AutoWeb: Automatically Inferring Web Framework Semantics Via Configuration Mutation

Web frameworks play an important role in modern web applications, providing a wide range of configurations to streamline the development process. However, the intricate semantics, facilitated by framework configurations, present substantial challenges when conducting static analyses on web applications. To mitigate this issue, existing approaches resort to manually modeling framework semantics for static analysis tools. Unfortunately, these manual works are both time-consuming and error-prone, especially considering the vast array of web frameworks and their frequent updates. In this paper, we present the first automated method for inferring web framework semantics. Our innovative approach can automatically deduce framework specifications by mutating configurations. We have developed a prototype called AutoWeb and performed extensive experiments on three popular Java web frameworks. The empirical results show that AutoWeb is comparable to these manual approaches in terms of precision, with a false negative rate of 8.2