A unified shared library which aids in building fuzzers for browsers or as complement for an already existing fuzzing framework.

Octo.js bundles core functions and generic boilerplate code commonly used in most frameworks for fuzzing browsers. It is designed for the sharing of improvements between our individual fuzzers, and with the purpose of reducing the maintainability of those core features with minimal effort.

Octo's future aims to be a stable, well-tested and well-documented standard library for fuzzing in a JavaScript environment.

Node

npm i @mozillasecurity/octo --save-dev

const {random} = require('@mozillasecurity/octo')

Browser

npm run build

<!-- Latest -->
https://mozillasecurity.github.io/octo/octo.js

<!-- Release -->
https://github.com/mozillasecurity/octo/releases/download/0.0.3/octo.js

<!-- Release -->
https://cdn.jsdelivr.net/gh/MozillaSecurity/octo@0.0.3/deploy/octo.js

Development

npm install
npm run build

Testing

Tests live in the tests/ subdirectory, and are written for QUnit. To run tests locally, open tests/index.html in a browser. The automated tests are run in Firefox or Chrome using Karma. To run the automated tests:

npm install
CHROME_BIN=chromium npm test

When adding new files, add them in index.html and karma.conf.js so they can be tested and included in coverage reports.