一句话：提出首个面向 LSP 服务器的灰盒混合模糊测试器，联合变异源码与编辑器操作，在真实服务器中发现并促成修复大量缺陷。
LSP 已被约 300 个服务器与 50 款编辑器采用，但语言服务器崩溃会禁用全部代码智能功能，漏洞还可能危及编辑不可信代码的开发者，此前却无专用测试技术。本文提出 LspFuzz，一个灰盒混合模糊测试器。其核心洞察是：需对源代码与编辑器操作进行整体变异，因为缺陷常源于二者组合。为满足 LSP 的复杂约束并探索输入空间，它采用两阶段变异：先对源码做语法感知变异，再上下文感知地派发编辑器操作。在四个广泛使用的 LSP 服务器上，LspFuzz 优于基线，发现未知真实缺陷。报告 51 个缺陷，42 个被确认，26 个已修复，2 个获 CVE。
The Language Server Protocol (LSP) has revolutionized the integration of code intelligence in modern software development. There are approximately 300 LSP server implementations for various languages and 50 editors offering LSP integration. However, the reliability of LSP servers is a growing concern, as crashes can disable all code intelligence features and significantly impact productivity, while vulnerabilities can put developers at risk even when editing untrusted source code. Despite the widespread adoption of LSP, no existing techniques specifically target LSP server testing. To bridge this gap, we present LspFuzz, a grey-box hybrid fuzzer for systematic LSP server testing. Our key insight is that effective LSP server testing requires holistic mutation of source code and editor operations, as bugs often manifest from their combinations. To satisfy the sophisticated constraints of LSP and effectively explore the input space, we employ a two-stage mutation pipeline: syntax-aware mutations to source code, followed by context-aware dispatching of editor operations. We evaluated LspFuzz on four widely used LSP servers. LspFuzz demonstrated superior performance compared to baseline fuzzers, and uncovered previously unknown bugs in real-world LSP servers. Of the 51 bugs we reported, 42 have been confirmed, 26 have been fixed by developers, and two have been assigned CVE numbers. Our work advances the quality assurance of LSP servers, providing both a practical tool and foundational insights for future research in this domain.
@inproceedings{paperbot9387,
title = {LspFuzz: Hunting Bugs in Language Servers},
author = {Hengcheng Zhu and Songqiang Chen and Valerio Terragni and Lili Wei and Yepang Liu and Jiarong Wu and Shing-Chi Cheung},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00183}
}