Aug 2026· Programming and computer software· Vol 52, pp. 297 - 307· 0 citations· 20 references
Computer Science
TL;DR
An approach to improving the recall of static analysis of .NET applications using frameworks, such as WPF and Entity Framework Core, is proposed, based on generating an equivalent C# code that models user interaction scenarios that significantly improves the recall of static analysis of framework-based applications.
An approach to verifying the results of static code analysis using large language models (LLMs), which filters warnings to eliminate false positives, which was implemented in SharpChecker, an industrial static analyzer for C#.
D. D. Panov, N. V. Shimchik, D. A. Chibisov et al.· Programming and computer sof...· 0 citations
The adoption of Large Language Models (LLMs) is changing how code is written, but the security implications of using LLMs to generate complete web API backends remain insufficiently characterized. Prior studies have assessed the security of LLM-generated code by detecting vulnerabilities in isolated code snippets; however, these assessments are too narrow to surface vulnerabilities that emerge in multi-endpoint backend services. To address this gap, we performed a security assessment on 75 FastAPI backends generated by three contemporary LLMs (Gemini 2.5 Pro, GPT 5.2, and DeepSeek V3.2). We designed a benchmark comprising the following five code generation categories: Authentication, Role-Based Access Control, File Uploads, Payment Processing, and Webhook Handling. Automated analysis of the generated APIs with Static Application Security Testing (SAST) tools, whose raw alerts we manually triaged to remove false positives, mainly revealed configuration problems, while Dynamic Application Security Testing (DAST) tools helped uncover runtime fragility such as application crashes on malformed input. Automated analysis was augmented with a manual assessment phase, which revealed vulnerabilities such as mass assignment and server-side request forgery. We also observed a disconnect between functional correctness and secure logic. In our trials, DeepSeek V3.2 produced the most vulnerable code despite the highest build success rate. Gemini 2.5 Pro had the highest startup-failure rate and produced shorter implementations, which coincided with fewer observed runtime findings among the APIs that started. GPT-5.2 fell between the two, characterized by near-correct security controls that took the right form but lacked the intended effect. We interpret this disconnect as a review-risk pattern, which we call the human-in-the-loop paradox: syntactically correct and well-structured LLM-generated code can still contain architectural vulnerabilities that are not revealed by surface-level inspection. The takeaway is that LLM-generated code warrants the same treatment as untrusted input from an external system.
Abdul Ali Khan, S. Rauti, T. Mäkilä· IEEE Access· 0 citations
PyFlow is presented, a generic IFDS-based static-analysis framework for Python that provides a multi-stage intermediate-representation pipeline and a generic IFDS solver parameterized by abstract domains and concludes with lessons learned from building IFDS analyses for Python.
Exception Related Code (ERC), which includes throw statements, conditions (if statements) that guard those throw statements, and try/catch blocks, is an essential component of software systems, allowing developers to detect and handle exceptional states that deviate from the expected program behavior. However, manually writing ERC across large codebases is tedious. We propose a novel task: retrofitting existing code with ERC. Namely, given code (without ERC) and Exceptional Behavior Tests (EBTs) (e.g., check if method throws InvalidArgumentException if null is given as the value to the argument) we aim to automatically generate missing ERC, such that the given tests pass. We design and implement Exception Coder (EXCODER) that performs context engineering to help Large Language Models (LLMs) tackle this task. EXCODER integrates static and dynamic program analysis with LLMs by providing the extracted contextual information to the LLMs. To evaluate EXCODER, we build a benchmark constructed from GitHub Java repositories, where we systematically remove ERC in 304 methods from 75 projects. Our results demonstrate that EXCODER provides an effective, though imperfect, solution to this problem in automated code generation, offering developers the first way to implement ERC following test-driven development. When combined with Qwen 2.5 Coder 32b, EXCODER achieves pass@1, 5, and 10 rates of 85.92% (12.56 percentage points over baseline), 86.18% (12.82 p.p. over baseline), and 86.51% (13.15 p.p. over baseline), respectively, on developer-written test suites. Our manual inspection of the generated code further reveals limitations of EXCODER, pointing to directions for future work.
Ling-Tao Zhong, Jiyang Zhang, Jayanth Srinivasa et al.· 0 citations
Large Language Models (LLMs) are increasingly used for software vulnerability detection, but their performance depends on how source code is represented in the input. Most prompting approaches use source code in its original form, while some works propose the use of structured representations. Abstract Syntax Trees (ASTs) are one of the most popular approaches, but AST verbosity increases input size relative to source code, making them hard to fit within some LLMs context windows. This paper investigates Behavior Trees (BTs) as an alternative intermediate representation for LLM-based vulnerability detection. BTs encode control flow, conditions, and executable actions more compactly than ASTs, making them a natural candidate when token count is a constraint. First, we propose a preprocessing stage that parses Java source code into ASTs and then converts them into BT representations. We then compare vulnerability detection performance across 460 Java samples from the Juliet Java test suite, using three input representations: raw source code, AST, and BT. All experiments use a single quantized local LLM, Mistral Small 3.2 24B (Q4_K_M). Our results show that using BT representations improves recall on short code samples, while raw source code achieves higher precision. On longer samples, BTs improve overall performance over the original representation and fit within the context window, whereas many ASTs exceed the context limit. These findings suggest that BTs can provide a compact and useful structured representation for vulnerability detection with quantized, locally deployable LLMs.
FlowCheck, a constraint language to specify user-visible information flows directly through the application interface, where constraints can also be displayed and inspected without reading code, and are structured enough for reliable LLM generation.
Reya Vir, Lydia B. Chilton, Zhuo Zhang et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
