Efficient symbolic execution of strings for validating web applications

Shannon, Daryl; Ghosh, Indradeep; Sunitha, R; Khurshid, Sarfraz

doi:10.1145/1555860.1555868

Cited by 11 publications

(13 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The automaton refinement scheme in Item 1 is quite different from existing automaton-based ones. One of the first attempts at solving hybrid constraints using automata in the string domain is described in our earlier work [11]. This paper summarizes the advances that we have made in the solver after that.…”

Section: Background and Motivating Examplementioning

confidence: 98%

JST: An automatic test generation tool for industrial Java applications with strings

Ghosh

Shafiei²,

et al. 2013

2013 35th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

Abstract-In this paper we present JST, a tool that automatically generates a high coverage test suite for industrial strength Java applications. This tool uses a numeric-string hybrid symbolic execution engine at its core which is based on the Symbolic Java PathFinder platform. However, in order to make the tool applicable to industrial applications the existing generic platform had to be enhanced in numerous ways that we describe in this paper. The JST tool consists of newly supported essential Java library components and widely used data structures; novel solving techniques for string constraints, regular expressions, and their interactions with integer and floating point numbers; and key optimizations that make the tool more efficient. We present a methodology to seamlessly integrate the features mentioned above to make the tool scalable to industrial applications that are beyond the reach of the original platform in terms of both applicability and performance. We also present extensive experimental data to illustrate the effectiveness of our tool.

show abstract

Section: Background and Motivating Examplementioning

confidence: 98%

JST: An automatic test generation tool for industrial Java applications with strings

Ghosh

Shafiei²,

et al. 2013

2013 35th International Conference on Software Engineering (ICSE)

View full text Add to dashboard Cite

show abstract

“…Other solvers [9,24,13,14,27,31,26,2,21] that work exclusively in the string domain have similar limitations.…”

Section: Motivating Examplementioning

confidence: 99%

“…Based on the underlining representation, existing string analyses can be roughly categorized into two kinds: automatabased [9,24,13,14,27,31,26,2,21] and bit-vector-based [17,22,8,21]. We have made comparison with a number of these existing works [17,22,33,26] in Sections 2 and 4.…”

Section: Related Workmentioning

confidence: 99%

Z3-str: a z3-based string solver for web application analysis

Zheng

Zhang

Ganesh

2013

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering

163

134

View full text Add to dashboard Cite

Analyzing web applications requires reasoning about strings and non-strings cohesively. Existing string solvers either ignore non-string program behavior or support limited set of string operations. In this paper, we develop a general purpose string solver, called Z3-str, as an extension of the Z3 SMT solver through its plug-in interface. Z3-str treats strings as a primitive type, thus avoiding the inherent limitations observed in many existing solvers that encode strings in terms of other primitives. The logic of the plug-in has three sorts, namely, bool, int and string. The string-sorted terms include string constants and variables of arbitrary length, with functions such as concatenation, sub-string, and replace. The int-sorted terms are standard, with the exception of the length function over string terms. The atomic formulas are equations over string terms, and (in)-equalities over integer terms. Not only does our solver have features that enable whole program symbolic, static and dynamic analysis, but also it performs better than other solvers in our experiments. The application of Z3-str in remote code execution detection shows that its support of a wide spectrum of string operations is key to reducing false positives.

show abstract

“…Finally, we intersect this automaton with the one accepting all words of length 2 to get the final automaton. Due to space constraint we will skip the details of implementing the new operations, which we extend from [16,9].…”

Section: Enhancement With Automaton Based Modelmentioning

confidence: 99%

“…Automaton based model [16,21,18,20,11,9]. A string is modeled by an automaton which accepts all possible values of this string.…”

Section: Introductionmentioning

confidence: 99%

PASS: String Solving with Parameterized Array and Interval Automaton

Ghosh

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The problem of solving string constraints together with numeric constraints has received increasing interest recently. Existing methods use either bit-vectors or automata (or their combination) to model strings, and reduce string constraints to bit-vector constraints or automaton operations, which are then solved in the respective domain. Unfortunately, they often fail to achieve a good balance between efficiency, accuracy, and comprehensiveness. In this paper we illustrate a new technique that uses parameterized arrays as the main data structure to model strings, and converts string constraints into quantified expressions that are solved through quantifier elimination. We present an efficient and sound quantifier elimination algorithm. In addition, we use an automaton model to handle regular expressions and reason about string values faster. Our method does not need to enumerate string lengths (as bit-vector based methods do), or concrete string values (as automaton based methods do). Hence, it can achieve much better accuracy and efficiency. In particular, it can identify unsatisfiable cases quickly. Our solver (named PASS) supports most of the popular string operations, including string comparisons, string-numeric conversions, and regular expressions. Experimental results demonstrate the advantages of our method.

show abstract

Efficient symbolic execution of strings for validating web applications

Cited by 11 publications

References 2 publications

JST: An automatic test generation tool for industrial Java applications with strings

JST: An automatic test generation tool for industrial Java applications with strings

Z3-str: a z3-based string solver for web application analysis

PASS: String Solving with Parameterized Array and Interval Automaton

Contact Info

Product

Resources

About