Fixing security vulnerability in a source code

A computer program product stored on a non-transitory tangible computer readable storage medium for automatically fixing a security vulnerability in a source code, the computer program product including code for:

• detecting a security vulnerability of an application by obtaining identification of a code block in a source code of the application that includes a code that sends tainted data to corresponding sink code;
• and
• automatically fixing the security vulnerability caused by the code block by automatically creating a corresponding fixed target code for the application, the corresponding fixed target code includes code modification which is selected from the group of code modifications consisting of:
• a code motion wherein at least part of the code block is moved to another location in the source code, and
• a code duplication wherein at least part of the code block is duplicated to create at least two copies thereof in the source code;
• wherein the security vulnerability is fixed when executing the application based on the corresponding fixed target code as said code modification prevents insecure data from running queries on a back-end database of the application;
• wherein the code that sends the tainted data contains statement creation;
• wherein the corresponding sink code creates a query with the tainted data;
• determining whether the code dominates entry into the corresponding sink code that creates the query;
• and
• performing the code modification when the code does not dominate the entry;
• wherein the security vulnerability is an SQL injection vulnerability.

A data processing system for fixing a security vulnerability in a source code comprising:

• a processor;
• a computer usable medium connected to the processor, wherein the computer usable medium contains a set of instructions, executable on the processor, for:
• detecting a security vulnerability of an application by obtaining identification of a code block in a source code of the application that includes a code that sends tainted data to corresponding sink code;
• and
• automatically fixing the security vulnerability caused by the code block by automatically creating a corresponding fixed target code for the application, the corresponding fixed target code includes code modification which is selected from the group of code modifications consisting of:
• a code motion wherein at least part of the code block is moved to another location in the source code, and
• a code duplication wherein at least part of the code block is duplicated to create at least two copies thereof in the source code;
• wherein the security vulnerability is fixed when executing the application based on the corresponding fixed target code as said code modification prevents insecure data from running queries on a back-end database of the application;
• wherein the code that sends the tainted data contains statement creation;
• wherein the corresponding sink code creates a query with the tainted data;
• determining whether the code dominates entry into the corresponding sink code that creates the query;
• and
• performing the code modification when the code does not dominate the entry;
• wherein the security vulnerability is an SQL injection vulnerability.