Treffer: Concolic Testing of Full-Stack JavaScript Applications

Recent years have seen the rise of so-called full-stack JavaScript web applications, where both the client and the server side of the web application are developed in JavaScript. Both sides communicate with each other via asynchronous messages, as enabled by e.g., WebSockets. Traditionally, automated whitebox testing of web applications involves testing both sides of the application in isolation from each other. However, this approach lacks a holistic overview of the entire web application under test. This leads to inaccuracies in the types of program bugs that are reported by the tester, and makes it more difficult for developers to understand how the behaviour of the client may affect the behaviour of the server, and vice versa. An interesting side-effect of the evolution towards full-stack applications is that a single automated tester can be developed that observes the execution of both parts of the system simultaneously, thereby remedying the aforementioned issues. In this paper, we examine the benefits and design challenges in employing such a holistic approach towards testing full-stack applications, and we demonstrate STACKFUL, the first concolic tester for full-stack JavaScript applications.