arXiv:2510.09037cs.AIcs.PL2025-10Conference of the …

用定位引导的指令修复正则表达式漏洞,兼顾准确与泛化能力。

Repairing Regex Vulnerabilities via Localization-Guided Instructions

  • 先符号化定位漏洞子模式,再让大模型修复局部片段。
  • 相比当前最优方法,修复率提升15.4个百分点。
  • 适合需要高可靠性的自动化安全修复场景。

正则表达式广泛用于输入验证和数据解析,但其易引发正则表达式拒绝服务(ReDoS)漏洞,亟需自动化修复方法。现有方案存在权衡:符号化规则方法精确但无法处理未知或复杂模式;大语言模型(LLMs)具泛化能力,却难以保证严格语法与语义正确性。本文提出混合框架局部正则修复(LRR),通过解耦问题定位与修复过程实现突破。首先由确定性符号模块精准定位脆弱子模式,形成可约束的问题空间;随后调用大模型为该片段生成语义等价修复。该架构成功解决规则方法无法处理的复杂案例,同时避免纯大模型方案的语义错误。实验表明,本方法在自动化修复上相较当前最优水平提升15.4个百分点。代码已开源于https://github.com/cdltlehf/LRR。

原文摘要 · Abstract (English)

Regular expressions (regexes) are foundational to modern computing for critical tasks like input validation and data parsing, yet their ubiquity exposes systems to regular expression denial of service (ReDoS), a vulnerability requiring automated repair methods. Current approaches, however, are hampered by a trade-off. Symbolic, rule-based system are precise but fails to repair unseen or complex vulnerability patterns. Conversely, large language models (LLMs) possess the necessary generalizability but are unreliable for tasks demanding strict syntactic and semantic correctness. We resolve this impasse by introducing a hybrid framework, localized regex repair (LRR), designed to harness LLM generalization while enforcing reliability. Our core insight is to decouple problem identification from the repair process. First, a deterministic, symbolic module localizes the precise vulnerable subpattern, creating a constrained and tractable problem space. Then, the LLM invoked to generate a semantically equivalent fix for this isolated segment. This combined architecture successfully resolves complex repair cases intractable for rule-based repair while avoiding the semantic errors of LLM-only approaches. Our work provides a validated methodology for solving such problems in automated repair, improving the repair rate by 15.4%p over the state-of-the-art. Our code is available at https://github.com/cdltlehf/LRR.

正则表达式漏洞修复大模型安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。