Expanding the scope of refactoring to fix Java security problems
summary
Claims that refactorings can fix real security and reliability bugs by rewriting code rather than just warning about it, using deep static analysis and whole-program reasoning. On Jenkins (≈320k LOC) a commercial scanner flags ~10,000 issues (~95% false positives); the refactoring system narrows that to 222 candidates, verifies ~80 real bugs and generates ~42 concrete fixes. Examples of fixes include replacing Random with SecureRandom, auto-converting string SQL concatenation to prepared statements, and inserting or relocating null checks or synchronization via behavior-enhancing refactorings.
AI-written summary · about
chapters (9)
- 0:00Introduction to Java security
- 2:51Software aging and maintenance
- 13:21Bug detection challenges
- 20:21Refactoring beyond behavior
- 22:48Detection precision issues
- 30:33Structural security fixes
- 35:28Complex automated fixes
- 40:05Intelligent code repair demo
- 42:54Q&A and future directions
related talks
01h 13mAutomating Security Fixes with OpenRewrite
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All- 46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once...
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
54mSecure Software Development
50mFix The Damned Software
20mAI-Driven Security as Code in Jenkins
51mPreventing Security Bugs through Software Design