Bounded verification of Ruby on Rails data models

Abstract

The use of scripting languages to build web applications has increased programmer productivity, but at the cost of degrading dependability. In this paper we focus on a class of bugs that appear in web applications that are built based on the Model-View-Controller architecture. Our goal is to automatically discover data model errors in Ruby on Rails applications. To this end, we created an automatic translator that converts data model expressions in Ruby on Rails applications to formal specifications. In particular, our translator takes Active Records specifications (which are used to specify data models in Ruby on Rails applications) as input and generates a data model in Alloy language as output. We then use bounded verification techniques implemented in the Alloy Analyzer to look for errors in these formal data model specifications. We applied our approach to two open source web applications to demonstrate its feasibility.

Unbounded data model verification using SMT solvers

“…There are several significant differences in this paper compared to the work presented in [16]: 1) In this paper we use an unbounded verification approach based on SMT-solvers as opposed to the bounded SAT-based verification approach used in [16]. 2) This paper directly constructs formulas in the theory of uninterpreted functions from verification queries about a given Rails data model, whereas the approach presented in [16] translates data models to Alloy specifications which Alloy Analyzer then converts to boolean SAT formulas. 3) We present a novel data model projection technique that simplifies the generated formula by removing constraints about the data model that are not relevant to the property being verified, improving the performance of the analysis.…”

“…4) We present experimental analysis demonstrating the performance of the proposed verification approach on five open source Rails applications. 5) We experimentally compare the unbounded verification approach presented in this paper with the bounded verification approach presented in [16] and show that the unbounded verification approach presented in this paper is more efficient.…”

“…The data models of all five applications were run through the ActiveRecord to Alloy translator that was implemented in our previous work [16]. The same measurements were taken as with Z3, but over an increasing bound from at most 10 objects for each class to at most 35 objects for each class.…”

“…This paper builds on our earlier work on bounded verification of Rails data models [16]. There are several significant differences in this paper compared to the work presented in [16]: 1) In this paper we use an unbounded verification approach based on SMT-solvers as opposed to the bounded SAT-based verification approach used in [16].…”

Finding security bugs in web applications using a catalog of access control patterns

“…Bordbar and Anastasakis [4], for example, model a user's interaction with a web application using UML, and perform bounded verification of properties of that interaction by translating the UML model into Alloy using UML2Alloy; other approaches ( [22,34,29]) perform similar tasks but provide less automation. Nijjar and Bultan [27] translate Rails data models into Alloy to find inconsistencies, but do not examine controller code. Bocić and Bultan [3] and Near and Jackson [24] check Rails code, but require the user to write a specification.…”