Decision procedures for path feasibility of string-manipulating programs with complex operations

Abstract

The design and implementation of decision procedures for checking path feasibility in string-manipulating programs is an important problem, with such applications as symbolic execution of programs with strings and automated detection of cross-site scripting (XSS) vulnerabilities in web applications. A (symbolic) path is given as a finite sequence of assignments and assertions (i.e. without loops), and checking its feasibility amounts to determining the existence of inputs that yield a successful execution. Modern programming languages (e.g. JavaScript, PHP, and Python) support many complex string operations, and strings are also often implicitly modified during a computation in some intricate fashion (e.g. by some autoescaping mechanisms).In this paper we provide two general semantic conditions which together ensure the decidability of path feasibility: (1) each assertion admits regular monadic decomposition (i.e. is an effectively recognisable relation), and (2) each assignment uses a (possibly nondeterministic) function whose inverse relation preserves regularity. We show that the semantic conditions are expressive since they are satisfied by a multitude of string operations including concatenation, one-way and two-way finite-state transducers, replaceAll functions (where the replacement string could contain variables), string-reverse functions, regularexpression matching, and some (restricted) forms of letter-counting/length functions. The semantic conditions also strictly subsume existing decidable string theories (e.g. straightline fragments, and acyclic logics), and most existing benchmarks (e.g. most of Kaluza's, and all of SLOG's, Stranger's, and SLOTH's benchmarks). Our semantic conditions also yield a conceptually simple decision procedure, as well as an extensible architecture of a string solver in that a user may easily incorporate his/her own string functions into the solver by simply providing code for the pre-image computation without worrying about other parts of the solver. Despite these, the semantic conditions are unfortunately too general to provide a fast and complete decision procedure. We provide strong theoretical evidence for this in the form of complexity results. To rectify this problem, we propose two solutions. Our main solution is to allow only partial string functions (i.e., prohibit nondeterminism) in condition (2). This restriction is satisfied in many cases in practice, and yields decision procedures that are effective in both theory and practice. Whenever nondeterministic functions are still needed (e.g. the string function split), our second solution is to provide a syntactic fragment that provides a support of nondeterministic functions, and operations like one-way transducers, replaceAll (with constant replacement string), the string-reverse function, concatenation, and regular-expression matching. We show that this fragment can be reduced to an existing solver SLOTH that exploits fast model checking algorithms like IC3.We provide an efficient implementation of our decision p...

A Novel Approach to String Constraint Solving

“…In [34] Chen et al define a first-order language based on the .NET string library functions and prove some decidability properties for (fragments of) that language. In particular, based on the work of [31], the authors prove that undecidablity of the path feasibility problem for a fragment called library language.…”

High-Level Abstractions for Simplifying Extended String Constraints in SMT

“…Trau [1] reduces certain extended functions, such as replace, to context-free membership constraints. Ostrich [7] implements a decision procedure for a subset of constraints that include extended string functions. The simplification techniques presented in this paper are agnostic to the underlying solving procedure, so they can be combined with all of these approaches.…”

Solving String Constraints with Streaming String Transducers

“…We also conducted experiments to compare our procedure with SLOTH [16] and OSTRICH [12]. All the test cases use the 8bit extended ASCII alphabet.…”

“…Chen et al developed a framework that solves straight-line string constraints by computing pre-image of regular languages under transductions [12]. It supports constraints that satisfy two specific restrictions RegMonDec and RegInvRel.…”

“…Holík et al implemented the solver SLOTH based on their work and succinct representation of string constraints using alternating finite automata, and demonstrated that their solver handles constraints derived from PHP and JavaScript programs [16]. Later Chen et al implemented the solver OSTRICH that handles string constraints with specific conditions by computing pre-image of regular languages under transductions [12]. OSTRICH is faster and can support a wider class of transductions than SLOTH.…”