Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Parallel Delta Debugging Framework
.. image:: https://img.shields.io/pypi/v/picire?logo=python&logoColor=white :target: https://pypi.org/project/picire/ .. image:: https://img.shields.io/pypi/l/picire?logo=open-source-initiative&logoColor=white :target: https://pypi.org/project/picire/ .. image:: https://img.shields.io/github/workflow/status/renatahodovan/picire/main/master?logo=github&logoColor=white :target: https://github.com/renatahodovan/picire/actions .. image:: https://img.shields.io/coveralls/github/renatahodovan/picire/master?logo=coveralls&logoColor=white :target: https://coveralls.io/github/renatahodovan/picire
Picire (pronounced as /pitsirE/) is a Python implementation of the
Delta Debugging
_ algorithm supporting parallelization and further
configuration options. It can be used either as a command line tool
or as a library.
Just like the original algorithm, Picire automatically reduces "interesting" tests while keeping their "interesting" behaviour. A common use case is minimizing failing tests so that they still reproduce the original failure.
The tool (and the algorithm) works iteratively. As a first step, it splits up the input into n chunks either by lines or characters. Then, iteratively, it inspects smaller test cases composed of these chunks whether they are still interesting. The selection of chunks can happen two ways: either a small subset of the chunks is kept (subset-based reduce), or that small subset is removed and everything else is kept (complement-based reduce). If a new interesting test case is found, it becomes the input of the next iteration. The iterations stop if removing any further chunks would make the test uninteresting (e.g. the test is 1-minimal).
.. _Delta Debugging
: https://www.st.cs.uni-saarland.de/dd/
.. _Python: https://www.python.org
To use Picire in another project, it can be added to setup.cfg
as an
install requirement (if using setuptools_ with declarative config):
.. code-block:: ini
[options]
install_requires =
picire
To install Picire manually, e.g., into a virtual environment, use pip_::
pip install picire
The above approaches install the latest release of Picire from PyPI_. Alternatively, for the development version, clone the project and perform a local install::
pip install .
.. _setuptools: https://github.com/pypa/setuptools .. _pip: https://pip.pypa.io .. _PyPI: https://pypi.org/
Picire has two mandatory command line arguments: one that defines the input
test case to be reduced (--input
) and another describing an executable
tester script or program (--test
) that can decide about the interestingness
of an arbitrary input. This will be run in every iteration to check a test case.
--parallel
: Enables Picire to run in multiprocess mode. (Otherwise, the
original single-process variant will run.)
-j <num>
: Defines the maximum number of parallel jobs.
--combine-loops
: The base algorithm had a dependency between subset and
complement-based reduce loops, but because of the sequential nature of its
implementation, it had no effect on efficiency. However, in parallel mode,
this separation becomes a potential sub-optimality. With this option, the
two reduce loops run combined for additional performance. Further details
about the algorithm variants are available in the cited papers.
--complement-first
: For some input types, subset-based reduce is not as
effective as the complement-based one (sometimes, aggressively removing too
big parts of the input eliminates the interestingness as well). By default,
Picire performs subset-based reduce before complement-based reduce, which
can result in many superfluous checks for such inputs. This flag forces to
start with complement checks.
--subset-iterator
/ --complement-iterator
: Guide the iteration
strategies of the subset and complement-based reduce loops.
forward
: Start investigating subsets (or complements) from the beginning
of the input.
backward
: Start investigating subsets (or complements) from the end of
the input. The goal is to reduce the number of semantic violations
(assuming that definitions - like variable declarations - appear before
uses).
skip
: Completely avoids the subset or complement checks (mostly used
with --subset-iterator
).
For the detailed options, see picire --help
.
The tester script is expected to take one command line argument, the path of a test case, and it has to exit with 0 if the test is interesting and with non-zero otherwise. An example tester script that runs an arbitrary target application and checks if it fails on an assertion might look like the one below::
#! /bin/bash
timeout --foreground 10 <path/to/the/target/application> $1 2>&1 | grep -q "Assertion failed";
Remarks:
<path/to/the/target/application>
should either be an absolute path to
the target application or the application should be on the search path (i.e.,
$PATH
).$1
is the single and mandatory command line argument containing the path
of a test case.timeout
to limit the amount of time waiting for producing the
expected behaviour.--foreground
flag can also be
useful as it allows forwarding the KILL
signals (used by the parallel
implementation) through the timeout's process group. This enables us to
stop all alive parallel processes when a new interesting configuration
is found already.grep
(perhaps with -q
or --quiet
) might be a right choice,
since it returns 0 if the pattern was found and 1 if not. Exactly the
return value Picire expects.A common form of Picire's usage::
picire --input=<path/to/the/input> --test=<path/to/the/tester> \
--parallel --subset-iterator=skip --complement-iterator=backward
Picire was tested on:
This software uses the delta debugging algorithm as described in:
Further improvements are described in:
Licensed under the BSD 3-Clause License_.
.. _License: LICENSE.rst
FAQs
Picire Parallel Delta Debugging Framework
We found that picire demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.