Z3-str: a z3-based string solver for web application analysis

Zheng, Yunhui; Zhang, Xiangyu; Ganesh, Vijay

doi:10.1145/2491411.2491456

Cited by 162 publications

(135 citation statements)

References 32 publications

Supporting

Mentioning

134

Contrasting

Order By: Relevance

“…Thus, answers to string constraint problems generated by kaluza are inherently unverifiable. Furthermore, kaluza is noticeably unstable; the tool generates incorrect results, even on instances of its own benchmark (as also reported in [60,106]), is frequently error-prone, and seems to be no longer in development.…”

Section: Bounded-length String Variablesmentioning

confidence: 86%

“…Fixed-length solvers are generally superior to unbounded-length solvers for producing a single solution, but are inferior for producing the set of all solutions. At the opposite end of the spectrum are solvers for string variables of unbounded length, such as [1,36,39,44,51,52,65,97,106]. These solvers define the set of all satisfying strings intensionally, typically by formal languages.…”

Section: Related Work: String Solversmentioning

confidence: 99%

“…The first string theory for an SMT solver was Z3-str [106], an extension of the SMT solver Z3 that provides a theory of word equations with length constraints. As reported in [60], not only is Z3-str unsound (i.e., it reports that some satisfiable problems are unsatisfiable), but it also returns spurious solutions to some problems.…”

Section: Unbounded-length String Variablesmentioning

confidence: 99%

“…Hence this extensive benchmark is not particularly interesting. In order not to be biased by hand-picking among the 50,000 instances, we evaluated all the 14 instances that are distributed with the kaluza code, removing those for which kaluza generates incorrect or inconsistent results (as also reported in [106]). …”

Section: Benchmarksmentioning

confidence: 99%

See 3 more Smart Citations

Other things besides number: Abstraction, constraint propagation, and string variable types

Scott

2016

Constraints

View full text Add to dashboard Cite

Constraint programming (CP) is a technology in which a combinatorial problem is modeled declaratively as a conjunction of constraints, each of which captures some of the combinatorial substructure of the problem. Constraints are more than a modeling convenience: every constraint is partially implemented by an inference algorithm, called a propagator, that rules out some but not necessarily all infeasible candidate values of one or more unknowns in the scope of the constraint. Interleaving propagation with systematic search leads to a powerful and complete solution method, combining a high degree of re-usability with natural, high-level modeling.A propagator can be characterized as a sound approximation of a constraint on an abstraction of sets of candidate values; propagators that share an abstraction are similar in the strength of the inference they perform when identifying infeasible candidate values. In this thesis, we consider abstractions of sets of candidate values that may be described by an elegant mathematical formalism, the Galois connection. We develop a theoretical framework from the correspondence between Galois connections and propagators, unifying two disparate views of the abstractionpropagation connection, namely the oft-overlooked distinction between representational and computational over-approximations. Our framework yields compact definitions of propagator strength, even in complicated cases (i.e., involving several types, or unknowns with internal structure); it also yields a method for the principled derivation of propagators from constraint definitions.We apply this framework to the extension of an existing CP solver to constraints over strings, that is, words of finite length. We define, via a Galois connection, an over-approximation for bounded-length strings, and demonstrate two different methods for implementing this overapproximation in a CP solver. First we use the Galois connection to derive a boundedlength string representation as an aggregation of existing scalar types; propagators for this representation are obtained by manual derivation, or automated synthesis, or a combination. Then we implement a string variable type, motivating design choices with knowledge gained from the construction of the over-approximation. The resulting CP solver extension not only substantially eases modeling for combinatorial string problems, but also leads to substantial efficiency improvements over prior CP methods.

show abstract

Section: Bounded-length String Variablesmentioning

confidence: 86%

Section: Related Work: String Solversmentioning

confidence: 99%

Section: Unbounded-length String Variablesmentioning

confidence: 99%

Section: Benchmarksmentioning

confidence: 99%

See 2 more Smart Citations

Other things besides number: Abstraction, constraint propagation, and string variable types

Scott

2016

Constraints

View full text Add to dashboard Cite

show abstract

“…Applicability constraints defined over strings, bag and sets may require dedicated theories. For instance, constraints defined using comparison functions over strings and string conversion functions can be modeled with the theory of strings [32]; constraints defined over bag and set functions (e.g., ac 6 , . .…”

Section: Definitionmentioning

confidence: 99%

Analysis of XACML Policies with SMT

Türkmen

Hartog

Ranise

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. The eXtensible Access Control Markup Language (XACML) is an extensible and flexible XML language for the specification of access control policies. However, the richness and flexibility of the language (along with the verbose syntax of XML) come with a price: errors are easy to make and difficult to detect when policies grow in size. If these errors are not detected and rectified, they can result in serious data leakage and/or privacy violations leading to significant legal and financial consequences. To assist policy authors in the analysis of their policies, several policy analysis tools have been proposed based on different underlying formalisms. However, most of these tools either abstract away functions over non-Boolean domains (hence they cannot provide information about them) or produce very large encodings which hinder the performance. In this paper, we present a generic policy analysis framework that employs SMT as the underlying reasoning mechanism. The use of SMT does not only allow more fine-grained analysis of policies but also improves the performance. We demonstrate that a wide range of security properties proposed in the literature can be easily modeled within the framework. A prototype implementation and its evaluation are also provided.

show abstract

ZaligVinder: A generic test framework for string solvers

Kulczynski

Manea

Nowotka

et al. 2021

J Software Evolu Process

View full text Add to dashboard Cite

The increased interest in string solving in the recent years has made it very hard to identify the right tool to address a particular user's purpose. Firstly, there is a multitude of string solvers, each addressing essentially some subset of the general problem. Generally, the addressed fragments are relevant and well motivated, but the lack of comparisons between the existing tools on an equal set of benchmarks cannot go unnoticed, especially as a common framework to compare solvers seems to be missing. In this paper, we gather a set of relevant benchmarks and introduce our new benchmarking framework to address this purpose.

show abstract

Z3-str: a z3-based string solver for web application analysis

Cited by 162 publications

References 32 publications

Other things besides number: Abstraction, constraint propagation, and string variable types

Other things besides number: Abstraction, constraint propagation, and string variable types

Analysis of XACML Policies with SMT

ZaligVinder: A generic test framework for string solvers

Contact Info

Product

Resources

About