Natural rewrites silence CodeQL JavaScript taint alerts while the flaw remains
Original title: Preserve the Vulnerability, Break the Alert: Testing the Robustness of CodeQL Taint Tracking with Natural Rewrites
Three rewrites per flow silenced 26.2% of 172 npm vulnerability flows, about USD 0.51 each; alert-blind refactors silenced none.
Researchers tested whether CodeQL's JavaScript taint tracking stays reliable when one function on a reported flow is rewritten as a plausible maintenance change that keeps the vulnerability. An LLM given only the exposed alert produced rewrites that manual audit and controlled experiments confirmed still contained the flaw after the alert disappeared. Every silencing rewrite mapped to one of seven gaps at the library-modeling boundary, and most also fooled other taint analyzers.
- On 172 real npm flows, three rewrites silenced 26.2% of CodeQL alerts.
- The largest gap is the WHATWG URL constructor, which taints query but not pathname.
- Sixty-four of 70 silencing rewrites cross a gap inside an API CodeQL already models.
- 74% of silencing rewrites also silence an independent analyzer; 53% escape three.
From the original article
1 min read at arxiv.orgStatic application security testing (SAST) tools such as CodeQL serve as security gates in continuous integration and code review, and a gate is also read in reverse. When a previously reported alert disappears after a change, developers and the tools around them often take the vulnerability to be gone. That inference holds only if the analyzer is robust to changes that keep the vulnerability.
By Zhezhen Cao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.