Inspecting JavaScript Vulnerability Mitigation Patches with Automated Fix Generation in Mind

Abstract

Software security has become a primary concern for both the industry and academia in recent years. As dependency on critical services provided by software systems grows globally, a potential security threat in such systems poses higher and higher risks (e.g. economical damage, a threat to human life, criminal activity). Finding potential security vulnerabilities at the code level automatically is a very popular approach to aid security testing. However, most of the methods based on machine learning and statistical models stop at listing potentially vulnerable code parts and leave their validation and mitigation to the developers. Automatic program repair could fill this gap by automatically generating vulnerability mitigation code patches. Nonetheless, it is still immature, especially in targeting security-relevant fixes. In this work, we try to establish a path towards automatic vulnerability fix generation techniques in the context of JavaScript programs. We inspect 361 actual vulnerability mitigation patches collected from vulnerability databases and GitHub. We found that vulnerability mitigation patches are not short on average and in many cases affect not just program code but test code as well. These results point towards that a general automatic repair approach targeting all the different types of vulnerabilities is not feasible. The analysis of the code properties and fix patterns for different vulnerability types might help in setting up a more realistic goal in the area of automatic JavaScript vulnerability repair.

CVEfixes: automated collection of vulnerabilities and their fixes from open-source software

“…Analysis of vulnerability fixing patches Similar to how the vulnerable code in CVEfixes can be used to better understand how security vulnerabilities are introduced in code and how these can be automatically predicted, the fixes offered by CVEfixes can be used to analyze and build on vulnerability fixing patches. Several studies have already initiated research analyzing such patches, such as the detection of patterns that can be used in automated program repair [41], and the identification of security-relevant commits, also known as pre-patches, as these may inadvertently leak information about security vulnerabilities before the CVE is published [42,43]. Other research has analyzed vulnerability fixing patches to facilitate the automated transformation of patches into "honeypots" that help trap malicious actors and detect if the corresponding vulnerabilities are exploited in the wild [44].…”