Lawmakers in Arkansas and Missouri are considering legislation that would bolster cyber reporting and data privacy standards for businesses; and, in Texas, tighten cybersecurity standards for water utilities.

Southern, Midwestern Bills Propose Cyber, Data Safeguards

“The most likely thing is the outer core is kind of tugging on the inner core and making it move a little bit,” said John Vidale, a professor of earth sciences at the University of Southern California.

Scientists Detect Shape-Shifting Along Earth’s Solid Inner Core - The New York Times

This article is authored by Drumil Tejas Joshi, Analyst 1 - Monitoring and Diagnostics, Southern Power Company, USA.

Data science and AI: The twin engines powering the renewable energy revolution - Hindustan Times

They are a direct response to the escalating export restrictions imposed by the US and its allies,” Angela Zhang, a professor of law at the University of Southern California and author of a book on Chinese tech regulation, wrote in an op-ed in the Financial Times last week.

DeepSeek caused a $600 billion freakout. But China’s AI upstart may not be the danger to Nvidia and U.S. export controls many assume

(Bloomberg) -- The devastating Palisades Fire pushed to the northeast, prompting new evacuations in the ultra-affluent Southern California neighborhoods of Brentwood and Bel Air as the threat of more dry winds raised risks after a brief respite.Most Read from BloombergA Blueprint for Better ...

Los Angeles Fire Pushes Northeast to Threaten Bel Air, Brentwood

As winds whip through Southern California, scores of businesses — from local restaurants and community institutions to film and television productions and a major theme park — have been affected by the multiple fires burning in the region.

Universal Studios Hollywood, longtime Malibu restaurants and other L.A.-area business affected by the fires

Marshall pulled out of the bowl due to a lack of players, with numerous players entering the transfer portal and coach Charles Huff now at Southern Miss.

Louisiana Tech to fill in at the Independence Bowl after Marshall opts out, will play against Army - Yahoo Sports

ANNAPOLIS, MD—Governor Wes Moore announced a $1.8 million award to BCR Cyber and the Maryland Association of Community Colleges to strengthen the state’s cybersecurity workforce during a ribbon-cutting event at Howard Community College. This initiative, supported by U.S. Senators Ben Cardin ...

Maryland Invests in Cutting-Edge Cybersecurity Education - The Southern Maryland Chronicle

Southern

southern

Perhaps best known globally for sunny vacations, folkloric Flamenco, and savory Paella, Spain is also home to one of the fastest-growing technology ecosystems in Europe. According to data from Dealroom, last year, Spanish startups were collectively worth around €100 billion (USD 111 billion), outpacing countries like Norway and Denmark, but still well behind more established ecosystems like the United Kingdom, Germany, and The Netherlands. The country ranked seventh in Europe in terms of attracting venture capital and had the fourth-highest number of funding rounds, according to the report which was made in collaboration with BBVA. While cities like Madrid and Barcelona lead the country for development on Startup Genome’s Global Ecosystems report, other cities like Valencia are also playing a big role in transforming Spain into an innovation hub on the continent. Valencia, a startup hub Valencia, Europe’s fifth busiest port city, is located in Eastern Spain on the Mediterranean Sea. It’s the third most populated municipality in the country and in addition to being one of Spain’s most important cities for export and logistics, it also houses a strong manufacturing sector and is a tourism hotspot. The city’s blend of old-world architecture (it was believed to be founded in 138 B.C.) with the futuristic buildings of one of its most famous children, renowned architect Santiago Calatrava, make for an aesthetic ripe for technological innovation. And founders are taking note. According to Startup Genome data, the city’s estimated startup ecosystem value – which measures exits and startup valuations – is over USD 5 billion, and the city saw 12 exits in 2022 and five in 2023. Particularly strong are startups innovating in AI. According to data from Startup Valencia, a non-profit dedicated to promoting startups in the city, over 20% of Valencian startups are powered by AI. What’s more, nearly 35% of startup companies in the city count at least one female co-founder, and 81% of startups surveyed say they align with the United Nations Sustainable Development Goals (SDGs). Overall, the non-profit reported that the city’s startup sector is growing at a rate of 16%. One big initiative from Startup Valencia that is helping to fuel that growth is their annual technology conference, VDS (formerly Valencia Digital Summit). The two-day gathering, which will host its seventh edition on October 23 and 24 under the theme “Embracing Evolution: Invest in the Leaders of Tomorrow,” convenes some of the world’s leading technology thought leaders to southern Europe. According to a company statement, the event is expected to bring together over 2,500 startups, and over 12,000 attendees from more than 100 countries. Also in attendance will be 700 investors, including representatives from global funds like Softbank and Techstars. Startups will also have a chance to pitch to investors on the demo stage, and featured speakers include Steve Chen, co-founder and former Chief Technology Officer of YouTube, Randi Zuckerberg, founder and CEO of Zuckerberg Media and HUG, Juan Antonio Samaranch, Vice President of the International Olympic Committee, among many others. Other initiatives too are driving the startup ecosystem forward in Valencia. Recently, Startup Valencia announced a partnership with the German research institute The Center for Digital Technology and Management, which aims to help the center scale in Spain and help foment local entrepreneurship. Also, Invest in Valencia, which promotes foreign investment into the city, is creating initiatives to promote Valencia’s 5G, cybersecurity and innovation sectors. Spain’s nation-wide support of startups On a national level, Spain has been taking steps in recent years to help foster startups and the tech sector. In December of 2022, the country passed its Startups Law, which aimed to cut some bureaucratic processes for starting companies, as well as tax incentives for startups and investors, as well as lower barriers for foreigners to enter the country to start a business or work with a startup. Earlier this year, the government announced the creation of a National Entrepreneurship Office (ONE), which focuses principally on prompting startups. The platform offers information for founders who want to recruit international talent, provides spaces for networking and startup events, information on grants and accelerators, and other information relevant to entrepreneurs. And in May, the government approved its AI strategy, which will deploy a total of €2.1 billion to help shore up the country’s AI sector. The strategy includes more funding for homegrown supercomputing, a structure for building a sustainable network of data centers to power AI, as well as investments and loan opportunities for companies innovating in AI. Taken together, the push from Spain as a whole, but also from Valencia as a startup hub, aims to help propel the country to be a leader in tech in southern Europe in the years to come. At least, that is the hope. The Sociable Perhaps best known globally for sunny vacations, folkloric Flamenco, and savory Paella, Spain is also home to one of the fastest-growing technology ecosystems in Europe. According to data from Dealroom, last year, Spanish startups were collectively worth around €100 billion (USD 111 billion), outpacing countries like Norway and Denmark, but still well behind more established ecosystems like the United Kingdom, Germany, and The Netherlands. data The country ranked seventh in Europe in terms of attracting venture capital and had the fourth-highest number of funding rounds, according to the report which was made in collaboration with BBVA. according While cities like Madrid and Barcelona lead the country for development on Startup Genome’s Global Ecosystems report , other cities like Valencia are also playing a big role in transforming Spain into an innovation hub on the continent. report Valencia, a startup hub Valencia, a startup hub Valencia, Europe’s fifth busiest port city, is located in Eastern Spain on the Mediterranean Sea. It’s the third most populated municipality in the country and in addition to being one of Spain’s most important cities for export and logistics, it also houses a strong manufacturing sector and is a tourism hotspot. The city’s blend of old-world architecture (it was believed to be founded in 138 B.C.) with the futuristic buildings of one of its most famous children, renowned architect Santiago Calatrava, make for an aesthetic ripe for technological innovation. And founders are taking note. According to Startup Genome data , the city’s estimated startup ecosystem value – which measures exits and startup valuations – is over USD 5 billion, and the city saw 12 exits in 2022 and five in 2023. data Particularly strong are startups innovating in AI. According to data from Startup Valencia, a non-profit dedicated to promoting startups in the city, over 20% of Valencian startups are powered by AI. data What’s more, nearly 35% of startup companies in the city count at least one female co-founder, and 81% of startups surveyed say they align with the United Nations Sustainable Development Goals (SDGs). Overall, the non-profit reported that the city’s startup sector is growing at a rate of 16%. One big initiative from Startup Valencia that is helping to fuel that growth is their annual technology conference, VDS (formerly Valencia Digital Summit). The two-day gathering, which will host its seventh edition on October 23 and 24 under the theme “Embracing Evolution: Invest in the Leaders of Tomorrow,” convenes some of the world’s leading technology thought leaders to southern Europe. VDS According to a company statement, the event is expected to bring together over 2,500 startups, and over 12,000 attendees from more than 100 countries. Also in attendance will be 700 investors, including representatives from global funds like Softbank and Techstars. Startups will also have a chance to pitch to investors on the demo stage, and featured speakers include Steve Chen , co-founder and former Chief Technology Officer of YouTube, Randi Zuckerberg , founder and CEO of Zuckerberg Media and HUG, Juan Antonio Samaranch , Vice President of the International Olympic Committee, among many others. Steve Chen Randi Zuckerberg Juan Antonio Samaranch Other initiatives too are driving the startup ecosystem forward in Valencia. Recently, Startup Valencia announced a partnership with the German research institute The Center for Digital Technology and Management, which aims to help the center scale in Spain and help foment local entrepreneurship. Also, Invest in Valencia , which promotes foreign investment into the city, is creating initiatives to promote Valencia’s 5G, cybersecurity and innovation sectors. announced Invest in Valencia Spain’s nation-wide support of startups Spain’s nation-wide support of startups On a national level, Spain has been taking steps in recent years to help foster startups and the tech sector. In December of 2022, the country passed its Startups Law, which aimed to cut some bureaucratic processes for starting companies, as well as tax incentives for startups and investors, as well as lower barriers for foreigners to enter the country to start a business or work with a startup. passed Earlier this year, the government announced the creation of a National Entrepreneurship Office (ONE), which focuses principally on prompting startups. The platform offers information for founders who want to recruit international talent, provides spaces for networking and startup events, information on grants and accelerators, and other information relevant to entrepreneurs. announced And in May, the government approved its AI strategy, which will deploy a total of €2.1 billion to help shore up the country’s AI sector. The strategy includes more funding for homegrown supercomputing, a structure for building a sustainable network of data centers to power AI, as well as investments and loan opportunities for companies innovating in AI. Taken together, the push from Spain as a whole, but also from Valencia as a startup hub, aims to help propel the country to be a leader in tech in southern Europe in the years to come. At least, that is the hope. The Sociable The Sociable The Sociable

Valencia’s Ambitious Plans to Become Southern Europe’s Next Startup Hub

A Floating City and The Blockade Runners by Jules Verne, is part of the HackerNoon Books Series. You can jump to any chapter in this book . A southern general here A SOUTHERN GENERAL. The “Dolphin” on arriving at the Charleston quay, had been saluted by the cheers of a large crowd. The inhabitants of this town, strictly blockaded by sea, were not accustomed to visits from European ships. They asked each other, not without astonishment, what this great steamer, proudly bearing the English flag, had come to do in their waters; but when they learned the object of her voyage, and why she had just forced the passage Sullivan, when the report spread that she carried a cargo of smuggled ammunition, the cheers and joyful cries were redoubled. James Playfair, without losing a moment, entered into negotiation with General Beauregard, the military commander of the town. The latter eagerly received the young Captain of the “Dolphin,” who had arrived in time to provide the soldiers with the clothes and ammunition they were so much in want of. It was agreed that the unloading of the ship should take place immediately, and numerous hands came to help the English sailors. Before quitting his ship James Playfair had received from Miss Halliburtt the most pressing injunctions with regard to her father, and the Captain had placed himself entirely at the young girl’s service. “Miss Jenny,” he had said, “you may rely on me; I will do the utmost in my power to save your father, but I hope this business will not present many difficulties; I shall go and see General Beauregard to-day, and without asking him at once for Mr. Halliburtt’s liberty, I shall learn in what situation he is, whether he is on bail, or a prisoner.” “My poor father!” replied Jenny, sighing; “he little thinks his daughter is so near him. Oh that I could fly into his arms!” “A little patience, Miss Jenny, you will soon embrace your father. Rely upon my acting with the most entire devotion, but also with prudence and consideration.” This is why James Playfair, after having delivered the cargo of the “Dolphin” up to the General, and bargained for an immense stock of cotton, faithful to his promise, turned the conversation to the events of the day. “So,” said he, “you believe in the triumph of the slave-holders?” “I do not for a moment doubt of our final success, and as regards Charleston, Lee’s army will soon relieve it: besides, what do you expect from the Abolitionists? admitting that which will never be, that the commercial towns of Virginia, the two Carolinas, Georgia, Alabama, fall under their power, what then? Will they be masters of a country they can never occupy? No, certainly not; and for my part if they are ever victorious they shall pay dearly for it.” “And you are quite sure of your soldiers?” asked the Captain; “you are not afraid that Charleston will grow weary of a siege which is ruining her?” “No, I do not fear treason; besides, the traitors would be punished remorselessly, and I would destroy the town itself by sword or fire if I discovered the least Unionist movement. Jefferson Davis confided Charleston to me, and you may be sure that Charleston is in safe hands.” “Have you any Federal prisoners?” asked James Playfair, coming to the interesting object of the conversation. “Yes, Captain,” replied the General, “it was at Charleston that the first shot of separation was fired. The Abolitionists who were here attempted to resist, and after being defeated they have been kept as prisoners of war.” “And have you many?” “About a hundred.” “Free in the town?” “They were until I discovered a plot formed by them: their chief succeeded in establishing a communication with the besiegers, who were thus informed of the situation of affairs in the town. I was then obliged to lock up these dangerous guests, and several of them will only leave their prison to ascend the slope of the citadel, where ten confederate balls will reward them for their federalism.” “What! to be shot!” cried the young man, shuddering involuntarily. “Yes, and their chief first of all. He is a very dangerous man to have in a besieged town. I have sent his letters to the President at Richmond, and before a week is passed his sentence will be irrevocably passed.” “Who is this man you speak of,” asked James Playfair, with an assumed carelessness. “A journalist from Boston, a violent Abolitionist with the confounded spirit of Lincoln.” “And his name?” “Jonathan Halliburtt.” “Poor wretch!” exclaimed James, suppressing his emotion; “whatever he may have done one cannot help pitying him. And you think that he will be shot?” “I am sure of it,” replied Beauregard. “What can you expect? War is war, one must defend oneself as best one can.” “Well, it is nothing to me,” said the Captain; “I shall be far enough away when this execution takes place.” “What! you are thinking of going away already.” “Yes, General, business must be attended to; as soon as my cargo of cotton is on board I shall be out to sea again. I was fortunate enough to enter the bay, but the difficulty is in getting out again. The ‘Dolphin’ is a good ship; she can beat any of the Federal ships for speed, but she does not pretend to distance cannon-balls, and a shell in her hull or engine would seriously affect my enterprise.” “As you please, Captain,” replied Beauregard; “I have no advice to give you under such circumstances. You are doing your business, and you are right. I should act in the same manner were I in your place; besides a stay at Charleston is not very pleasant, and a harbour where shells are falling three days out of four is not a safe shelter for your ship; so you will set sail when you please; but can you tell me what is the number and the force of the Federal ships cruising before Charleston?” James Playfair did his best to answer the General, and took leave of him on the best of terms; then he returned to the “Dolphin” very thoughtful and very depressed from what he had just heard. “What shall I say to Miss Jenny? ought I to tell her of Mr. Halliburtt’s terrible situation? or would it be better to keep her in ignorance of the trial which is awaiting her? Poor child!” He had not gone fifty steps from the governor’s house when he ran against Crockston: the worthy American had been watching for him since his departure. “Well, Captain?” James Playfair looked steadily at Crockston, and the latter soon understood he had no favourable news to give him. “Have you seen Beauregard?” he asked. “Yes,” replied James Playfair. “And have you spoken to him about Mr. Halliburtt?” “No! it was he who spoke to me about him.” “Well, Captain?” “Well! I may as well tell you everything, Crockston.” “Everything, Captain.” “General Beauregard has told me that your master will be shot within a week.” At this news any one else but Crockston would have grown furious or given way to bursts of grief, but the American, who feared nothing, only said, with almost a smile on his lips,— “Pooh! what does it matter?” “How! what does it matter?” cried James Playfair; “I tell you that Mr. Halliburtt will be shot within a week, and you answer, what does it matter?” “And I mean it—if in six days he is on board the ‘Dolphin,’ and if in seven days the ‘Dolphin’ is on the open sea.” “Right!” exclaimed the Captain, pressing Crockston’s hand. “I understand, my good fellow, you have got some pluck; and for myself, in spite of Uncle Vincent, I would throw myself overboard for Miss Jenny.” “No one need be thrown overboard,” replied the American, “only the fish would gain by that: the most important business now is to deliver Mr. Halliburtt.” “But you must know that it will be difficult to do so.” “Pooh!” exclaimed Crockston. “It is a question of communicating with a prisoner strictly guarded.” “Certainly.” “And to bring about an almost miraculous escape.” “Nonsense,” exclaimed Crockston; “a prisoner thinks more of escaping than his guardian thinks of keeping him; that’s why, thanks to our help, Mr. Halliburtt will be saved.” “You are right, Crockston.” “Always right.” “But now what will you do? there must be some plan; and there are precautions to be taken.” “I will think about it.” “But when Miss Jenny learns that her father is condemned to death, and that the order for his execution may come any day—” “She will know nothing about it, that is all.” “Yes, it will be better for her and for us to tell her nothing.” “Where is Mr. Halliburtt imprisoned?” asked Crockston. “In the citadel,” replied James Playfair. “Just so!—On board now?” “On board, Crockston!” About HackerNoon Book Series: We bring you the most important technical, scientific, and insightful public domain books. This book is part of the public domain. Jules Verne (2022). A Floating City and The Blockade Runners. Urbana, Illinois: Project Gutenberg. Retrieved October 2022 https://www.gutenberg.org/files/67829/67829-h/67829-h.htm This eBook is for the use of anyone anywhere at no cost and with almost no restrictions whatsoever. You may copy it, give it away or re-use it under the terms of the Project Gutenberg License included with this eBook or online at , located at . www.gutenberg.org https://www.gutenberg.org/policy/license.html

A southern general.

STRAIT OF MAGELLAN.—CLIMATE OF THE SOUTHERN COASTS

Table of Links Abstract and 1 Introduction 2 Background 3 Approach and 3.1 Differential Testing for XML Processors 3.2 XPath Expression Generation 3.3 XML Generation 4 Evaluation 4.1 Effectiveness 4.2 Efficiency 4.3 Comparison to the State of the Art 4.4 Analysis of BaseX Historical Bug Reports 5 Related Work 6 Conclusion, Acknowledgments, and References 3.2 XPath Expression Generation In this section, we introduce how we generate XPath queries. We encountered two main challenges that we had to tackle when generating XPath expressions. Non-existent elements. Randomly generated queries could be semantically correct, but reference non-existent nodes or attributes. For the document in Figure 1, //Author[@id < 1] is a valid XPath expression. However, none of the Author nodes contain an id attribute. Thus, XPath returns an empty sequence for each node, causing the predicate @id < 1 to evaluate to false. We believe that queries, where only non-existent attributes or nodes are referenced, are less likely to exercise the logic of the processors under test, as subsequent operations are likely to evaluate to an empty sequence as well. Thus, we aim to avoid generating such queries. Empty results. Randomly generated predicates might likely evaluate to false and cause queries to generate empty result sets. For the document in Figure 1, the XPath predicate starts-with(text(), x) identifies nodes whose text starts with x. If x is a randomly generated string, the possibility is high that no nodes in the current result set match the condition. Consequently, any use of the predicate would yield an empty result. Any subsequently added section would yield an empty result as well, meaning that such queries would be less likely to exercise the processor under test. Consequently, we want to avoid generating such predicates, in particular, when they involve multiple sections. This relates to the first problem, as non-existent nodes or attributes can also introduce empty results. Approach overview. We designed the XPath generation process of XPress tackling the two aforementioned issues. To create XPath expressions that refer to valid nodes and attributes to trigger deeper logic of the system under test, we generate queries that reference existent context relative to the so-called targeted node, such as its tag name and attributes (steps 3 and 4). Since randomly generated predicates might miss the targeted node from the result set, we rectify the generated expressions to ensure the inclusion of the targeted node (step 5). Iterative section generation. We create XPath expressions sectionby-section by executing step ○2 to step ○5 for each section, which allows us to ensure non-empty results after generating each section. In the example, we first generate section /Books by selecting as the targeted node, and after executing steps 2 to step  , the result of /Books is non-empty—containing the node. Based on this, we further proceed to generate the next section /Book[count(Author) > 1] starting at step 2. Section prefix. We randomly generate one of the applicable section prefixes. First, we randomly select the start of the section to be / or //. We then retrieve the current context node sequence by executing the expression—/Books in the example—on a processor. Based on the result, we include all possible axes that would not lead to an empty result set by simple conditional checks. We support all 11 axes described in the XPath 3.0 standard [4]. For example, applying the axis /descendants:: will lead to a non-empty result, if at least one non-leaf node exists in the current selection. From the possible axes, we select a random one and apply it. When generating the section prefix /Book, the axis step is implicit. It is equivalent to /Books/child::Book, which selects all child nodes of the previously selected nodes. We again execute the query and retrieve the result node-set. We use the result for the name test, for which we either select a tag name from the result node-set, or use the wildcard *. By doing so, we are again guaranteed a non-empty result set. In the example, the tag name Book is selected and applied, resulting in the selection of all three Book nodes. In our artifact, we include a table that details the conditional checks for all 11 axes. Target node selection. To generate targeted queries that fetch at least one node, we select a so-called targeted node to guide the predicate generation process. We use information about the target node, such as its text content, the attributes it holds, and its relationship to other nodes during the predicate generation. This is similar to the concept of the pivot row in PQS [36], which is a technique that has been proposed to test relational DBMSs. After the generated predicate is applied, we expect the target node to be included in the result node-set. In step 3, we select node 1 as the target node for the predicate generation process. Constraining the context to exist for the targeted node does not affect the evaluation of the expression on other candidate nodes and, therefore, still allows finding bugs that are triggered only when referring to nodes’ non-existing attributes or child nodes. Predicate generation. We use a tree structure to represent the predicate and take a bottom-up construction approach to enable tracking of expression results along tree construction. We start generating the predicate from a specific subject, which is either the targeted node or a node sequence derived from the targeted node with equal probability. In the example, we select the child node sequence from the targeted node as the subject. We then iteratively apply random function nodes and supply function parameters to construct the predicate, until the predicate reaches a desired length. We keep track of the data type and value of the current subexpression when constructing the predicate, by executing the subexpression on one randomly chosen XML processor—we use this XML processor also for predicate rectification and we subsequently refer to this XML processor as the designated XML processor. We use the value and data type of the current sub-expression in the following two ways: by (1) selecting function nodes of according data types and (2) supplying arguments to reference existent context and triggering corner cases. Specifically, we select a random function node from functions that could accept the value of the current data type as input. A function node can either represent a function or an operation. In the example, Author is a node sequence and count is a randomly selected function from functions that accept node sequence as input. For function nodes that require additional arguments, we supply arguments while taking the current result value into consideration. As an example, when selecting attribute values from node sequences, we use name tests referencing existent attributes. For the = operator, we choose an operand that is equal to the current value with a high probability of triggering the equal case which is of low probability under random generation. Aside from constants, we also set the possibility for operands to be other predicate trees. Through this, we support the generation of expressions with multiple subject occurrences. Besides boolean predicates, we also apply positional predicates to the XPath expression randomly. Predicate rectification. Lastly, we rectify the generated predicate to guarantee that the targeted node is contained in the final result set. We first execute the generated predicate on the designated XML processor. If the result set misses the targeted node, we rectify the predicate. To negate the predicate’s result, we can always apply a not operator. However, as shown in Algorithm 1, we probabilistically apply more specific rectification for certain operators to uncover additional potential bugs. For logical operators such as and, both child expressions need to be modified to evaluate to true to contain the targeted node, while or needs only modification of one random child expression. For comparison operators, such as <=, we replace them with their opposite operators, which, in the example, is >. Thus, the targeted node is guaranteed to be contained in the result set. This paper is available on arxiv under CC BY 4.0 DEED license. Authors:
(1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com);
(2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Approach and 3.1 Differential Testing for XML Processors 3 Approach and 3.1 Differential Testing for XML Processors 3.2 XPath Expression Generation 3.2 XPath Expression Generation 3.3 XML Generation 3.3 XML Generation 4 Evaluation 4 Evaluation 4.1 Effectiveness 4.1 Effectiveness 4.2 Efficiency 4.2 Efficiency 4.3 Comparison to the State of the Art 4.3 Comparison to the State of the Art 4.4 Analysis of BaseX Historical Bug Reports 4.4 Analysis of BaseX Historical Bug Reports 5 Related Work 5 Related Work 6 Conclusion, Acknowledgments, and References 6 Conclusion, Acknowledgments, and References 3.2 XPath Expression Generation In this section, we introduce how we generate XPath queries. We encountered two main challenges that we had to tackle when generating XPath expressions. Non-existent elements. Randomly generated queries could be semantically correct, but reference non-existent nodes or attributes. For the document in Figure 1, //Author[@id < 1] is a valid XPath expression. However, none of the Author nodes contain an id attribute. Thus, XPath returns an empty sequence for each node, causing the predicate @id < 1 to evaluate to false. We believe that queries, where only non-existent attributes or nodes are referenced, are less likely to exercise the logic of the processors under test, as subsequent operations are likely to evaluate to an empty sequence as well. Thus, we aim to avoid generating such queries. Non-existent elements. Empty results. Randomly generated predicates might likely evaluate to false and cause queries to generate empty result sets. For the document in Figure 1, the XPath predicate starts-with(text(), x) identifies nodes whose text starts with x. If x is a randomly generated string, the possibility is high that no nodes in the current result set match the condition. Consequently, any use of the predicate would yield an empty result. Any subsequently added section would yield an empty result as well, meaning that such queries would be less likely to exercise the processor under test. Consequently, we want to avoid generating such predicates, in particular, when they involve multiple sections. This relates to the first problem, as non-existent nodes or attributes can also introduce empty results. Empty results. Approach overview. We designed the XPath generation process of XPress tackling the two aforementioned issues. To create XPath expressions that refer to valid nodes and attributes to trigger deeper logic of the system under test, we generate queries that reference existent context relative to the so-called targeted node, such as its tag name and attributes (steps 3 and 4). Since randomly generated predicates might miss the targeted node from the result set, we rectify the generated expressions to ensure the inclusion of the targeted node (step 5). Approach overview. Iterative section generation. We create XPath expressions sectionby-section by executing step ○2 to step ○5 for each section, which allows us to ensure non-empty results after generating each section. In the example, we first generate section /Books by selecting as the targeted node, and after executing steps 2 to step  , the result of /Books is non-empty—containing the node. Based on this, we further proceed to generate the next section /Book[count(Author) > 1] starting at step 2. Iterative section generation. Section prefix. We randomly generate one of the applicable section prefixes. First, we randomly select the start of the section to be / or //. We then retrieve the current context node sequence by executing the expression—/Books in the example—on a processor. Based on the result, we include all possible axes that would not lead to an empty result set by simple conditional checks. We support all 11 axes described in the XPath 3.0 standard [4]. For example, applying the axis /descendants:: will lead to a non-empty result, if at least one non-leaf node exists in the current selection. From the possible axes, we select a random one and apply it. When generating the section prefix /Book, the axis step is implicit. It is equivalent to /Books/child::Book, which selects all child nodes of the previously selected nodes. We again execute the query and retrieve the result node-set. We use the result for the name test, for which we either select a tag name from the result node-set, or use the wildcard *. By doing so, we are again guaranteed a non-empty result set. In the example, the tag name Book is selected and applied, resulting in the selection of all three Book nodes. In our artifact, we include a table that details the conditional checks for all 11 axes. Section prefix. Target node selection. To generate targeted queries that fetch at least one node, we select a so-called targeted node to guide the predicate generation process. We use information about the target node, such as its text content, the attributes it holds, and its relationship to other nodes during the predicate generation. This is similar to the concept of the pivot row in PQS [36], which is a technique that has been proposed to test relational DBMSs. After the generated predicate is applied, we expect the target node to be included in the result node-set. In step 3, we select node 1 as the target node for the predicate generation process. Constraining the context to exist for the targeted node does not affect the evaluation of the expression on other candidate nodes and, therefore, still allows finding bugs that are triggered only when referring to nodes’ non-existing attributes or child nodes. Target node selection. Predicate generation. We use a tree structure to represent the predicate and take a bottom-up construction approach to enable tracking of expression results along tree construction. We start generating the predicate from a specific subject, which is either the targeted node or a node sequence derived from the targeted node with equal probability. In the example, we select the child node sequence from the targeted node as the subject. We then iteratively apply random function nodes and supply function parameters to construct the predicate, until the predicate reaches a desired length. We keep track of the data type and value of the current subexpression when constructing the predicate, by executing the subexpression on one randomly chosen XML processor—we use this XML processor also for predicate rectification and we subsequently refer to this XML processor as the designated XML processor. We use the value and data type of the current sub-expression in the following two ways: by (1) selecting function nodes of according data types and (2) supplying arguments to reference existent context and triggering corner cases. Specifically, we select a random function node from functions that could accept the value of the current data type as input. A function node can either represent a function or an operation. In the example, Author is a node sequence and count is a randomly selected function from functions that accept node sequence as input. For function nodes that require additional arguments, we supply arguments while taking the current result value into consideration. As an example, when selecting attribute values from node sequences, we use name tests referencing existent attributes. For the = operator, we choose an operand that is equal to the current value with a high probability of triggering the equal case which is of low probability under random generation. Aside from constants, we also set the possibility for operands to be other predicate trees. Through this, we support the generation of expressions with multiple subject occurrences. Besides boolean predicates, we also apply positional predicates to the XPath expression randomly. Predicate generation. Predicate rectification. Lastly, we rectify the generated predicate to guarantee that the targeted node is contained in the final result set. We first execute the generated predicate on the designated XML processor. If the result set misses the targeted node, we rectify the predicate. To negate the predicate’s result, we can always apply a not operator. However, as shown in Algorithm 1, we probabilistically apply more specific rectification for certain operators to uncover additional potential bugs. For logical operators such as and, both child expressions need to be modified to evaluate to true to contain the targeted node, while or needs only modification of one random child expression. For comparison operators, such as <=, we replace them with their opposite operators, which, in the example, is >. Thus, the targeted node is guaranteed to be contained in the result set. Predicate rectification. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv Authors: (1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com); (2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg). Authors: Authors: (1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com); (2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg).

XPath Expression Generation: How We Generated XPath Queries

Table of Links Abstract and 1 Introduction 2 Background 3 Approach and 3.1 Differential Testing for XML Processors 3.2 XPath Expression Generation 3.3 XML Generation 4 Evaluation 4.1 Effectiveness 4.2 Efficiency 4.3 Comparison to the State of the Art 4.4 Analysis of BaseX Historical Bug Reports 5 Related Work 6 Conclusion, Acknowledgments, and References 3 APPROACH Figure 3 shows an overview of the approach using the same example as in Figure 1. At a high level, our approach consists of three main steps. First, we randomly generate an XML document as the context for the following queries (step 1). We then generate an XPath expression that we will subsequently validate (step 2 to step 5). Finally, we execute the XPath expression on the XML document using all engines under test and compare the resulting outputs to detect potential bugs (step 6). In the subsequent subsections, we explain these steps in reverse order to reflect their importance. We guide the XPath expression generation towards queries that reference nodes and attributes present in the XML document and result in non-empty result sets based on the intuition that they are more likely to stress the underlying logic of the tested systems. To generate XPath expressions with non-empty result sets, we construct the query section-by-section and ensure that a non-empty result set is produced before proceeding with the next section. Each section consists of a section prefix and predicates, and we first generate the prefix (step 2) and then the predicate. By restricting the section prefix, we guarantee that the result contains at least one node. From the nodes selected by the section prefix, we randomly select a node as a target (step 3). We then generate a predicate aiming to select the targeted node using a bottom-up tree construction method (step 4). We rectify the predicate to ensure that the result set contains the targeted node (step 5). We repeat this process until the XPath query reaches the desired length. 3.1 Differential Testing for XML Processors As detailed subsequently, differential testing enables us to find both logic bugs as well as internal errors when comparing the results of XML processors implementing the same XPath standard. Query execution. When passing XML documents and XPath queries to different systems, we must account for the different input interfaces. For example, DBMSs use database connection interfaces to store and query data, while Saxon can be used as a library. To abstract this, we treat every XML processor implementation as a function that returns a result set and expects two string values, namely an XML document XML and an XPath query XPATH. Listing 1 shows an implementation of this interface for Oracle Database using SQL statements. It creates a table t, inserts the XML document—the XMLType constructor is used to convert the string to an XML data type—and uses an XMLQuery function call in a SELECT statement to compute the result set. For BaseX and eXist-db, similar to the commands shown for Oracle Database, we also start with an empty database and subsequently insert an XML document. Listing 2 shows an excerpt of the Java code for Saxon. First, the call to compile converts the textual XPath query to an executable object, which is then loaded. Unlike for the DBMSs, which require inserting data into a database, for Saxon, the XML document is simply associated with the query using the setContextItem call. The evaluate call computes the result, which is returned for comparison. Bug identification. We identify both logic bugs and internal errors by comparing the returned results of different processors on the same XML document and query. We identify logic bugs when the tested systems return different node-set outputs for the same test cases. To parse and track the results easily under different output formats, we use unique node ids to identify element nodes. We detect internal errors as discrepancies with respect to errors. Rather than checking for an exact error message match, we validate whether all the systems produce an error, or all execute the XPath query successfully. If only a subset of the systems report an error for the same XPath query, we found a potential bug. Different XPath standards. Our approach and tool are applicable to both XPath 1.0 and XPath 3.0. However, due to the differences in the formats, only processors using the same standard can be tested. Functionality that is supported only in XPath 3.0, can be disabled while generating test cases for processors that implement XPath 1.0. For example, sequence functions, such as subsequence, are defined only for the XPath 3.0 standard. When generating test cases for XPath 1.0 processors, we omit to generate subsequence function nodes for predicates. We did not encounter any functions or operators that were removed in the XPath 3.0 standard, so all expressions that we generate when testing XPath 1.0 processors can be used also when testing XPath 3.0 processors. By comparing only processors with the same XPath standard against each other, the difference in the results between different XPath standards (see Section 2) has no influence on the testing process. This paper is available on arxiv under CC BY 4.0 DEED license. Authors:
(1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com);
(2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Approach and 3.1 Differential Testing for XML Processors 3 Approach and 3.1 Differential Testing for XML Processors 3.2 XPath Expression Generation 3.2 XPath Expression Generation 3.3 XML Generation 3.3 XML Generation 4 Evaluation 4 Evaluation 4.1 Effectiveness 4.1 Effectiveness 4.2 Efficiency 4.2 Efficiency 4.3 Comparison to the State of the Art 4.3 Comparison to the State of the Art 4.4 Analysis of BaseX Historical Bug Reports 4.4 Analysis of BaseX Historical Bug Reports 5 Related Work 5 Related Work 6 Conclusion, Acknowledgments, and References 6 Conclusion, Acknowledgments, and References 3 APPROACH Figure 3 shows an overview of the approach using the same example as in Figure 1. At a high level, our approach consists of three main steps. First, we randomly generate an XML document as the context for the following queries (step 1). We then generate an XPath expression that we will subsequently validate (step 2 to step 5). Finally, we execute the XPath expression on the XML document using all engines under test and compare the resulting outputs to detect potential bugs (step 6). In the subsequent subsections, we explain these steps in reverse order to reflect their importance. We guide the XPath expression generation towards queries that reference nodes and attributes present in the XML document and result in non-empty result sets based on the intuition that they are more likely to stress the underlying logic of the tested systems. To generate XPath expressions with non-empty result sets, we construct the query section-by-section and ensure that a non-empty result set is produced before proceeding with the next section. Each section consists of a section prefix and predicates, and we first generate the prefix (step 2) and then the predicate. By restricting the section prefix, we guarantee that the result contains at least one node. From the nodes selected by the section prefix, we randomly select a node as a target (step 3). We then generate a predicate aiming to select the targeted node using a bottom-up tree construction method (step 4). We rectify the predicate to ensure that the result set contains the targeted node (step 5). We repeat this process until the XPath query reaches the desired length. 3.1 Differential Testing for XML Processors As detailed subsequently, differential testing enables us to find both logic bugs as well as internal errors when comparing the results of XML processors implementing the same XPath standard. Query execution. When passing XML documents and XPath queries to different systems, we must account for the different Query execution. input interfaces. For example, DBMSs use database connection interfaces to store and query data, while Saxon can be used as a library. To abstract this, we treat every XML processor implementation as a function that returns a result set and expects two string values, namely an XML document XML and an XPath query XPATH. Listing 1 shows an implementation of this interface for Oracle Database using SQL statements. It creates a table t, inserts the XML document—the XMLType constructor is used to convert the string to an XML data type—and uses an XMLQuery function call in a SELECT statement to compute the result set. For BaseX and eXist-db, similar to the commands shown for Oracle Database, we also start with an empty database and subsequently insert an XML document. Listing 2 shows an excerpt of the Java code for Saxon. First, the call to compile converts the textual XPath query to an executable object, which is then loaded. Unlike for the DBMSs, which require inserting data into a database, for Saxon, the XML document is simply associated with the query using the setContextItem call. The evaluate call computes the result, which is returned for comparison. Bug identification. We identify both logic bugs and internal errors by comparing the returned results of different processors on the same XML document and query. We identify logic bugs when the tested systems return different node-set outputs for the same test cases. To parse and track the results easily under different output formats, we use unique node ids to identify element nodes. We detect internal errors as discrepancies with respect to errors. Rather than checking for an exact error message match, we validate whether all the systems produce an error, or all execute the XPath query successfully. If only a subset of the systems report an error for the same XPath query, we found a potential bug. Bug identification. Different XPath standards . Our approach and tool are applicable to both XPath 1.0 and XPath 3.0. However, due to the differences in the formats, only processors using the same standard can be tested. Functionality that is supported only in XPath 3.0, can be disabled while generating test cases for processors that implement XPath 1.0. For example, sequence functions, such as subsequence, are defined only for the XPath 3.0 standard. When generating test cases for XPath 1.0 processors, we omit to generate subsequence function nodes for predicates. We did not encounter any functions or operators that were removed in the XPath 3.0 standard, so all expressions that we generate when testing XPath 1.0 processors can be used also when testing XPath 3.0 processors. By comparing only processors with the same XPath standard against each other, the difference in the results between different XPath standards (see Section 2) has no influence on the testing process. Different XPath standards This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv Authors: (1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com); (2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg). Authors: Authors: (1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com); (2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg).

The Approach and Differential Testing for XML Processors

Table of Links Abstract and 1 Introduction 2 Background 3 Approach and 3.1 Differential Testing for XML Processors 3.2 XPath Expression Generation 3.3 XML Generation 4 Evaluation 4.1 Effectiveness 4.2 Efficiency 4.3 Comparison to the State of the Art 4.4 Analysis of BaseX Historical Bug Reports 5 Related Work 6 Conclusion, Acknowledgments, and References ABSTRACT Extensible Markup Language (XML) is a widely used file format for data storage and transmission. Many XML processors support XPath, a query language that enables the extraction of elements from XML documents. These systems can be affected by logic bugs, which are bugs that cause the processor to return incorrect results. In order to tackle such bugs, we propose a new approach, which we realized as a system called XPress. As a test oracle, XPress relies on differential testing, which compares the results of multiple systems on the same test input, and identifies bugs through discrepancies in their outputs. As test inputs, XPress generates both XML documents and XPath queries. Aiming to generate meaningful queries that compute non-empty results, XPress selects a so-called targeted node to guide the XPath expression generation process. Using the targeted node, XPress generates XPath expressions that reference existing context related to the targeted node, such as its tag name and attributes, while also guaranteeing that a predicate evaluates to true before further expanding the query. We tested our approach on six mature XML processors, BaseX, eXist-DB, Saxon, PostgreSQL, libXML2, and a commercial database system. In total, we have found 27 unique bugs in these systems, of which 25 have been verified by the developers, and 20 of which have been fixed. XPress is efficient, as it finds 12 unique bugs in BaseX in 24 hours, which is 2× as fast as naive random generation. We expect that the effectiveness and simplicity of our approach will help to improve the robustness of many XML processors. CCS CONCEPTS • Software and its engineering → Software testing and debugging KEYWORDS XML processors, XPath generation, differential testing 1 INTRODUCTION Extensible Markup Language (XML) is a widely used file format for data storage and transmission. XPath is an expression language, which provides the ability to navigate through XML documents to select wanted nodes. XPath is also at the core of other XML query language standards such as XSLT [7] and XQuery [6], making it a fundamental XML query language. Various XML document processors have been developed for extracting information from XML documents efficiently. We loosely categorize them depending on whether they can store XML documents in addition to processing them—that is, whether they are Database Management Systems (DBMSs), or provide only processing functionality. In terms of DBMSs specialized for XML, popular examples include BaseX [8] and eXist-DB [10]. Many general-purpose DBMSs such as Oracle Database [14], MySQL [13], and PostgreSQL [15] have adopted support for processing XML documents. In fact, out of the 10 most popular DBMSs according to the DB-engines ranking [9], 6 support at least partial XML document parsing. A popular example of a processor without storage functionality is Saxon. Saxon [18] is an in-memory XML processor that can be either used in a standalone way or embedded as a library. Finally, libxml2 [12] is a popular XML processing library written in C. XPath is supported by all of these processors. XML document processors can be affected by logic bugs. Logic bugs are bugs that cause the XML processor to produce incorrect results without crashing the system, meaning that they can often go unnoticed. In order to find such bugs, developers mainly rely on test suites such as the XPathMark test suite for XPath [25], the W3C qt3 test suite [19], or hand-written unit tests. Manually writing tests requires much effort, and it is challenging to comprehensively cover the XML processors’ functionality. To find logic bugs automatically, a so-called test oracle is required that can determine whether the system’s output is correct in order to find logic bugs. Todic and Uzelac have proposed an automated testing technique for SQLServer’s index support; their test oracle compared the results of a given query with and without index definition [41]. A limitation of this technique is that it is applicable only to finding index-related bugs in DBMSs. To the best of our knowledge, no other test oracles have been proposed in this context. In order to detect XPath-related bugs in XML processors, we propose differential testing as an oracle. The core idea of differential testing is to use one input that is executed using multiple systems; any discrepancy in the results indicates a potential bug in the system. For testing XML processors, the input for the XML processors under test is an XML document and XPath expression, and the results are a sequence of XML nodes or values. Differential testing has been successfully applied in various related domains, such as relational DBMSs [38], compilers [43, 45], JVM implementations [23], ORM systems [39], and graph DBMSs [44, 46]. Its effectiveness hinges on two main requirements. First, multiple systems to be compared must be available. As discussed above, various XML processors with XPath support exist. Second, for any valid input, the systems should produce the same result, since otherwise, a differential-testing approach raises many false alarms. This requirement is not always met, for example, when applying differential testing to relational DBMSs, where the “common SQL subset is relatively small and changes with each release" and NULL handling differs between DBMSs [38]. As we found, XPath is a well-defined language by the W3C standard, and XPath implementations of the same standard follow the same language rules, making differential testing highly applicable. To generate test cases, we propose an approach that selects a so-called targeted node from the XML document, based on which we generate a query that is guaranteed to fetch at least that node. As such, it tackles two challenges that might prevent testing from exercising interesting behaviors. First, by generating the query based on the targeted node, we can guarantee that we access a tag name, attributes, and relative paths that exist with respect to at least the targeted node. Second, by rectifying predicates so that they evaluate to true for the targeted node, we can ensure that the result set is non-empty even for complex queries. A similar highlevel idea has been proposed in the context of testing relational DBMSs, called Pivoted Query Synthesis (PQS) [36], where a pivot row was selected, based on which predicates were rectified to return true. Apart from applying that idea in a different context, we also propose a different rectification strategy that eschews mirroring the predicate’s execution logic in the testing tool, which was required for realizing PQS. We implemented our approach as a tool named XPress,[1] which, to the best of our knowledge, is the first general automated testing tool for XML processors, and tested our method on six mature and widely-used XML processors BaseX, eXist-DB, Saxon, PostgreSQL, libXML2 and a commercial DBMS. The experimental results show that our approach is effective in detecting XPath-related logic bugs in XML processors. We found 27 previously unknown unique bugs, not covered by existing test suites, of which 19 were logic bugs. 25 of them have been confirmed, and 20 of them have been fixed. Furthermore, these test cases have been integrated into the aforementioned qt3 test suite, so that they can detect potential bugs in XML processors that we have not tested. Our experiments demonstrate that our proposed guided query generation process improves testing efficiency by finding 2× more unique bugs within 24 hours in BaseX as compared to random generation. Given the high effectiveness and efficiency of the approach, we believe it will likely be adopted by developers of XML processors to improve their systems. To summarize, we make the following contributions: • We propose the first general approach for automatically testing XML processors in order to find logic bugs. • We implemented and evaluated our approach on six widelyused XML process systems, which successfully found 27 previously-unknown unique bugs. This paper is available on arxiv under CC BY 4.0 DEED license. [1] Our artifact is publicly available at https://zenodo.org/records/10473926 Authors:
(1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com);
(2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg). Table of Links Abstract and 1 Introduction Abstract and 1 Introduction 2 Background 2 Background 3 Approach and 3.1 Differential Testing for XML Processors 3 Approach and 3.1 Differential Testing for XML Processors 3.2 XPath Expression Generation 3.2 XPath Expression Generation 3.3 XML Generation 3.3 XML Generation 4 Evaluation 4 Evaluation 4.1 Effectiveness 4.1 Effectiveness 4.2 Efficiency 4.2 Efficiency 4.3 Comparison to the State of the Art 4.3 Comparison to the State of the Art 4.4 Analysis of BaseX Historical Bug Reports 4.4 Analysis of BaseX Historical Bug Reports 5 Related Work 5 Related Work 6 Conclusion, Acknowledgments, and References 6 Conclusion, Acknowledgments, and References ABSTRACT Extensible Markup Language (XML) is a widely used file format for data storage and transmission. Many XML processors support XPath, a query language that enables the extraction of elements from XML documents. These systems can be affected by logic bugs, which are bugs that cause the processor to return incorrect results. In order to tackle such bugs, we propose a new approach, which we realized as a system called XPress. As a test oracle, XPress relies on differential testing, which compares the results of multiple systems on the same test input, and identifies bugs through discrepancies in their outputs. As test inputs, XPress generates both XML documents and XPath queries. Aiming to generate meaningful queries that compute non-empty results, XPress selects a so-called targeted node to guide the XPath expression generation process. Using the targeted node, XPress generates XPath expressions that reference existing context related to the targeted node, such as its tag name and attributes, while also guaranteeing that a predicate evaluates to true before further expanding the query. We tested our approach on six mature XML processors, BaseX, eXist-DB, Saxon, PostgreSQL, libXML2, and a commercial database system. In total, we have found 27 unique bugs in these systems, of which 25 have been verified by the developers, and 20 of which have been fixed. XPress is efficient, as it finds 12 unique bugs in BaseX in 24 hours, which is 2× as fast as naive random generation. We expect that the effectiveness and simplicity of our approach will help to improve the robustness of many XML processors. CCS CONCEPTS CCS CONCEPTS • Software and its engineering → Software testing and debugging • Software and its engineering → Software testing and debugging KEYWORDS KEYWORDS XML processors, XPath generation, differential testing 1 INTRODUCTION Extensible Markup Language (XML) is a widely used file format for data storage and transmission. XPath is an expression language, which provides the ability to navigate through XML documents to select wanted nodes. XPath is also at the core of other XML query language standards such as XSLT [7] and XQuery [6], making it a fundamental XML query language. Various XML document processors have been developed for extracting information from XML documents efficiently. We loosely categorize them depending on whether they can store XML documents in addition to processing them—that is, whether they are Database Management Systems (DBMSs), or provide only processing functionality. In terms of DBMSs specialized for XML, popular examples include BaseX [8] and eXist-DB [10]. Many general-purpose DBMSs such as Oracle Database [14], MySQL [13], and PostgreSQL [15] have adopted support for processing XML documents. In fact, out of the 10 most popular DBMSs according to the DB-engines ranking [9], 6 support at least partial XML document parsing. A popular example of a processor without storage functionality is Saxon. Saxon [18] is an in-memory XML processor that can be either used in a standalone way or embedded as a library. Finally, libxml2 [12] is a popular XML processing library written in C. XPath is supported by all of these processors. XML document processors can be affected by logic bugs. Logic bugs are bugs that cause the XML processor to produce incorrect results without crashing the system, meaning that they can often go unnoticed. In order to find such bugs, developers mainly rely on test suites such as the XPathMark test suite for XPath [25], the W3C qt3 test suite [19], or hand-written unit tests. Manually writing tests requires much effort, and it is challenging to comprehensively cover the XML processors’ functionality. To find logic bugs automatically, a so-called test oracle is required that can determine whether the system’s output is correct in order to find logic bugs. Todic and Uzelac have proposed an automated testing technique for SQLServer’s index support; their test oracle compared the results of a given query with and without index definition [41]. A limitation of this technique is that it is applicable only to finding index-related bugs in DBMSs. To the best of our knowledge, no other test oracles have been proposed in this context. In order to detect XPath-related bugs in XML processors, we propose differential testing as an oracle. The core idea of differential testing is to use one input that is executed using multiple systems; any discrepancy in the results indicates a potential bug in the system. For testing XML processors, the input for the XML processors under test is an XML document and XPath expression, and the results are a sequence of XML nodes or values. Differential testing has been successfully applied in various related domains, such as relational DBMSs [38], compilers [43, 45], JVM implementations [23], ORM systems [39], and graph DBMSs [44, 46]. Its effectiveness hinges on two main requirements. First, multiple systems to be compared must be available. As discussed above, various XML processors with XPath support exist. Second, for any valid input, the systems should produce the same result, since otherwise, a differential-testing approach raises many false alarms. This requirement is not always met, for example, when applying differential testing to relational DBMSs, where the “common SQL subset is relatively small and changes with each release" and NULL handling differs between DBMSs [38]. As we found, XPath is a well-defined language by the W3C standard, and XPath implementations of the same standard follow the same language rules, making differential testing highly applicable. To generate test cases, we propose an approach that selects a so-called targeted node from the XML document, based on which we generate a query that is guaranteed to fetch at least that node. As such, it tackles two challenges that might prevent testing from exercising interesting behaviors. First, by generating the query based on the targeted node, we can guarantee that we access a tag name, attributes, and relative paths that exist with respect to at least the targeted node. Second, by rectifying predicates so that they evaluate to true for the targeted node, we can ensure that the result set is non-empty even for complex queries. A similar highlevel idea has been proposed in the context of testing relational DBMSs, called Pivoted Query Synthesis (PQS) [36], where a pivot row was selected, based on which predicates were rectified to return true. Apart from applying that idea in a different context, we also propose a different rectification strategy that eschews mirroring the predicate’s execution logic in the testing tool, which was required for realizing PQS. We implemented our approach as a tool named XPress,[1] which, to the best of our knowledge, is the first general automated testing tool for XML processors, and tested our method on six mature and widely-used XML processors BaseX, eXist-DB, Saxon, PostgreSQL, libXML2 and a commercial DBMS. The experimental results show that our approach is effective in detecting XPath-related logic bugs in XML processors. We found 27 previously unknown unique bugs, not covered by existing test suites, of which 19 were logic bugs. 25 of them have been confirmed, and 20 of them have been fixed. Furthermore, these test cases have been integrated into the aforementioned qt3 test suite, so that they can detect potential bugs in XML processors that we have not tested. Our experiments demonstrate that our proposed guided query generation process improves testing efficiency by finding 2× more unique bugs within 24 hours in BaseX as compared to random generation. Given the high effectiveness and efficiency of the approach, we believe it will likely be adopted by developers of XML processors to improve their systems. To summarize, we make the following contributions: • We propose the first general approach for automatically testing XML processors in order to find logic bugs. • We implemented and evaluated our approach on six widelyused XML process systems, which successfully found 27 previously-unknown unique bugs. This paper is available on arxiv under CC BY 4.0 DEED license. This paper is available on arxiv under CC BY 4.0 DEED license. available on arxiv [1] Our artifact is publicly available at https://zenodo.org/records/10473926 Authors: (1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com); (2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg). Authors: Authors: (1) Shuxin Li, Southern University of Science and Technology China and Work done during an internship at the National University of Singapore (shuxin.li.lv@gmail.com); (2) Manuel Rigger, National University of Singapore Singapore (rigger@nus.edu.sg).

Finding XPath Bugs in XML Document Processors
via Differential Testing

How Jupiter’s Plasma Torus Strips Away Io’s Atmosphere

The news cycle is exceptionally choppy right now. Brands need to make critical decisions on where they stand and the course ahead. And if they don’t take a stand and choose where they’re headed, how long can they stay up and stay above the waters? When boating, or doing other things where a fall can be dangerous, there’s something called the three points of contact rule. The idea is your body should have at least three points of contact with something stable at all times. Anything less than that and a wave can come along and throw you. That’s how marketing should be done right now. Sales One of those points of contact is almost always going to be the deck of the boat. At least one of your feet is going to be planted there. In marketing or public relations that should be sales. Even if you’re a non-profit, it’s going to be where the money comes from. You can have points of contact elsewhere, but if revenue or sponsorship is not coming from somewhere, you don’t have a going concern. While that seems obvious, many marketing and most public relations teams don’t do this. Sales people can be a pain in the rear end. If they win business, they can say it was because of their efforts and marketing and sales didn’t really help. When sales aren’t coming in, well marketing isn’t doing its job and what in the world is public relations doing apart from absorbing budget? And the concreteness of sales’ metrics… either money is coming into the bank account or not, is scary if you don’t have a direct role in bringing in those dollars, but are rather supporting it indirectly. Too frequently marketing and public relations functions then try to set up metrics that they can control, and are at a safe distance from sales. Moving leads and prospects through a marketing funnel, impressions, clicks, etc. And there’s correlation between that and sales, but it sure is tenuous. Sales are sales are sales. And if you don’t have at least one of your points of contact on the deck of the boat formed by sales, it really doesn’t matter where the other points of contact are. Integration Beyond sales, the other points of contact can be any number of things that work for sales. It could be media relations, social media, email campaigns, collateral, your site, etc. But whatever it is it had better be connected to sales. And if you’re moving you’d better through a changing market and media environment, make sure those other points of contact are also connected to each other in addition to sales. This seems obvious, but if you have a newsletter, how many of its articles have been selected or written with prospects in your funnel in mind? Does your sales team know when the newsletter is going out and has it been written in a fashion where it organically can be forwarded to leads and prospects? Can a sales person send a message saying, “hey you know how we talked about Hackernoon the other day and how great it is as a resource? Here’s an article I found there that’s useful to marketers and public relations professionals and shows how brands should pay attention to places like Hackernoon to understand how they can become more proficient in today’s crazy environment.” Why now? And let’s come back to today’s crazy environment. Before Donald Trump's inauguration, what society seemed to respect in a brand, and what society expects now is in volatile flux. What’s the constant message and brand running through those three points of contact? Here's three constants we heard from Dominic-Madori Davis of TechCrunch and Alyse Killeen of Stillmark as they were interviewed by Meredith Beuchaw and Ed Zimmerman of Lowenstein Sandler LLP at VentureCrush recently: Your personal story and choices you've made anchor brand and the sale
Your primary, consistent, and differentiated value prop through those choices sharpens brand and backs the sale
Non-textual signals amplify brand and facilitate the sale In times like these, you are what you have chosen to do. And what you choose now will be what your brand is tomorrow and beyond. Davis said a personal story is part of what draws something to her journalistic attention. She also looks for stories she and readers would not have found on their own. Davis also went on to say today a journalist has a brand that transcends the news brand they work for. For her personal story, she shared how her professional journey started with screenwriting at University of Southern California. She was pulled into copy editing her student paper. The Varsity Blues scandals put a news spotlight on the campus (Melissa Korn's journalism is also great here for context). Does her initial choice of screenwriting tell us something about her investment in personal stories and having the space to explore the unexpected? Killeen shared the influence of working for her grandfather, and hearing people talk about the respect they had for his integrity, the choices he made. At Stillmark she said she focuses their brand on a primary value proposition. And she pointed out that in working with startup founders, what they think and want their primary value proposition to be, may change when they see why customers are coming to them. Davis highlighted how fashion choices, are an example of showing differentiation and a brand, rather than telling. You can watch the full panel here: https://www.youtube.com/watch?v=_LBEZl5dRGI&embedable=true Bringing together brand and sales Here’s the thing, sales ensure you are a going concern. Brand ensures your going concern will endure based on the memory of the choices you’ve made in the course of winning sales. If your sales don’t have integrity, if you sacrifice integrity for sales, the dollars are good now, but they’ll be cheaper later as your brand declines. For those three points of contact, make sure the point of contact you have with sales, is anchored in the right kind of sales, for the right reasons, backed with the kind of demonstrated integrity that will sustain your business and grow it dependably. The news cycle is exceptionally choppy right now. Brands need to make critical decisions on where they stand and the course ahead. And if they don’t take a stand and choose where they’re headed, how long can they stay up and stay above the waters? When boating, or doing other things where a fall can be dangerous, there’s something called the three points of contact rule. The idea is your body should have at least three points of contact with something stable at all times. Anything less than that and a wave can come along and throw you. That’s how marketing should be done right now. Sales Sales One of those points of contact is almost always going to be the deck of the boat. At least one of your feet is going to be planted there. In marketing or public relations that should be sales. Even if you’re a non-profit, it’s going to be where the money comes from. You can have points of contact elsewhere, but if revenue or sponsorship is not coming from somewhere, you don’t have a going concern. While that seems obvious, many marketing and most public relations teams don’t do this. Sales people can be a pain in the rear end. If they win business, they can say it was because of their efforts and marketing and sales didn’t really help. When sales aren’t coming in, well marketing isn’t doing its job and what in the world is public relations doing apart from absorbing budget? And the concreteness of sales’ metrics… either money is coming into the bank account or not, is scary if you don’t have a direct role in bringing in those dollars, but are rather supporting it indirectly. Too frequently marketing and public relations functions then try to set up metrics that they can control, and are at a safe distance from sales. Moving leads and prospects through a marketing funnel, impressions, clicks, etc. And there’s correlation between that and sales, but it sure is tenuous. Sales are sales are sales. And if you don’t have at least one of your points of contact on the deck of the boat formed by sales, it really doesn’t matter where the other points of contact are. Integration Integration Beyond sales, the other points of contact can be any number of things that work for sales. It could be media relations, social media, email campaigns, collateral, your site, etc. But whatever it is it had better be connected to sales. And if you’re moving you’d better through a changing market and media environment, make sure those other points of contact are also connected to each other in addition to sales. This seems obvious, but if you have a newsletter, how many of its articles have been selected or written with prospects in your funnel in mind? Does your sales team know when the newsletter is going out and has it been written in a fashion where it organically can be forwarded to leads and prospects? Can a sales person send a message saying, “hey you know how we talked about Hackernoon the other day and how great it is as a resource? Here’s an article I found there that’s useful to marketers and public relations professionals and shows how brands should pay attention to places like Hackernoon to understand how they can become more proficient in today’s crazy environment.” Why now? Why now? And let’s come back to today’s crazy environment. Before Donald Trump's inauguration, what society seemed to respect in a brand, and what society expects now is in volatile flux. What’s the constant message and brand running through those three points of contact? Here's three constants we heard from Dominic-Madori Davis of TechCrunch and Alyse Killeen of Stillmark as they were interviewed by Meredith Beuchaw and Ed Zimmerman of Lowenstein Sandler LLP at VentureCrush recently: Dominic-Madori Davis Dominic-Madori Davis TechCrunch TechCrunch Alyse Killeen Alyse Killeen Stillmark Stillmark Meredith Beuchaw Meredith Beuchaw Ed Zimmerman Ed Zimmerman Lowenstein Sandler LLP Lowenstein Sandler LLP VentureCrush VentureCrush Your personal story and choices you've made anchor brand and the sale Your primary, consistent, and differentiated value prop through those choices sharpens brand and backs the sale Non-textual signals amplify brand and facilitate the sale Your personal story and choices you've made anchor brand and the sale Your primary, consistent, and differentiated value prop through those choices sharpens brand and backs the sale Non-textual signals amplify brand and facilitate the sale In times like these, you are what you have chosen to do. And what you choose now will be what your brand is tomorrow and beyond. Davis said a personal story is part of what draws something to her journalistic attention. She also looks for stories she and readers would not have found on their own. Davis also went on to say today a journalist has a brand that transcends the news brand they work for. For her personal story, she shared how her professional journey started with screenwriting at University of Southern California. She was pulled into copy editing her student paper. The Varsity Blues scandals put a news spotlight on the campus ( Melissa Korn 's journalism is also great here for context). Melissa Korn Melissa Korn Does her initial choice of screenwriting tell us something about her investment in personal stories and having the space to explore the unexpected? Killeen shared the influence of working for her grandfather, and hearing people talk about the respect they had for his integrity, the choices he made. At Stillmark she said she focuses their brand on a primary value proposition. And she pointed out that in working with startup founders, what they think and want their primary value proposition to be, may change when they see why customers are coming to them. Davis highlighted how fashion choices, are an example of showing differentiation and a brand, rather than telling. You can watch the full panel here: https://www.youtube.com/watch?v=_LBEZl5dRGI&embedable=true https://www.youtube.com/watch?v=_LBEZl5dRGI&embedable=true Bringing together brand and sales Bringing together brand and sales Here’s the thing, sales ensure you are a going concern. Brand ensures your going concern will endure based on the memory of the choices you’ve made in the course of winning sales. If your sales don’t have integrity, if you sacrifice integrity for sales, the dollars are good now, but they’ll be cheaper later as your brand declines. For those three points of contact, make sure the point of contact you have with sales, is anchored in the right kind of sales, for the right reasons, backed with the kind of demonstrated integrity that will sustain your business and grow it dependably.

Stories, News & Mentions about SOUTHERN

Southern’s Stories on HackerNoon

Southern's News & Mentions