A decision procedure for subset constraints over regular languages

Abstract

Reasoning about string variables, in particular program inputs, is an important aspect of many program analyses and testing frameworks. Program inputs invariably arrive as strings, and are often manipulated using high-level string operations such as equality checks, regular expression matching, and string concatenation. It is difficult to reason about these operations because they are not well-integrated into current constraint solvers.We present a decision procedure that solves systems of equations over regular language variables. Given such a system of constraints, our algorithm finds satisfying assignments for the variables in the system. We define this problem formally and render a mechanized correctness proof of the core of the algorithm. We evaluate its scalability and practical utility by applying it to the problem of automatically finding inputs that cause SQL injection vulnerabilities.

Unbounded Model-Checking with Interpolation for Regular Language Constraints

“…All experiments have been run on a single core of a 2.7GHz Core i7-26202M with 7.8Gb memory. We compare the performance of revenant with Rex [22] 2 and dprle [9], and StrSolve [11] 3 on a range of common benchmarks (first and second experiments).…”

“…Table 1(a) shows the results of our evaluation running the different tools. Note that previous works (e.g., [22,9,11]) used the same set of regular expressions but regular set difference of pairs of languages was used instead of intersection. The reason why we do not perform the same experiment here is that our current implementation does not handle regular complement.…”

“…Hooimeijer et al . [9] present dprle which also relies on the classical algorithms for regular languages involving concatenation and subset constraints. dprle utilises dependency analysis information to slice away product automaton states that are irrelevant for the query.…”

“…Although this problem is decidable, the implementation of practical algorithms is still an open issue. Most state-of-the-art solutions (e.g., [22,9,11]) rely on the classical product algorithm for intersection of DFAs, but they differ in how they tackle the two main performance bottlenecks: exponential blowup while converting regular expressions to DFAs, and the large state space of the product automaton. These solvers, particularly lazy solvers [11], are very efficient when the query is underconstrained because they can avoid building the full product automaton.…”

“…-We describe revenant, a publicly available solver designed to handle the intersection of sets (beyond pairs) of regular languages efficiently. -We compare with the state-of-the-art solvers Rex [22], dprle [9], and StrSolve [11], using a standard benchmark set of regular expressions extracted from real applications [21], together with intersection instances designed to stress test solvers. revenant performs very well on instances in its target domain, while remaining competitive across benchmarks.…”