一句话：提出反例引导的 OIDC 自动修复引擎 AuthFix，结合 LLM 合成补丁并以 Petri 网模型检测验证，修复 23 个缺陷中的 17 个。
OpenID Connect（OIDC）虽广泛用于单点登录，但其实现中的安全缺陷已造成严重经济损失与数据泄露，亟需自动修复手段；然而 OIDC 领域复杂、故障定位与补丁验证困难。本文提出 AuthFix，一个反例引导的自动修复引擎，利用 LLM 完成 OIDC 程序缺陷修复。它包含故障定位、补丁合成与补丁验证三个组件，并通过一种新颖的 Petri 网模型检测器对交互进行建模，从而保证生成补丁的正确性。在 OIDC 缺陷数据集上的评估表明，AuthFix 为 23 个缺陷中的 17 个（74%）成功生成了正确补丁，且其中很大比例的补丁与开发者手工修复在语义上等价。
OpenID Connect has revolutionized online authentication based on single sign-on (SSO) by providing a secure and convenient method for accessing multiple services with a single set of credentials. Despite its widespread adoption, critical security bugs in OpenID Connect have resulted in significant financial losses and security breaches, highlighting the need for robust mitigation strategies. Automated program repair presents a promising solution for generating candidate patches for OpenID implementations. However, challenges such as domain-specific complexities and the necessity for precise fault localization and patch verification must be addressed. We propose AuthFix, a counterexample-guided repair engine leveraging LLMs for automated OpenID bug fixing. AuthFix integrates three key components: fault localization, patch synthesis, and patch verification. By employing a novel Petri-net-based model checker, AuthFix ensures the correctness of patches by effectively modeling interactions. Our evaluation on a dataset of OpenID bugs demonstrates that AuthFix successfully generated correct patches for 17 out of 23 bugs (74%), with a high proportion of patches semantically equivalent to developer-written fixes.
DOI 原文 ·
@inproceedings{paperbot9308,
title = {Automated Repair of OpenID Connect Programs},
author = {Tamjid Al Rahat and Yanju Chen and Yu Feng and Yuan Tian},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00187}
}