Extensible Markup Language (XML) is a widely used file format for data storage and transmission. Many XML processors support XPath, a query language that enables the extraction of elements from XML documents. These systems can be affected by logic bugs, which are bugs that cause the processor to return incorrect results. In order to tackle such bugs, we propose a new approach, which we realized as a system called XPress. As a test oracle, XPress relies on differential testing, which compares the results of multiple systems on the same test input, and identifies bugs through discrepancies in their outputs. As test inputs, XPress generates both XML documents and XPath queries. Aiming to generate meaningful queries that compute non-empty results, XPress selects a so-called targeted node to guide the XPath expression generation process. Using the targeted node, XPress generates XPath expressions that reference existing context related to the targeted node, such as its tag name and attributes, while also guaranteeing that a predicate evaluates to true before further expanding the query. We tested our approach on six mature XML processors, BaseX, eXist-DB, Saxon, PostgreSQL, libXML2, and a commercial database system. In total, we have found 20 unique bugs in these systems, of which 25 have been verified by the developers, and 12 of which have been fixed. XPress is efficient, as it finds 12 unique bugs in BaseX in 24 hours, which is 2x as fast as naive random generation. We expect that the effectiveness and simplicity of our approach will help to improve the robustness of many XML processors.

翻译：可扩展标记语言(XML)是一种广泛用于数据存储和传输的文件格式。许多XML处理器支持XPath——一种能够从XML文档中提取元素的查询语言。这些系统可能受逻辑缺陷影响，即导致处理器返回错误结果的缺陷。为应对此类缺陷，我们提出了一种新方法，并将其实现为名为XPress的系统。作为测试预言，XPress采用差分测试技术，通过比较多个系统对同一测试输入的输出结果，借助输出差异识别缺陷。在测试输入方面，XPress同时生成XML文档和XPath查询。为生成能计算非空结果的有意义查询，XPress选择所谓的目标节点来引导XPath表达式生成过程。利用目标节点，XPress生成引用该节点相关上下文（如标签名和属性）的XPath表达式，同时确保谓词在进一步扩展查询前评估为真。我们对六款成熟的XML处理器（BaseX、eXist-DB、Saxon、PostgreSQL、libXML2及一款商业数据库系统）进行了测试。共发现20个独特缺陷，其中25个已获开发者确认，12个已被修复。XPress具有高效性，能在24小时内发现BaseX中的12个独特缺陷，速度是朴素随机生成的2倍。我们预期该方法简洁高效的特点将有助于提升众多XML处理器的鲁棒性。