Automated Web Test Input Generation via Symbolic Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for automated test input generation for web applications, particularly those written in scripting languages like PHP, are inadequate due to their reliance on manual effort, limited effectiveness in handling dynamic features, and inability to ensure comprehensive code coverage, especially for string and array-centric operations, which are prevalent in web applications.
Innovation Solution
The method involves source-to-source transformation, symbolic execution, and the use of finite state transducers (FSTs) to model string operations and generate symbolic inputs, allowing for automated test input generation that achieves branch or path coverage by solving recorded string constraints, while also checking for security vulnerabilities like SQL injection attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual testing is used, then test quality can be ensured, but human effort and cost increase significantly
Solution Approach 1:
The testing system performs self-service by automatically generating test inputs and executing tests without requiring manual intervention. The system uses symbolic execution and constraint solving to autonomously create test cases that cover desired code paths, eliminating the need for manual test case creation while maintaining comprehensive coverage.
Solution Approach 2:
The patent replaces manual mechanical testing processes with automated computational systems. Instead of human testers manually creating and executing test cases, the system uses symbolic execution engines, constraint solvers, and automated input generation algorithms to perform testing operations, thereby improving efficiency while maintaining quality.
2Extent of automation
If random input generation is used, then automation is achieved, but test inputs become redundant and miss certain program behaviors
Solution Approach 1:
The system implements feedback mechanisms by analyzing program execution traces and using this information to guide subsequent test input generation. The constraint solving component uses feedback from executed paths to generate new inputs that target unexplored code regions, ensuring comprehensive coverage rather than redundant testing.
Solution Approach 2:
The patent performs preliminary symbolic execution and constraint collection before generating actual test inputs. By pre-analyzing the program structure and gathering constraints from symbolic execution, the system prepares comprehensive test strategies in advance that ensure thorough code coverage when actual testing occurs.
3Device complexity
If concolic testing handles only numeric constraints, then existing approaches are simplified, but string and array operations in scripting languages cannot be tested
Solution Approach 1:
The patent achieves universality by extending the constraint solving framework to handle multiple data types including strings, arrays, and numeric values. The same symbolic execution and constraint solving infrastructure processes all these types uniformly, enabling comprehensive testing of scripting languages that heavily utilize string and array operations without requiring separate specialized systems.
Solution Approach 2:
The system adapts the constraint handling mechanism by changing how constraints are represented and solved for different data types. For strings and arrays, the constraint solver uses specialized techniques that generalize the numeric constraint handling, allowing the same framework to accommodate diverse data types and operations found in web application scripting languages.
4Ease of manufacture
If traditional testing focuses on static pages and control flow, then page coverage can be measured, but dynamic string operations and code coverage cannot be ensured
Solution Approach 1:
The patent replaces traditional mechanical testing of static pages with symbolic execution and dynamic constraint solving. Instead of manually tracing control flow or using simple page coverage metrics, the system uses computational techniques to precisely track execution paths, string transformations, and code coverage at a granular level, achieving high-precision measurement of actual code execution.
Solution Approach 2:
The system introduces symbolic execution as an intermediary layer between the test generator and the actual program execution. This intermediary performs abstract interpretation and constraint collection that bridges the gap between high-level testing goals and low-level code coverage requirements, enabling precise measurement of code execution for dynamic operations.
Data Source
AI summary
A method and apparatus is disclosed herein for automated test input generation for web applications. In one embodiment, the method comprises performing a source-to-source transformation of the program; performing interpretation on the program based on a set of test input values; symbolically executing the program; recording a symbolic constraint for each of one or more conditional expressions encountered during execution of the program, including analyzing a string operation in the program to identify one or more possible execution paths, and generating symbolic inputs representing values of variables in each of the conditional expressions as a numeric expression and a string constraint including generating constraints on string values by modeling string operations using finite state transducers (FSTs) and supplying values from the program's execution in place of intractable sub-expressions; and generating new inputs to drive the program during a subsequent iteration based on results of solving the recorded string constraints.