Skip to main content

Parameters

Parameters is an object type to specify detailed checker behavior. It has many parameters. But, few parameters are useful to users, and the others are not needed to be set manually.

The parameters are defined in a JSON Schema written in YAML. The TypeScript type, the Scala class, the CLI options and the list below are generated from it. In TypeScript and JSON (e.g. the agent mode of the CLI), a duration is a number of milliseconds, and null means infinite. The CLI takes a duration with a unit, e.g. --timeout=10s.

accelerationMode​

  • Type: "auto" | "on" | "off" (TypeScript), AccelerationMode (Scala)
  • Default: "auto" (TypeScript), AccelerationMode.Auto (Scala)
  • CLI: --acceleration-mode
  • Since: v4.2.0

The acceleration mode of the fuzzing.

  • auto turns it on as on does, unless the pattern has back-references.
  • on turns it on, unless the pattern has backtracking control verbs (e.g. (*PRUNE)) or non-atomic look-arounds (e.g. (?*...)), which memoization does not follow.
  • off turns it off.

attackLimit​

  • Type: number (TypeScript), Int (Scala)
  • Default: 1500000000
  • CLI: --attack-limit
  • Since: v1.0.0

The upper limit of the VM's steps when the fuzz checker runs an attack string.

A step is a character that the VM reads, including each character that a back-reference compares. The fuzz checker also sizes the attack string to reach this number of steps.

attackTimeout​

  • Type: number | null (TypeScript, in milliseconds), Duration (Scala)
  • Default: 1000 (TypeScript), Duration(1, SECONDS) (Scala)
  • CLI: --attack-timeout
  • Since: v4.2.0

The upper limit of matching time on the attack.

checker​

  • Type: "auto" | "fuzz" | "automaton" (TypeScript), Checker (Scala)
  • Default: "auto" (TypeScript), Checker.Auto (Scala)
  • CLI: --checker
  • Since: v1.0.0

The checker to use.

  • auto chooses one of the two below by the criteria.
  • fuzz uses the fuzzing with static analysis.
  • automaton uses the algorithm based on automata theory.

crossoverSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 25
  • CLI: --crossover-size
  • Since: v4.2.0

The number of crossovers on each generation.

dialect​

  • Type: DialectParameter (TypeScript), Dialect (Scala)
  • Default: "javascript" (TypeScript), Dialect.JavaScript (Scala)
  • CLI: --dialect
  • Since: v5.0.0

The regular expression dialect of the pattern, with its settings.

It is the name of the dialect, which takes the default settings, or an object of the name and the settings (e.g. "python" or { "name": "python", "type": "bytes" }). The flags are the dialect's own flag letters. See Dialects for the dialects and their settings.

heatRatio​

  • Type: number (TypeScript), Double (Scala)
  • Default: 0.001
  • CLI: --heat-ratio
  • Since: v4.2.0

The ratio of the number of characters read to the maximum number to be considered as a hot spot.

incubationLimit​

  • Type: number (TypeScript), Int (Scala)
  • Default: 25000
  • CLI: --incubation-limit
  • Since: v3.0.0

The upper limit of the VM's steps when the fuzz checker runs a gene string on incubation.

static seeding also sizes its seed strings to reach this number of steps.

incubationTimeout​

  • Type: number | null (TypeScript, in milliseconds), Duration (Scala)
  • Default: 250 (TypeScript), Duration(250, MILLISECONDS) (Scala)
  • CLI: --incubation-timeout
  • Since: v4.2.0

The upper limit of matching time on incubation.

logger​

  • Type: (message: string) => void (TypeScript), Option[Context.Logger] (Scala)
  • Default: null (TypeScript), None (Scala)
  • Since: v4.2.0

The logger function to record execution traces.

null in TypeScript or None in Scala disables the logging. The CLI enables it with --enable-log.

maxAttackStringSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 300000
  • CLI: --max-attack-string-size
  • Since: v4.2.0

The maximum length of the attack string on fuzzing.

maxDegree​

  • Type: number (TypeScript), Int (Scala)
  • Default: 4
  • CLI: --max-degree
  • Since: v1.1.0

The maximum degree to be considered in fuzzing.

maxGeneStringSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 2400
  • CLI: --max-gene-string-size
  • Since: v4.2.0

The maximum length of the gene string on fuzzing.

maxGenerationSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 100
  • CLI: --max-generation-size
  • Since: v1.0.0

The maximum size of each generation on fuzzing.

maxInitialGenerationSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 500
  • CLI: --max-initial-generation-size
  • Since: v4.2.0

The maximum size of the initial generation on fuzzing.

maxIteration​

  • Type: number (TypeScript), Int (Scala)
  • Default: 10
  • CLI: --max-iteration
  • Since: v1.0.0

The maximum number of fuzzing iterations.

maxNFASize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 35000
  • CLI: --max-nfa-size
  • Since: v1.0.0

The maximum size of the NFA to determine which algorithm is used.

maxPatternSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 1500
  • CLI: --max-pattern-size
  • Since: v1.1.1

The maximum size of the regular expression pattern to determine which algorithm is used.

maxRefutedAttacks​

  • Type: number (TypeScript), Int (Scala)
  • Default: 10
  • CLI: --max-refuted-attacks
  • Since: v5.0.0

The maximum number of attacks that the runtime attacks refute.

When the runtime attacks refute this many attacks, the checking stops, and the result is unknown with the runtime-attacks-refuted error.

maxRepeatCount​

  • Type: number (TypeScript), Int (Scala)
  • Default: 30
  • CLI: --max-repeat-count
  • Since: v1.0.0

The maximum sum of the repeat counts of the repetition quantifiers to determine which algorithm is used.

maxRuntimeAttackStringSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 300000
  • CLI: --max-runtime-attack-string-size
  • Since: v5.0.0

The maximum length of the attack string in the diagnostics, which the runtime attack runs.

maxSimpleRepeatCount​

  • Type: number (TypeScript), Int (Scala)
  • Default: 30
  • CLI: --max-simple-repeat-count
  • Since: v4.2.0

The maximum repeat count of each repetition quantifier on static seeding.

mutationSize​

  • Type: number (TypeScript), Int (Scala)
  • Default: 50
  • CLI: --mutation-size
  • Since: v4.2.0

The number of mutations on each generation.

randomSeed​

  • Type: number (TypeScript), Long (Scala)
  • Default: 0
  • CLI: --random-seed
  • Since: v4.0.0

The PRNG seed number.

runtimeAttackLimit​

  • Type: number (TypeScript), Int (Scala)
  • Default: 1500000000
  • CLI: --runtime-attack-limit
  • Since: v5.0.0

The number of steps that the attack string in the diagnostics is sized for.

It is not a limit of the VM. The repeat count of the attack string, which the runtime attack runs, is chosen so that a backtracking matcher reads about this many characters, counted as the VM counts its steps (see attackLimit).

runtimeAttackTimeout​

  • Type: number | null (TypeScript, in milliseconds), Duration (Scala)
  • Default: -1000 (TypeScript), Duration(-1, SECONDS) (Scala)
  • CLI: --runtime-attack-timeout
  • Since: v5.0.0

The upper limit of matching time on the runtime attack.

The runtime attack runs the attack string on the real engine of the dialect (see Runtime-Attack Verification). An attack string that the engine matches within this time is refuted: it is recorded in refutedAttacks of the diagnostics, and the checking goes on. The time is also bounded by the time left of timeout. The runtime attack is skipped if this value is not positive, or where commands cannot run (e.g. in the browser).

seeder​

  • Type: "static" | "dynamic" (TypeScript), Seeder (Scala)
  • Default: "static" (TypeScript), Seeder.Static (Scala)
  • CLI: --seeder
  • Since: v4.2.0

The seeder of the fuzzing.

  • static uses the seeding based on automata theory.
  • dynamic uses the seeding with dynamic analysis.

seedingLimit​

  • Type: number (TypeScript), Int (Scala)
  • Default: 1000
  • CLI: --seeding-limit
  • Since: v4.2.0

The upper limit of the VM's steps on dynamic seeding.

seedingTimeout​

  • Type: number | null (TypeScript, in milliseconds), Duration (Scala)
  • Default: 100 (TypeScript), Duration(100, MILLISECONDS) (Scala)
  • CLI: --seeding-timeout
  • Since: v4.2.0

The upper limit of matching time on dynamic seeding.

timeout​

  • Type: number | null (TypeScript, in milliseconds), Duration (Scala)
  • Default: 10000 (TypeScript), Duration(10, SECONDS) (Scala)
  • CLI: --timeout
  • Since: v1.0.0

The upper limit of checking time.

When it is exceeded, the result is unknown with the timeout error. It has no limit if it is infinite in Scala or null in TypeScript. The time starts when the check starts, not while the check waits in a queue. In TypeScript, it is in milliseconds.