Precise Interface Identification to Improve Testing and Analysis of Web Applications William G.J. Halfond, Saswat Anand, and Alessandro Orso Georgia Institute of Technology

Example Web Application 2 Web Server End Users Initial Visit Web Application getQuote.jsp buyPolicy.jsp Quote Information

Interface Identification 3 public void write(File outfile, String buffer, int length) Domain information Grouping of parameters 1.Names of parameters 2.Grouping of parameters 3.Domain information Parameter names

Example Web Application Interface Domain Constraints action = “checkeligibility”  integer(age)  age < 16 action = “checkeligibility”  integer(age)  age  16 4 public void service (HttpRequest req) 1. String aValue = req.getIP( “action” ) 2. if (aValue.equals( “checkeligibility” )) 3. int userAge = getNumIP( “age” ) 4. if (userAge < 16) 5. displayErrorMsg(“Too young.” ) 6. else 7. displayQuotePage( ) 8. if (aValue.equals( “doquote” )) 9. String nValue = req.getIP( “name” ) 10. String carType = req.getIP( “type” ) 11. int carYear = getNumIP( “year” ) 12. calculateQuote(carType, carYear) … public int getNumIP(String name) 1. String value = getIP(name) 2. int param = Integer.parse(value) 3. return param 1.Names of parameters 2.Grouping of parameters 3.Domain information Parameter Names action, age, name, type, year Groupings of Parameters action action, age action, name, type, year

Dynamic Spider Web spider crawls pages of application Limitation: No guarantee of completeness Static DFW 1 : Identify parameter names via static analysis Limitation: Only identifes parameter names WAM DF 2 : Uses iterative data-flow analysis Limitation: Assumes all paths feasible Previous Approaches: Interface Identification 5 1.Deng, Frankl, Wang, SEN Halfond and Orso, FSE (action, age, name, type, year) 1. String aValue = req.getIP( “action” ) 2. if (aValue.equals( “checkeligibility” )) … 8. if (aValue.equals( “doquote” )) 4. if (userAge < 16) 5. displayErrorMsg(“Too young.” ) 6. else 7. displayQuotePage( )

Our Approach Statically identify interfaces by using symbolic execution to model input parameters and domain constraining operations. 1.Program transformation 2.Symbolic execution 3.Interface identification 6

1 – Program Transformation 1. Introduce symbolic values 2. Replace domain-constraining operations value  getIP(name) s  new SymbolicValue() s.assignName( name ) SymbolicState.add(s, value ) return s 7 1. Accessing an input parameter 2. Conversion to numeric type 3. String comparison 4. Arithmetic constraints

2 – Symbolic Execution Symbolically execute the transformed web application -- track path conditions and symbolic state. 8 Symbolic Execution Transformed Web Application getQuote.jsp buyPolicy.jsp Path Conditions c 1  c 2  c 3 c 3  c 4  c 5 Symbolic States s action  aValue s year  carYear

2 – Access Input Parameters 1. String aValue = req.getIP( “action” ) (PC, SS) (PC, SS[s action  aValue ]) 9 PC = Path Condition SS = Symbolic State

2 – String Comparison (PC  s action  “checkeligibility”, SS[s action  aValue ]) (PC, SS[s action  aValue ]) 2. if (aValue.equals( “checkeligibility” )) 8. if (aValue.equals( “doQuote” )) 1. String aValue = req.getIP( “action” ) 10 (PC  s action  “checkeligibility”, SS[s action  aValue ]) TRUE FALSE

3 – Interface Identification PC1  s action  “checkeligibility”  integer(s age )  s age  16 PC2  s action  “checkeligibility”  integer(s age )  s age  16 SS  [s action  aValue, s age  userAge ] 1. String aValue = req.getIP( “action” ) 2. if (aValue.equals( “checkeligibility” )) 3. int userAge = getNumIP( “age” ) 4. if (userAge < 16) 5. displayErrorMsg(“Too young.” ) 6. else 7. displayQuotePage( ) … 11

Empirical Evaluation Research Questions (RQ): 1.Efficiency -- Is the new approach efficient in terms of its analysis time requirements? 2.Precision -- Is the new approach more precise than previous approaches? 3.Usefulness -- Does the new approach improve the performance of quality assurance techniques? 12

Implementation: WAM SE Written in Java for Java Enterprise Edition (JEE) based web applications Implementation Modules 1. TRANSFORM Customized JEE libraries Stinger for analysis and automated transformation 2. SE ENGINE Symbolic execution engine built on JavaPathFinder Constraint solver is YICES 3. PC ANALYSIS 13

Implementation: Other Approaches 14 Dynamic Spider Web spider crawls pages of application OWASP Web Scarab Project Static DFW 1 : Identify parameter names via static analysis Reimplementation of the author-provided code WAM DF 2 : Uses iterative data-flow analysis Implementation from previous work 1.Deng, Frankl, Wang, SEN Halfond and Orso, FSE 2007.

Subject Applications SubjectLOCClassesServlets Bookstore19, Classifieds10,70218 Employee Directory5, Events7, Subjects available online from GotoCode.com 15

RQ1: Efficiency 1.High amount of infeasible paths in subjects 2.Low number of constraints per parameter 3.Web applications highly modular WAM SE WAM DF DFWSpider 16

RQ2: Precision On average, 80% of WAM DF interfaces were spurious WAM SE WAM DF 17

RQ3: Usefulness Measure improvement of three quality assurance techniques: a)Invocation Verification b)Penetration Testing c)Test Input Generation 18

RQ3a – Invocation Verification 19 ApproachFalse PositivesFalse Negatives WAM DF 0%50% Spider39%0% WAM SE 0% Verification of invocations for subject Bookstore Web Application getQuote.jspbuyPolicy.jsp X

RQ3b – Penetration Testing WAM SE WAM DF DFWSpider 20 Number of vulnerabilities: 2X – 6X higher for WAM SE

RQ3c – Test Input Generation % Stmt. Coverage % Branch Coverage # Command Forms Branch coverage increase: 3%-67% Statement coverage increase: 3%-25% Command form increase: 651%-1,577% WAM SE WAM DF DFWSpider 21

RQ3c – Test Suite Size RQ3c results: 1.Higher coverage for measured metrics 2.Smaller average test suite WAM SE WAM DF DFWSpider 22 Test suite decrease in size: 4X – 10X

Summary of Results Developed interface identification technique for web applications based on symbolic execution. Empirical evaluation: Similar analysis time to other techniques More precise than current techniques Improves quality assurance techniques 23

2 – Conversion to Numeric Type (PC, SS[s action  aValue ]) 3. int userAge = getNumIP( “age” ) … public int getNumIP(String name) 1. String value = getIP(name) 2. int param = Integer.parse(value) 3. return param (PC  integer(s age ), SS[s age  userAge, s action  aValue ]) 24

2 – Arithmetic Constraints (PC  integer(s age ), SS[s age  userAge ]) (PC  integer(s age )  s age  16, SS[s age  userAge ]) 4. if (userAge < 16) 3. int userAge = getNumIP( “age” ) 25 (PC  integer(s age )  s age  16, SS[s age  userAge ]) TRUE FALSE