SymJS']JS: Automatic Symbolic Testing of Java']JavaScript Web Applications

被引：51
|
作者：
Li, Guodong [1 ]
Andreasen, Esben [2 ]
Ghosh, Indradeep [1 ]
机构：
[1] Fujitsu Labs Amer, Sunnyvale, CA USA
[2] Aarhus Univ, Dept Comp Sci, Aarhus, Denmark
来源：
22ND ACM SIGSOFT INTERNATIONAL SYMPOSIUM ON THE FOUNDATIONS OF SOFTWARE ENGINEERING (FSE 2014) | 2014年
关键词：
!text type='Java']Java[!/text]Script; Web; Symbolic Execution; Automatic Software Testing; Event Sequence; Taint Analysis; EXECUTION;
D O I：
10.1145/2635868.2635913
中图分类号：
TP31 [计算机软件];
学科分类号：
081202 ; 0835 ;
摘要：
We present SymJS, a comprehensive framework for automatic testing of client-side JavaScript Web applications. The tool contains a symbolic execution engine for JavaScript, and an automatic event explorer for Web pages. Without any user intervention, SymJS can automatically discover and explore Web events, symbolically execute the associated JavaScript code, refine the execution based on dynamic feedbacks, and produce test cases with high coverage. The symbolic engine contains a symbolic virtual machine, a string-numeric solver, and a symbolic executable DOM model. SymJS's innovations include a novel symbolic virtual machine for JavaScript Web, symbolic+dynamic feedback directed event space exploration, and dynamic taint analysis for enhancing event sequence construction. We illustrate the effectiveness of SymJS on standard JavaScript benchmarks and various real-life Web applications. On average SymJS achieves over 90% line coverage for the benchmark programs, significantly outperforming existing methods.
引用
收藏
页码：449 / 459
页数：11
相关论文
共 50 条
  • [31] JS']JSXGraph - Dynamic Mathematics with Java']JavaScript
    Gerhaeuser, Michael
    Valentin, Bianca
    Wassermann, Alfred
    INTERNATIONAL JOURNAL FOR TECHNOLOGY IN MATHEMATICS EDUCATION, 2010, 17 (04): : 211 - 215
  • [32] JS']JSExplain: A Double Debugger for Java']JavaScript
    Chargueraud, Arthur
    Schmitt, Alan
    Wood, Thomas
    COMPANION PROCEEDINGS OF THE WORLD WIDE WEB CONFERENCE 2018 (WWW 2018), 2018, : 691 - 699
  • [33] BUGSJS']JS: A Benchmark of Java']JavaScript Bugs
    Gyimesi, Peter
    Vancsics, Bela
    Stocco, Andrea
    Mazinanian, Davood
    Beszedes, Arpad
    Ferenc, Rudolf
    Mesbah, Ali
    2019 IEEE 12TH CONFERENCE ON SOFTWARE TESTING, VALIDATION AND VERIFICATION (ICST 2019), 2019, : 90 - 101
  • [34] JS']JSOD: Java']JavaScript obfuscation detector
    AL-Taharwa, Ismail Adel
    Lee, Hahn-Ming
    Jeng, Albert B.
    Wu, Kuo-Ping
    Ho, Cheng-Seen
    Chen, Shyi-Ming
    SECURITY AND COMMUNICATION NETWORKS, 2015, 8 (06) : 1092 - 1107
  • [35] astrojs']js: Java']JavaScript Libraries for Astronomy
    Kapadia, Amit
    Smith, Arfon
    ASTRONOMICAL DATA ANALYSIS SOFTWARE AND SYSTEMS XXII, 2013, 475 : 299 - 302
  • [36] Dynamic Symbolic Execution for the Analysis of Web Server Applications in Java']Java
    Balasubramanian, Daniel
    Zhang, Zhenkai
    McDermet, Dan
    Karsai, Gabor
    SAC '19: PROCEEDINGS OF THE 34TH ACM/SIGAPP SYMPOSIUM ON APPLIED COMPUTING, 2019, : 2178 - 2185
  • [37] JS']JS-SAN: defense mechanism for HTML']HTML5-based web applications against java']javascript code injection vulnerabilities
    Gupta, Shashank
    Gupta, B. B.
    SECURITY AND COMMUNICATION NETWORKS, 2016, 9 (11) : 1477 - 1495
  • [38] JS']JSConTest: Contract-Driven Testing and Path Effect Inference for Java']JavaScript
    Heidegger, Phillip
    Thiemann, Peter
    JOURNAL OF OBJECT TECHNOLOGY, 2012, 11 (01):
  • [39] WebAssembly - Hope for Fast Acceleration of Web Applications Using Java']JavaScript
    Fras, Krystian
    Nowak, Ziemowit
    INFORMATION SYSTEMS ARCHITECTURE AND TECHNOLOGY, ISAT 2019, PT I, 2020, 1050 : 275 - 284
  • [40] CSRF protection in Java']JavaScript frameworks and the security of Java']JavaScript applications
    Peguero, Ksenia
    Cheng, Xiuzhen
    HIGH-CONFIDENCE COMPUTING, 2021, 1 (02):
12345