SMT, Strings, Security Philipp Rmmer Uppsala University SAT/SMT/AR, - PowerPoint PPT Presentation

Soundness argument  Label equations in the proof with:  if equation is unsat  if equation is sat, has variable occurrences, and is length of for the Decreasing labels shortest solution → Branch cannot  Order pairs lexicographically be closed! Lemma In each application of the Nielsen rule, if the parent is labelled with , then at least one child has label . 60

Combinations ... Quadratii Equations 61

Combinations ... Regex Constraints Quadratii Equations 62

Combinations ... Regex Constraints ✓ Quadratii Equations 63

Combinations ... Regex Constraints Length ✓ Constraints Quadratii Equations 64

Combinations ... Regex Constraints Length ✓ Constraints ? Quadratii Equations 65

Combinations ... Regex Constraints Length ✓ ? Constraints ? Quadratii Equations 66

Combinations ... Regex Constraints Length ✓ ? Constraints ? Quadratii Transduition Equations 67

Combinations ... Regex Constraints Length ✓ ? Constraints ? Quadratii Transduition Equations Undeiidable 68

Combinations ... Regex Constraints Length ✓ ? Constraints ? Quadratii Transduition Equations Undeiidable 69

Combinations ... Regex Constraints Length ✓ ? Constraints ? Quadratii Transduition Equations Undeiidable 70

Combinations ... Regex Constraints Length ✓ ? Constraints ? Quadratii Transduition Equations Undeiidable 71

The Norn fragment 1. Boolean structure 2. Acyclic (linear) word equations 3. Regex memberships 4. Length constraints Parosh Aziz Abdulla, Mohamed Faouzi Atig, Yu-Fang Chen, Lukás Holík, Ahmed Rezine, Philipp Rümmer, Jari Stenman: String Constraints for Verifcation. CAV 2014 72

The Norn fragment 1. Boolean structure 2. Acyclic (linear) word equations 3. Regex memberships 4. Length constraints (a decidable fragment) Parosh Aziz Abdulla, Mohamed Faouzi Atig, Yu-Fang Chen, Lukás Holík, Ahmed Rezine, Philipp Rümmer, Jari Stenman: String Constraints for Verifcation. CAV 2014 73

The Norn fragment 1. Boolean structure Order in which 2. Acyclic (linear) word equations procedure handles 3. Regex memberships operators 4. Length constraints (a decidable fragment) Parosh Aziz Abdulla, Mohamed Faouzi Atig, Yu-Fang Chen, Lukás Holík, Ahmed Rezine, Philipp Rümmer, Jari Stenman: String Constraints for Verifcation. CAV 2014 74

Examples 75

1. Boolean struiture  Use standard DPLL/CDCL → Easy  Just consider conjunctions of literals  But we need to handle negation!  Negated word equations  Negated regex constraints  Negated length constraints 76

1. Boolean struiture  Use standard DPLL/CDCL → Easy  Just consider conjunctions of literals  But we need to handle negation!  Negated word equations ? ✓  Negated regex constraints ✓  Negated length constraints 77

1b. Negative word eqs. Can be reduced to positive equations: Lemma 78

1b. Negative word eqs. Can be reduced to positive equations: Lemma Large alphabets → a, b need to be handled symbolically in practice 79

1b. Negative word eqs. Can be reduced to positive equations: Lemma Theorem Any Boolean combination of word equations can be reduced to a single word equation with the same set of solutions (when projected to the 80 original set of variables).

2. Aiyilii word equations  Reduce to solved form by systematic application of Nielsen’s transformation: ( do not occur in )  After that, eliminate equations by inlining! 81

3. Regular expressions  Membership tests with ioniatenation can be split:  Tests with same left-hand side can be merged: 82

3. Regular expressions  Membership tests with ioniatenation can be split: Disjunction over  Tests with same left-hand side can be states of automaton merged: representing 83

4. Length ionstraints  Compute the length abstraition of each regex constraint:  Conjoin length abstractions with other length constraints and check satisfability 84

4. Length ionstraints  Compute the length abstraition of each regex constraint:  Conjoin length abstractions with other length constraints and check satisfability A Presburger formula that can be extracted in linear time from 85

5. Optimisations ...  E.g., exploit length information when splitting equations or regexes (still too slow ...) 86

Adding Transducers . 87

3. Regular expressions  Membership tests with ioniatenation can be split:  Tests with same left-hand side can be merged: 88

3. Regular expressions  Membership tests with ioniatenation can be split: Does not work any more with transducers!  Tests with same left-hand side can be merged: 89

The Sloth fragments 1. Boolean structure (no negation) 2. Straight-line word equations 3. n -track transducer constraints Lukás Holík, Petr Janku, Anthony W. Lin, Philipp Rümmer, Tomás Vojnar: String constraints with concatenation and transducers solved efciently. PACMPL 2(POPL): 4:1-4:32 90 (2018)

The Sloth fragments 1. Boolean structure (no negation) 2. Straight-line word equations 3. n -track transducer constraints → also decidable! Lukás Holík, Petr Janku, Anthony W. Lin, Philipp Rümmer, Tomás Vojnar: String constraints with concatenation and transducers solved efciently. PACMPL 2(POPL): 4:1-4:32 91 (2018)

Transduiers Defnition An n -traik transduier is a fnite-state automaton over the alphabet An n -track transducer defnes an n -ary rational relation . 92

Transduiers Defnition An n -traik transduier is a fnite-state automaton over the alphabet An n -track transducer defnes an n -ary rational relation . 93

Transduiers Defnition An n -traik transduier is a fnite-state automaton over the alphabet An n -track transducer defnes an n -ary rational relation . 94

HTML Esiaping 95

Undeiidability Proposition/Folklore String constraints with rational relations are undeiidable .  Post correspondence problem: Given word pairs is there an index sequence with 96

Undeiidability Proposition/Folklore String constraints with rational relations are undeiidable .  Post correspondence problem: Given word pairs e l b a d i i e d n U is there an index sequence with 97

Fragments: aiyilii formulas  Positive Boolean comb. of rational relations applied to distinct variables  In every , and share at most one variable  PSPACE-complete [Barcelo, Figuiera, and Libkin’13] 98

Straight-line fragment SL  Conjunction of equations sorted by dependency:  All pairwise distinct  Each may only occur in  Each is concatenation, or (interpreted as )  Regex constraints 99

SL example JavaSiript embedded in a web-page var x = goog.string.htmlEscape(cat); var y = goog.string.escapeString(x); catElem.innerHTML = '<button onclick="createCatList(\'' + y + '\')">' + x + '</button>'; 100