一句话：首个面向 IndexedDB API 的模糊测试方法，通过 IR 种子生成与全局数据库快照实现语义可控的高质量测试用例生成。
浏览器 API 模糊测试虽已取得长足进展，但针对 Web 存储技术的系统性测试方法仍然缺失。IndexedDB 是现代浏览器中最流行的 NoSQL 数据库，其异步事件驱动特性和严格的阶段分离给 API 模糊测试带来了独特挑战：现有浏览器模糊测试技术难以生成嵌套的事件流与调用，严重影响语义正确性，且往往依赖 try-catch 块抑制异常，引入可观的性能开销。本文提出 IDBFuzz，这是首个为 IndexedDB API 量身定制的模糊测试方法，能够有效捕获 IndexedDB 固有的执行上下文与事件语义，并处理大型持久化对象。作者设计了一种基于中间表示（IR）的种子生成器，将分层 IR 骨架与输入对象生成解耦；借助全局数据库快照，IDBFuzz 可以生成语义可控的种子，从而高效产出显著提升覆盖率的高质量测试用例。
Despite great progress in fuzzing browser APIs, systematic approaches for testing web storage techniques remain absent. IndexedDB, the most popular NoSql database in modern browsers, brings unique challenges for fuzzing its API due to its asynchronous event-driven feature and strict phase separation. Current browser fuzzing techniques frequently struggle to generate nested event flows and invocations, which significantly impacts semantic correctness. Moreover, they often rely heavily on the try-catch block to suppress exceptions, which introduces substantial performance overhead. We propose IDBFuzz, the first fuzzing approach tailored for the IndexedDB API, which effectively tackles the challenge of capturing the execution context and event semantics inherent to IndexedDB, as well as handling large persistent objects. We design a seed generator based on intermediate representation (IR) that decouples layered IR skeletons from input object generation. With the aid of a global database snapshot, IDBFuzz can generate semantically controllable seeds, enabling the efficient production of high-quality test cases that significantly improve coverage.
DOI 原文 ·
@inproceedings{paperbot9533,
title = {IDBFuzz: Web Storage DataBase Fuzzing with Controllable Semantics},
author = {Jingyi Chen and Jinfu Chen and Saihua Cai and Shengran Wang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00346}
}