$30 off During Our Annual Pro Sale. View Details »

Input Algebras

Input Algebras

ICSE 2021

Rahul Gopinath

May 25, 2021
Tweet

More Decks by Rahul Gopinath

Other Decks in Research

Transcript

  1. Input Algebras
    Rahul Gopinath
    Hamed Nemati
    Andreas Zeller
    CISPA Helmholtz Center for Information Security
    for Taming Grammar Fuzzers

    View Slide

  2. 3
    {"a": ["key"]} ✓
    Program

    View Slide

  3. 4
    {"a": ["key"]}
    Program
    {"": [1,2,"k"]} ✘

    View Slide

  4. 5
    {"a": ["key"]}
    Program
    {"": [1,2,"k"]}

    ["A", "B", "C"]

    View Slide

  5. 6
    {"a": ["key"]}
    Program
    {"": [1,2,"k"]}
    ["A", "B", "C"]
    [{"": [1,2,3,4]}]

    View Slide

  6. 7
    {"a": ["key"]}
    {"": [1,2,"k"]}
    ["A", "B", "C"]
    [{"": [1,2,3,4]}]
    if json.has_key(""):
    raise Exception()
    Program

    View Slide

  7. 8
    {"type":"PathNode","matrix":
    {"m11":-0.6630394213564543,"m12":0,"m21":0,"m22":0.5236476835782672,"dx":565.5201
    948628471,"dy":371.5686591257294},"children":
    [],"strokeStyle":"#000000","fillStyle":"#e1e1e1","lineWidth":4,"smoothness":0.3,"sloppiness":
    0.5,"startX":50,"startY":0,"closed":true,"segments":
    [{"type":3,"x":100,"y":50,"x1":100,"y1":0,"r":
    [-0.3779207859188318,0.07996635790914297,-0.47163885831832886,-0.0710031278431
    4156]},{"type":3,"x":50,"y":100,"x1":100,"y1":100,"r":
    [0.24857700895518064,0.030472169630229473,0.49844827968627214,0.1326016811653
    9717]},{"type":3,"x":0,"y":50,"x1":0,"y1":100,"r":
    [0.1751830680295825,-0.18606301862746477,-0.4092112798243761,-0.47907172795385
    12]},{"type":3,"x":50,"y":0,"x1":0,"y1":0,"r":
    [0.37117584701627493,0.3612578883767128,0.0462839687243104,-0.156406396068632
    6]}],"shadow":false},{"type":"PathNode","matrix":
    {"m11":-1.475090930376591,"m12":0,"m21":0,"m22":1.2306765694828008,"dx":700.13810
    32855618,"dy":133.20628077515605},"children":
    [],"strokeStyle":"#000000","fillStyle":"#ffffff","lineWidth":2,"smoothness":0.3,"sloppiness":0.5,"
    startX":126.25,"startY":127.50445838342671,"closed":true,"segments":
    [{"type":3,"x":146.01190476190476,"y":147.5936260519611,"x1":146.01190476190476,"y1":
    127.50445838342671,"r":
    [-0.1750196823850274,-0.05804965365678072,-0.3536788672208786,0.05322327278554
    4395]},
    {"type":3,"x":126.25,"y":167.6827937204955,"x1":146.01190476190476,"y1":167.68279372
    04955,"r":
    [-0.32906053867191076,-0.11536165233701468,0.35579121299088,0.3873158805072307
    6]},{"type":3,"x":108,"y":147,"x1":106.48809523809524,"y1":167.6827937204955,"r":
    [0.08825046103447676,0.011088204570114613,0.43411328736692667,-0.133069220930
    3379]},
    {"type":3,"x":126.25,"y":127.50445838342671,"x1":106.48809523809524,"y1":127.5044583
    8342671,"r":
    [0.42778260353952646,0.24726040940731764,0.3631806019693613,0.053255504928529
    26]}],"shadow":false},{"type":"TextNode","matrix":
    {"m11":1,"m12":0,"m21":0,"m22":1,"dx":543,"dy":225},"children":
    [],"fillStyle":"#000000","text":"Y","fontName":"FG Virgil","fontSize":20},
    {"type":"TextNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":559,"dy":144},"children":
    [],"fillStyle":"#000000","text":"x","fontName":"FG Virgil","fontSize":20},
    {"type":"ArrowNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":0,"dy":0},"children":
    [],"arrowSize":10,"path":{"type":"PathNode","matrix":
    Program ✘

    View Slide

  8. {"type":"PathNode","matrix":
    {"m11":-0.6630394213564543,"m12":0,"m21":0,"m22":0.5236476835782672,"dx":565.5201
    948628471,"dy":371.5686591257294},"children":
    [],"strokeStyle":"#000000","fillStyle":"#e1e1e1","lineWidth":4,"smoothness":0.3,"sloppiness":
    0.5,"startX":50,"startY":0,"closed":true,"segments":
    [{"type":3,"x":100,"y":50,"x1":100,"y1":0,"r":
    [-0.3779207859188318,0.07996635790914297,-0.47163885831832886,-0.0710031278431
    4156]},{"type":3,"x":50,"y":100,"x1":100,"y1":100,"r":
    [0.24857700895518064,0.030472169630229473,0.49844827968627214,0.1326016811653
    9717]},{"type":3,"x":0,"y":50,"x1":0,"y1":100,"r":
    [0.1751830680295825,-0.18606301862746477,-0.4092112798243761,-0.47907172795385
    12]},{"type":3,"x":50,"y":0,"x1":0,"y1":0,"r":
    [0.37117584701627493,0.3612578883767128,0.0462839687243104,-0.156406396068632
    6]}],"shadow":false},{"type":"PathNode","matrix":
    {"m11":-1.475090930376591,"m12":0,"m21":0,"m22":1.2306765694828008,"dx":700.13810
    32855618,"dy":133.20628077515605},"children":
    [],"strokeStyle":"#000000","fillStyle":"#ffffff","lineWidth":2,"smoothness":0.3,"sloppiness":0.5,"
    startX":126.25,"startY":127.50445838342671,"closed":true,"segments":
    [{"type":3,"x":146.01190476190476,"y":147.5936260519611,"x1":146.01190476190476,"y1":
    127.50445838342671,"r":
    [-0.1750196823850274,-0.05804965365678072,-0.3536788672208786,0.05322327278554
    4395]},
    {"type":3,"x":126.25,"y":167.6827937204955,"x1":146.01190476190476,"y1":167.68279372
    04955,"r":
    [-0.32906053867191076,-0.11536165233701468,0.35579121299088,0.3873158805072307
    6]},{"type":3,"x":108,"y":147,"x1":106.48809523809524,"y1":167.6827937204955,"r":
    [0.08825046103447676,0.011088204570114613,0.43411328736692667,-0.133069220930
    3379]},
    {"type":3,"x":126.25,"y":127.50445838342671,"x1":106.48809523809524,"y1":127.5044583
    8342671,"r":
    [0.42778260353952646,0.24726040940731764,0.3631806019693613,0.053255504928529
    26]}],"shadow":false},{"type":"TextNode","matrix":
    {"m11":1,"m12":0,"m21":0,"m22":1,"dx":543,"dy":225},"children":
    [],"fillStyle":"#000000","text":"Y","fontName":"FG Virgil","fontSize":20},
    {"type":"TextNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":559,"dy":144},"children":
    [],"fillStyle":"#000000","text":"x","fontName":"FG Virgil","fontSize":20},
    {"type":"ArrowNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":0,"dy":0},"children":
    [],"arrowSize":10,"path":{"type":"PathNode","matrix":
    What is the smallest failure inducing input?
    Hierarchical Delta Debugging

    View Slide

  9. {"type":"PathNode","matrix":
    {"m11":-0.6630394213564543,"m12":0,"m21":0,"m22":0.5236476835782672,"dx":565.5201
    948628471,"dy":371.5686591257294},"children":
    [],"strokeStyle":"#000000","fillStyle":"#e1e1e1","lineWidth":4,"smoothness":0.3,"sloppiness":
    0.5,"startX":50,"startY":0,"closed":true,"segments":
    [{"type":3,"x":100,"y":50,"x1":100,"y1":0,"r":
    [-0.3779207859188318,0.07996635790914297,-0.47163885831832886,-0.0710031278431
    4156]},{"type":3,"x":50,"y":100,"x1":100,"y1":100,"r":
    [0.24857700895518064,0.030472169630229473,0.49844827968627214,0.1326016811653
    9717]},{"type":3,"x":0,"y":50,"x1":0,"y1":100,"r":
    [0.1751830680295825,-0.18606301862746477,-0.4092112798243761,-0.47907172795385
    12]},{"type":3,"x":50,"y":0,"x1":0,"y1":0,"r":
    [0.37117584701627493,0.3612578883767128,0.0462839687243104,-0.156406396068632
    6]}],"shadow":false},{"type":"PathNode","matrix":
    {"m11":-1.475090930376591,"m12":0,"m21":0,"m22":1.2306765694828008,"dx":700.13810
    32855618,"dy":133.20628077515605},"children":
    [],"strokeStyle":"#000000","fillStyle":"#ffffff","lineWidth":2,"smoothness":0.3,"sloppiness":0.5,"
    startX":126.25,"startY":127.50445838342671,"closed":true,"segments":
    [{"type":3,"x":146.01190476190476,"y":147.5936260519611,"x1":146.01190476190476,"y1":
    127.50445838342671,"r":
    [-0.1750196823850274,-0.05804965365678072,-0.3536788672208786,0.05322327278554
    4395]},
    {"type":3,"x":126.25,"y":167.6827937204955,"x1":146.01190476190476,"y1":167.68279372
    04955,"r":
    [-0.32906053867191076,-0.11536165233701468,0.35579121299088,0.3873158805072307
    6]},{"type":3,"x":108,"y":147,"x1":106.48809523809524,"y1":167.6827937204955,"r":
    [0.08825046103447676,0.011088204570114613,0.43411328736692667,-0.133069220930
    3379]},
    {"type":3,"x":126.25,"y":127.50445838342671,"x1":106.48809523809524,"y1":127.5044583
    8342671,"r":
    [0.42778260353952646,0.24726040940731764,0.3631806019693613,0.053255504928529
    26]}],"shadow":false},{"type":"TextNode","matrix":
    {"m11":1,"m12":0,"m21":0,"m22":1,"dx":543,"dy":225},"children":
    [],"fillStyle":"#000000","text":"Y","fontName":"FG Virgil","fontSize":20},
    {"type":"TextNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":559,"dy":144},"children":
    [],"fillStyle":"#000000","text":"x","fontName":"FG Virgil","fontSize":20},
    {"type":"ArrowNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":0,"dy":0},"children":
    [],"arrowSize":10,"path":{"type":"PathNode","matrix":
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= |`,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= |

    ::= [0-9]
    JSON Grammar

    View Slide

  10. {"type":"PathNode","matrix":
    {"m11":-0.6630394213564543,"m12":0,"m21":0,"m22":0.5236476835782672,"dx":565.5201948628471,"dy":371.568659125
    7294},"children":
    [],"strokeStyle":"#000000","fillStyle":"#e1e1e1","lineWidth":4,"smoothness":0.3,"sloppiness":0.5,"startX":50,"startY":0,"closed
    ":true,"segments":[{"type":3,"x":100,"y":50,"x1":100,"y1":0,"r":
    [-0.3779207859188318,0.07996635790914297,-0.47163885831832886,-0.07100312784314156]},
    {"type":3,"x":50,"y":100,"x1":100,"y1":100,"r":
    [0.24857700895518064,0.030472169630229473,0.49844827968627214,0.13260168116539717]},
    {"type":3,"x":0,"y":50,"x1":0,"y1":100,"r":
    [0.1751830680295825,-0.18606301862746477,-0.4092112798243761,-0.4790717279538512]},
    {"type":3,"x":50,"y":0,"x1":0,"y1":0,"r":
    [0.37117584701627493,0.3612578883767128,0.0462839687243104,-0.1564063960686326]}],"shadow":false},
    {"type":"PathNode","matrix":
    {"":-1.475090930376591,"m12":0,"m21":0,"m22":1.2306765694828008,"dx":700.1381032855618,"dy":133.2062807751560
    5},"children":
    [],"strokeStyle":"#000000","fillStyle":"#ffffff","lineWidth":2,"smoothness":0.3,"sloppiness":0.5,"startX":126.25,"startY":127.504
    45838342671,"closed":true,"segments":
    [{"type":3,"x":146.01190476190476,"y":147.5936260519611,"x1":146.01190476190476,"y1":127.50445838342671,"r":
    [-0.1750196823850274,-0.05804965365678072,-0.3536788672208786,0.053223272785544395]},
    {"type":3,"x":126.25,"y":167.6827937204955,"x1":146.01190476190476,"y1":167.6827937204955,"r":
    [-0.32906053867191076,-0.11536165233701468,0.35579121299088,0.38731588050723076]},
    {"type":3,"x":108,"y":147,"x1":106.48809523809524,"y1":167.6827937204955,"r":
    [0.08825046103447676,0.011088204570114613,0.43411328736692667,-0.1330692209303379]},
    {"type":3,"x":126.25,"y":127.50445838342671,"x1":106.48809523809524,"y1":127.50445838342671,"r":
    [0.42778260353952646,0.24726040940731764,0.3631806019693613,0.05325550492852926]}],"shadow":false},
    {"type":"TextNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":543,"dy":225},"children":
    [],"fillStyle":"#000000","text":"Y","fontName":"FG Virgil","fontSize":20},{"type":"TextNode","matrix":
    {"m11":1,"m12":0,"m21":0,"m22":1,"dx":559,"dy":144},"children":[],"fillStyle":"#000000","text":"x","fontName":"FG
    Virgil","fontSize":20},{"type":"ArrowNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":0,"dy":0},"children":
    [],"arrowSize":10,"path":{"type":"PathNode","matrix":{"m11":1,"m12":0,"m21":0,"m22":1,"dx":464,"dy":-3},"children":
    [],"strokeStyle":"#000000","fillStyle":"#ffffff","lineWidth":2,"smoothness":0.3,"
    {"": []}
    Hierarchical Delta Debugging

    View Slide

  11. Why did my program fail?
    DDSET
    Gopinath, Kampmann, Havrikov, Soremekun, and Zeller. Abstracting Failure Inducing Inputs. ISSTA 2020.

    View Slide

  12. 13
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:

    View Slide

  13. 14
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    122489
    {"A":{}, {"23": {"P":[]}}]
    [[], [[[]],[]],{"A":{}, {"23": {"P":[]}}]

    View Slide

  14. 15
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    "XYZR389"
    {"A":{}, {"23": {"P":[]}}}
    [[], [[[]],[]],{"A":{}, {"23": {"P":[]}}]

    View Slide

  15. 16
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    [true, null]
    {"A":{}, {"23": {"P":[]}}}
    [[], [[[]],[]],{"A":{}, {"23": {"P":[]}}]

    View Slide

  16. 17
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    {"__": [[]]}
    {"?P":[{}], {"|": {"":[]}}}
    {"X":[[],[]],{"A":{}, {"2": {"R":[]}}}

    View Slide

  17. 18
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    {"": [[]]}
    {"?P":[{}], {"|": {"P":[]}}}
    {"X":[[],[]],{"A":{}, {"2": {"R":[]}}}

    View Slide

  18. 19
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    {"7897A": []}
    {"klnm,.qer;dfs?P":[]}
    {"123KOUIJ!qR30578950":[]}

    View Slide

  19. 20
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    {"": true}
    {"":[1,2,445,"x"]}
    {"":{"PQ":[true, false, 223,"a"]}}

    View Slide

  20. 21
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": []}
    DDSET:
    Abstraction
    {"": }
    Abstract Input

    View Slide

  21. • Effectively abstracts a minimized input

    • The abstraction identifies where the problem lies

    • Decompose complex program behaviors
    DDSET
    Gopinath, Kampmann, Havrikov, Soremekun, and Zeller. Abstracting Failure Inducing Inputs. ISSTA 2020.
    ISSTA 2020 Distinguished Award
    {"": }
    Abstract Input
    {"": []}
    Minimized Input

    View Slide

  22. {"": }
    Abstract Input
    {"": []}
    Minimized Input
    How do we generate more failure inducing inputs?

    View Slide

  23. {"": }
    Abstract Input
    {"": [343,{},44998]}
    {"": {"xxy":44998, {"b":[1,2,3]}}}
    {"": {"ket":[], {"x":[],"y",[[],[1,2,3,455,6]]}}}
    {"":[{3243435656:"xy,zzzpqiu"},[{"c":[112]},{"d":[[]]},{}]]}




    Failure Inducing Inputs

    View Slide

  24. {"": }
    Abstract Input
    Need Contextualization!
    Failure Inducing Inputs
    [{"": [1,2,3,4]}]
    {"pqr": {"": [1,2,3,4]}, "abc":[]}
    [{"xr": {"": [4]}, "abc":[[],[],[1243], true, false]}



    View Slide

  25. {"": }
    Abstract Input
    Language of Evocative Inputs

    View Slide

  26. Language of Evocative Inputs
    {"": }
    Abstract Input
    Evocative Subtree

    View Slide

  27. Language of Evocative Inputs
    {"": }
    Abstract Input
    Evocative Fragment

    View Slide

  28. Language of Evocative Inputs
    {"": }
    Abstract Input
    Evocative Subtree is "":
    Root node of the tree fragment
    String representation of the tree fragment
    Evocative Fragment

    View Slide

  29. Language of Evocative Inputs
    Evocative Subtree
    ::= `:`
    ::= `""`
    Evocative Pattern Grammar
    generate() = "":

    View Slide

  30. Identify Reachable Nodes
    Evocative Subtree
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    ::= `:`
    ::= `""`

    View Slide

  31. Identify Reachable Nodes
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    Basic idea:

    (1) Collect all rules that can reach the root node of abstract tree (here )
    Evocative Subtree
    ::= `:`
    ::= `""`

    View Slide

  32. Identify Insertion Positions
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`

    ::= `:`

    ::= `[``]`

    ::=
    | `,`
    Basic idea:

    (1) Insert one Nonterminal at a time.
    Evocative Subtree
    ::= `:`
    ::= `""`

    View Slide

  33. Identify Insertion Positions
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`
    | `,`

    ::= `:`

    ::= `[``]`

    ::=
    | `,`
    Basic idea:

    (1) Insert one Nonterminal at a time.
    Evocative Subtree
    ::= `:`
    ::= `""`

    View Slide

  34. Identify Insertion Positions
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`
    | `,`

    ::= `:`

    ::= `[``]`

    ::=
    | `,`
    Basic idea:

    (1) Insert one Nonterminal at a time.
    Evocative Subtree
    ::= `:`
    ::= `""`

    View Slide

  35. Identify Insertion Positions
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`
    | `,`

    ::= `:`

    ::= `[``]`

    ::=
    | `,`
    | `,`
    | `,`
    Basic idea:

    (1) Insert one Nonterminal at a time.
    Evocative Subtree
    ::= `:`
    ::= `""`

    View Slide

  36. Reachable Grammar
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`

    ::= `:`

    ::= `[``]`

    ::=
    | `,`
    | `,`
    Basic idea:

    (1) Insert one Nonterminal at a time.
    Evocative Subtree
    ::= `:`
    ::= `""`

    View Slide

  37. Connect Reachable Grammar and Pattern Grammar
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`

    ::= `:`
    | `:` 

    ::= `[``]`

    ::=
    | `,`
    | `,`
    ::= `""`
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`

    ::= `:`

    ::= `[``]`

    ::=
    | `,`
    | `,`
    ::= `:`
    ::= `""`
    is "":

    View Slide

  38. Evocative Grammar
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`

    ::= `:`
    | `:`

    ::= `[``]`

    ::=
    | `,`
    | `,`
    ::= `""`
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    {"": 100}
    {"": [343,{},44998]}
    [{"": {"xxy":44998, {"b":[1,2,3]}}},[],[]]
    {"_": {"ket":[], {"":[],"y",[[],[1,2,3,455,6]]}}}
    {".":[{3243435656:"xy,zzzpqiu"},[{"":[112]},{"d":[[]]},{}]]}
    [{"": [1,2,3,4]}]
    {"pqr": {"": [1,2,3,4]}, "abc":[]}
    [[1132],{"xx":[{6:"dafjli;y,zzzdfaiu"},[{"__":[1{}{}]},{"":[[444456]]},{}]]}
    generate()








    View Slide

  39. Evocative Grammar
    ::= 

    ::= 

    |
    | 

    | 

    ::= `{``}`

    ::=
    | `,`
    | `,`

    ::= `:`
    | `:`

    ::= `[``]`

    ::=
    | `,`
    | `,`
    ::= `""`
    ::= 

    ::= 

    |
    | 

    | 

    | `true` | `false` | `null`

    ::= `{``}` | `{}`

    ::= | `,`

    ::= `:`

    ::= `[``]` | `[]`

    ::= | `,`

    ::= `"` `"` | `""`

    ::= 

    ::= [A-Za-z0-9]

    ::= 

    ::= | 

    ::= [0-9]
    generate()
    Properties:

    - Generator: All generated inputs guaranteed to have

    at least one fragment inducing the given behavior

    - Validator: Will recognize all inputs with at least

    one fragment that can induce the given behavior

    - Produced grammar is context-free: Consumable

    by any grammar fuzzer.

    View Slide

  40. What if there are more failure inducing patterns?

    where is "":
    if json.has_key_value(null):
    raise Exception()
    if json.has_key(""):
    raise Exception()

    where is : null

    View Slide

  41. What if there are more failure inducing patterns?
    if json.has_key("") and json.has_key_value(null):
    raise Exception()

    where is "":
    is : null

    View Slide

  42. What if there are more failure inducing patterns?
    if json.has_key("") and not json.has_key_value(null):
    raise Exception()

    where is "":
    is : null

    View Slide

  43. What if there are more failure inducing patterns?
    if json.has_key(""):
    raise Exception()
    if json.has_key_value(null):
    raise Exception()

    where is "":
    is : null

    View Slide

  44. { }
    Input Algebras: Patterns to Grammar

    where is "":
    is : null
    :=
    := ...
    :=
    := ...
    & =
    := and

    ...
    :=
    ...
    { }
    :=
    | &
    :=
    | =
    := and |||
    |||
    :=
    |

    View Slide

  45. :=
    :=
    |
    := '[' ']'
    := '{' '}'
    :=
    | ','
    | ','
    :=
    | ','
    | ','
    := ':'
    | ':'
    :=
    := 'false' | 'true'
    | |
    |
    := '[]' | '[' ']'
    := '{}' | '{' '}'
    :=
    | ','
    :=
    | ','
    := ':'
    := 'false' | 'true'
    | |
    | |

    where is "":
    is : null
    {"": 100}
    {"": [343,{},44998]}
    [{"": {"xxy":44998, {"b":[1,2,3]}}},[],[]]
    {"_": {"ket":[], {"":[],"y",[[],[1,2,3,455,6]]}}}
    {".":[{3243435656:"xy,zzzpqiu"},[{"":[112]},{"d":[[]]},{}]]}
    [{"": [1,2,3,4]}]
    {"pqr": {"": [1,2,3,4]}, "abc":[]}
    [[1132],{"xx":[{6:"dafjli;y,zzzdfaiu"},[{"__":[1{}{}]},{"":[[444456]]},{}]]}
    generate()








    View Slide


  46. where
    is "":
    is :null

    where
    is (())
    is / 0

    where
    is "0"
    is "0x"

    where
    is ";;"
    is "()"
    is "()"

    View Slide

  47. Issue 386 from Rhino
    var A = class extends (class {}){};
    Issue 2937 from Closure
    const [y,y] = [];
    var {baz:{} = baz => {}} = baz => {};
    Issue 385 from Rhino
    {while ((l_0)){ if ((l_0)) {break;;var l_0; continue }0}}
    Issue 2842 from Closure
    = class extends (class {}){}
    var {<$Id1>:{} = <$Id1> => {}} ;
    const [<$Id1>,<$Id1>] = []
    {while ((<$Id1>)){ if ((<$Id1>)) {break;;var <$Id1>; continue }0}}

    View Slide

  48. where
    is = class extends (class {}){}
    is {while ((<$Id1>)){ if ((<$Id1>)) {break;;var <$Id1>; continue }0}}
    is var {<$Id2>:{} = <$Id2> => {}} ;
    is const [<$Id3>,<$Id3>] = []
    Input Algebras




    View Slide

  49. Input Algebras: Beyond fuzzing
    • Validating inputs

    • Supercharged recognizers (alternative to regex)

    • Semantic code search

    • Generating data structures

    • Easily specified access control lists

    View Slide

  50. https://rahul.gopinath.org
    DOI:10.5281/zenodo.4456296

    View Slide