Inspecting JavaScript Vulnerability Mitigation Patches with Automated Fix Generation in Mind

Software security has become a primary concern for both the industry and academia in the recent years.
As dependency on critical services provided by software systems grows globally, a potential security threat in such systems poses higher and higher risks (e.g. economical damage, threat to human life, criminal activity).

Finding potential security vulnerabilities at the code level automatically is a very popular approach to aid security testing.
However, most of the methods based on machine learning and statistical models stop at listing potentially vulnerable code parts and leave their validation and mitigation to the developers.
Automatic program repair could fill this gap by automatically generating vulnerability mitigation code patches.
Nonetheless, it is still immature, especially in targeting security relevant fixes.

In this work we try to establish a path towards automatic vulnerability fix generation techniques in the context of JavaScript programs.
We inspect 361 actual vulnerability mitigation patches collected from vulnerability databases and GitHub.
We found that vulnerability mitigation patches are not short on average and in many cases affect not just program code but test code as well.
These results point towards that a general automatic repair approach targeting all the different types of vulnerabilities is not feasible.
The analysis of the code properties and fix patterns for different vulnerability types might help in setting up a more realistic goal in the area of automatic JavaScript vulnerability repair.