Precise Analysis of String Expressions

Abstract

Abstract.We perform static analysis of Java programs to answer a simple question: which values may occur as results of string expressions? The answers are summarized for each expression by a regular language that is guaranteed to contain all possible values. We present several applications of this analysis, including statically checking the syntax of dynamically generated expressions, such as SQL queries. Our analysis constructs flow graphs from class files and generates a context-free grammar with a nonterminal for each string expression. The language of this grammar is then widened into a regular language through a variant of an algorithm previously used for speech recognition. The collection of resulting regular languages is compactly represented as a special kind of multi-level automaton from which individual answers may be extracted. If a program error is detected, examples of invalid strings are automatically produced. We present extensive benchmarks demonstrating that the analysis is efficient and produces results of useful precision.

Static Analysis of String Values

“…For the concatenation of two strings, we rely on the concatList function that concatenates two lists of bricks, and then we normalise its result. readLine returns the top value, while substring e b returns the substring iff the first brick of the list has index [1,1] and the length of all the strings contained in it is greater than e. Notice that T ′ = {t.substring(b, e)∀t ∈ T}.…”

“…When a constant string is evaluated, the semantics returns a single brick containing exactly that string with [1,1] as index. For the concatenation of two strings, we rely on the concatList function that concatenates two lists of bricks, and then we normalise its result.…”

“…The abstraction function is defined by: α ′ BR (s) = [{s}] (1,1) and Table 5 defines the abstract semantics on BR. When a constant string is evaluated, the semantics returns a single brick containing exactly that string with [1,1] as index.…”

Relational String Verification Using Multi-track Automata

“…Due to its importance in security, string analysis has been widely studied. One influential approach has been grammar-based string analysis that statically computes an over-approximation of the values of string expressions in Java programs [6] which has also been used to check for various types of errors in Web applications [8,9,12]. In [9,12], multi-track DFAs, known as transducers, are used to model replacement operations.…”

On Unfolding for Programs Using Strings as a Data Type

“…Recently, a number of techniques producing string constraints have been suggested for automatic testing [8,1] and program verification [16]. String-constraint solvers are used in many testing and analysis tools [5,2,6,15,23].…”