[Tool demo] AIFix4SecCode: an Automated Code Repair Framework for Fixing Vulnerabilities

<p>&nbsp;</p> <p><strong>&gt;&gt;&gt;&gt; TOOL DEMO SCREENCAST</strong>: please download file <a href="https://zenodo.org/record/8314593/files/AIFix4SecCode-demo.mp4?download=1">AIFix4SecCode-demo.mp4</a>. <strong>&lt;&lt;&lt;&lt;</strong></p> <p>&nbsp;</p> <p>AIFix4SecCode is an automated code repair framework for fixing vulnerabilities. The framework detects vulnerabilities based on static analysis with the help of the <a href="https://github.com/sed-inf-u-szeged/OpenStaticAnalyzer">OpenStaticAnalyzer</a> tool that integrates <a href="https://spotbugs.github.io/">SpotBugs</a> as well.</p> <p>The detected vulnerabilities get automatically patched by an ASG transformation based repair solution implemented in the <a href="https://github.com/FrontEndART/OpenStaticAnalyzer/tree/CodeRepairTool/java/cl/CodeRepair">CodeRepair</a> code module. Currently, the automatic repair of the following security issues are supported:</p> <ul> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#ei2-may-expose-internal-representation-by-incorporating-reference-to-mutable-object-ei-expose-rep2">EI_EXPOSE_REP2</a></li> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#ei-may-expose-internal-representation-by-returning-reference-to-mutable-object-ei-expose-rep">EI_EXPOSE_REP</a></li> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#ms-field-isn-t-final-but-should-be-ms-should-be-final">MS_SHOULD_BE_FINAL</a></li> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#np-possible-null-pointer-dereference-np-null-on-some-path">NP_NULL_ON_SOME_PATH</a></li> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#np-possible-null-pointer-dereference-in-method-on-exception-path-np-null-on-some-path-exception">NP_NULL_ON_SOME_PATH_EXCEPTION</a></li> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#ms-field-should-be-package-protected-ms-pkgprotect">MS_PKGPROTECT</a></li> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#ms-field-is-a-mutable-collection-ms-mutable-collection">MS_MUTABLE_COLLECTION</a></li> <li><a href="https://spotbugs.readthedocs.io/en/stable/bugDescriptions.html#fi-finalizer-should-be-protected-not-public-fi-public-should-be-protected">FI_PUBLIC_SHOULD_BE_PROTECTED</a></li> </ul>