ExpoSE: practical symbolic execution of standalone JavaScript

Loring, Blake; Mitchell, Duncan; Kinder, Johannes

doi:10.1145/3092282.3092295

Cited by 21 publications

(23 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We now describe an implementation of our approach in the DSE engine ExpoSE 1 [27]. We explain how to model the regex API with capturing language membership ( §6.1) and give a brief overview of ExpoSE ( §6.2).…”

Section: Methodsmentioning

confidence: 99%

“…Several testing and verification tools include some degree of support for regular expressions because they are so common [24,27,29,34,37]. In particular, SMT (satisfiability modulo theory) solvers now often support theories for strings and classical regular expressions [1,2,6,15,25,26,34,[38][39][40], which allow expressing constraints such as s ∈ L(goo+d) for the test example above.…”

Section: Introductionmentioning

confidence: 99%

“…• We fully model ES6 regex in terms of classical regular languages and string constraints ( §4) and cover several aspects missing from previous work [27,29,30]. We introduce the notion of a capturing language to make the problem of matching and capture group assignment self-contained.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Sound regular expression semantics for dynamic symbolic execution of JavaScript

Loring

Mitchell

Kinder

2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

Self Cite

View full text Add to dashboard Cite

Support for regular expressions in symbolic execution-based tools for test generation and bug finding is insufficient. Common aspects of mainstream regular expression engines, such as backreferences or greedy matching, are ignored or imprecisely approximated, leading to poor test coverage or missed bugs. In this paper, we present a model for the complete regular expression language of ECMAScript 2015 (ES6), which is sound for dynamic symbolic execution of the test and exec functions. We model regular expression operations using string constraints and classical regular expressions and use a refinement scheme to address the problem of matching precedence and greediness. We implemented our model in ExpoSE, a dynamic symbolic execution engine for JavaScript, and evaluated it on over 1,000 Node.js packages containing regular expressions, demonstrating that the strategy is effective and can significantly increase the number of successful regular expression queries and therefore boost coverage.CCS Concepts • Software and its engineering → Software verification and validation; Dynamic analysis; • Theory of computation → Regular languages.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Sound regular expression semantics for dynamic symbolic execution of JavaScript

Loring

Mitchell

Kinder

2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

Self Cite

View full text Add to dashboard Cite

show abstract

“…To the best of our knowledge, the only mature SMT solvers that currently support all the theories it requires are Z3 and CVC4. Note that previous systems such as Kudzu [41], Jalangi [45], SymJS [30] and ExpoSE [34] were all designed for use with particular constraint solvers. As such, our implementation is the first multi-solver DSE tool.…”

Section: Backend Solving and Optimizationsmentioning

confidence: 99%

Constraint Programming for Dynamic Symbolic Execution of JavaScript

Amadini

Andrlon

Gange

et al. 2019

Integration of Constraint Programming, Artificial Intelligence, and Operations Research

View full text Add to dashboard Cite

Dynamic Symbolic Execution (DSE) combines concrete and symbolic execution, usually for the purpose of generating good test suites automatically. It relies on constraint solvers to solve path conditions and to generate new inputs to explore. DSE tools usually make use of SMT solvers for constraint solving. In this paper, we show that constraint programming (CP) is a powerful alternative or complementary technique for DSE. Specifically, we apply CP techniques for DSE of JavaScript, the de facto standard for web programming. We capture the JavaScript semantics with MiniZinc and integrate this approach into a tool we call Aratha. We use G-Strings, a CP solver equipped with string variables, for solving path conditions, and we compare the performance of this approach against state-of-the-art SMT solvers. Experimental results, in terms of both speed and coverage, show the benefits of our approach, thus opening new research vistas for using CP techniques in the service of program analysis.

show abstract

“…Popular methods for analysing how strings are being manipulated by a program include symbolic executions [Bjùrner et al 2009;Cadar et al 2008Cadar et al , 2011Godefroid et al 2005;Kausler and Sherman 2014;Loring et al 2017;Redelinghuys et al 2012;Saxena et al 2010;Sen et al 2013] which at their core use constraint solvers over the string domain (a.k.a. string solvers).…”

Section: Introductionmentioning

confidence: 99%

String constraints with concatenation and transducers solved efficiently

Holík

Janků

Lin

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

String analysis is the problem of reasoning about how strings are manipulated by a program. It has numerous applications including automatic detection of cross-site scripting, and automatic test-case generation. A popular string analysis technique includes symbolic executions, which at their core use constraint solvers over the string domain, a.k.a. string solvers. Such solvers typically reason about constraints expressed in theories over strings with the concatenation operator as an atomic constraint. In recent years, researchers started to recognise the importance of incorporating the replace-all operator (i.e. replace all occurrences of a string by another string) and, more generally, finite-state transductions in the theories of strings with concatenation. Such string operations are typically crucial for reasoning about XSS vulnerabilities in web applications, especially for modelling sanitisation functions and implicit browser transductions (e.g. innerHTML). Although this results in an undecidable theory in general, it was recently shown that the straight-line fragment of the theory is decidable, and is sufficiently expressive in practice. In this paper, we provide the first string solver that can reason about constraints involving both concatenation and finite-state transductions. Moreover, it has a completeness and termination guarantee for several important fragments (e.g. straight-line fragment). The main challenge addressed in the paper is the prohibitive worst-case complexity of the theory (double-exponential time), which is exponentially harder than the case without finite-state transductions. To this end, we propose a method that exploits succinct alternating finite-state automata as concise symbolic representations of string constraints. In contrast to previous approaches using nondeterministic automata, alternation offers not only exponential savings in space when representing Boolean combinations of transducers, but also a possibility of succinct representation of otherwise costly combinations of transducers and concatenation. Reasoning about the emptiness of the AFA language requires a state-space exploration in an exponential-sized graph, for which we use model checking algorithms (e.g. IC3). We have implemented our algorithm and demonstrated its efficacy on benchmarks that are derived from cross-site scripting analysis and other examples in the literature.

show abstract

ExpoSE: practical symbolic execution of standalone JavaScript

Cited by 21 publications

References 10 publications

Sound regular expression semantics for dynamic symbolic execution of JavaScript

Sound regular expression semantics for dynamic symbolic execution of JavaScript

Constraint Programming for Dynamic Symbolic Execution of JavaScript

String constraints with concatenation and transducers solved efficiently

Contact Info

Product

Resources

About