8, using the seeds causing the exception recorded in step S7 as a test set, taking one of the seeds causing the exception each time and executing it multiple times in the new engine, if the exception is triggered again, compiling the record into a report, and finally feeding back all the reports, i.e., vulnerability reports, to the user.

[0037] Preferably, in step S8, a seed causing anomaly is taken each time and executed five times in the new engine.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] 1. The system of the present invention conducts effective and directional mining for potential vulnerabilities in the Web Assembly (WASM) module in the JavaScript engine, solving the problem that other solutions cannot analyze or have poor analysis results when analyzing such vulnerabilities.

[0040] 2. The system of the present invention innovatively introduces a fuzz testing method, fully integrating the new proposals and new features of WASM, strengthening the interaction effect between WASM and JavaScript, and greatly improving the efficiency and accuracy of vulnerability mining.

[0041] 3. The method of the present invention has good versatility and extensibility, and can be smoothly extended to any newly developed or existing JavaScript engine, thereby expanding its application scope and being able to play a role in more different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0043] Figure 1 A structural diagram of a vulnerability detection system for a WASM module in a JavaScript engine provided in an embodiment of the present invention;

[0044] Figure 2 The present invention provides a flowchart of a vulnerability detection system for a WASM module in a JavaScript engine in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0046] The present invention proposes a fuzz testing system and method for the WASM module of the JavaScript engine, focusing on detecting vulnerabilities in the JavaScript engine and the WASM module it contains, covering a series of new features of the WASM module, and strengthening the interaction between the WASM module and the JavaScript engine, so as to quickly discover vulnerabilities and provide vulnerability reports.

[0047] Embodiment 1:

[0048] Figure 1 This is a structural diagram of a fuzz testing system for the WASM module in the JavaScript engine.

[0049] This embodiment provides a fuzz testing system for a WASM module in a JavaScript engine, including: a seed generation module, a target engine adaptation module and a fuzz testing module.

[0050] The seed generation module is used to generate an initialization seed set.

[0051] Specifically, the seed generation module first generates a WASM seed based on the characteristics of the WASM module, then generates a JavaScript seed based on the WASM seed, and finally concatenates the WASM seed and the JavaScript seed to generate an initialization seed set for fuzz testing. The seed generation module includes WASM seed generation and JavaScript seed generation.

[0052] To be more specific, in the WASM seed generation process, a new seed generation algorithm is designed by combining the characteristics of WASM modules such as single instruction multiple data (SIMD), tail calls, Wasm garbage collection (WasmGC), tail recursion, etc., aiming to improve semantic correctness and comprehensively cover the critical path of memory sharing between WASM modules and JavaScript engine.

[0053] Specifically, by analyzing the latest WASM specifications and related proposal documents, we build supported syntax trees and semantic models for the above new features, and automatically generate code snippets covering the latest features based on the syntax trees and semantic models. In the generation process, we introduce complex structures, nested types, and shared memory operations to expand the coverage of code logic and output WASM seeds with high grammatical and semantic correctness.

[0054] More specifically, in JavaScript seed generation, the WASM seed is taken as input to generate a JavaScript seed that interacts with the WASM seed in different ways such as exception handling, function calls, and shared memory.

[0055] The initialization seed set includes WASM seeds and JavaScript seeds to simulate the actual operation scenario. The three logics of splicing the two and the corresponding generated seeds are as follows:

[0056] Exception handling logic: Create exceptions in WASM and generate corresponding JavaScript exception handling code. It will randomly trigger runtime exceptions in WASM, generate JavaScript code that can capture these exceptions, and tamper with WASM objects in the code.

[0057] Function call logic: Generate JavaScript call code with different parameter types based on the function exported by WASM, covering different parameter types and boundary value tests.

[0058] Shared memory logic: Generates JavaScript code for operating the shared memory of the WASM module, including code for implementing data sharing and interactive operations between JavaScript and WASM, especially for dynamic expansion and modification of shared memory.

[0059] The target engine adaptation module adds coverage collection function and correctness detection mechanism to the JavaScript engine of the test target to obtain a modified new engine.

[0060] Specifically, the target engine adaptation module accepts the JavaScript engine of the test target as input, and adds coverage feedback code and correctness detection code to the test target program through the plug-in technology.

[0061] The process of adding coverage feedback code through instrumentation technology is as follows: take the JavaScript engine of the test target as input, add code at the control flow transfer point such as jump function call, and output the intermediate engine after modification. The intermediate engine automatically collects the running path of the program at runtime. In this process, weights are assigned to different functional modules to guide the focus of the test. Considering that the JavaScript engine involves complex interactions between WASM and JavaScript, the importance and feature coverage requirements of each module are different. A higher weight is assigned to the new features of WASM, and a lower weight is assigned to ordinary JavaScript operations, or even coverage is not collected, so as to reduce the impact of useless operations on coverage.

[0062] The process of adding correctness detection code through the instrumentation technology is: take the intermediate engine as input, add code to the memory reading and writing, and variable modification, and output the new engine after modification. When the new engine is executed, it will automatically check the size and type of the buffer and shared memory when encountering memory reading and writing operations. If a problem is encountered, an exception will be triggered, and the program's running path will be automatically collected.

[0063] Among them, the correctness check code is used to track the types and sizes of shared objects, memory, etc. in different contexts (JavaScript context, WASM context and its actual context) in real time. When performing memory access, table index and type constraint operations, check whether the types and sizes of shared objects, memory, etc. in different contexts are consistent. If they are inconsistent, an exception will be triggered, thereby checking for potential type confusion and out-of-bounds vulnerabilities.

[0064] The fuzz testing module is used to screen, mutate, and perform fuzz testing operations on the initialization seed set and output vulnerability reports.

[0065] Specifically, the fuzz testing module takes the initialization seed set as input, uses the seed mutator to screen and mutate the initialization seed set, then executes the seed in the new engine, records the exceptions of the program running, and finally verifies the vulnerability of the abnormal seed and outputs the vulnerability report. The fuzz testing module includes a seed screening algorithm, a seed mutation algorithm, a fuzz tester, and a vulnerability verification.

[0066] The seed screening algorithm takes the initialized seed set as input, screens the seeds based on their semantic correctness, the instructions they contain, and other indicators, and outputs a high-quality seed set.

[0067] Specifically, the seed screening algorithm uses coverage-oriented, feature priority sorting and semantic integrity checking methods to screen out high-quality seeds from the initial seed set. At the same time, it regularly cleans up seeds that are duplicated in coverage or path contribution to reduce the size of the seed pool and obtain a high-quality seed set.

[0068] The seed mutation algorithm takes seeds randomly selected from the high-quality seed set as input, adopts a local mutation strategy based on the syntax tree, mutates the seeds in a small range, and outputs the seeds to be tested.

[0069] To ensure that the mutated seeds comply with the specifications of the WASM module and the JavaScript language, two strategies are used to improve the semantic correctness of the mutated seeds during the mutation process. The two strategies include: syntax and semantic constraint strategy and specific interaction mutation operation strategy. The syntax and semantic constraint strategy uses a local mutation strategy based on the syntax tree during mutation, mutating the seeds in a small range to ensure that the overall structure and semantics of the code are not destroyed. The specific interaction mutation operation strategy designs special mutation operations for the interaction between the WASM module and the JavaScript engine, including:

[0070] Dynamic parameter adjustment operation: modify the parameter type and quantity when the JavaScript engine calls the WASM module function;

[0071] Memory access modification operations: Add read and write operations on the WASM module shared memory in the mutated JavaScript engine code to try to trigger more potential vulnerabilities.

[0072] The fuzz tester takes the seed to be tested as input and runs the new engine for fuzz testing. The fuzz test runs based on the fork mode. Specifically, the seed to be tested is taken as input, the new engine is run and the coverage information is collected. If the coverage growth is detected, the seed is added to the input queue, and then the seed is randomly selected from the input queue and used as the next input through the seed mutator. When program exceptions such as crashes, assertion failures, and undefined behavior occur during the execution of the new engine, the seed that caused the exception is output.

[0073] Vulnerability verification takes the seed that causes the anomaly as input, executes the new engine multiple times for testing, verifies the reproducibility of the anomaly, and outputs a vulnerability report if the anomaly is reproducible.

[0074] Specifically, the vulnerability verification performs a single execution on the seed that causes the exception to verify the reproducibility of the exception. If the seed that causes the exception can still cause the program exception, the relevant program exception report and the seed that causes the exception are sorted out, and the vulnerability report is output to the user for manual confirmation.

[0075] Based on the generated vulnerability report, the vulnerabilities of the WASM module in the JavaScript engine can be quickly located, which helps JavaScript engine developers and security researchers to quickly discover security issues in the JavaScript engine, greatly improves testing efficiency and vulnerability discovery, and thus improves the security of the JavaScript engine.

[0076] The seed generation and mutation module, the target engine adaptation module and the fuzz testing module operate in coordination with each other through a data interface.

[0077] Embodiment 2:

[0078] Figure 2 This is a flow chart of a fuzz testing method for a JavaScript engine WASM module in an embodiment of the present invention.

[0079] As shown in Figure 2, this embodiment provides a vulnerability detection method for a WASM module in a JavaScript engine, based on a vulnerability detection system for a WASM module in a JavaScript engine described in the above embodiment 1, including the following steps:

[0080] Step S1, using the syntax tree and semantic model that supports the characteristics of the WASM module to generate a WASM seed, and according to the corresponding semantics, record the functions, shared memory and objects in the WASM seed, and output the WASM seed set;

[0081] Step S2, randomly selecting a seed from the WASM seed set as input, using a JavaScript sample generator to generate a JavaScript seed that interacts with the WASM module in different ways such as exception handling, function call, and shared memory, and outputting a JavaScript seed set;

[0082] Step S3, concatenate the WASM seed set and the JavaScript seed set to form a combined sample, randomly select their respective optimization levels for the combined sample, and output a test seed set for fuzz testing.

[0083] Step S4, taking the JavaScript engine of the test target as input, adding code at the jump function call control flow transfer to implement the insertion of coverage feedback code, and obtaining an intermediate engine, which will automatically collect the program's running path when running.

[0084] Step S5, taking the intermediate engine as input, adding correctness check code to memory reading and writing and variable modification. When the code is executed, if it encounters memory reading and writing operations, it will automatically check the size and type of the buffer and shared memory. Once a problem is encountered, an exception is triggered and a new engine is output.

[0085] Step S6, taking the test seed set as input, screening the seeds in the test seed set, retaining the seeds that can trigger more branch paths, verifying the semantic correctness of the seeds, and outputting a high-quality seed set;

[0086] Step S7, taking the high-quality seed set as input, randomly selecting seeds from it for mutation, obtaining mutated seeds, submitting the mutated seeds to the new engine for execution, and automatically counting the code coverage when the new engine is running. If the coverage increases, the corresponding seeds are added to the high-quality seed set, and the correctness detection code added by the instrumentation automatically checks whether there are problems when the new engine is running. If there are problems, an exception is triggered; if a seed triggers an exception during the execution process, the exception is recorded and the seed that caused the exception is output.

[0087] Step S8, using the seeds causing the exception recorded in step S7 as a test set, taking one of the seeds causing the exception each time and executing it multiple times in the new engine, if the exception is triggered again, compiling the record into a report, and finally feeding back all the reports, i.e., vulnerability reports, to the user.

[0088] In this embodiment, a seed causing anomaly is taken each time and executed five times in a new engine.

[0089] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0090] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A fuzz testing system for WASM modules in JavaScript engines, characterized in that: include: Seed generation module, target engine adaptation module and fuzz testing module; The seed generation module is used to generate an initialization seed set; The target engine adaptation module adds coverage collection function and correctness detection mechanism to the JavaScript engine of the test target to obtain a modified new engine; The fuzz testing module is used to screen, mutate and perform fuzz testing operations on the initialization seed set, and output a vulnerability report; The seed generation and mutation module, the target engine adaptation module and the fuzzy testing module operate in coordination with each other via a data interface.

2. A fuzz testing system for WASM modules in JavaScript engines according to claim 1, characterized in that: The seed generation module first generates a WASM seed based on the characteristics of the WASM module, then generates a JavaScript seed based on the WASM seed, and finally concatenates the WASM seed and the JavaScript seed to generate an initialization seed set for fuzz testing. The seed generation module includes WASM seed generation and JavaScript seed generation.

3. A fuzz testing system for WASM modules in JavaScript engines according to claim 2, characterized in that: In the WASM seed generation, by analyzing the latest WASM specifications and related proposal documents, a syntax tree and semantic model supporting the above-mentioned new features are constructed, and code snippets covering the latest features are automatically generated based on the syntax tree and semantic model. Complex structures, nested types and shared memory operations are introduced in the generation process to expand the code logic coverage and output WASM seeds with high grammatical and semantic correctness.

4. A fuzz testing system for WASM modules in JavaScript engines according to claim 2, characterized in that: In the JavaScript seed generation, the WASM seed is used as input to generate a JavaScript seed that interacts with the WASM seed using different methods such as exception handling, function calls, and shared memory.

5. A fuzz testing system for WASM modules in JavaScript engines according to claim 1, characterized in that: The target engine adaptation module accepts the JavaScript engine of the test target as input, and adds coverage feedback code and correctness detection code to the test target program through the plugging technology.

6. A fuzz testing system for WASM modules in a JavaScript engine according to claim 5, characterized in that: The process of adding coverage feedback code through instrumentation technology is as follows: taking the JavaScript engine of the test target as input, adding code at the control flow transfer point such as jump function call, and outputting the intermediate engine after modification. The intermediate engine automatically collects the running path of the program at runtime, and assigns weights to different functional modules to guide the test focus; The process of adding correctness detection code through the stub technology is: taking the intermediate engine as input, adding code at the memory reading and writing and variable modification, and outputting a new engine after modification. When the new engine is executed, it will automatically check the size and type of the buffer and shared memory when encountering memory reading and writing operations. If a problem is encountered, an exception will be triggered, and the program's running path will be automatically collected.

7. A fuzz testing system for WASM modules in JavaScript engines according to claim 1, characterized in that: The fuzz testing module takes the initialization seed set as input, uses a seed mutator to screen and mutate the initialization seed set, then executes the seeds in the new engine, records the anomalies of program execution, and finally verifies the vulnerabilities of the abnormal seeds and outputs a vulnerability report. The fuzz testing module includes a seed screening algorithm, a seed mutation algorithm, a fuzz tester and a vulnerability verification.

8. A fuzz testing system for WASM modules in a JavaScript engine according to claim 7, characterized in that: The seed screening algorithm takes the initialization seed set as input, screens the seeds according to indicators such as semantic correctness and instructions contained in the seeds, and outputs a high-quality seed set; The seed mutation algorithm takes seeds randomly selected from the high-quality seed set as input, adopts a local mutation strategy based on a syntax tree, mutates the seeds in a small range, and outputs seeds to be tested; The fuzz tester takes the seed to be tested as input and runs the new engine to perform fuzz testing. The fuzz testing is run based on a fork mode. When a program exception occurs during the execution of the new engine, the seed causing the exception is output; The vulnerability verification takes the seed causing the exception as input, executes the new engine multiple times for testing, verifies the reproducibility of the exception, and outputs a vulnerability report if the exception is reproducible.

9. A vulnerability detection method for a WASM module in a JavaScript engine, based on a fuzzy testing system for a WASM module in a JavaScript engine according to any one of claims 1 to 8, characterized in that: The steps include: Step S1, using a syntax tree and semantic model that supports WASM module characteristics to generate a WASM seed, and according to corresponding semantics, recording functions, shared memory, and objects in the WASM seed, and outputting a WASM seed set; Step S2, randomly selecting a seed from the WASM seed set as input, using a JavaScript sample generator to generate a JavaScript seed that interacts with the WASM module in different ways such as exception handling, function call, and shared memory, and outputting a JavaScript seed set; Step S3, concatenating the WASM seed set and the JavaScript seed set to form a combined sample, randomly selecting respective optimization levels for the combined sample, and outputting a test seed set for fuzz testing; Step S4, taking the JavaScript engine of the test target as input, adding code at the jump function call control flow transfer to implement the insertion of coverage feedback code, and obtaining an intermediate engine, which automatically collects the running path of the program when running; Step S5, taking the intermediate engine as input, adding correctness check code to memory read and write and variable modification. When the code is executed, if it encounters memory read and write operations, it automatically checks the size and type of the buffer and shared memory. Once a problem is encountered, an exception is triggered and a new engine is output; Step S6, taking the test seed set as input, screening the seeds in the test seed set, retaining the seeds that can trigger more branch paths, verifying the semantic correctness of the seeds, and outputting a high-quality seed set; Step S7, taking the high-quality seed set as input, randomly selecting seeds from the set for mutation to obtain mutant seeds, submitting the mutant seeds to the new engine for execution, and automatically counting the code coverage when the new engine is running. If the coverage increases, the corresponding seeds are added to the high-quality seed set, and the correctness detection code added by the instrumentation automatically checks whether there is a problem when the new engine is running, and triggers an exception if there is a problem. If a seed triggers an exception during execution, the exception is recorded and the seed that caused the exception is output; Step S8, using the seeds causing the exception recorded in step S7 as a test set, taking one of the seeds causing the exception each time and executing it multiple times in the new engine, if the exception is triggered again, organizing the record into a report, and finally feeding back all reports, i.e., vulnerability reports, to the user.

10. A vulnerability detection method for WASM modules in JavaScript engines according to claim 9, characterized in that: In step S8, a seed causing anomaly is taken each time and executed five times in the new engine.

Images