APIfix: output-oriented program synthesis for combating breaking changes in libraries
APIfix: output-oriented program synthesis for combating breaking changes in libraries
复制标题
APIfix：面向输出的程序综合，用于应对库中的重大更改
DOI：
--
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Abhik Roychoudhury
中科院分区：
文献类型：
--
作者：
Xiang Gao;Arjun Radhakrishna;Gustavo Soares;Ridwan Shariffdeen;Sumit Gulwani;Abhik Roychoudhury
第三方库的使用在应用软件中非常普遍。这些库不断发展以适应新功能或减轻安全漏洞，从而破坏软件使用的应用程序编程接口（API）。库中的这种破坏性更改可能会阻止客户端代码使用新的库版本，从而使应用程序易受攻击且无法更新。我们提出了一种新的面向输出的程序合成算法自动API的使用适应通过程序转换。我们的目标不仅仅是依赖于客户端从旧库版本到新库版本的几个示例性人工适应，因为这可能导致过度拟合转换规则。相反，我们还依赖于客户端中新更新库的示例用法，这为合成和应用转换规则提供了有价值的上下文。我们的工具APIFix提供了一种自动化机制，可以将使用旧库版本的应用程序代码转换为使用新库版本的代码-从而实现自动化的API使用适应，以修复破坏性更改的影响。我们的评估表明，APIFix推断的转换规则达到98.7%的准确率和91.5%的召回率。通过比较我们的方法，国家的最先进的程序合成方法，我们表明，我们的方法显着减少过度拟合，同时合成转换规则的API使用适应。
Use of third-party libraries is extremely common in application software. The libraries evolve to accommodate new features or mitigate security vulnerabilities, thereby breaking the Application Programming Interface(API) used by the software. Such breaking changes in the libraries may discourage client code from using the new library versions thereby keeping the application vulnerable and not up-to-date. We propose a novel output-oriented program synthesis algorithm to automate API usage adaptations via program transformation. Our aim is not only to rely on the few example human adaptations of the clients from the old library version to the new library version, since this can lead to over-fitting transformation rules. Instead, we also rely on example usages of the new updated library in clients, which provide valuable context for synthesizing and applying the transformation rules. Our tool APIFix provides an automated mechanism to transform application code using the old library versions to code using the new library versions - thereby achieving automated API usage adaptation to fix the effect of breaking changes. Our evaluation shows that the transformation rules inferred by APIFix achieve 98.7% precision and 91.5% recall. By comparing our approach to state-of-the-art program synthesis approaches, we show that our approach significantly reduces over-fitting while synthesizing transformation rules for API usage adaptations.