Symbolic String Verification: An Automata-Based Approach

Abstract

Abstract. We present an automata-based approach for the verification of string operations in PHP programs based on symbolic string analysis. String analysis is a static analysis technique that determines the values that a string expression can take during program execution at a given program point. This information can be used to verify that string values are sanitized properly and to detect programming errors and security vulnerabilities. In our string analysis approach, we encode the set of string values that string variables can take as automata. We implement all string functions using a symbolic automata representation (MBDD representation from the MONA automata package) and leverage efficient manipulations on MBDDs, e.g., determinization and minimization. Particularly, we propose a novel algorithm for language-based replacement. Our replacement function takes three DFAs as arguments and outputs a DFA. Finally, we apply a widening operator defined on automata to approximate fixpoint computations. If this conservative approximation does not include any bad patterns (specified as regular expressions), we conclude that the program does not contain any errors or vulnerabilities. Our experimental results demonstrate that our approach works quite well in checking the correctness of sanitization operations in real-world PHP applications.

Verifying client-side input validation functions using string analysis

“…DFA based symbolic string analysis has been used to verify the correctness of string sanitization operations in PHP programs [23], [22]. Recently, foundations of relational string analysis using multi-track automata (as opposed to single-track automata used in our analysis) were investigated in [24].…”

“…• concat(exp1, exp2): Here we compute the concatenation of the regular languages resulting from evaluating exp1 and exp2 and return it as the result (using the symbolic DFA concatenation operation discussed in [23] Conditional Statement: This type of statement represents the branch conditions in a number of language constructs in JavaScript including if statement, for loop, while loop and do while loop. Conditional statement consists of a predicate on variables and constants.…”

Static Analysis of String Values

“…A more recent work was developed by Yu et al [24]. It presented an automatabased approach for the verification of string operations in PHP programs.…”

“…On the other hand, the stateof-the-art in this field is still limited: approaches that rely on automata and use regular expressions are precise but slow, and they do not scale up [14,24,21,13], while many other approaches are focused on particular properties or class of programs [10,18,12]. Genericity and scalability are the main advantages of the abstract interpretation approach [4,5], though its instantiation to textual values has been quite limited up to now.…”

Relational String Verification Using Multi-track Automata

“…All statements are labeled. We only consider one string operation (concatenation) in our formal model; however, our symbolic string analysis techniques can be extended to handle complex string operations (such as replacement [14]). Function calls use call-by-value parameter passing.…”