PASS: String Solving with Parameterized Array and Interval Automaton

Abstract

Abstract. The problem of solving string constraints together with numeric constraints has received increasing interest recently. Existing methods use either bit-vectors or automata (or their combination) to model strings, and reduce string constraints to bit-vector constraints or automaton operations, which are then solved in the respective domain. Unfortunately, they often fail to achieve a good balance between efficiency, accuracy, and comprehensiveness. In this paper we illustrate a new technique that uses parameterized arrays as the main data structure to model strings, and converts string constraints into quantified expressions that are solved through quantifier elimination. We present an efficient and sound quantifier elimination algorithm. In addition, we use an automaton model to handle regular expressions and reason about string values faster. Our method does not need to enumerate string lengths (as bit-vector based methods do), or concrete string values (as automaton based methods do). Hence, it can achieve much better accuracy and efficiency. In particular, it can identify unsatisfiable cases quickly. Our solver (named PASS) supports most of the popular string operations, including string comparisons, string-numeric conversions, and regular expressions. Experimental results demonstrate the advantages of our method.

Counting Algorithms for Recognizable and Algebraic Series

“…BEK [12] uses symbolic finite transducers (SFT) to model a sanitizer in PHP code. [9] and [19] extend this approach by extended SFTs in which an input is an arbitrary string not limited to a single character to represent a decoder, and by using parameterized array, respectively.…”

A Decision Procedure for Regular Membership and Length Constraints over Unbounded Strings

“…Also, automata refinement may constitute a performance bottleneck, even though it is very useful in solving membership constraints. Further discussion can be found in [10,18]. Other approaches for solving regular expression constraints are based on reductions to other theories, such as bit-vectors [15] or linear integer arithmetic constraints [29], [7], and using constraint solvers for those theories.…”

SymJS: automatic symbolic testing of JavaScript web applications

“…a valid solution for P4 is: name = "a b" and visa = "0000000000000001". SymJS applies symbolic execution to explore all paths, and uses an efficient string-numeric solver [13] to determine path feasibility and produce test cases. P 1 : trim(name) = "fujitsu" P 2 : trim(name) = "fujitsu" ∧ trim(name).split(" ").len = 2 P 3 : P 2 ∧ ¬visa.match("\d{16}") P 4 : P 2 ∧ visa.match("\d{16}") ∧ parseInt(visa [15]) % 2 = 0 P 5 :…”

“…However, JavaScript features extensive String operations, which are not supported by most modern SMT solvers. Thus SymJS introduces the PASS solver [13] to handle string constraints. PASS supports integers, bit-vector numbers, floating point numbers, and strings.…”

“…On average, the solver optimizations described in Section 3 can lead to 10 − 20% improvement on solving time. The improvement is marginal since PASS [13] has used various inner optimizations, e.g. applying early termination and incremental solving, as well as using the automaton model lazily.…”