EDEFuzz: A Web API Fuzzer for Excessive Data Exposures

Lianglu Pan, Shaanan Cohney, Toby C. Murray, Van-Thuan Pham. 2023. International Conference on Software Engineering.

Read the paper · doi:10.1145/3597503.3608133 · arXiv:2301.09258

What this paper does with SQLancer

One citation, in a list of systems where metamorphic relations have been used successfully to find bugs. EDEFuzz detects Excessive Data Exposure, where a web API sends clients far more data than they need, often over public channels. The authors note the problem has no explicit oracle -- nothing crashes -- and develop a metamorphic relation to supply one, building the first fuzzer for it. Across 69 targets from the Alexa Top-200 it found 33,365 potential leaks, and on eight websites it reached a 98.65% true positive rate. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
16	M. Rigger, and Z. Su Testing database engines via pivoted query synthesis, in 14thUSENIXSymposiumonOperatingSystemsDesignandImplementation (OSDI20), 2020, 667–682 (cit. on p. 3).	sqlancer publication · PQS

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Pastworkhassuccessfullyidentifiedandusedmetamorphic relations to find bugs in a variety of systems, including Machine Translation software [ 15] and popular DBMSs [ 16].	citation marker background	2.3 Metamorphic Testing/Fuzzing page 3

This page is rendered from _data/papers/paper_doi_10_1145_3597503_3608133.json, extracted from arxiv. 12 pages, 39 references parsed.