More Like this

1. Ma11y: A Mutation Framework for Web Accessibility Testing

   https://doi.org/10.1145/3650212.3652113  

   Tafreshipour, Mahan; Deshpande, Anmol; Mehralian, Forough; Ahmed, Iftekhar; Malek, Sam (September 2024, ACM)

   Despite the availability of numerous automatic accessibility testing solutions, web accessibility issues persist on many websites. Moreover, there is a lack of systematic evaluations of the efficacy of current accessibility testing tools. To address this gap, we present the first mutation analysis framework, called Ma11y, designed to assess web accessibility testing tools. Ma11y includes 25 mutation operators that intentionally violate various accessibility principles and an automated oracle to determine whether a mutant is detected by a testing tool. Evaluation on real-world websites demonstrates the practical applicability of the mutation operators and the framework’s capacity to assess tool performance. Our results demonstrate that the current tools cannot identify nearly 50% of the accessibility bugs injected by our framework, thus underscoring the need for the development of more effective accessibility testing tools. Finally, the framework’s accuracy and performance attest to its potential for seamless and automated application in practical settings 

   more » « less
2. TestSage: Regression Test Selection for Large-Scale Web Service Testing

   https://doi.org/10.1109/ICST.2019.00052  

   Zhong, Hua; Zhang, Lingming; Khurshid, Sarfraz (April 2019, IEEE Conference on Software Testing, Validation and Verification (ICST))

   Regression testing is an important but expensive activity in software development. Among various types of tests, web service tests are usually one of the most expensive (due to network communications) but widely adopted types of tests in commercial software development. Regression test selection (RTS) aims to reduce the number of tests which need to be retested by only running tests that are affected by code changes. Although a large number of RTS techniques have been proposed in the past few decades, these techniques have not been adopted on large-scale web service testing. This is because most existing RTS techniques either require direct code dependency between tests and code under test or cannot be applied on large scale systems with enough efficiency. In this paper, we present a novel RTS technique, TestSage, that performs RTS for web service tests on large scale commercial software. With a small overhead, TestSage is able to collect fine grained (function level) dependency between test and service under test that do not directly depend on each other. TestSage has also been successfully applied to large complex systems with over a million functions. We conducted experiments of TestSage on a large scale backend service at Google. Experimental results show that TestSage reduces 34% of testing time when running all AEC (Analysis, Execution and Collection) phases, 50% of testing time while running without collection phase. TestSage has been integrated with internal testing framework at Google and runs day-to-day at the company. 

   more » « less
3. SynthDB: Synthesizing Database via Program Analysis for Security Testing of Web Applications

   https://doi.org/10.14722/ndss.2023.24632  

   Chen, An; Lee, Jiho; Chaulagain, Basanta; Kwon, Yonghwi; Lee, Kyu Hyung (January 2023, the 30th Network and Distributed System Security Symposium (NDSS))
4. SYNTHDB: Synthesizing Database via Program Analysis for Security Testing of Web Applications

   https://doi.org/10.14722/ndss.2023.24632  

   Chen, An; Lee, JiHo; Chaulagain, Basanta; Kwon, Yonghwil; Lee, Kyu Hyung (April 2023, Network and Distributed System Security Symposium)

   Testing database-backed web applications is chal- lenging because their behaviors (e.g., control flow) are highly dependent on data returned from SQL queries. Without a database containing sufficient and realistic data, it is challenging to reach potentially vulnerable code snippets, limiting various existing dynamic-based security testing approaches. However, obtaining such a database for testing is difficult in practice as it often contains sensitive information. Sharing it can lead to data leaks and privacy issues. In this paper, we present SYNTHDB, a program analysis- based database generation technique for database-backed PHP applications. SYNTHDB leverages a concolic execution engine to identify interactions between PHP codebase and the SQL queries. It then collects and solves various constraints to reconstruct a database that can enable exploring uncovered program paths without violating database integrity. Our evaluation results show that the database generated by SYNTHDB outperforms state-of- the-arts database generation techniques in terms of code and query coverage in 17 real-world PHP applications. Specifically, SYNTHDB generated databases achieve 62.9% code and 77.1% query coverages, which are 14.0% and 24.2% more in code and query coverages than the state-of-the-art techniques. Fur- thermore, our security analysis results show that SYNTHDB effectively aids existing security testing tools: Burp Suite, Wfuzz, and webFuzz. Burp Suite aided by SYNTHDB detects 76.8% of vulnerabilities while other existing techniques cover 55.7% or fewer. Impressively, with SYNTHDB, Burp Suite discovers 33 pre- viously unknown vulnerabilities from 5 real-world applications. 

   more » « less
5. Testing umbrella species and food-web properties of large carnivores in the Rocky Mountains

   https://doi.org/10.1016/j.biocon.2022.109888  

   Steenweg, Robin; Hebblewhite, Mark; Burton, Cole; Whittington, Jesse; Heim, Nikki; Fisher, Jason T.; Ladle, Andrew; Lowe, Winsor; Muhly, Tyler; Paczkowski, John; et al (February 2023, Biological Conservation)