An End-to-End Framework for Detecting and Repairing Potential Vulnerabilities

Nowadays, program development is getting easier and easier as the various IDE tools provide advice on what to write in the program. But it is not enough to implement a solution to a problem, it is also important that the non-functional properties, like the quality or security of the code is appropriate in all aspects. One of the most widely used techniques to ensure quality is testing. If the tests fail, one can fix the code immediately. However, security issues in the program are cases that we do not expect when implementing the program, which is why we do not write tests for them in advance. In many cases, security relevant bugs can not only cause financial loss but also put human lives at risk, so detecting and fixing them is an important step for the reliability and quality of the program. The aim of the tool presented in this paper is to generate automatic code repairs to potential vulnerabilities in the program. By integrating the recommended fixes, one can easily harden the security of their program early in the development process. A case study on 6 open-source subject systems showed that we were able to generate viable repair patches for 57 out of the 81 detected security issues (70%). For certain types (e.g., revealing private references of mutable objects) our tool reached close to perfect performance. This data package contains the detailed results of the study.如今，各类集成开发环境（IDE）工具可提供代码编写辅助建议，程序开发的难度正持续降低。但仅实现问题的解决方案仍远远不够，代码的非功能属性——如代码质量与安全性——在全维度均需符合要求，这一点同样至关重要。保障代码质量最广泛采用的技术手段之一便是软件测试。若测试未通过，开发者可立即对代码进行修复。然而，程序中的安全漏洞往往是开发阶段未被预见的场景，这也是我们无法预先为其编写测试用例的原因。在诸多场景中，安全相关的代码缺陷不仅可能造成经济损失，更会直接威胁人类生命安全，因此检测并修复此类缺陷对程序的可靠性与质量而言是至关重要的环节。本文所提出的工具，其核心目标是为程序中潜在的安全漏洞自动生成代码修复方案。通过集成该工具生成的推荐修复方案，开发者可在开发早期阶段轻松强化程序的安全性。针对6个开源主题系统开展的案例研究表明，在检测出的81个安全问题中，我们的工具可为其中57个生成切实可行的修复补丁（占比70%）。针对特定类型的漏洞（如暴露可变对象的私有引用），我们的工具已达到近乎完美的修复效果。本数据包包含本次案例研究的详细结果。