Crawljax

Automatic JavaScript Invariants Plugin

The automatic JavaScript invariant plugin consists of two plugins. One is used to find invariants and one is used to test applications (using the invariants).

For both the finding and testing plugins, we need to use a proxy. This is done by adding the WebScarabWrapper plugin to the CrawljaxConfiguration object.

Finding

For the invariant finding plugin, we need to add the JSExecutionTracer plugin to the CrawljaxConfiguration object and we need to add the JSModifyProxyPlugin with an AstInstrumenter instance to the WebScarabWrapper plugin.

CrawljaxConfiguration config = new CrawljaxConfiguration();

ProxyConfiguration prox = new ProxyConfiguration();

WebScarabWrapper web = new WebScarabWrapper();
JSModifyProxyPlugin modifier = new JSModifyProxyPlugin(new AstInstrumenter());
web.addPlugin(modifier);
JSExecutionTracer tracer = new JSExecutionTracer(“daikon.assertions”);
tracer.setOutputFolder(outputdir + “/jsassertions”);

config.addPlugin(tracer);
config.addPlugin(web);
config.setProxyConfiguration(prox);

Testing

For the invariant testing plugin, we need to add the JSAssertionResults plugin to the CrawljaxConfiguration object and we need to add the JSModifyProxyPlugin with an AstAssertionInserter instance to the WebScarabWrapper plugin. Also, the JSAssertionResults plugin needs to have an ErrorReport instance so that the errors are stored in a report.

CrawljaxConfiguration config = new CrawljaxConfiguration();

ProxyConfiguration prox = new ProxyConfiguration();

ErrorReport reporter = new ErrorReport(“invariants”, outputdir + “/errorreport”);

WebScarabWrapper web = new WebScarabWrapper();
JSModifyProxyPlugin modifier = new JSModifyProxyPlugin(new AstAssertionInserter(outputdir + “/jsassertions/daikon.assertions”));
web.addPlugin(modifier);
JSAssertionResults results = new JSAssertionResults(reporter);
config.addPlugin(results);

config.addPlugin(web);
config.setProxyConfiguration(prox);
config.setCrawlSpecification(crawler);

Automatic DOM Invariants Plugin

The automatic DOM invariant plugin consists of two plugins. One is used to find the invariants and one is used to test an application (using the invariants).

Finding

For the invariant finding plugin, construct the DOMInvariantFinder class, use the setOutputFolder method on the instance to specify where invariants are stored and add the instance to the CrawljaxConfiguration object.
After executing Crawljax, the output can be found in the specified output folder. Filenames starting with inv- are the actual invariants and filenames starting with dom- are the DOMs of the corresponding states. The rest of the filename is based on a hash of the clickpath.

CrawljaxConfiguration config = new CrawljaxConfiguration();
DomInvariantFinder plugin = new DomInvariantFinder();
plugin.setOutputFolder("dom-output");
config.addPlugin(plugin);

Testing

For the invariant testing plugin, construct the DomInvariantTester class and pass the path to the folder where the invariants can be stored as a first argument. Next, specify the output directory using setOutputFolder on the plugin and add the plugin to the CrawljaxConfiguration object.
After executing Crawljax, an error report will be stored in the folder that was specified as output folder. Each HTML file corresponds with a state.

CrawljaxConfiguration config = new CrawljaxConfiguration();
DomInvariantTester plugin = new DomInvariantTester("dom-output");
plugin.setOutputFolder("dom-output");
config.addPlugin(plugin);