Inspecting JavaScript Vulnerability Mitigation Patches with Automated Fix Generation in Mind

Software security has become a primary concern for both the industry and academia in the recent years.<br> As dependency on critical services provided by software systems grows globally, a potential security threat in such systems poses higher and higher risks (e.g. economical damage, threat to human life, criminal activity). Finding potential security vulnerabilities at the code level automatically is a very popular approach to aid security testing.<br> However, most of the methods based on machine learning and statistical models stop at listing potentially vulnerable code parts and leave their validation and mitigation to the developers.<br> Automatic program repair could fill this gap by automatically generating vulnerability mitigation code patches.<br> Nonetheless, it is still immature, especially in targeting security relevant fixes. In this work we try to establish a path towards automatic vulnerability fix generation techniques in the context of JavaScript programs.<br> We inspect 361 actual vulnerability mitigation patches collected from vulnerability databases and GitHub.<br> We found that vulnerability mitigation patches are not short on average and in many cases affect not just program code but test code as well.<br> These results point towards that a general automatic repair approach targeting all the different types of vulnerabilities is not feasible.<br> The analysis of the code properties and fix patterns for different vulnerability types might help in setting up a more realistic goal in the area of automatic JavaScript vulnerability repair.