Collected research

S3: A Symbolic String Solver for Vulnerability Detection in Web Applications

Minh-Thai Trinh, Duc-Hiep Chu and Joxan Jaffar · trinhmt.github.io

S3 is a symbolic string solver built on Z3-str that covers the main JavaScript string operations plus regular-expression membership and the Kleene star, encoding them as string equations and generating a bounded set of instances. It gives symbolic execution engines more definitive answers when hunting injection flaws such as XSS and SQL injection in web code.

Record

Researcher

Minh-Thai Trinh, Duc-Hiep Chu and Joxan Jaffar

Published by

trinhmt.github.io

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2014 research round

Tags

• injection
• sqli
• xss
• javascript
• formal-analysis
• static-analysis
• dynamic-analysis
• tooling
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Minh-Thai Trinh, Duc-Hiep Chu and Joxan Jaffar, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.