Web frameworks play an important role in modern web applications, providing a wide range of configurations to streamline the development process. However, the intricate semantics, facilitated by framework configurations, present substantial challenges when conducting static analyses on web applications. To mitigate this issue, existing approaches resort to manually modeling framework semantics for static analysis tools. Unfortunately, these manual works are both time-consuming and error-prone, especially considering the vast array of web frameworks and their frequent updates. In this paper, we present the first automated method for inferring web framework semantics. Our innovative approach can automatically deduce framework specifications by mutating configurations. We have developed a prototype called AutoWeb and performed extensive experiments on three popular Java web frameworks. The empirical results show that AutoWeb is comparable to these manual approaches in terms of precision, with a false negative rate of 8.2% and no false positives.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

AutoWeb: Automatically Inferring Web Framework Semantics via Configuration Mutation

  • Haining Meng,
  • Haofeng Li,
  • Jie Lu,
  • Chenghang Shi,
  • Liqing Cao,
  • Lian Li,
  • Lin Gao

摘要

Web frameworks play an important role in modern web applications, providing a wide range of configurations to streamline the development process. However, the intricate semantics, facilitated by framework configurations, present substantial challenges when conducting static analyses on web applications. To mitigate this issue, existing approaches resort to manually modeling framework semantics for static analysis tools. Unfortunately, these manual works are both time-consuming and error-prone, especially considering the vast array of web frameworks and their frequent updates. In this paper, we present the first automated method for inferring web framework semantics. Our innovative approach can automatically deduce framework specifications by mutating configurations. We have developed a prototype called AutoWeb and performed extensive experiments on three popular Java web frameworks. The empirical results show that AutoWeb is comparable to these manual approaches in terms of precision, with a false negative rate of 8.2% and no false positives.