- We use concolic analysis and perform a symbolic execution driven by concrete runs.
Instrumented WebKit Browser
Page Analysis Tools
As well as our main analysis, we have developed some tools to help manual analysis of web forms and their validation code. Manual interactions with a form are recorded as both concrete and symbolic traces, which are linked to the original page source code.
- Event handlers
- Each field has its own validation function and may depend on other fields.
- Triggering them in-order is a useful guess, but may miss some information.
- Checking dependence between the handlers is difficult.
- Testing all orderings is not feasible.
- Forms may be updated dynamically.
- Select boxes and radio buttons have implied constraints found in the DOM.
- Some constraint types are not supported by the solver or our translation.
- Long loops and repeated code.
- Continue testing on real-world sites to identify common patterns which we do not handle well.
- Track event handler dependencies and use partial order methods to choose appropriate orderings to test.
- Use heuristics or static analysis to target the search and speed up exploration of the most interesting parts of the trees.
- Work on converting the trees to useful descriptions of the constraints.
- Infer higher-level constraints such as set containment which are not shown directly in our traces.
- New features for our translator and the solver, for example more complex regular expression tests or string inequalities.