GrammaTech Bug-Injector

GrammaTech Bug-Injector is a test case generation tool designed to stress-test DevSecOps pipelines. The tool operates by injecting known bug templates into real-world code and integrating the bugs into the surrounding code structure. It generates test cases on demand for specific bug types within particular host programs. Each test case produced by Bug-Injector includes an input that triggers the injected bug to manifest. The tool creates realistic test cases that come with ground truth and triggering inputs for each bug. Test cases can be generated in large quantities on demand and are designed to be unbiased towards or against any specific bug finding techniques. Bug-Injector has been transitioned to the NIST Software Assurance Metrics and Tool Evaluation (SAMATE) group. The tool was used in practice as part of the SATE VI (Static Analysis Tool Exposition) event. The methodology and implementation details are documented in a paper published in the Source Code Analysis and Manipulation workshop.