A Dynamic Symbolic Execution (DSE) engine for JavaScript. ExpoSE is highly scalable, compatible with recent JavaScript standards, and supports symbolic modelling of strings and regular expressions.
License: MIT License
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
If dependencies aren't installed ExpoSE may hang forever. At the least which should be used to check that there is any mitmproxy on the system (or mitmproxy -v should be used to check a python3 varient is installed)
If I run https://1688.com, I get the following output:
[249915:0905/001635.380864:INFO:CONSOLE(12207)] "PUUID: 11847, OUTPUT_LOAD_EVENT: !!!{"depth":0,"createdFromParent":"N/A","createdFrom":true,"createdAtDepth":2,"createdAtFork":24}!!! !!!Solver { (define-funs-rec ( ( str.repeat ((x!1 String) (x!2 Int)) String) ( str.whiteLeft ((x!1 String) (x!2 Int)) Int) ( str.whiteRight ((x!1 String) (x!2 Int)) Int)) ( (ite (<= x!2 0) "" (str.++ x!1 ((_ str.repeat 0) x!1 (- x!2 1)))) (ite (= (str.at x!1 x!2) " ") ((_ str.whiteLeft 0) x!1 (+ x!2 1)) x!2) (ite (= (str.at x!1 x!2) " ") ((_ str.whiteRight 0) x!1 (- x!2 1)) x!2))) }!!! !!!"https://astyle.alicdn.com/pkg/@alife/refly-vendors/1.0.0/src/browser-update/browser-update.css?_v=f5edf2a8db75a4731dfc4310931ef708.css"!!! !!!""!!!", source: https://www.1688.com/ (12207)
But according to this output, this OUTPUT_LOAD_EVENT has no parent process ("createdFromParent": "N/A") and is generated from the true branch of the previous PC's 24th assertion ("createdAtFork": 24). However, this PUUID doesn't have a 24th assertion, because it has only a single define-funs-rec. Am I misunderstanding something from here?
Also, multiple OUTPUT_LOAD_EVENT from the same PUUID: 11847 have the same "depth" and "createdAtDepth": they have the "depth" either 0 or 2. So we cannot distinguish where each OUTPUT_LOAD_EVENT node should be located in the tree. I thought "depth" within the same PUUID should be incremented whenever a new OUTPUT_LOAD_EVENT is created, isn't it?
I've encountered an issue when attempting to run the basic example provided in the README. The process ends with some error messages, and I'm unable to proceed. I've installed it locally and within Docker afterwards, but I've got the same results.
Here is the output I received:
my-expose-container | [+] ExpoSE /usr/src/app/tests/numbers/infoflow concurrent: 4 timeout: 7200000 per-test: 2400000
[\] [0 done /0 queued / 1 running / 0 errors / 0% coverage ] ***(node:20) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
my-expose-container | (Use `node --trace-deprecation ...` to show where the warning was created)
[|] [1 done /0 queued / 0 running / 1 errors / 0% coverage ] ***
my-expose-container | [+] {"_bound":0} took 0.377s
my-expose-container | [!] Exception E: SyntaxError: Unexpected end of JSON input of test data on
my-expose-container | [!] Exception E: SyntaxError: Unexpected end of JSON input of coverage data on
my-expose-container | [!] Exit code non-zero
my-expose-container | [!] Error extracting final output - a fatal error must have occured
my-expose-container | [!] expoSE replay /usr/src/app/tests/numbers/infoflow '{"_bound":0}'
my-expose-container | [!] Stats
my-expose-container | [!] Done
my-expose-container | [+] Total Lines Of Code 0
my-expose-container | [+] Total Coverage: NaN%
my-expose-container | [+] EXPOSE_PRINT_COVERAGE=1 for line by line breakdown
my-expose-container | [+] ExpoSE Finished. 1 paths, 1 errors
my-expose-container exited with code 1
This is my Dockerfile:
FROM node:14.16.1
WORKDIR /usr/src/app
RUN git clone https://github.com/ExpoSEJS/ExpoSE.git .
RUN ./install
And this is my docker-compose.yml:
version: '3.8'
services:
expose:
build: .
container_name: my-expose-container
command: ["./expoSE", "./tests/numbers/infoflow"]
I'm unsure how to proceed with troubleshooting this issue.
Any guidance or fix you can provide would be greatly appreciated.
Split models occasionally diverge (split_lhs triggers this) or take a long time to terminate.
Could be an error in Split model or a bug in RegexpBuiltinExec (In which case it might be related to #42)
String methods etc could fail in concrete mode if this method is broken. It should be tested.
running the ui via npm start
results in an empty page
enabling javascript debugger shows an error
Uncaught ReferenceError: ClientRect is not defined
at xel.min.html:1
at xel.min.html:1
seems ClientRect was replace with DOMRect https://bugs.chromium.org/p/chromium/issues/detail?id=719246
this should be resolved in a newer version of xel
Hi
I just wonder how to handle the dynamic execution. In my case, the program stopped in this step:
expoSE "https://www.google.com"
Web Mode, Starting Proxy
I have all of the dependencies including mitmproxy and python.
Thanks !
File "scripts/analyse":
--- (node --max_old_space_size=4096 Distributor/bin/Distributor.js "$1" ${@:2})
+++ (node --max_old_space_size=4096 Distributor/bin/Distributor.js "$1" "${@:2}")
File "Analyser/src/SymbolicExecution.js"
...
--- if (offset == "referer") {
+++ if (offset == "referrer") {
...
File "Analyser/src/Models/MathModels.js"
model.add(Math.ceil, symbolicHook(
Math.ceil,
(base, args) => state.isSymbolic(args[0]),
(base, args, r) => {
const intArg = ctx.mkRealToInt(state.asSymbolic(args[0]));
const floored = ctx.mkIntToReal(intArg);
--- return new ConcolicValue(r, floored);
+++ const one_real = ctx.mkIntToReal(ctx.mkIntVal(1))));
+++ return new ConcolicValue(r, ctx.mkIte(ctx.mkLt(floored, state.asSymbolic(args[0])), ctx.mkAdd(floored, one_real, floored));
}
));
model.add(Math.round, symbolicHook(
Math.round,
(base, args) => state.isSymbolic(args[0]),
(base, args, r) => {
const intArg = ctx.mkRealToInt(state.asSymbolic(args[0]));
const floored = ctx.mkIntToReal(intArg);
--- return new ConcolicValue(r, floored);
+++ const half_real = ctx.mkDiv(ctx.mkIntToReal(ctx.mkIntVal(1)), 2);
+++ const realArgPlusHalf = ctx.mkAdd(state.asSymbolic(args[0]), half_real));
+++ const intArgPlusHalf = ctx.mkRealToInt(realArgPlusHalf);
+++ const flooredPlusHalf = ctx.mkIntToReal(ingArgPlusHalf);
+++ return new ConcolicValue(r, ctx.mkIte(ctx.mkLt(floored, flooredPlusHalf)), flooredPlusHalf, floored));
}
));
I tried to install ExpoSE and still can not run it.
It logs errors outside of the module.
./expoSE ./tests/numbers/infoflow
(node:15974) Warning: To load an ES module, set "type": "module" in the package.json or use the .mjs extension.
(Use `node --trace-warnings ...` to show where the warning was created)
(node:15974) Warning: To load an ES module, set "type": "module" in the package.json or use the .mjs extension.
/home/kien/ExpoSE/Distributor/src/Distributor.js:3
import Internal from "./Internal";
^^^^^^
SyntaxError: Cannot use import statement outside a module
at wrapSafe (internal/modules/cjs/loader.js:979:16)
at Module._compile (internal/modules/cjs/loader.js:1027:27)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
at Module.load (internal/modules/cjs/loader.js:928:32)
at Function.Module._load (internal/modules/cjs/loader.js:769:14)
at ModuleWrap.<anonymous> (internal/modules/esm/translators.js:199:29)
at ModuleJob.run (internal/modules/esm/module_job.js:152:23)
at async Loader.import (internal/modules/esm/loader.js:166:24)
at async Object.loadESM (internal/process/esm_loader.js:68:5)
With node version 14.17.1 and environment dependency in the readme of this repo.
I run something in tests folder like :
./expoSE tests/regex/match/captures/anchors.js
and give some report like that :
[+] ExpoSE /home/kien/ExpoSE/tests/regex/match/captures/anchors.js concurrent: 8 timeout: 7200000 per-test: 2400000
[\] [0 done /0 queued / 1 running / 0 errors / 0% coverage ] ***(node:1001) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
(Use `node --trace-deprecation ...` to show where the warning was created)
[-] [4 done /0 queued / 0 running / 3 errors / 32% coverage ] ***
[+] {"_bound":0,"X":""} took 5.923s
[+] {"X":"abc","_bound":14} took 4.932s
[!] Reachable
[!] expoSE replay '/home/kien/ExpoSE/tests/regex/match/captures/anchors.js' '{"X":"abc","_bound":14}'
[+] {"X":"abchello","_bound":19} took 6.257s
[!] Reachable
[!] expoSE replay '/home/kien/ExpoSE/tests/regex/match/captures/anchors.js' '{"X":"abchello","_bound":19}'
[+] {"X":"helloabc","_bound":18} took 6.267s
[!] Reachable
[!] expoSE replay '/home/kien/ExpoSE/tests/regex/match/captures/anchors.js' '{"X":"helloabc","_bound":18}'
[!] Stats
[+] General Function Call: 20
[+] Symbolic Values: 4
[+] Symbolic Primitives: 4
[+] Wrapped Constants: 20
[+] Symbolic Field: 4
[+] Modeled Function Call: {"#match":4}
[+] Regex Encoded: 4
[+] Regex Which May Need Checks: 4
[+] Regex Checks: 6
[+] Max Queries (Any): 1
[+] Max Queries (Succesful): 1
[+] Symbolic Binary: 16
[+] Failed Queries: 5
[!] Done
[+] /home/kien/ExpoSE/tests/regex/match/captures/anchors.js. Coverage (Term): 82% Coverage (Decisions): 69% Coverage (LOC): 100% Lines Of Code: 20 -*
[+] Total Lines Of Code 20
[+] Total Coverage: 1%
[+] EXPOSE_PRINT_COVERAGE=1 for line by line breakdown
[+] ExpoSE Finished. 4 paths, 3 errors
and it created a file like
J$.iids = {"8":[12,6,12,17],"9":[3,10,3,17],"10":[8,11,8,24],"16":[16,6,16,28],"17":[3,18,3,22],"18":[12,6,12,17],"24":[10,5,10,22],"25":[3,10,3,23],"26":[16,8,16,20],"33":[3,10,3,23],"34":[16,6,16,28],"41":[3,10,3,23],"49":[4,9,4,11],"57":[4,19,4,22],"65":[4,24,4,26],"73":[4,9,4,27],"75":[4,9,4,18],"81":[4,9,4,27],"89":[4,9,4,27],"97":[8,1,8,3],"105":[8,11,8,12],"113":[8,11,8,19],"121":[8,22,8,24],"129":[8,1,8,25],"131":[8,1,8,10],"137":[8,1,8,26],"145":[10,5,10,14],"153":[10,20,10,21],"161":[10,5,10,22],"163":[10,5,10,19],"169":[12,6,12,7],"177":[12,8,12,9],"185":[12,6,12,10],"193":[12,14,12,17],"201":[13,9,13,22],"209":[13,9,13,22],"217":[13,3,13,23],"225":[16,6,16,7],"233":[16,8,16,9],"241":[16,8,16,16],"249":[16,19,16,20],"257":[16,6,16,21],"265":[16,25,16,28],"273":[17,9,17,22],"281":[17,9,17,22],"289":[17,3,17,23],"297":[20,8,20,19],"305":[20,8,20,19],"313":[20,2,20,20],"321":[1,1,21,2],"329":[1,1,21,2],"337":[1,1,21,2],"345":[12,2,14,3],"353":[16,2,18,3],"361":[10,1,21,2],"369":[1,1,21,2],"377":[1,1,21,2],"nBranches":6,"originalCodeFileName":"/home/kien/ExpoSE/tests/regex/anchors/both.js","instrumentedCodeFileName":"/home/kien/ExpoSE/tests/regex/anchors/both_jalangi_.js","code":"/* Copyright (c) Royal Holloway, University of London | Contact Blake Loring ([email protected]), Duncan Mitchell ([email protected]), or Johannes Kinder ([email protected]) for details or support | LICENSE.md for license details */\n\n'use strict';\nvar S$ = require('S$');\nvar q = S$.symbol(\"q\", '');\n\n//This assumption is required to make the testcase solve in reasonable time with Z3\n//This is not due to the regular expression but in fact due to the q.length and str.at\nS$.assume(q.length < 10);\n\nif (/^--.+=$/.test(q)) {\n\n\tif (q[0] != '-') {\n\t\tthrow 'Unreachable';\n\t}\n\n\tif (q[q.length - 1] != '=') {\n\t\tthrow 'Unreachable';\n\t}\n\n\tthrow 'Reachable';\n}\n"};
jalangiLabel0:
while (true) {
try {
J$.Se(321, '/home/kien/ExpoSE/tests/regex/anchors/both_jalangi_.js', '/home/kien/ExpoSE/tests/regex/anchors/both.js');
J$.N(329, 'S$', S$, 0);
J$.N(337, 'q', q, 0);
var S$ = J$.X1(41, J$.W(33, 'S$', J$.F(25, J$.R(9, 'require', require, 2), 0)(J$.T(17, 'S$', 21, false)), S$, 3));
var q = J$.X1(89, J$.W(81, 'q', J$.M(73, J$.R(49, 'S$', S$, 1), 'symbol', 0)(J$.T(57, "q", 21, false), J$.T(65, '', 21, false)), q, 3));
J$.X1(137, J$.M(129, J$.R(97, 'S$', S$, 1), 'assume', 0)(J$.B(10, '<', J$.G(113, J$.R(105, 'q', q, 1), 'length', 0), J$.T(121, 10, 22, false), 0)));
if (J$.X1(361, J$.C(24, J$.M(161, J$.T(145, /^--.+=$/, 14, false), 'test', 0)(J$.R(153, 'q', q, 1))))) {
if (J$.X1(345, J$.C(8, J$.B(18, '!=', J$.G(185, J$.R(169, 'q', q, 1), J$.T(177, 0, 22, false), 4), J$.T(193, '-', 21, false), 0)))) {
throw J$.X1(217, J$.Th(209, J$.T(201, 'Unreachable', 21, false)));
}
if (J$.X1(353, J$.C(16, J$.B(34, '!=', J$.G(257, J$.R(225, 'q', q, 1), J$.B(26, '-', J$.G(241, J$.R(233, 'q', q, 1), 'length', 0), J$.T(249, 1, 22, false), 0), 4), J$.T(265, '=', 21, false), 0)))) {
throw J$.X1(289, J$.Th(281, J$.T(273, 'Unreachable', 21, false)));
}
throw J$.X1(313, J$.Th(305, J$.T(297, 'Reachable', 21, false)));
}
} catch (J$e) {
J$.Ex(369, J$e);
} finally {
if (J$.Sr(377)) {
J$.L();
continue jalangiLabel0;
} else {
J$.L();
break jalangiLabel0;
}
}
}
// JALANGI DO NOT INSTRUMENT
term '// JALANGI DO NOT INSTRUMENT' like me run something wrong ?
I am not know why total Coverage is so less.
And does it have something like string test make regex failed ?
Thank you.
Kien Hoang
For now I'd like to talk something about tracing function.
I just wonder how I can use expoSE to trace a function in js file, so that I can know that which button or other action can call a certain function.
Any hint will be appreciate, thanks for your help!
coerceToString should be rewritten to ToString,
coerceToObject should be rewritten ToObject,
etc for the informal model transformations
Test cases
ExpoSE/tests/regex/exec/greed/nested.js
ExpoSE/tests/regex/match/greed/nested.js
both fail with max refinements - didn't happen before changes to the model.
Probably a bug in model generation for RegexpBuiltinExec.
I try to install expoSE using command npm install.
Although the installation was successful (even with a few warning), the "expoSE" command could not be found：
Do you know what the problem is?
Thanks.
For now I'm going through the examples and other source material, but having some documentation bundled would be really nice. I'm looking at using ASTs and symbolic execution in general to help with verifying work and compare structures of code.
From some playing around I've deduced:
_t means the type of a propertyStill not sure what _bound means.
Cannot reuse model for substr
The model now supports callbacks but they need unit testing for correctness.
Setup:
When running tests inside Docker container or on host get following output:
*** [3/167] [1 running] [2 errors] ***
./tests/regex/search/not_at_start.js failed with errors (1). Printing output
[+] ExpoSE /source/tests/regex/search/not_at_start.js concurrent: 1 timeout: 7200000 per-test: 2400000
[|] [1 done /0 queued / 0 running / 1 errors / 0% coverage ] ***
[+] {"_bound":0} took 0.93s
[!] Exception E: SyntaxError: Unexpected end of JSON input of test data on
[!] Exception E: SyntaxError: Unexpected end of JSON input of coverage data on
[!] Exit code non-zero
[!] Error extracting final output - a fatal error must have occured
[!] expoSE replay '/source/tests/regex/search/not_at_start.js' '{"_bound":0}'
[!] Stats
[!] Done
[+] Total Lines Of Code 0
[+] Total Coverage: NaN%
[+] EXPOSE_PRINT_COVERAGE=1 for line by line breakdown
[+] ExpoSE Finished. 1 paths, 1 errors
Hi. I am trying to run ExpoSE to analyze some javascript codes. After running npm install, I got some errors:
npm WARN deprecated [email protected]: Typings is deprecated in favor of NPM @types -- see README for more information
npm WARN deprecated [email protected]: Use `agent` option with `popsicle` directly
npm WARN deprecated [email protected]: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated [email protected]: Please see https://github.com/lydell/urix#deprecated
> [email protected] postinstall /home/sobhan/ExpoSE
> ./scripts/setup/setup
Setting up for Node
v10.22.0
Setting Up Packages
Cleaning lib/S$
Setting up lib/S$
Pulling Dependencies
npm WARN [email protected] No repository field.
npm WARN [email protected] license should be a valid SPDX license expression
up to date in 1.614s
found 0 vulnerabilities
Cleaning lib/Stats
Setting up lib/Stats
Pulling Dependencies
npm WARN [email protected] No description
npm WARN [email protected] No repository field.
npm WARN [email protected] No license field.
up to date in 1.419s
found 0 vulnerabilities
Cleaning Analyser
Setting up Analyser
Pulling Dependencies
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: This NPM package for DataTables has now been deprecated and the 'datatables.net' set of packages should be used in preference to this one. Please see the NPM installation guide for DataTables for more details: https://datatables.net/download/npm.
npm WARN deprecated [email protected]: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated [email protected]: This module relies on Node.js's internals and will break at some point. Do not use it, and update to [email protected].
> [email protected] postinstall /home/sobhan/ExpoSE/Analyser/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!
The project needs your help! Please consider supporting of core-js on Open Collective or Patreon:
> https://opencollective.com/core-js
> https://www.patreon.com/zloirock
Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)
> [email protected] postinstall /home/sobhan/ExpoSE/Analyser
> ./scripts/postinstall
npm WARN deprecated [email protected]: This NPM package for DataTables has now been deprecated and the 'datatables.net' set of packages should be used in preference to this one. Please see the NPM installation guide for DataTables for more details: https://datatables.net/download/npm.
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: This module relies on Node.js's internals and will break at some point. Do not use it, and update to [email protected].
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: to-iso-string has been deprecated, use @segment/to-iso-string instead.
npm WARN deprecated [email protected]: Jade has been renamed to pug, please install the latest version of pug instead of jade
npm WARN deprecated [email protected]: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
> [email protected] postinstall /home/sobhan/ExpoSE/Analyser/node_modules/jalangi2/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
npm notice created a lockfile as package-lock.json. You should commit this file.
added 148 packages from 875 contributors and audited 149 packages in 10.057s
2 packages are looking for funding
run `npm fund` for details
found 15 vulnerabilities (3 low, 6 moderate, 5 high, 1 critical)
run `npm audit fix` to fix them, or `npm audit` for details
Cloning into 'node_modules/z3javascript'...
[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
npm ERR! code ELIFECYCLE
npm ERR! errno 128
npm ERR! [email protected] postinstall: `./scripts/postinstall`
npm ERR! Exit status 128
npm ERR!
npm ERR! Failed at the [email protected] postinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm ERR! A complete log of this run can be found in:
npm ERR! /home/sobhan/.npm/_logs/2021-04-21T05_05_25_690Z-debug.log
Cleaning Tester
Setting up Tester
Pulling Dependencies
> [email protected] postinstall /home/sobhan/ExpoSE/Tester/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
npm WARN [email protected] No repository field.
npm WARN [email protected] license should be a valid SPDX license expression
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
added 334 packages from 128 contributors and audited 338 packages in 5.626s
2 packages are looking for funding
run `npm fund` for details
found 1 low severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
Cleaning Distributor
Setting up Distributor
Pulling Dependencies
npm WARN [email protected] No repository field.
npm WARN [email protected] license should be a valid SPDX license expression
added 17 packages from 14 contributors and audited 17 packages in 1.659s
2 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
Cleaning Dashboard
Setting up Dashboard
Pulling Dependencies
> [email protected] postinstall /home/sobhan/ExpoSE/Dashboard/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
> [email protected] postinstall /home/sobhan/ExpoSE/Dashboard/node_modules/electron
> node install.js
npm WARN [email protected] No description
npm WARN [email protected] No repository field.
npm WARN [email protected] No license field.
added 96 packages from 100 contributors and audited 96 packages in 8.708s
6 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
Cleaning Browser
Setting up Browser
Pulling Dependencies
> [email protected] postinstall /home/sobhan/ExpoSE/Browser/node_modules/electron
> node install.js
npm WARN [email protected] No repository field.
added 154 packages from 136 contributors and audited 154 packages in 7.349s
6 packages are looking for funding
run `npm fund` for details
found 1 moderate severity vulnerability
run `npm audit fix` to fix them, or `npm audit` for details
Building Analyser
/home/sobhan/ExpoSE/.eslintrc.json
0:0 warning File ignored by default. Use a negated ignore pattern (like "--ignore-pattern '!<relative/path/to/filename>'") to override
/home/sobhan/ExpoSE/Distributor/src/Spawn.js
99:21 warning Unnecessary escape character: \/ no-useless-escape
✖ 2 problems (0 errors, 2 warnings)
Building Libs
Successfully compiled 1 file with Babel (476ms).
Building Distributor
Successfully compiled 15 files with Babel (969ms).
Building Analyser
Successfully compiled 24 files with Babel (1644ms).
Building into
Bundling Analyser/bin/Analyser.js into bin/bundle.js
Copying Analyser Dependencies to Browser
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.1 (node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN [email protected] No repository field.
npm WARN [email protected] No license field.
added 666 packages from 408 contributors and audited 667 packages in 269.489s
19 packages are looking for funding
run `npm fund` for details
found 3 high severity vulnerabilities
run `npm audit fix` to fix them, or `npm audit` for details
As it is seen in the output it seems, there are some problems with the z3javascript module.
After installation first I set the environment variable EXPOSE_PRINT_PATHS to 1 and then I ran expoSE ./tests/numbers/infoflow. And then I got this error:
[+] ExpoSE /home/sobhan/ExpoSE/tests/numbers/infoflow concurrent: 4 timeout: 7200000 per-test: 2400000
[\] [0 done /0 queued / 1 running / 0 errors / 0% coverage ] ***(node:2067) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
internal/modules/cjs/loader.js:638
throw err;
^
Error: Cannot find module 'z3javascript'
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
at Function.Module._load (internal/modules/cjs/loader.js:562:25)
at Module.require (internal/modules/cjs/loader.js:692:17)
at require (internal/modules/cjs/helpers.js:25:18)
at Object.<anonymous> (/home/sobhan/ExpoSE/Analyser/bin/SymbolicState.js:26:44)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
at Function.Module._load (internal/modules/cjs/loader.js:585:3)
[|] [1 done /0 queued / 0 running / 1 errors / 0% coverage ] ***
[+] {"_bound":0} took 0.429s
[!] Exception E: SyntaxError: Unexpected end of JSON input of test data on
[!] Exception E: SyntaxError: Unexpected end of JSON input of coverage data on
[!] Exit code non-zero
[!] Error extracting final output - a fatal error must have occured
[!] expoSE replay /home/sobhan/ExpoSE/tests/numbers/infoflow '{"_bound":0}'
[!] Stats
[!] Done
[+] Total Lines Of Code 0
[+] Total Coverage: NaN%
[+] EXPOSE_PRINT_COVERAGE=1 for line by line breakdown
[+] ExpoSE Finished. 1 paths, 1 errors
I also tried to clone z3javascript manually. To do that I ran these commands:
cd node_modules/ # ~/ExpoSE/node_modules
git clone https://github.com/ExpoSEJS/z3javascript.git
cd z3javascript/ # ~/ExpoSE/node_modules/z3javascript
npm install
cp -r node_modules/* .. # copying modules to ~/ExpoSE/node_modules/
cd ../.. # ~/ExpoSE
./expoSE ./tests/numbers/infoflow
And this time I got this error message:
[+] ExpoSE /home/sobhan/ExpoSE/tests/numbers/infoflow concurrent: 4 timeout: 7200000 per-test: 2400000
[\] [0 done /0 queued / 1 running / 0 errors / 0% coverage ] ***(node:3683) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
fs.js:114
throw err;
^
Error: ENOENT: no such file or directory, open './node_modules/z3javascript/bin/libz3.so'
at Object.openSync (fs.js:443:3)
at readFileSync (fs.js:343:35)
at new DynamicLibrary (/home/sobhan/ExpoSE/node_modules/z3javascript/node_modules/ffi/lib/dynamic_library.js:67:21)
at Object.Library (/home/sobhan/ExpoSE/node_modules/z3javascript/node_modules/ffi/lib/library.js:45:12)
at module.exports (/home/sobhan/ExpoSE/node_modules/z3javascript/bin/package.js:78:14)
at Object.<anonymous> (/home/sobhan/ExpoSE/node_modules/z3javascript/bin/Z3Loader.js:15:16)
at Module._compile (internal/modules/cjs/loader.js:778:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
at Module.load (internal/modules/cjs/loader.js:653:32)
at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
[|] [1 done /0 queued / 0 running / 1 errors / 0% coverage ] ***
[+] {"_bound":0} took 0.474s
[!] Exception E: SyntaxError: Unexpected end of JSON input of coverage data on
[!] Exception E: SyntaxError: Unexpected end of JSON input of test data on
[!] Exit code non-zero
[!] Error extracting final output - a fatal error must have occured
[!] expoSE replay /home/sobhan/ExpoSE/tests/numbers/infoflow '{"_bound":0}'
[!] Stats
[!] Done
[+] Total Lines Of Code 0
[+] Total Coverage: NaN%
[+] EXPOSE_PRINT_COVERAGE=1 for line by line breakdown
[+] ExpoSE Finished. 1 paths, 1 errors
Would you please help me with how to make this work?
Thanks for your work. ExpoSE is easy to use and well-written as a symbolic execution framework. But recently I found a bug. I'll appreciate it if you can help me solve it.
Here is the PoC.
var a = {name: "myname"};
if(a.hasOwnProperty("name"))
console.log('correct');
else
console.log('wrong');
When directly run the script, it will print "correct". But if I use ExpoSE to analyze it, hasOwnProperty will return undefined and "wrong" will be printed. I tried to find the bug in Analyzer but for now, I still have no idea why this happens.
Hi Blake.
This is somewhat similar to #88
I'm looking into the browser feature for possible use in my own work, hopefully contributing a few pull requests along the way.
I have some questions you might be able to answer.
$?.symbol?Thank you for your time,
~Yoshiki
I'm trying to test a small (non-cryptographic) hash function (NB: the actual function I want to test uses charCodeAt(), but since this isn't supported in ExpoSE, I switched to arrays of ints with some reasonable constraints):
"use strict";
var S$ = require('S$');
function obfuscateWord(e) {
let t = 0x17ed2e7f1ccbb000;
for (let n = 0; n < e.length; n++) t = 33 * t ^ e[n];
return t
}
var a = S$.symbol("A", [0] );
S$.assume(a.length < 5);
S$.assume(a.length > 1);
for (var i = 0; i < a.length; i++) {
S$.assume(a[i] > 96); // a
S$.assume(a[i] < 123); // z
}
// 69712246 is the hash of "test"
if (obfuscateWord(a) == 69712246) {
throw 'Reachable';
}When I run this through ExpoSE with EXPOSE_PRINT_PATHS=1, it never finds the "Reachable" line (which can be reached with the input test, i.e. [116, 101, 115, 116]. Instead it generates lots of test cases with this exception (full log attached):
[!] Uncaught exception RangeError [ERR_OUT_OF_RANGE]: error setting argument 2 - The value of "value" is out of range. It must be >= -2147483648 and <= 2147483647. Received 56_894_816_742_442_910_000 Stack: RangeError [ERR_OUT_OF_RANGE]: The value of "value" is out of range. It must be >= -2147483648 and <= 2147483647. Received 56_894_816_742_442_910_000
at checkInt (internal/buffer.js:69:11)
at writeU_Int32LE (internal/buffer.js:689:3)
at Buffer.writeInt32LE (internal/buffer.js:858:10)
at Object.set (/home/moyix/git/ExpoSE/Analyser/node_modules/z3javascript/node_modules/ref-napi/lib/ref.js:932:50)
at Object.set (/home/moyix/git/ExpoSE/Analyser/node_modules/z3javascript/node_modules/ref-napi/lib/ref.js:492:10)
at Object.alloc (/home/moyix/git/ExpoSE/Analyser/node_modules/z3javascript/node_modules/ref-napi/lib/ref.js:526:13)
at Context.proxy (/home/moyix/git/ExpoSE/Analyser/node_modules/z3javascript/node_modules/ffi-napi/lib/_foreign_function.js:50:28)
at Context.Z3.<computed> (/home/moyix/git/ExpoSE/Analyser/node_modules/z3javascript/bin/package.js:811:32)
at Context._buildConst (/home/moyix/git/ExpoSE/Analyser/node_modules/z3javascript/bin/Context.js:76:27)
at Context._build (/home/moyix/git/ExpoSE/Analyser/node_modules/z3javascript/bin/Context.js:67:31)
[!] ====== EXITING SCRIPT /home/moyix/git/ExpoSE/obfuscate_short.js depth 0 ======
Full log: expose_error.txt
Any idea what is going wrong here? Or did I do something wrong with the constraints?
steps
test output here https://gist.github.com/kumavis/53d1f802fa8109790d343835d9ef6eb0
I'll take a closer look at the CI to try and figure out what I'm missing
Hello!
I was wondering if there was a way to assume more complex constraints on symbolic strings.
For example, a priori knowledge like "symbolic string does not contain this substring"
I tried S$.assume(x.indexOf(substr) === -1), where x is a symbolic string, but it looks like this is halting the symbolic execution.
To give you a little more context, I'm trying to use your tool for analysis of web JavaScript with URL query strings as variables. A very common pattern I see is the following.
var S$ = require('S$');
var x = S$.symbol("X", '2');
\\S$.assume(x.indexOf('=') === -1);
\\S$.assume(x.indexOf('&') === -1);
var url = 'https://experiment.com?z=' + x;
const hashes = url.slice(url.indexOf('?') + 1).split('&');
const params = {}
hashes.map(hash => {
const [key, val] = hash.split('=')
params[key] = decodeURIComponent(val)
});
if(params['z'] === '3') {
throw "Hello Z3.";
}
If no substring assumptions are made, then expoSE does explore a large number of path. However, looking at the traces, generated inputs exercise the split('&') and split('=') operators, failing to reach the last conditional block.
It would really help if I can tell the symbolic execution to ignore '=' and '&'
If this is currently unsupported, then it would be great if you can point me to the location where I can pass extra constraints to the solver.
Thanks,
~Yoshiki
Hello,
I'm trying to learn and use some DSE tools, and found ExpoSE, but sorry, I couldn't get it to work. The question is: what I'm doing wrong or not seeing properly?
The setup was fine, and I executed successfully all tests running ./scripts/run_testes.
Now I'm running the command EXPOSE_LOG_LEVEL=3 EXPOSE_PRINT_PATHS=1 EXPOSE_PRINT_COVERAGE=1 expoSE ./minimist, and after a few minutes I got some messages, evertything seens to be fine, but those two messages points to a dead-end:
[!] Wrote final coverage to /var/folders/g1/zw1lbf2x0gz_b1n899bhjszw0000gn/T/tmp-34291p8JnimJ4p6bm
[!] Wrote final output to /var/folders/g1/zw1lbf2x0gz_b1n899bhjszw0000gn/T/tmp-34291PpRL57fVU2JE
Those files doesn't exists after the script has finished! I got some more messages, a listing from index.js, and the files index_jalangi.js and index_jalangi.json was generated and I'm studying them now.
But I didn't got any luck running the UI! After selecting minimist/index.js using the Analyze option, runtime counter finish at ~18/19, no info is reported, and at Output tab I got:
( . . . )
,SyntaxError: Unexpected token in / in JSON at position 0
,at JSON.parse()
,at Object.(/Users/ra978165/Developer/ExpoSE/Distributor/bin/Distributor.js:39:23)
,at Module._compile(module.js:571:32)
( . . . )
The other tabs and all info is blank! At this point I ventured some debugging, and at this point ExpoSE seens to be trying to load ./minimist/index.js using the JSON.parser() and I didn't figure out what can I do to fix my input, since the Analyse option didn't enable .json files! The Load option didn't the trick either!
A few hints would be greatly appreciated!
The safety check on concretization of objects (for example the result of exec) can make that object concrete prior to a symbolic call.
The correct behavior here is difficult to model but it would be nice if there was at least a limit support for code like
var x = /Hello/.exec(S$.symbol('A', ''));
console.log(x);
if (x && x[0] == "What") { throw 'Woops' }
Seems to be caused by using intersection (Assertions) with nested capture groups
A bad run method usage has caused bugs. This should be tested so it doesn't happen again.
package.json currently contains "main": "src/main.js", which doesn't exist.
The most sensible way I would "consume" this as a NodeJS package would be to use symbol support in my code. E.g.,
import S$ from 'expose';
// or
// import {symbol} from 'expose';
const intInput = S$.symbol('intInput', 0);
// ...For this reason, I think "main": "lib/S$/src/symbols.js" would make sense. In any case, "main": "src/main.js" is misleading.
npm ERR! code ENOTSUP
npm ERR! notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm ERR! notsup Not compatible with your version of node/npm: [email protected]
npm ERR! notsup Not compatible with your version of node/npm: [email protected]
npm ERR! notsup Required: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"}
npm ERR! notsup Actual: {"npm":"6.14.12","node":"14.16.1"}
npm ERR! A complete log of this run can be found in:
npm ERR! /home/skyer/.npm/_logs/2023-08-09T05_50_11_397Z-debug.log
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] postinstall: `./scripts/postinstall`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] postinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm ERR! A complete log of this run can be found in:
npm ERR! /home/skyer/.npm/_logs/2023-08-09T05_50_11_435Z-debug.log
Let me begin by congratulating you for the excellent papers.
Was wondering how to use the Browser mode w/ Electron? How to specify symbolic input in that case? I can see the Electron browser showing up but then after closing it I get a bunch of errors in the CLI:
[!] Exception E: SyntaxError: Unexpected end of JSON input of test data on
[!] Exception E: SyntaxError: Unexpected end of JSON input of coverage data on
[!] Error extracting final output - a fatal error must have occured
[!] expoSE replay 'https://google.com' '{"_bound":0}'
[!] Stats
[!] Done
[+] Total Lines Of Code 0
[+] Total Coverage: NaN%
[+] EXPOSE_PRINT_COVERAGE=1 for line by line breakdown
[+] ExpoSE Finished. 1 paths, 1 errors
Digging around the log file in /tmp/ it appears to me that it always fails to instrument:
b'Transforming\nFailure during HTML instrumentation: ENOENT: no such file or directory, open ... ...
... ...
... ...
... ...
Exception in processFile() @ proxy.py
Traceback (most recent call last):
File "node_modules/jalangi2/scripts/proxy.py", line 51, in processFile
with open (instrumentedFileName, "r") as file:
FileNotFoundError: [Errno 2] No such file or directory: 'cache/www.google.com/e286e6d443be5e0a7f6b1b5381f16203/index_jalangi_.html'
I wrote a very simple page as a test (shown below) but that also results in a similar instrumentation failure. Can you give me some pointers to how to make it work?
<!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Parse foo</title>
</head>
<body>
<script>
var s = location.href.substring(document.location.href.indexOf("?a=")+3);
var regex1 = RegExp('foo*','g');
var array1;
while ((array1 = regex1.exec(s)) !== null) {
document.write(`Found ${array1[0]}. Next starts at ${regex1.lastIndex}.<br>`);
}
</script>
</body>
</html>Recently I am trying to analyze some modules with ExpoSE. Since ExpoSE is based on jalangi2, I have to use babel to downgrade modules that are not compatible with jalangi2. Then I found the bug. Some test scripts cannot work correctly with ExpoSE.
Take consono as an example. It will infinitely call the following functions when running with ExpoSE.
[?] Entering anonymous near (/home/james/nodejs/ExpoSE/node_modules/core-js/internals/fix-regexp-well-known-symbol-logic.js:116:7:116:75)
[?] TODO: IsNative Uncached
[?] Entering anonymous near (/home/james/nodejs/ExpoSE/node_modules/core-js/modules/es.string.replace.js:38:3:98:4)
[?] TODO: IsNative Uncached
[?] Entering anonymous near (/home/james/nodejs/ExpoSE/node_modules/core-js/internals/fix-regexp-well-known-symbol-logic.js:94:41:105
The command I executed is EXPOSE_PRINT_PATHS=1 EXPOSE_LOG_LEVEL=3 ./expoSE target/TestConsono/TestConsono.js.
In case you need the testcase, I've uploaded it to the following repo.
https://github.com/cl0udz/bug-poc
I am new to this library, so I'm not sure if this is a bug or I am missing something.
Considering the following test case:
const S$ = require('S$');
const s = S$.symbol('s', 'x');
if (s.replace('', '').length) {
throw 'Has length'
} else {
throw 'Nope'
}I would have expected it to find both paths (one with s = 'x' and one with s = ''), however running expoSE test.js results in:
[!] Nope
[!] expoSE replay '{...}/test.js' '{"_bound":0}'
[!] Stats
[+] General Function Call: 5
[+] Symbolic Values: 1
[+] Symbolic Primitives: 1
[+] Wrapped Constants: 1
[+] Symbolic Field: 1
[+] Modeled Function Call: {"#replace":1}
[!] Done
[+] /home/oaie/hacks/html-parser/src/test.js. Coverage (Term): 81% Coverage (Decisions): 50% Coverage (LOC): 80% Lines Of Code: 7 -*
[+] Total Lines Of Code 7
[+] Total Coverage: 0.8%
[+] EXPOSE_PRINT_COVERAGE=1 for line by line breakdown
[+] ExpoSE Finished. 1 paths, 1 errors
When using the empty string as the default parameter it finds the first one (Has length) but not the second one (Nope). Thus it seems, that using the no-op s.replace('', '') prevents it from searching for further solutions somehow. Without the .replace(...) call it finds both solutions.
I first tried building on MacOS and ran into this issue. To make it easier for you to reproduce the issue, I upgraded the Dockerfile to match the latest install instruction. You can find the changes in my fork.
The build error is as follows:
Setting up for Node
v14.16.1
Installing top level
npm WARN [email protected] No repository field.
npm WARN [email protected] No license field.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
added 443 packages from 304 contributors and audited 444 packages in 25.174s
36 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
Setting Up Packages
Cleaning lib/S$
Setting up lib/S$
Pulling Dependencies
npm WARN [email protected] No repository field.
npm WARN [email protected] license should be a valid SPDX license expression
up to date in 0.521s
found 0 vulnerabilities
Cleaning lib/Stats
Setting up lib/Stats
Pulling Dependencies
npm WARN [email protected] No description
npm WARN [email protected] No repository field.
npm WARN [email protected] No license field.
up to date in 0.505s
found 0 vulnerabilities
Cleaning Analyser
Setting up Analyser
Pulling Dependencies
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: This NPM package for DataTables has now been deprecated and the 'datatables.net' set of packages should be used in preference to this one. Please see the NPM installation guide for DataTables for more details: https://datatables.net/download/npm.
npm WARN deprecated [email protected]: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated [email protected]: This module relies on Node.js's internals and will break at some point. Do not use it, and update to [email protected].
> [email protected] postinstall /source/Analyser/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!
The project needs your help! Please consider supporting of core-js on Open Collective or Patreon:
> https://opencollective.com/core-js
> https://www.patreon.com/zloirock
Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)
> [email protected] postinstall /source/Analyser
> ./scripts/postinstall
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: 🙌 Thanks for using Babel: we recommend using babel-preset-env now: please read https://babeljs.io/env to update!
npm WARN deprecated [email protected]: This NPM package for DataTables has now been deprecated and the 'datatables.net' set of packages should be used in preference to this one. Please see the NPM installation guide for DataTables for more details: https://datatables.net/download/npm.
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated [email protected]: This module relies on Node.js's internals and will break at some point. Do not use it, and update to [email protected].
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: Jade has been renamed to pug, please install the latest version of pug instead of jade
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated [email protected]: to-iso-string has been deprecated, use @segment/to-iso-string instead.
> [email protected] postinstall /source/Analyser/node_modules/jalangi2/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
npm notice created a lockfile as package-lock.json. You should commit this file.
added 146 packages from 825 contributors and audited 148 packages in 10.81s
4 packages are looking for funding
run `npm fund` for details
found 29 vulnerabilities (18 moderate, 7 high, 4 critical)
run `npm audit fix` to fix them, or `npm audit` for details
Cloning into 'node_modules/z3javascript'...
> [email protected] install /source/Analyser/node_modules/z3javascript/node_modules/ref-napi
> node-gyp-build
> [email protected] install /source/Analyser/node_modules/z3javascript/node_modules/ffi-napi
> node-gyp-build
gyp ERR! configure error
gyp ERR! stack TypeError: Cannot read property 'pipeline' of undefined
gyp ERR! stack at Object.<anonymous> (/source/Analyser/node_modules/z3javascript/node_modules/node-gyp/lib/install.js:8:32)
gyp ERR! stack at Module._compile (internal/modules/cjs/loader.js:1063:30)
gyp ERR! stack at Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
gyp ERR! stack at Module.load (internal/modules/cjs/loader.js:928:32)
gyp ERR! stack at Function.Module._load (internal/modules/cjs/loader.js:769:14)
gyp ERR! stack at Module.require (internal/modules/cjs/loader.js:952:19)
gyp ERR! stack at require (internal/modules/cjs/helpers.js:88:18)
gyp ERR! stack at Object.acc.<computed> [as install] (/source/Analyser/node_modules/z3javascript/node_modules/node-gyp/lib/node-gyp.js:80:32)
gyp ERR! stack at getNodeDir (/source/Analyser/node_modules/z3javascript/node_modules/node-gyp/lib/configure.js:53:26)
gyp ERR! stack at configure (/source/Analyser/node_modules/z3javascript/node_modules/node-gyp/lib/configure.js:24:10)
gyp ERR! System Linux 5.15.0-92-generic
gyp ERR! command "/home/expose/.local/share/fnm/node-versions/v14.16.1/installation/bin/node" "/source/Analyser/node_modules/z3javascript/node_modules/node-gyp/bin/node-gyp.js" "rebuild"
gyp ERR! cwd /source/Analyser/node_modules/z3javascript/node_modules/ffi-napi
gyp ERR! node -v v14.16.1
gyp ERR! node-gyp -v v10.0.1
gyp ERR! not ok
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^16.14.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16 || 14 >=14.17"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^16.14.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16 || 14 >=14.17"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16 || 14 >=14.17"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16 || 14 >=14.17"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for @npmcli/[email protected]: wanted: {"node":"^16.14.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: @npmcli/[email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^16.14.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16 || 14 >=14.17"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16 || 14 >=14.17"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for @npmcli/[email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: @npmcli/[email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16 || 14 >=14.17"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":"^14.17.0 || ^16.13.0 || >=18.0.0"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN notsup Unsupported engine for [email protected]: wanted: {"node":">=16"} (current: {"node":"14.16.1","npm":"6.14.12"})
npm WARN notsup Not compatible with your version of node/npm: [email protected]
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.2 (node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN [email protected] license should be a valid SPDX license expression
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] install: `node-gyp-build`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] install script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm ERR! A complete log of this run can be found in:
npm ERR! /home/expose/.npm/_logs/2024-02-16T13_19_25_449Z-debug.log
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] postinstall: `./scripts/postinstall`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] postinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
npm ERR! A complete log of this run can be found in:
npm ERR! /home/expose/.npm/_logs/2024-02-16T13_19_25_553Z-debug.log
Cleaning Tester
Setting up Tester
Pulling Dependencies
> [email protected] postinstall /source/Tester/node_modules/core-js
> node -e "try{require('./postinstall')}catch(e){}"
npm WARN [email protected] No repository field.
npm WARN [email protected] license should be a valid SPDX license expression
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
added 319 packages from 132 contributors and audited 323 packages in 13.096s
6 packages are looking for funding
run `npm fund` for details
found 6 vulnerabilities (2 low, 4 high)
run `npm audit fix` to fix them, or `npm audit` for details
Cleaning Distributor
Setting up Distributor
Pulling Dependencies
npm WARN [email protected] No repository field.
npm WARN [email protected] license should be a valid SPDX license expression
added 17 packages from 14 contributors and audited 17 packages in 1.376s
2 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
Cleaning Dashboard
./scripts/setup/cleanup: line 3: cd: Dashboard: No such file or directory
Setting up Dashboard
Pulling Dependencies
./scripts/setup/setup_pkg: line 7: cd: Dashboard: No such file or directory
npm WARN [email protected] No repository field.
npm WARN [email protected] No license field.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
added 443 packages from 304 contributors and audited 444 packages in 19.767s
36 packages are looking for funding
run `npm fund` for details
found 0 vulnerabilities
Cleaning Browser
Setting up Browser
Pulling Dependencies
> [email protected] postinstall /source/Browser/node_modules/electron
> node install.js
Downloading SHASUMS256.txt
[============================================>] 100.0% of 5.39 kB (5.39 kB/s)
npm WARN [email protected] No repository field.
added 115 packages from 115 contributors and audited 115 packages in 19.552s
4 packages are looking for funding
run `npm fund` for details
found 16 vulnerabilities (3 low, 10 moderate, 3 high)
run `npm audit fix` to fix them, or `npm audit` for details
Building Analyser
/source/.eslintrc.json
0:0 warning File ignored by default. Use a negated ignore pattern (like "--ignore-pattern '!<relative/path/to/filename>'") to override
/source/Distributor/src/Spawn.js
99:21 warning Unnecessary escape character: \/ no-useless-escape
✖ 2 problems (0 errors, 2 warnings)
Building Libs
Successfully compiled 1 file with Babel (1123ms).
Building Distributor
Successfully compiled 15 files with Babel (2052ms).
Building Analyser
Successfully compiled 24 files with Babel (2303ms).
Building into /source
Bundling Analyser/bin/Analyser.js into bin/bundle.js
Copying Analyser Dependencies to Browser
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.