tree-splicer
tree-splicer is a simple grammar-based test case generator (black-box fuzzer). It uses tree-sitter grammars to parse a number of input files, and produces new files formed by splicing together parts of the input files.
tree-splicer aims to occupy a different niche from more advanced grammar-based fuzzers like Gramatron, Nautilus, and Grammarinator. Rather than achieve maximal coverage and bug-finding through complete, hand-written grammars and complex techniques like coverage-based feedback, tree-splicer aims to achieve maximal ease-of-use by using off-the-shelf tree-sitter grammars and not requiring any instrumentation (nor even source code) for the target.
tree-sitter grammars are resistant to syntax errors. Therefore, tree-splicer can even mutate syntactically-invalid inputs! You can also use tree-splicer with an incomplete grammar.
Example
Given this simple Rust program:
use env;
Here are a few candidates created by tree-splicer-rust
:
use env;
use env;
use env;
Installation
From a release
Statically-linked Linux binaries are available on the releases page.
From crates.io
You can build a released version from crates.io. You'll need the
Rust compiler and the Cargo build tool. rustup makes it very
easy to obtain these. Then, to install the reducer for the language <LANG>
,
run:
cargo install tree-splicer-<LANG>
This will install binaries in ~/.cargo/bin
by default.
Build
To build from source, you'll need the Rust compiler and the Cargo build tool. rustup makes it very easy to obtain these. Then, get the source:
Finally, build everything:
You can find binaries in target/release
. Run tests with cargo test
.