Mis.Config: Finding Misreferred Configuration Bugs in Web Application Using Thin Slicing

摘要

There are many web-based applications for multi-agent systems (MAS). However, developing MAS is not easy, because agents have many different variables, and it is difficult to validate them. PHP is one of the most popular web programming languages. PHP is dynamically typed, which means that the type of variable is assigned when the variable is accessed. This flexibility makes it easier to develop MAS. On the contrary, when a programmer refers variables to other PHP files, misreferences among the PHP files may occur because it is difficult to find references across files. To solve these misreferences, we propose a bug-finding tool called Mis.Config using static analysis. We used control flow graphs (CFGs) and thin slicing to realize this purpose. In our experiment, we applied our tool to real-world software to investigate whether Mis.Config can find misreferenced configurations.