DCAFixer: An Automatic Tool for Bug Detection and Repair for Database Java Client Applications

Application programs are a possible source of attacks to databases. SQL injection is a well-known attack that exploits the lack of user input sanitization by applications. Following secure code practices to avoid vulnerabilities is the best way to prevent attacks. However, developers usually make mistakes either due to a lack of knowledge (i.e., a beginner developer) or due to bad code practices like copy-paste, which duplicates bugs and vulnerabilities in the code. Detecting such vulnerabilities manually is expensive and time-consuming, especially for very large code bases. Fixing vulnerabilities is also expensive as it requires manual interventions. It is thus clear that in order to systematically find and fix vulnerabilities we need automatic tools. In this article, we address such a need. We propose the Database Client Applications Fixer (DCAFixer) tool, which automatically detects and repairs three types of common vulnerabilities in SQL application programs, namely unsanitized user inputs, insecure credentials handling, and unencrypted connections. DCAFixer operates in three phases: fault localization, patch generation and selection, and patch validation.