A symbolic model checking approach to the analysis of string and length constraints

Wang, Hung-En; Chen, Shih‐Yu; Yu, Fang; Jiang, Jie-Hong R.

doi:10.1145/3238147.3238189

Cited by 14 publications

(9 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Solvers typically use a combination of techniques to check the satisfiability of string constraints, including word-based methods, automata-based methods, and unfolding-based methods like the translation to bit-vector constraints. We mention among others the following string solvers: Z3 [de Moura and Bjùrner 2008], CVC4 [Liang et al 2014], Z3-str/2/3/4 [Berzish et al 2017;Berzish, Murphy 2021;Zheng et al 2015Zheng et al , 2013, ABC [Bultan and contributors 2015], Norn [Abdulla et al 2014], Trau [Abdulla et al 2017Bui and contributors 2019], OSTRICH [Chen et al 2019], S2S [Le and He 2018], Qzy [Cox and Leasure 2017], Stranger [Yu et al 2010], Sloth [Abdulla et al 2019;, Slog [Wang et al 2016], Slent [Wang et al 2018], Gecode+S [Scott et al 2017], G-Strings [Amadini et al 2017], HAMPI [Kiezun et al 2012], and S3 [Trinh et al 2014]. Most modern string solvers provide support of concatenation and regular constraints.…”

Section: Related Workmentioning

confidence: 99%

“…One powerful method for identifying such bugs in programs is symbolic execution (possibly in combination with dynamic analysis), which analyses symbolic paths in a program by viewing them as constraints whose feasibility is checked by constraint solvers. Together with the challenging problem of string analysis, this interplay between program analysis and constraint solvers has motivated the highly active research area of string solving, resulting in the development of numerous string solvers in the last decade or so including Z3 [de Moura and Bjùrner 2008], CVC4 [Liang et al 2014], Z3-str/2/3/4 [Berzish et al 2017;Berzish, Murphy 2021;Zheng et al 2015Zheng et al , 2013, ABC [Bultan and contributors 2015], Norn [Abdulla et al 2014], Trau [Abdulla et al 2017Bui and contributors 2019], OSTRICH [Chen et al 2019], S2S [Le and He 2018], Qzy [Cox and Leasure 2017], Stranger [Yu et al 2010], Sloth [Abdulla et al 2019;, Slog [Wang et al 2016], Slent [Wang et al 2018], Gecode+S [Scott et al 2017], G-Strings [Amadini et al 2017], HAMPI [Kiezun et al 2012], among many others.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Solving string constraints with Regex-dependent functions through transducers with priorities and variables

Chen

Flores-Lamas

Hague

et al. 2022

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Regular expressions are a classical concept in formal language theory. Regular expressions in programming languages (RegEx) such as JavaScript, feature non-standard semantics of operators (e.g. greedy/lazy Kleene star), as well as additional features such as capturing groups and references. While symbolic execution of programs containing RegExes appeals to string solvers natively supporting important features of RegEx, such a string solver is hitherto missing. In this paper, we propose the first string theory and string solver that natively provides such support. The key idea of our string solver is to introduce a new automata model, called prioritized streaming string transducers (PSST), to formalize the semantics of RegEx-dependent string functions. PSSTs combine priorities, which have previously been introduced in prioritized finite-state automata to capture greedy/lazy semantics, with string variables as in streaming string transducers to model capturing groups. We validate the consistency of the formal semantics with the actual JavaScript semantics by extensive experiments. Furthermore, to solve the string constraints, we show that PSSTs enjoy nice closure and algorithmic properties, in particular, the regularity-preserving property (i.e., pre-images of regular constraints under PSSTs are regular), and introduce a sound sequent calculus that exploits these properties and performs propagation of regular constraints by means of taking post-images or pre-images. Although the satisfiability of the string constraint language is generally undecidable, we show that our approach is complete for the so-called straight-line fragment. We evaluate the performance of our string solver on over 195000 string constraints generated from an open-source RegEx library. The experimental results show the efficacy of our approach, drastically improving the existing methods (via symbolic execution) in both precision and efficiency.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Solving string constraints with Regex-dependent functions through transducers with priorities and variables

Chen

Flores-Lamas

Hague

et al. 2022

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…1. A program that counts the occurrences of a string into another one the context of string constraints verification, focusing on the study of decidable fragments of the string constraint formulas [3] or proposing new efficient decidable procedures or string constraints representations [3,5,11] also based on automata, such as [33,34], or involving type conversion string constraints [1].…”

Section: Related Workmentioning

confidence: 99%

Twinning Automata and Regular Expressions for String Static Analysis

Negrini

Arceri

Ferrara

et al. 2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper we formalize Tarsis, a new abstract domain based on the abstract interpretation theory that approximates string values through finite state automata. The main novelty of Tarsis is that it works over an alphabet of strings instead of single characters. On the one hand, such an approach requires a more complex and refined definition of the widening operator, and the abstract semantics of string operators. On the other hand, it is in position to obtain strictly more precise results than state-of-the-art approaches. We implemented a prototype of Tarsis, and we applied it to some case studies taken from some of the most popular Java libraries manipulating string values. The experimental results confirm that Tarsis is in position to obtain strictly more precise results than existing analyses.

show abstract

“…Solvers typically use a combination of techniques to check the satisfiability of string constraints, including word-based methods, automata-based methods, and unfolding-based methods like the translation to bit-vector constraints. We mention among others the following string solvers: Z3 [de Moura and Bjørner 2008], CVC4 [Liang et al 2014], Z3-str/2/3/4 [Berzish et al 2017;Berzish, Murphy 2021;Zheng et al 2015Zheng et al , 2013, ABC [Bultan and contributors 2015], Norn [Abdulla et al 2014], Trau [Abdulla et al 2017Bui and contributors 2019], OSTRICH [Chen et al 2019], S2S [Le and He 2018], Qzy [Cox and Leasure 2017], Stranger [Yu et al 2010], Sloth [Abdulla et al 2019;, Slog [Wang et al 2016], Slent [Wang et al 2018], Gecode+S [Scott et al 2017], G-Strings [Amadini et al 2017], HAMPI [Kiezun et al 2012], and S3 [Trinh et al 2014]. Most modern string solvers provide support of concatenation and regular constraints.…”

Section: Related Workmentioning

confidence: 99%

“…One powerful method for identifying such bugs in programs is symbolic execution (possibly in combination with dynamic analysis), which analyses symbolic paths in a program by viewing them as constraints whose feasibility is checked by constraint solvers. Together with the challenging problem of string analysis, this interplay between program analysis and constraint solvers has motivated the highly active research area of string solving, resulting in the development of numerous string solvers in the last decade or so including Z3 [de Moura and Bjørner 2008], CVC4 [Liang et al 2014], Z3-str/2/3/4 [Berzish et al 2017;Berzish, Murphy 2021;Zheng et al 2015Zheng et al , 2013, ABC [Bultan and contributors 2015], Norn [Abdulla et al 2014], Trau [Abdulla et al 2017Bui and contributors 2019], OSTRICH [Chen et al 2019], S2S [Le and He 2018], Qzy [Cox and Leasure 2017], Stranger [Yu et al 2010], Sloth [Abdulla et al 2019;, Slog [Wang et al 2016], Slent [Wang et al 2018], Gecode+S [Scott et al 2017], G-Strings [Amadini et al 2017], HAMPI [Kiezun et al 2012], among many others.…”

Section: Introductionmentioning

confidence: 99%

Solving String Constraints With Regex-Dependent Functions Through Transducers With Priorities And Variables

Chen¹,

Lamas²,

Hague³

et al. 2021

Preprint

View full text Add to dashboard Cite

Regular expressions are a classical concept in formal language theory. Regular expressions in programming languages (RegEx) such as JavaScript, feature non-standard semantics of operators (e.g. greedy/lazy Kleene star), as well as additional features such as capturing groups and references. While symbolic execution of programs containing RegExes appeals to string solvers natively supporting important features of RegEx, such a string solver is hitherto missing. In this paper, we propose the first string theory and string solver that natively provides such support. The key idea of our string solver is to introduce a new automata model, called prioritized streaming string transducers (PSST), to formalize the semantics of RegEx-dependent string functions. PSSTs combine priorities, which have previously been introduced in prioritized finite-state automata to capture greedy/lazy semantics, with string variables as in streaming string transducers to model capturing groups. We validate the consistency of the formal semantics with the actual JavaScript semantics by extensive experiments. Furthermore, to solve the string constraints, we show that PSSTs enjoy nice closure and algorithmic properties, in particular, the regularity-preserving property (i.e., pre-images of regular constraints under PSSTs are regular), and introduce a sound sequent calculus that exploits these properties and performs propagation of regular constraints by means of taking post-images or pre-images. Although the satisfiability of the string constraint language is generally undecidable, we show that our approach is complete for the so-called straightline fragment. We evaluate the performance of our string solver on over 195 000 string constraints generated from an open-source RegEx library. The experimental results show the efficacy of our approach, drastically improving the existing methods (via symbolic execution) in both precision and efficiency.

show abstract

A symbolic model checking approach to the analysis of string and length constraints

Cited by 14 publications

References 20 publications

Solving string constraints with Regex-dependent functions through transducers with priorities and variables

Solving string constraints with Regex-dependent functions through transducers with priorities and variables

Twinning Automata and Regular Expressions for String Static Analysis

Solving String Constraints With Regex-Dependent Functions Through Transducers With Priorities And Variables

Contact Info

Product

Resources

About