Runtime Verification for the Web (RV 2010 Tutorial)

Sylvain Hallé
Sylvain Hallé and Roger Villemaire
Runtime Verification for the Web
A Tutorial Introduction to Interface Contracts
in Web Applications
.
Université du Québec à Chicoutimi
CANADA
Université du Québec à Montréal
CANADA
Fonds de recherche
sur la nature
et les technologies
CRSNG
NSERC

Sylvain Hallé
Web applications and cloud computing: a growing part of
computing systems
Very simple protocols: no state, only basic type checking, the
rest is up to the developers
Loose couplingg of components: nice but comes with problems!
Few works on verification / enforcement of web applications
A ‘‘call to arms’’ to the community: interesting opportunities for
application of RV
Why this tutorial?

Sylvain Hallé
Part One: The basics of web applications
?What is a web application?
An example: the Beep Store
Constraints and problems
Part Two: Interface contracts in web applications
Characterizing constraints
Formalizing constraints
Monitoring constraints
Doing this for real: back to the Beep Store
What’s next?
?
?
?
?
?
?
?
Tutorial overview

Sylvain Hallé
Part One
The basics of web applications

Sylvain Hallé
Desktop computing

Sylvain Hallé
Cloud computingCloud computing

Sylvain Hallé
Cloud computingCloud computing
Network connection

Sylvain Hallé
Cloud computingA static web site

Sylvain Hallé
Bee G
Beatles
Camel
Caravan

Sylvain Hallé
Bee G
Beatles
Camel
Caravan
beatles.html

Sylvain Hallé
Sea
rc
h
The
Beep
Store
W
ha
t is
th
is?
Lo
gin
As
k fo
r ac
co
un
t
Con
ta
ct
us
Ve
rsion
info
beatles.html

Sylvain Hallé
Sea
rc
h
The
Beep
Store
W
ha
t is
th
is?
Lo
gin
As
k fo
r ac
co
un
t
Con
ta
ct
us
Ve
rsion
info
beatles.html
<html>
<h1>
</h1>
</html>
...
Results for
Beatles
...

Sylvain Hallé
Sea
rc
h
The
Beep
Store
W
ha
t is
th
is?
Lo
gin
As
k fo
r ac
co
un
t
Con
ta
ct
us
Ve
rsion
info
beatles.html
<html>
<h1>
</h1>
</html>
...
Results for
Beatles
...
COnly page rendering
instructions are sent

Sylvain Hallé
Cloud computingA dynamic web site
Bee G
Beatles
Camel
Caravan

Sylvain Hallé
Cloud computing
Bee G
Beatles
Camel
Caravan
page.php?artist beatles=
A dynamic web site

Sylvain Hallé

Sylvain Hallé
artist
beatles=

Sylvain Hallé
artist
beatles=
Sea
rc
h
The
Beep
Store
W
ha
t is
th
is?
Lo
gin
As
k fo
r ac
co
un
t
Con
ta
ct
us
Ve
rsion
info

Sylvain Hallé
C
Content is generated
programatically based on
user input
artist
beatles=
Sea
rc
h
The
Beep
Store
W
ha
t is
th
is?
Lo
gin
As
k fo
r ac
co
un
t
Con
ta
ct
us
Ve
rsion
info

Sylvain Hallé
Cloud computingAjax web application

Sylvain Hallé
JavaScript

Sylvain Hallé
Bee G
Beatles
Camel
Caravan

Sylvain Hallé
Bee G
Beatles
Camel
Caravan
<a onclick=
>
"javascript:
findBand(’ ’)"Beatles

Sylvain Hallé
findBand(’Beatles’)

Sylvain Hallé
artist
beatles=

Sylvain Hallé
document.innerHTML = findBand(’Beatles’)
artist
beatles=

Sylvain Hallé
document.innerHTML = findBand(’Beatles’)
artist
beatles=
CPage is updated,
not reloaded

Sylvain Hallé
artist
beatles=
CServer response only provides
updated contents
document.innerHTML =

Sylvain Hallé
Ajax web applications: examples
Microsoft Office Live

Sylvain Hallé
eyeOS

Sylvain Hallé
Chrome OS

Sylvain Hallé
Does not need
to be a URL
Does not need
to be HTML

Sylvain Hallé
Does not need
to be a URL
Does not need
to be HTML
<Search>
</Search>
beatles
<Artist>
</Artist>

Sylvain Hallé
Does not need
to be a URL
Does not need
to be HTML
<SearchResults>
</SearchResults>
The Beatles
Rubber Soul
...
<Item>
</Item>
<Artist>
</Artist>
<Title>
</Title>
<Search>
</Search>
beatles
<Artist>
</Artist>

Sylvain Hallé
<Search>
</Search>
beatles
<Artist>
</Artist> XML
The eXtensible Markup
Language
?Nested collection of
elements
?Input/output data is
semi-structured
.
.
<SearchResults>
</SearchResults>
The Beatles
Rubber Soul
...
<Item>
</Item>
<Artist>
</Artist>
<Title>
</Title>

Sylvain Hallé
Cloud computingConceptually...

Sylvain Hallé
Cloud computingConceptually...
Web service
Web client

Sylvain Hallé
An example: the Beep Store
? tutorial application
?Fake CD catalog + web service
+ web client
?Functionalities typical of applications we studied

?Examples:
Session login/logout
Shopping cart
operations
Purpose-built
SQLite PHP
JavaScript
real-world
.
..
.
.
The
Beep
Store
GO
Sign in or register
What is this?
Login
Ask for account
Contact us
Fault parameters
Search: Your Cart
Search results for ‘Beatles’
Rubber Soul
The Beatles
Yellow Submarine
The Beatles

Sylvain Hallé
Main issue
Possible
between messages sent
and messages expected
mismatch
Not like traditional programming: all
input-output is exchanged unverified!

Sylvain Hallé
Defining message formats
?

Sylvain Hallé
1.
2.
...
?

Sylvain Hallé
1.
2.
...
<ItemSearch>
</ItemSearch>
beatles<Artist> </object>

Sylvain Hallé
<ItemSearch>
</ItemSearch>
<ItemSearchResponse>
<Items>
</Items>
</ItemSearchResponse>
Help!
The Beatles
<Item>
</Item>
...
<Title> </no>
<Artist> </Artist>

Sylvain Hallé
<ItemSearch>
</ItemSearch>
<Items>
</Items>
Help!
The Beatles
<Item>
</Item>
...
<Title> </no>
<Artist> </Artist>
XML request
XML response

Sylvain Hallé
<ItemSearch>
</ItemSearch>
ItemSearch[
[string]
]
Artist
<Items>
</Items>
Help!
The Beatles
<Item>
</Item>
...
<Title> </no>
<Artist> </Artist>
XML request
XML response

Sylvain Hallé
<ItemSearch>
</ItemSearch>
ItemSearch[
[string]
]
Artist
ItemSearchResponse[
[
Item[
Title[string],
Artist[string]
]{0,¥}
]
]
Items
<Items>
</Items>
Help!
The Beatles
<Item>
</Item>
...
<Title> </no>
<Artist> </Artist>
XML request
XML response

Sylvain Hallé
ItemSearch[
[string]
]
Artist
ItemSearchResponse[
[
Item[
Title[string],
Artist[string]
]{0,¥}
]
]
Items
?
!

Sylvain Hallé
WSDL: Web Service Description Language
ItemSearch[
[string]
]
Artist
CartCreate[
[int],
[int],
[
Item[
Title[string],
Artist[string]
]{0,¥}
]
]
Items
SessionKey
Items
?
?
ItemSearchResponse[
[
Item[
Title[string],
Artist[string],
]{0,¥}
]
]
Items
CartCreateResponse[
[int],
[int],
[
Item[
Title[string],
Artist[string]
]{0,¥}
]
]
SessionKey
CartId
Items
!
!
. . .

Sylvain Hallé
http://webservices.amazon.com/AWSECommerceService/
AWSECommerceService.wsdl
https://www.paypal.com/wsdl/PayPalSvc.wsdl
http://api.google.com/GoogleSearch.wsdl
WSDLs for real world web services

Sylvain Hallé
<ItemSearch>
</ItemSearch>
beatles
1234
<Artist> </Artist>
<Bizbiz> </Bizbiz>

Sylvain Hallé
<ItemSearch>
</ItemSearch>
beatles
1234
<Artist> </Artist>
<Bizbiz> </Bizbiz>
ItemSearch[
[string]
]
Artist vs.
?

Sylvain Hallé
<CartCreateResponse>
<SessionKey>
</SessionKey>
<CartId> </CartId>
<Items>
</Items>
1234
abc
...

Sylvain Hallé
<CartCreateResponse>
<SessionKey>
</SessionKey>
<CartId> </CartId>
<Items>
</Items>
1234
abc
...
CartCreateResponse[
[int],
[int],
[
Item[
Title[string],
Artist[string]
]{0,¥}
]
]
SessionKey
CartId
Items
vs.
!

Sylvain Hallé
?
What happened?

Sylvain Hallé
1.
2.
...
What happened?

Sylvain Hallé
2
What happened?

Sylvain Hallé
c
What happened?

Sylvain Hallé
2
c
What happened?

Sylvain Hallé
?
2
c
2
c
Interface contracts
All messages comply with the WSDL but...
1.
2.
...

Sylvain Hallé
?
2
c
2
c
Interface contracts
You cannot add the same item
twice to the shopping cart
1.
2.
...

Sylvain Hallé
?
2
c
2
c
Interface contracts
???
You cannot add the same item
twice to the shopping cart
1.
2.
...

Sylvain Hallé
Interface contracts
???

Sylvain Hallé
???
Interface contracts

Sylvain Hallé
Free-form messages
Stateful interactions, stateless protocols
No uniform contract notation
Constraints at message level
XML, but that’s about it. No assumptions on nesting,
degree, etc.
HTTP / SOAP define only message structure
No protocol enforces sequential constraints
Plain-text documentation... but OWL, RDF, ...
Components are black boxes (e.g. Amazon)
What are the issues?

Sylvain Hallé
The big question
Prevent
contract
violations

Sylvain Hallé
1. A priori certification
A trustworthy authority
assesses the client’s
compliance to the contract...
A first solution
Testing, static
verification
etc.

Sylvain Hallé
A trustworthy authority
assesses the client’s
compliance to the contract...
...and grants a digital
certificate
A first solution

Sylvain Hallé
A+
The service needs a certificate to
start an exchange with a client
A first solution

Sylvain Hallé
The service needs a certificate to
start an exchange with a client
Example: iPhone app certification
A+
A first solution

Sylvain Hallé
Z+
Problem: the client can change after
certification
iPhone jailbreaking,
Javascript prototype hijacking, ...
A first solution

Sylvain Hallé
Proposed approach
2. Client-side Runtime
Monitoring
A separate process checks
each message...
CONTRACT

Sylvain Hallé
A
Monitoring
each message...
CONTRACT
Proposed approach

Sylvain Hallé
A
The message is relayed to the web service
proper when it complies with the contract
Monitoring
each message...
Proposed approach

Sylvain Hallé
Monitoring
each message...
...and is discarded when it violates the
contract
Proposed approach

Sylvain Hallé
A web service interacts with a web client through the exchange
of semi-structured XML documents called
The service and client are generally designed by
No verification is done on the incoming and outgoing messages:
possible between sent and expected messages (in both
directions)
A priori checking of a client for compliance is
very hard, if not impossible
Runtime monitoring is a possible solution
messages
different
organisations
mismatch
.
.
.
.
Summary (I)

Sylvain Hallé
Part Two
Interface contracts in
web applications

Sylvain Hallé
Interface contracts
All possible sequences
of all possibles messages
with all possible values

Sylvain Hallé
Interface contracts
Constraints
on individual
messages

Sylvain Hallé
Interface contracts
Constraints
on sequencesConstraints
on individual
messages

Sylvain Hallé
Interface contracts
Constraints
on sequences
Data-aware
sequential constraints
Constraints
on individual
messages

Sylvain Hallé
Interface contracts
Interface contract =
valid (error-free) interactions
Constraints
on sequences
Data-aware
sequential constraints
Constraints
on individual
messages

Sylvain Hallé
Interface contracts
As a tutorial tool, the Beep Store’s JavaScript client can be told
to ‘‘forget’’ elements of the service’s interface contract
The
Beep
Store
GO
Sign in or register
What is this?
Login
Ask for account
Contact us
Fault parameters
Search: Your Cart
Fault parameters
Don’t check Results’s type
In the detailed search form, sends an ItemSearch message without
checking that the Results element is an integer.
"Add to cart" enabled if item present in cart
Makes the "Add to cart" button available for items that are already in the
user's cart.
Message schemas
Cart manipulations
Highlights
documentation
Disables the
verification

Sylvain Hallé
Interface contracts
Dave, my mind
is going...
As a tutorial tool, the Beep Store’s JavaScript client can be told
to ‘‘forget’’ elements of the service’s interface contract

Sylvain Hallé
Constraints on individual messages
Examples:
Three types of constraints (I)
<Message>
<Action>ItemSearch</Action>
<Results>5</Results>
<Keyword>beatles</Keyword>
<Page>1</Page>
</Message>

Sylvain Hallé
Examples:
1. The element must be an integer between 1 and 20.Page "/M
<Message>
<Page>1</Page>
</Message>

Sylvain Hallé
1. The element must be an integer between 1 and 20.
2. The element is mandatory only if is present,
otherwise it is forbidden.
Page
Page Results
"/M
<Message>
<Page>1</Page>
</Message>
Examples:

Sylvain Hallé
Expressing data constraints
Simple XPath
Fetches portions of an XML document according to a
query path = sequence of tags
:set of messages
: set of XML query paths
: set of atomic values
: ´®2
Examples:
(‘‘/a/b/c’’, m) = {1,2,4}
(‘‘/a/b/d’’, m) = Æ
M
M
Q
Q
V
V
p
p
p m
{
<a>
<b>
<c>1</c>
<c>2</c>
</b>
<d>
<c>9</c>
</d>
<b>
<c>3</c>
</b>
</a>

Sylvain Hallé
XPath term
Expresses properties over values fetched by XPath expressions
For some message Î, path Î,
"x : j(x) Ûj(v) for every Î( , )
$x : j(x) Ûj(v) for some Î( , )
Examples:
"x : x < 5/a/b/c
$x :/a/b
$x : "y : y £x/a/b/c /a/b/c
m M
mq
mq
q Q
q
q
v
v
p
p
2
<a>
<b>
<c>1</c>
<c>2</c>
</b>
<d>
<c>9</c>
</d>
<b>
<c>3</c>
</b>
</a>
m
{

Sylvain Hallé
2
Page
Page Results
"/M
<Message>
<Page>1</Page>
</Message>

Sylvain Hallé
2
1. " x : x > 0 Ùx < 21/Message/Page
Page Results
<Message>
<Page>1</Page>
</Message>

Sylvain Hallé
2
1. " x : x > 0 Ùx < 21/Message/Page
2. $ x : Û$ y :/Message/Page /Message/Results
<Message>
<Page>1</Page>
</Message>

Sylvain Hallé
Constraints on message sequences
Examples:
2
<Message>
<Action>
Login
</Action>
...
</Message>
<Message>
<Action>
LoginResponse
</Action>
...
</Message>
<Message>
<Action>
CartCreate
</Action>
...
</Message>
Three types of constraints (II)

Sylvain Hallé
Examples:
2
3. The request cannot be resent if its response is
successful.
.
Login "/
"/
<Message>
<Action>
Login
</Action>
...
</Message>
<Message>
<Action>
LoginResponse
</Action>
...
</Message>
<Message>
<Action>
CartCreate
</Action>
...
</Message>
X

Sylvain Hallé
Examples:
2
successful.
.
4. must follow a successful LoginResponse.
Login
CartCreate
"/
"/
"/
<Message>
<Action>
Login
</Action>
...
</Message>
<Message>
<Action>
LoginResponse
</Action>
...
</Message>
<Message>
<Action>
CartCreate
</Action>
...
</Message>
X

Sylvain Hallé
Linear Temporal Logic
Alphabet (A)
Set of possible messages
Trace (A*)
Sequence of messages

Sylvain Hallé
LTL formula = assertion on the of states in a tracesequence
a "always a"
a "a in the next"
a "eventually a"
a b "a until b"
G
X
F
W
G (a ®b)X (d cÚe) WØFALSE TRUE
. . .A A EC CDB B

Sylvain Hallé
Well-known results:
1. For every LTL formula j, there exists a Büchi automaton A
such that for every (infinite) trace s:
i.e. LTL describes languages
2. The alphabet symbols can be generalized to finite sets of
Boolean propositions
w-regular
ÞLet’s use XPath terms as our Boolean propositions
j
s|= jÛsÎL(A )j

Sylvain Hallé
Examples:
2
3. (" a : a = LoginResponse ®/Message/Action
( " a’ : a’ ¹Login))/Message/Action
.
G
X G
CartCreate "/
<Message>
<Action>
Login
</Action>
...
</Message>
<Message>
<Action>
LoginResponse
</Action>
...
</Message>
<Message>
<Action>
CartCreate
</Action>
...
</Message>
X

Sylvain Hallé
Examples:
2
.
G
X G
CartCreate "/
<Message>
<Action>
Login
</Action>
...
</Message>
<Message>
<Action>
LoginResponse
</Action>
...
</Message>
<Message>
<Action>
CartCreate
</Action>
...
</Message>
X
Xpath terms

Sylvain Hallé
Examples:
2
4. (" a : a ¹CartCreate)/Message/Action
(" a’ : a’ =LoginResponse)/Message/Action
G
X G
W
.
<Message>
<Action>
Login
</Action>
...
</Message>
<Message>
<Action>
LoginResponse
</Action>
...
</Message>
<Message>
<Action>
CartCreate
</Action>
...
</Message>
X
Xpath terms

Sylvain Hallé
The verification can be separated in two steps
G
X
Ú
"$
$ G
F
®
1. Temporal step
Determine termporal
relationships to current
message
2. Data step
Evaluate relevant XPath
terms on message

Sylvain Hallé
Runtime monitoring
Gerth, Peled, Vardi, Wolper (PSTV 1995): construction of a
Büchi automaton from a given LTL formula j
Benefit:
" ": automaton states are built as the
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
j
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
s=
j
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
s=a
j
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
s=a
j
a
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
s=ab
j
a
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
s=ab
j
a b
b
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
s=aba
j
a b
b
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Runtime monitoring
s=aba
j
a
a
a
b
b
Benefit:
trace is read
on-the-fly

Sylvain Hallé
Benefit:
trace is read
Dead end: formula is false
on-the-fly
Runtime monitoring
s=aba
j
a
a
a
b
b

Sylvain Hallé
Runtime monitoring
Algorithm overview:
1. An LTL formula is decomposed into nodes of the form
sub-formulas that
must be true now
sub-formulas that must
be true in the next state

Sylvain Hallé
Algorithm overview:
1. An LTL formula is decomposed into nodes of the form
Example:
sub-formulas that
must be true now
sub-formulas that must
be true in the next state
Runtime monitoring

Sylvain Hallé
2. Negations pushed inside (classical identities +
dual of U = V)
3. At the leaves, Gcontains atoms + negations of atoms:
we evaluate them
Verdict:
! All leaves contain : formula is false
! A leaf is : formula is true
! Otherwise:
4. Next event: Dcopied into Gand we continue
FALSE
empty
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
G (a ®b)X ?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
G (a ®b)X ?
a ®bX G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
G (a ®b)X ?
Øa G (a ®b)X?
a ®bX G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
G (a ®b)X ?
a, X b G (a ®b)X?Øa G (a ®b)X?
a ®bX G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
G (a ®b)X ?
a, X b G (a ®b)X?
a G (a ®b), bX?
Øa G (a ®b)X?
a ®bX G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
a G (a ®b), bX?
Øa G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= a
a G (a ®b), bX?
Øa G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= a
a G (a ®b), bX?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= a
G (a ®b), bX?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= a
?G (a ®b), bX
G (a ®b), bX?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= a
a, X b, b G (a ®b)X?
a, b G (a ®b), bX?
Øa, b G (a ®b)X?
a ®b, bX G (a ®b)X?
?G (a ®b), bX
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= a
a, b G (a ®b), bX?
Øa, b G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= a
Øa, b G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= ac
Øa, b G (a ®b)X?
Runtime monitoring

Sylvain Hallé
Example: G (a ®b)X
s= ac
No way to extend the trace:
formula is false
Runtime monitoring

Sylvain Hallé
Data-aware sequential constraints
Examples:
2
5. There can be at most one active cart ID per session key."/
Three types of constraints (III)
<Message>
<SessionKey>123</SessionKey>
<CartId>789</CartId>
...
</Message>
<Message>
...
</Message>

Sylvain Hallé
Examples:
2
5. (" k : " c :/Message/SessionKey /Message/CartId
(" k’ : " c’ :/Message/SessionKey /Message/CartId
k = k’ ®c = c’))
G
G
<Message>
...
</Message>
<Message>
...
</Message>

Sylvain Hallé
2
k = k’ ®c = c’))
G
G

Sylvain Hallé
·XPath terms and temporal operators are
mixed
.
·Not just ‘‘LTL with syntactical sugar’’
.
·Not just a pathological case
k = k’ ®c = c’))
G
G
2
G
G
"
"
k

Sylvain Hallé
Examples:
2
6. You cannot add the same item twice to the shopping cart."/
<Message>
<Action>CartAdd</Action>
<Items>
<Item>
<ItemId>567</ItemId>
...
<Message>
<Items>
<Item>
...
X

Sylvain Hallé
Examples:
2
6. (" a : a = CartAdd ®/Message/Action
" i : (" a’ :/Message/ItemId /Message/Action
a’ = CartAdd ®" i’ : i ¹i’ ))/Message/ItemId
G
X G
<Message>
<Items>
<Item>
...
<Message>
<Items>
<Item>
...
X

Sylvain Hallé
Quantification must be relative to the values in the current
message, and not the whole set V of possible values!
Example: ‘‘In every message, the a parameter must equal the b
parameter’’. Suppose V = {1,2}, and classical first-order
quantification.
Runtime monitoring
"x : "y : x = ya b
("y : 1 = y) Ù("y : 1 = y)b b
(1 = 1) Ù(1 = 2) Ù(1 = 1) Ù(1 = 2)
Contradiction
G
G G
G G G G

Sylvain Hallé
LTL-FO+
current
(Hallé & Villemaire, EDOC 2008)
Extension of LTL with (limited) first-order quantification on
message elements
·Boolean and LTL operators keep their original meaning
·An XPath term is always meant to refer to the
message in the trace
Runtime monitoring

Sylvain Hallé
Adaptation of the runtime monitoring algorithm to handle
LTL-FO+:
1. Atoms become equality tests
2. Decomposition rules for quantifiers
(and vice versa)
Runtime monitoring

Sylvain Hallé
Six constraints for the Beep Store
Data-aware constraints

Sylvain Hallé
Page
Page Results

Sylvain Hallé
successful.
Page
Page Results
Login
CartCreate

Sylvain Hallé
successful.
5. There can be at most one active cart ID per session key.
6. You cannot add the same item twice to the shopping cart.
Page
Page Results
Login
CartCreate

Sylvain Hallé
Why are web service contracts special?
1. Presence of data-aware constraints
·Cannot separate data part from temporal part
in specification AND enforcement
2. Complex messages
·Arbitrary nested structure
·Cannot say ‘ ItemId’’:
there are many!
·Rules out languages that
merely freeze a value in a
variable
‘the
<Message>
<Items>
<Item>
...
</Item>
<Item>
...
</Item>
...
</Items>
</Message>

Sylvain Hallé
Enforcing interface contracts at runtime
XMLHttpRequest
·JavaScript object
·Provided by the browser
·All communications to monitor
already centralized: ‘‘no’’
instrumentation

Sylvain Hallé
XMLHttpRequestBB

Sylvain Hallé
XMLHttpRequestBB
XMLHttpRequest
LTL-FO+
algorithm
·Wrapper around original
·Provides same methods
·Checks messages before
relaying them

Sylvain Hallé
Add BeepBeep to an application
myapplication.html
<html>
<head>
<title>
</title>
<script type=" "
href=" "/>
</head>
<body>
</body>
</html>
My Application
...
text/javascript
myapplication.js
?
Include BeepBeep
Copy BeepBeep in the application's directory
http://beepbeep.sourceforge.net

Sylvain Hallé
myapplication.html
<html>
<head>
<title>
</title>
<script type=" "
href=" "/>
</head>
<body>
</body>
</html>
My Application
...
text/javascript
myapplication.js
<script type="text/javascript"
href="beepbeep.js"/>
?
Include BeepBeep

Sylvain Hallé
myapplication.html myapplication.js
<html>
<head>
<title>
</title>
<script type=" "
href=" "/>
</head>
<body>
</body>
</html>
My Application
...
text/javascript
myapplication.js
// Initializations
= ();
()
{
( );
}
...
req XMLHttpRequest
...
abc
...
req. some_message
new
function
send
?
Include BeepBeep

Sylvain Hallé
beepstore.html beepstore.js
<html>
<head>
<title>
</title>
<script type=" "
href=" "/>
</head>
<body>
</body>
</html>
My Application
...
text/javascript
myapplication.js
// Initializations
= ();
()
{
( );
}
...
req
...
abc
...
req. some_message
new
function
send
XMLHttpRequestBB
Include BeepBeep
?


Sylvain Hallé
Create a with LTL-FO+ formulascontract file?
# -------------------------------------------------------
# BeepBeep contract file for the Beep Store
# -------------------------------------------------------
% The element Page must be an integer between 1 and 20.
% The element Page is mandatory only if Results is
present, otherwise it is forbidden.
% The Login request cannot be resent if its response
is successful.
; ( p /Message/Page (((p) > ({0})) ((p) < ({21}))))
; ( a /Message/Action (((a) = ({ItemSearch})) (
(( r /Message/Results ({TRUE}))
( p /Message/Page ({TRUE})))
(( p /Message/Page ({TRUE})) (
r /Message/Results ({TRUE}))))))
; ( a /Message/Action (((a) ({LoginResponse}))
( ( ( b /Message/Action ( ((b) ({Login}))))))))
G
G
G
X G
[ ]
[ ]
< >
< >
< >
< >
[ ]
[ ]
&
->
->
&
->
= ->
! =
Caption: used
when violations
are discovered
Plain-text
LTL-FO+
(automatically
parsed)
}

Sylvain Hallé
When loading the application, BeepBeep starts as a small
Java applet inside the page
The
Beep
Store
GO
Sign in or register
What is this?
Login
Ask for account
Contact us
Fault parameters
Search: Your Cart
Search results for ‘Beatles’
Rubber Soul
The Beatles
Yellow Submarine
The Beatles

?/?/?/?/?/?:0:0

Sylvain Hallé
BeepBeep’s visible interface
?/?/?/?/?/?:0:0
Current state of monitor
for each property
Number of
messages
processed
Cumulative
processing
time (in ms)
T: last message made it true
t: is true
F: last message made it false
f: is false
?: not yet true/false

Sylvain Hallé
An interface contract provides constraints cover the of
each XML message, their and their
An extension of Linear Temporal Logic including a limited form
of quantification over message elements specifies them
of these constraints can be done
efficiently, even with quantification
BeepBeep is a tool that allows it with
on real applications
format
contents ordering
Runtime monitoring
minimal modifications
http://beepbeep.sourceforge.net/
Summary (II)

Sylvain Hallé
Bounded-memory fragments of LTL
The forward-only fragment of LTL
(Hallé & Villemaire, SAC 2009)
Applications to runtime monitoring of Java programs
Java-MOP plugin under construction
Symbolic (rather than explicit) handling of quantification
LTL with past operators
Standard web service mechanism for interface contracts?
.
.
Open issues and interesting questions

Sylvain Hallé
In client-side monitoring...
10

Sylvain Hallé
In client-side monitoring...
...the server has no guarantee that
monitoring actually takes place
Z
Z
Z
10

Sylvain Hallé
In server-side monitoring...
9

Sylvain Hallé
In server-side monitoring...
Too many clients may overwhelm the
server’s verification process
9

Sylvain Hallé
Processing savings of
client-side monitoring
Guarantees of server-side
monitoring
11

Sylvain Hallé
Processing savings of
client-side monitoring
11
COOPERATIVE
RUNTIME MONITORING
Best paper award
S. Hallé, Cooperative
runtime monitoring
of LTL Interface Contracts.
Proc. EDOC 2010.Guarantees of server-side
monitoring
COOPERATIVE
RUNTIME MONITORING

Runtime Verification for the Web (RV 2010 Tutorial)

Recommandé

Recommandé

Contenu connexe

Similaire à Runtime Verification for the Web (RV 2010 Tutorial)

Similaire à Runtime Verification for the Web (RV 2010 Tutorial) (20)

Plus de Sylvain Hallé

Plus de Sylvain Hallé (20)

Dernier

Dernier (20)

Runtime Verification for the Web (RV 2010 Tutorial)