User Defined Checkers for Static Analysis with Symbolic Execution

Many modern static analysis tools provide toolkits that allow creation of custom checkers by end users. The majority of existing solutions choose AST-based approaches to provide a simpler declarative API. Solutions based on dataflow analysis or symbolic execution use complex explicit APIs that require much more expertise to achieve decent results compared to AST-based checkers. Even though the latter approach is much more powerful simplicity of the former made it much more prevalent.In this paper we introduce SvaceAPI a tool to write checkers based on symbolic execution in a declarative way. We describe a simple pattern-based API that leverages symbolic execution and attributes provided by Svace. Testing the API on a couple of checkers and open source programs across the variety of languages showed the same quality results as for built-in Svace checkers without noticeable performance regressions.