A method and apparatus is disclosed herein for automated test input generation for web applications. In one embodiment, the method comprises performing a source-to-source transformation of the program; performing interpretation on the program based on a set of test input values; symbolically executing the program; recording a symbolic constraint for each of one or more conditional expressions encountered during execution of the program, including analyzing a string operation in the program to identify one or more possible execution paths, and generating symbolic inputs representing values of variables in each of the conditional expressions as a numeric expression and a string constraint including generating constraints on string values by modeling string operations using finite state transducers (FSTs) and supplying values from the program's execution in place of intractable sub-expressions; and generating new inputs to drive the program during a subsequent iteration based on results of solving the recorded string constraints.

Automated test input generation for web applications

Web applications routinely handle sensitive data, and many people rely on them to support various daily activities, so errors can have severe and broad-reaching consequences. Unlike most desktop applications, many web applications are written in scripting languages, such as PHP. The dynamic features commonly supported by these languages significantly inhibit static analysis and existing static analysis of these languages can fail to produce meaningful results on realworld web applications.Automated test input generation using the concolic testing framework has proven useful for finding bugs and improving test coverage on C and Java programs, which generally emphasize numeric values and pointer-based data structures. However, scripting languages, such as PHP, promote a style of programming for developing web applications that emphasizes string values, objects, and arrays.In this paper, we propose an automated input test generation algorithm that uses runtime values to analyze dynamic code, models the semantics of string operations, and handles operations whose argument and return values may not share a common type. As in the standard concolic testing framework, our algorithm gathers constraints during symbolic execution. Our algorithm resolves constraints over multiple types by considering each variable instance individually, so that it only needs to invert each operation. By recording constraints selectively, our implementation successfully finds bugs in real-world web applications which state-of-the-art static analysis tools fail to analyze.

/pdf/dynamic-test-input-generation-for-web-applications-3hzgwazdtp.pdf

Dynamic test input generation for web applications

This paper presents a new result in the equational theory of regular languages, which emerged from lively discussions between the authors about Stone and Priestley duality. Let us call lattice of languagesa class of regular languages closed under finite intersection and finite union. The main results of this paper (Theorems 5.2 and 6.1) can be summarized in a nutshell as follows:

A set of regular languages is a lattice of languages if and only if it can be defined by a set of profinite equations.

The product on profinite words is the dual of the residuation operations on regular languages.

In their more general form, our equations are of the form ui¾?v, where uand vare profinite words. The first result not only subsumes Eilenberg-Reiterman's theory of varieties and their subsequent extensions, but it shows for instance that any class of regular languages defined by a fragment of logic closed under conjunctions and disjunctions (first order, monadic second order, temporal, etc.) admits an equational description. In particular, the celebrated McNaughton-Schutzenberger characterisation of first order definable languages by the aperiodicity condition xi¾?= xi¾?+ 1, far from being an isolated statement, now appears as an elegant instance of a very general result.

/pdf/duality-and-equational-theory-of-regular-languages-nwhsgkf74n.pdf

Duality and Equational Theory of Regular Languages

We consider fragments of first-order logic over finite words. In particular, we deal with first-order logic with a restricted number of variables and with the lower levels of the alternation hierarchy. We use the algebraic approach to show decidability of expressibility within these fragments. As a byproduct, we survey several characterizations of the respective fragments. We give complete proofs for all characterizations and we provide all necessary background. Some of the proofs seem to be new and simpler than those which can be found elsewhere. We also give a proof of Simon's theorem on factorization forests restricted to aperiodic monoids because this is simpler and sufficient for our purpose.

/pdf/a-survey-on-small-fragments-of-first-order-logic-over-finite-20ykpq5fal.pdf

A survey on small fragments of first-order logic over finite words

Reasoning about string variables, in particular program inputs, is an important aspect of many program analyses and testing frameworks Program inputs invariably arrive as strings, and are often manipulated using high-level string operations such as equality checks, regular expression matching, and string concatenation It is difficult to reason about these operations because they are not well-integrated into current constraint solversWe present a decision procedure that solves systems of equations over regular language variables Given such a system of constraints, our algorithm finds satisfying assignments for the variables in the system We define this problem formally and render a mechanized correctness proof of the core of the algorithm We evaluate its scalability and practical utility by applying it to the problem of automatically finding inputs that cause SQL injection vulnerabilities

http://crest.cs.ucl.ac.uk/cow/1/slides/string_crest.pdf

A decision procedure for subset constraints over regular languages

We construct a finite language L such that the largest language commuting with L is not recursively enumerable. This gives a negative answer to the question raised by Conway in 1971 and also strongly disproves Conway's conjecture on context-freeness of maximal solutions of systems of semi-linear inequalities.

The Power of Commuting with Finite Sets of Words

In the talk we give an overview of recent developments in the area of language equations, with an emphasis on methods for dealing with non-classical types of equations whose theory has not been successfully developed already in the previous decades, and on results forming the current borderline of our knowledge. This abstract is in particular meant to provide the interested listener with references to the material discussed in the talk.

https://www.math.muni.cz/~kunc/math/slides.pdf

What do we know about language equations

The notion of pseudovarieties of homomorphisms onto finite
monoids was recently introduced by Straubing as an algebraic
characterization for certain classes of regular languages In
this paper we provide a mechanism of equational description of
these pseudovarieties based on an appropriate generalization of
the notion of implicit operations We show that the resulting
metric monoids of implicit operations coincide with the
standard ones, the only difference being the actual
interpretation of pseudoidentities As an example, an
equational characterization of the pseudovariety corresponding
to the class of regular languages in AC0 is given

/pdf/equational-description-of-pseudovarieties-of-homomorphisms-3lc7uhfnvd.pdf

Equational description of pseudovarieties of homomorphisms

By means of constructing suitable well quasi-orders of free monoids we prove that all maximal solutions of certain systems of language inequalities are regular. This way we deal with a wide class of systems of inequalities where all constants are languages recognized by finite simple semigroups. In a similar manner we also demonstrate that the largest solution of the inequality XK ⊆ LX is regular provided the language L is regular.

Regular solutions of language inequalities and well quasi-orders

A framework for the study of periodic behaviour of two-way deterministic finite automata (2DFA) is developed. Computations of 2DFAs are represented by a two-way analogue of transformation semigroups, every element of which describes the behaviour of a 2DFA on a certain string x. A subsemigroup generated by this element represents the behaviour on strings in x+. The main contribution of this paper is a description of all such monogenic subsemigroups up to isomorphism. This characterization is then used to show that transforming an n-state 2DFA over a one-letter alphabet to an equivalent sweeping 2DFA requires exactly n+1 states, and transforming it to a one-way automaton requires exactly max0≤l≤n G(n - l) + l + 1 states, where G(k) is the maximum order of a permutation of k elements.

Michal Kunc

Papers

The Power of Commuting with Finite Sets of Words

What do we know about language equations

Equational description of pseudovarieties of homomorphisms

Regular solutions of language inequalities and well quasi-orders

Describing periodicity in two-way deterministic finite automata using transformation semigroups