Towards Better Semantics Exploration for Browser Fuzzing
Read the paper · doi:10.1145/3622819
What this paper does with SQLancer
One author-year citation, in a list of domains where grammar-based fuzzing has been applied: compilers, databases, and deep learning frameworks.
SaGe improves browser fuzzing by replacing handwritten context-free grammars, which the authors say model browser semantics too crudely and yield inputs that cover only part of the semantics and are often semantically wrong. It extracts a rudimentary grammar from W3C standards and iteratively enriches it into a production-context sensitive grammar carrying semantic information. Over 24-hour campaigns on Chrome, Safari and Firefox it improved edge coverage by 6-278% and found 62 bugs.
How it was classified
uses infrastructure — no
SQLancer is cited, not used; nothing in the mentions describes reusing its code.
extends technique — no
No technique is extended; the citation is background.
compares with — no
No empirical comparison against SQLancer is reported in the mentions.
describes as state of the art — no
The citation does not characterise SQLancer as the state of the art.
Every place it refers to SQLancer (1)
1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.
| Id | Sentence | Found by | Where |
|---|---|---|---|
| M1 | 2011], databases [ Rigger and Su 2020 ;Wang et al . |
author year citation |
7.1 Grammar-BasedFuzzing page 24 |