Finding Bugs in Web Applications Using Dynamic Test Generation and Explicit-State Model Checking
Finding Bugs in Web Applications Using Dynamic Test Generation and Explicit-State Model Checking
复制标题
DOI：
10.1109/tse.2010.31
复制
发表时间：
2010-07
影响因子：
7.4
通讯作者：
Shay Artzi;Adam Kiezun;Julian T Dolby;F. Tip;Danny Dig;A. Paradkar;Michael D. Ernst
中科院分区：
文献类型：
--
作者：
Shay Artzi;Adam Kiezun;Julian T Dolby;F. Tip;Danny Dig;A. Paradkar;Michael D. Ernst
Web脚本崩溃和动态生成的网页格式错误是Web应用程序中常见的错误，严重影响了Web应用程序的可用性。当前的网页验证工具不能处理在当今互联网上无处不在的动态生成的页面。我们提出了一个动态测试生成技术的领域的动态Web应用程序。该技术利用结合具体和符号执行和显式状态模型检查。该技术自动生成测试，运行测试，捕获输入的逻辑约束，并最大限度地减少失败测试的输入条件，使生成的错误报告很小，并有助于查找和修复潜在的错误。我们的工具Apollo实现了PHP编程语言的技术。Apollo为Web应用程序生成测试输入，监视应用程序是否崩溃，并验证输出是否符合HTML规范。本文介绍了Apollo的算法和实现，以及在六个PHP Web应用程序中发现673个错误的实验评估。
Web script crashes and malformed dynamically generated webpages are common errors, and they seriously impact the usability of Web applications. Current tools for webpage validation cannot handle the dynamically generated pages that are ubiquitous on today's Internet. We present a dynamic test generation technique for the domain of dynamic Web applications. The technique utilizes both combined concrete and symbolic execution and explicit-state model checking. The technique generates tests automatically, runs the tests capturing logical constraints on inputs, and minimizes the conditions on the inputs to failing tests so that the resulting bug reports are small and useful in finding and fixing the underlying faults. Our tool Apollo implements the technique for the PHP programming language. Apollo generates test inputs for a Web application, monitors the application for crashes, and validates that the output conforms to the HTML specification. This paper presents Apollo's algorithms and implementation, and an experimental evaluation that revealed 673 faults in six PHP Web applications.