.png){kind=icon}
.png){kind=icon}
Return
DCAFixer: An Automatic Tool for Bug Detection and Repair for Database Java Client Applications
.png){kind=icon}
PRE
AI
DOI：10.1109/TDSC.2024.3396667.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Application programs are a possible source of attacks to databases. SQL injection is a well-known attack that exploits the lack of user input sanitization by applications. Following secure code practices to avoid vulnerabilities is the best way to prevent attacks. However, developers usually make mistakes either due to a lack of knowledge (i.e., a beginner developer) or due to bad code practices like copy-paste, which duplicates bugs and vulnerabilities in the code. Detecting such vulnerabilities manually is expensive and time-consuming, especially for very large code bases. Fixing vulnerabilities is also expensive as it requires manual interventions. It is thus clear that in order to systematically find and fix vulnerabilities we need automatic tools. In this article, we address such a need. We propose the Database Client Applications Fixer (DCAFixer) tool, which automatically detects and repairs three types of common vulnerabilities in SQL application programs, namely unsanitized user inputs, insecure credentials handling, and unencrypted connections. DCAFixer operates in three phases: fault localization, patch generation and selection, and patch validation.
Keywords:
Codes
Databases
Security
SQL injection
Firewalls (computing)
Maintenance engineering
Computer bugs
Application security
computer security
data breach
data integrity
database systems
databases
information security
security
software engineering
Journal
IF:
7.5
Papers:
2.4K
Citations:
9.6K
