We present the first systematic approach to static and dynamic taint analysis for Graph APIs focusing on broken access control. The approach comprises the following. We taint nodes of the Graph API if they represent data requiring specific privileges in order to be retrieved or manipulated, and identify API calls which are related to sources and sinks. Then, we statically analyze whether a tainted information flow between API source and sink calls occurs. To this end, we model the API calls using graph transformation rules. We subsequently use Critical Pair Analysis to automatically analyze potential dependencies between rules representing source calls and rules representing sink calls. We distinguish direct from indirect tainted information flow and argue under which conditions the Critical Pair Analysis is able to detect not only direct, but also indirect tainted flow. The static taint analysis (i) identifies flows that need to be further reviewed, since tainted nodes may be created by an API call and used or manipulated by another API call later without having the necessary privileges, and (ii) can be used to systematically design dynamic security tests for broken access control. The dynamic taint analysis checks if potential broken access control risks detected during the static taint analysis really occur. We apply the approach to a part of the GitHub GraphQL API. The application illustrates that our analysis supports the detection of two types of broken access control systematically: the case where users of the API may not be able to access or manipulate information, although they should be able to do so; and the case where users (or attackers) of the API may be able to access/manipulate information that they should not.

Kein CA

Graph databases are now playing an important role because they allow us to overcome some limitations of relational databases. In particular, in graph databases we are interested not only on the data contained but also on its topology. As a consequence, most graph database queries are navigational, asking whether some nodes are connected by edges or paths. Up to now, most foundational work has concentrated on the study of computational models and query languages, analyzing their expressivity, computability, and complexity. However, in our work we address a different kind of foundational work. We are not concerned with expressibility, efficiency or feasibility issues, but with correctness. More precisely, given an algorithm or an implementation for solving queries, how can we be sure that the answers obtained are correct (soundness) and that all possible correct answers are obtained by our implementation (completeness). In this sense, in this paper we first present a core query language, similar to Cypher or G-Core. Then, we define a simple logic whose formulas are precisely the database queries, and whose satisfaction relation defines what is a correct answer. Finally, we define an operational semantics, which could be seen as an abstract implementation of our language, showing that the semantics is correct, i.e. sound and complete with respect to our logic.

Drags are a recent, natural generalization of terms which admit arbitrary cycles. A key aspect of drags is that they can be equipped with a composition operator so that rewriting amounts to replace a drag by another in a composition. In this paper, we develop a unification algorithm for drags that allows to check the local confluence property of a set of drag rewrite rules.

Abstract We introduce a logic-based incremental approach to graph repair, generating a sound and complete (upon termination) overview of least-changing graph repairs from which a user may select a graph repair based on non-formalized further requirements. This incremental approach features delta preservation as it allows to restrict the generation of graph repairs to delta-preserving graph repairs, which do not revert the additions and deletions of the most recent consistency-violating graph update. We specify consistency of graphs using the logic of nested graph conditions, which is equivalent to first-order logic on graphs. Technically, the incremental approach encodes if and how the graph under repair satisfies a graph condition using the novel data structure of satisfaction trees, which are adapted incrementally according to the graph updates applied. In addition to the incremental approach, we also present two state-based graph repair algorithms, which restore consistency of a graph independent of the most recent graph update and which generate additional graph repairs using a global perspective on the graph under repair. We evaluate the developed algorithms using our prototypical implementation in the tool AutoGraph and illustrate our incremental approach using a case study from the graph database domain.

In the context of software model-driven development, artifacts are specified by several models describing different aspects, e.g., different views, dynamic behavior, structure, distributed information, etc. Then, maintaining and repairing consistency of the whole specification are crucial issues if the models can be separately developed and updated. Model Synchronization is the process of restoring consistency after the update of one or several of the models. In the present work, we approach the case when conflicts may arise due to concurrently updating different models. Specifically, based on the Triple Graph Grammar approach, we propose an incremental algorithm $$\mathtt{CSynch}$$ for solving conflicts and repairing consistency. In addition, we identify and formalize when a synchronizing solution can be considered adequate and show that our procedure $$\mathtt{CSynch}$$ is sound and complete.

Graph repair, restoring consistency of a graph, plays a prominent role in several areas of computer science and beyond: For example, in model-driven engineering, the abstract syntax of models is usually encoded using graphs. Flexible edit operations temporarily create inconsistent graphs not representing a valid model, thus requiring graph repair. Similarly, in graph databases—managing the storage and manipulation of graph data—updates may cause that a given database does not satisfy some integrity constraints, requiring also graph repair. We present a logic-based incremental approach to graph repair, generating a sound and complete (upon termination) overview of least-changing repairs. In our context, we formalize consistency by so-called graph conditions being equivalent to first-order logic on graphs. We present two kind of repair algorithms: State-based repair restores consistency independent of the graph update history, whereas delta-based (or incremental) repair takes this history explicitly into account. Technically, our algorithms rely on an existing model generation algorithm for graph conditions implemented in $$\textsc {AutoGraph}$$ . Moreover, the delta-based approach uses the new concept of satisfaction (ST) trees for encoding if and how a graph satisfies a graph condition. We then demonstrate how to manipulate these $$\mathrm {STs}$$ incrementally with respect to a graph update.

Triple graph grammars (TGGs) are a well-established concept for the specification and execution of bidirectional model transformations within model driven software engineering. Their main advantage is an automatic generation of operational rules for forward and backward model transformations, which simplifies specification and enhances usability as well as consistency. In this paper we present several important results for analysing model transformations based on the formal categorical foundation of TGGs within the framework of attributed graph transformation systems. Our first main result shows that the crucial properties of correctness and completeness are ensured for model transformations. In order to analyse functional behaviour, we generate a new kind of operational rule, called aforward translation rule. We apply existing results for the analysis of local confluence for attributed graph transformation systems. As additional main results, we provide sufficient criteria for the verification of functional behaviour as well as a necessary and sufficient condition for strong functional behaviour. In fact, these conditions imply polynomial complexity for the execution of the model transformation. We also analyse information and complete information preservation of model transformations, that is, whether a source model can be reconstructed (uniquely) from the target model computed by the model transformation. We illustrate the results for the well-known model transformation example from class diagrams to relational database models.

Nested application conditions generalise the well-known negative application conditions and are important for several application domains. In this paper, we present Local Church–Rosser, Parallelism, Concurrency and Amalgamation Theorems for rules with nested application conditions in the framework of $\mathcal{M}$ -adhesive categories, where $\mathcal{M}$ -adhesive categories are slightly more general than weak adhesive high-level replacement categories. Most of the proofs are based on the corresponding statements for rules without application conditions and two shift lemmas stating that nested application conditions can be shifted over morphisms and rules.

Graph transformation systems have been studied extensively and applied to several areas of computer science like formal language theory, the modeling of databases, concurrent or distributed systems, and visual, logical, and functional programming. In

Applying an attributed graph transformation rule to a given object graph always implies some kind of constraint solving. In many cases, the given constraints are almost trivial to solve. For instance, this is the case when a rule describes a transfor

Abstract Graph constraints were introduced in the area of graph transformation, in connection with the notion of (negative) application conditions, as a form to limit the applicability of transformation rules. However, we believe that graph constraints may also play a significant role in the area of visual software modelling or in the specification and verification of semi-structured documents or websites (i.e. HTML or XML sets of documents). In this sense, after some discussion on these application areas, we concentrate on the problem of how to prove the consistency of specifications based on this kind of constraints. In particular, we present proof rules for two classes of graph constraints and show that our proof rules are sound and (refutationally) complete for each class. In addition, we study clause subsumption in this context as a form to speed up refutation.

The aim of this paper is to present a generic framework for the modelling of componentbased systems using architectural connectors. More precisely, concepts of component, connector and architecture are presented in a formal generic way, which are independent of any semi-formal or formal modelling approach. The idea is that one could use this framework to define component and connector notions for every given modelling formalism. As a main result, we define the semantics of architectures using graph transformation, showing that the semantics is independent of the order in which the connections are computed, and that the semantics is compatible with transformation. In the continuation of this paper, we show the applicability of our ideas. In particular, our framework is instantiated by Petri nets and CSP, including a case study using Petri Nets.

The aim of this paper is to show how the generic approach to connector architectures, presented in the first part of this work, can be applied to a given modeling formalism to define architectural component and connector notions associated to that formalism. Starting with a review of the generic approach, in this second part of the paper we consider two modeling formalisms: elementary Petri nets and CSP. As main results we show that both cases satisfy the axioms of our component framework, so that the results concerning the semantics of architectures can be applied. Moreover, a small case study in terms of Petri Nets is presented in order to show how the results can be applied to a connector architecture based on Petri nets.

Graph transitions represent an extension of the DPO approach to graph transformation for the specification of reactive systems. In this paper, we develop the theory of concurrency for graph transitions. In particular, we prove a local Church–Rosser theorem and define a notion of shift-equivalence that allows us to represent both intra-concurrency (within the specified subsystem) and inter-concurrency (between subsystem and environment). Via an implementation of transitions in terms of DPO transformations with context rules, a second, more restrictive notion of equivalence is defined that captures, in addition, the extra-concurrency (between operations of the environment). As a running example and motivation, we show how the concepts of this paper provide a formal model for distributed information systems.

In this paper we try to shed some light on the similarities and differences in the different approaches denning the notions of implementation and implementation correctness. For obvious reasons, we do not discuss all existing approaches individually. Instead, a formal framework is introduced in order to discuss the most important ones. Additionally, we discuss some issues, which in our opinion are often misunderstood, concerning transitivity of implementation correctness and its role in the software development process. In particular, on the one hand, we show that for reasonable notions of implementation, it is almost impossible to prove transitivity of implementation correctness at the specification level. On the other hand, we show that this is not really important if the programming language satisfies the properties of horizontal and vertical composition.

In this paper we continue previous work by Sannella, Sokolowski and Tarlecki on parameterization in specification languages. Within the loose approach, we define specification and model level semantics for two kinds of parameterizations (parameterized specifications and specifications of parameterized data types) and describe, in a compositional manner, parameter passing at both levels. Moreover, the specification and the model level semantics of parameter passing are shown to be compatible. We also show that the results obtained do not only apply to the loose approach but can also be directly applicable to the initial framework, and in general to any other kind of monomorphic framework (i.e., a framework where all specifications are monomorphic). In particular, the results obtained generalize and extend previous results for the initial approach. Finally, to obtain our results, new categorical constructions of multiple pushouts, amalgamations and extensions, which generalize standard notions of pushouts, amalgamations and extensions, had to be introduced.

The intention of this part 1 of an overview paper on algebraic specifications is an informal introduction to formal methods for software development in general and to applications of algebraic specifications in particular. Horizontal structuring and vertical refinement techniques for algebraic specifications are shown to support the general software development process. Moreover, a short overview of case studies and tools in the ESPRIT projects LOTOSPHERE and PROSPECTRA is given. In part 2 of this paper we give a survey of the research field of algebraic specifications developed within the last two decades, which shows how the classical view of algebraic specifications has been extended towards a general theory of foundations of system specifications.

Part I of this paper concerning algebraic specifications is an informal introduction to formal methods for software development using algebraic techniques. The intention of this second part of the paper is to survey the research field of algebraic specifications developed within the last two decades and the role of this field concerning formal methods in computer science. The aim of this paper is to show that the classical field of algebraic specifications, using equational axioms, equational logic and algebraic data types and varieties, has reached a consolidated status by now. It can be considered as an important kernel of a more general theory which is presently under development, focusing on the foundations of system specifications in general.