一句话：提出状态感知测试用例生成框架 Coni，基于规范建模连接器状态并结合差分测试，检出 44 个新缺陷。
数据库连接器被广泛用于应用与数据库的交互，其缺陷会导致返回错误结果或连接意外中断。现有 DBMS 模糊测试主要关注 SQL 生成且仅使用少量连接器接口，难以直接迁移；同时缺乏领域知识使自动测试用例生成难以探索连接器的复杂交互。本文的核心挑战是生成语义正确且能触发各种连接器状态迁移的测试用例。为此，作者提出 Coni：首先依据相关标准规范定义数据库连接器状态模型，并据此在测试用例中生成接口调用序列以覆盖各种状态迁移；随后利用运行时收集的参数信息与上下文信息生成合适的参数值；最后将测试用例同时执行于目标连接器与参考连接器，结果不一致即提示潜在缺陷。作者在 5 个广泛使用的 JDBC 连接器（MySQL Connector/J、MariaDB Connector/J、AWS JDBC Driver for MySQL、PGJDBC 和 PG JDBC NG）上评估 Coni，共报告 44 个此前未知的缺陷，其中 34 个已被确认。
Database connectors are widely used in many applications to facilitate flexible and convenient database interactions. Potential bugs in database connectors can lead to various abnormal behaviors within applications, such as returning incorrect results or experiencing unexpected connection interruption. However, existing DBMS fuzzing works cannot be directly applied to testing database connectors as they mainly focus on SQL generation and use a small subset of connector interfaces. Automated test case generation also struggles to generate effective test cases that explore intricate interactions of database connectors due to a lack of domain knowledge. The main challenge in testing database connectors is generating semantically correct test cases that can trigger various connector state transitions. To address that, we propose CONI, a framework designed for detecting logic bugs of database connectors with state-aware test case generation. First, we define the database connector state model by analyzing the corresponding standard specification. Building upon this model, Coni generates interface call sequences within test cases to encompass various state transitions. After that, Coni generates suitable parameter values based on the parameter information and contextual information collected during runtime. Then the test cases are executed on a target and a reference database connector. Inconsistent results indicate potential bugs. We evaluated CONI on 5 widely-used JDBC database connectors, namely MySQL Connector/J, MariaDB Connector/J, AWS JDBC Driver for MySQL, PGJDBC, and PG JDBC NG. In total, Coni reported 44 previously unknown bugs, of which 34 have been confirmed.
DOI 原文 ·
@inproceedings{paperbot8884,
title = {Coni: Detecting Database Connector Bugs via State-Aware Test Case Generation},
author = {Wenqian Deng and Jie Liang and Zhiyong Wu and Jingzhou Fu and Mingzhe Wang and Yu Jiang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00003}
}