{
"cells": [
{
"cell_type": "markdown",
"id": "76619533",
"metadata": {
"button": false,
"new_sheet": false,
"run_control": {
"read_only": false
},
"slideshow": {
"slide_type": "slide"
}
},
"source": [
"# Fuzzing with Constraints\n",
"\n",
"In previous chapters, we have seen how [Grammar-Based Fuzzing](GrammarFuzzer.ipynb) allows us to efficiently generate myriads of syntactically valid inputs.\n",
"However, there are _semantic_ input features that cannot be expressed in a context-free grammar, such as\n",
"\n",
"* \"$X$ is the length of $Y$\";\n",
"* \"$X$ is an identifier previously declared\"; or\n",
"* \"$X$ should be longer than 4,096 bytes\".\n",
"\n",
"In this chapter, we show how the [ISLa](https://rindphi.github.io/isla/) framework allows us to express such features as _constraints_ added to a grammar.\n",
"By having ISLa solve these constraints automatically, we produce inputs that are not only _syntactically_ valid, but actually _semantically_ valid.\n",
"Furthermore, such constraints allow us to very precisely _shape_ the inputs we want for testing."
]
},
{
"cell_type": "code",
"execution_count": 1,
"id": "371d240d",
"metadata": {
"execution": {
"iopub.execute_input": "2024-04-27T13:47:28.038140Z",
"iopub.status.busy": "2024-04-27T13:47:28.037937Z",
"iopub.status.idle": "2024-04-27T13:47:28.096266Z",
"shell.execute_reply": "2024-04-27T13:47:28.095983Z"
},
"slideshow": {
"slide_type": "skip"
}
},
"outputs": [
{
"data": {
"text/html": [
"\n",
" \n",
" "
],
"text/plain": [
" \n",
" \n",
" \n",
" \n",
" ... Text TextQuiz
\n",
" Quiz
\n",
"
Text
\n" ] } ], "source": [ "solver = ISLaSolver(XML_GRAMMAR, \n", " '''\n", "Text
\n", "