一句话：提出 CORAL，在修复 Maven 项目第三方库漏洞的同时保证项目编译与单元测试不被破坏。
随着开源软件漏洞披露增多，软件成分分析（SCA）被广泛用于揭示软件项目中的第三方库及其漏洞。除揭示问题外，SCA 工具还会采用各种修复策略，但修复质量差异很大；低效的修复会引入编译失败等副作用，阻碍用户采纳。作者调研发现，现有 SCA 工具无法正确处理用户对修复后项目兼容性的关切。为此，论文提出面向 Maven 项目的第三方库兼容性修复方法 CORAL，目标是在不破坏项目的前提下修复漏洞。评估表明，CORAL 修复了 87.56% 的漏洞，优于其他工具的最佳成绩 75.32%，并达到 98.67% 的编译成功率和 92.96% 的单元测试成功率。进一步分析发现，流行 Maven 项目中 78.45% 的漏洞可在不破坏编译的情况下修复，其余 21.55% 只能通过破坏编译的升级修复，甚至无法通过升级修复。
With the increasing disclosure of vulnerabilities in open-source software, software composition analysis (SCA) has been widely applied to reveal third-party libraries and the associated vulnerabilities in software projects. Beyond the revelation, SCA tools adopt various remediation strategies to fix vulnerabilities, the quality of which varies substantially. However, ineffective remediation could induce side effects, such as compi-lation failures, which impede acceptance by users. According to our studies, existing SCA tools could not correctly handle the concerns of users regarding the compatibility of remediated projects. To this end, we propose Compatible Remediation of Third-party libraries (CORAL) for Maven projects to fix vulnerabilities without breaking the projects. The evaluation proved that Coralnot only fixed 87.56% of vulnerabilities which outperformed other tools (best 75.32%) and achieved a 98.67% successful compilation rate and a 92.96% successful unit test rate. Furthermore, we found that 78.45% of vulnerabilities in popular Maven projects could be fixed without breaking the compilation, and the rest of the vulnerabilities (21.55%) could either be fixed by upgrades that break the compilations or even be impossible to fix by upgrading.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2301-08434,
title = {Compatible Remediation on Vulnerabilities from Third-Party Libraries for Java Projects},
author = {Lyuye Zhang and Chengwei Liu and Zhengzi Xu and Sen Chen and Lingling Fan and Lida Zhao and Jiahui Wu and Yang Liu},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00212}
}