Sound regular expression semantics for dynamic symbolic execution of JavaScript

Abstract

Support for regular expressions in symbolic execution-based tools for test generation and bug finding is insufficient. Common aspects of mainstream regular expression engines, such as backreferences or greedy matching, are ignored or imprecisely approximated, leading to poor test coverage or missed bugs. In this paper, we present a model for the complete regular expression language of ECMAScript 2015 (ES6), which is sound for dynamic symbolic execution of the test and exec functions. We model regular expression operations using string constraints and classical regular expressions and use a refinement scheme to address the problem of matching precedence and greediness. We implemented our model in ExpoSE, a dynamic symbolic execution engine for JavaScript, and evaluated it on over 1,000 Node.js packages containing regular expressions, demonstrating that the strategy is effective and can significantly increase the number of successful regular expression queries and therefore boost coverage.CCS Concepts • Software and its engineering → Software verification and validation; Dynamic analysis; • Theory of computation → Regular languages.

Solving string constraints with Regex-dependent functions through transducers with priorities and variables

“…Unfortunately, the gap between the string functions that are supported by current string solvers and those supported by modern programming languages is still too big. As convincingly argued in [Loring et al 2019] in the context of constraint solving, the widely used Regular Expressions in modern programming languages (among others, JavaScript, Python, etc. )Ðwhich we call RegEx in the sequelÐare one important and frequently occurring feature in programs that are difficult for existing SMT theories over strings to model and solve, especially because their syntaxes and semantics substantially differ from the notion of regular expressions in formal language theory [Hopcroft and Ullman 1979].…”

“…see [Abdulla et al 2018;Chen et al 2019;Liang et al 2014;Trinh et al 2016;), i.e., features that can be found in the above examples like capturing groups, greedy/lazy matching, and references are not supported. This limitation of existing string solvers was already mentioned in the recent paper [Loring et al 2019].…”

“…One recently proposed solution is to map the path constraints generated by string-manipulating programs that exploit RegEx into constraints in the SMT theories supported by existing string solvers. In fact, this was done in recent papers [Loring et al 2019], where the path constraints are mapped to constraints in the theory of strings with concatenation and regular constraints in Z3 [de Moura and Bjùrner 2008]. Unfortunately, this mapping is an approximation, since such complex string manipulations are generally inexpressible in any string theories supported by existing string solvers.…”

“…Unfortunately, this mapping is an approximation, since such complex string manipulations are generally inexpressible in any string theories supported by existing string solvers. To leverage this, CEGAR (counter-example guided abstraction and refinement) is used in [Loring et al 2019], while ensuring that an under-approximation is preserved. This results in a rather severe price in both precision and performance: the refinement process may not terminate even for extremely simple programs (e.g.…”

Gillian, Part I: A Multi-language Platform for Symbolic Execution

“…Symbolic Execution Tools for JavaScript and C. Most existing symbolic execution tools for JavaScript aim at bugfinding and target specific types of bugs, such as security vulnerabilities related to the misuse of strings [57], malformed Web API requests [66], DOM-API-specific bugs [35], or bugs involving regular expressions [36]. These tools aim at code in the large, primarily focussing on scalability and coverage.…”