In recent years, JavaScript has become the most widely used programming
language, especially in web development. However, writing secure JavaScript
code is not trivial, and programmers often make mistakes that lead to security
vulnerabilities in web applications. Large Language Models (LLMs) have
demonstrated substantial advancements across multiple domains, and their
evolving capabilities indicate their potential for automatic code generation
based on a required specification, including automatic bug fixing. In this
study, we explore the accuracy of LLMs, namely ChatGPT and Bard, in finding and
fixing security vulnerabilities in JavaScript programs. We also investigate the
impact of context in a prompt on directing LLMs to produce a correct patch of
vulnerable JavaScript code. Our experiments on real-world software
vulnerabilities show that while LLMs are promising in automatic program repair
of JavaScript code, achieving a correct bug fix often requires an appropriate
amount of context in the prompt.

本研究探讨了 ChatGPT 和 Bard 这两个大型语言模型在发现和修复 JavaScript 程序中的安全漏洞方面的准确性，以及提示语境对定位 LLMs 生成正确补丁的影响。实验结果显示，虽然 LLMs 在自动修复 JavaScript 代码方面具有潜力，但要实现正确的缺陷修复往往需要适当的提示语境。

JavaScript 程序中基于大规模语言模型的漏洞修复研究

A Study of Vulnerability Repair in JavaScript Programs with Large  Language Models

Automatically fixing software bugs is a challenging task. While recent work
showed that natural language context is useful in guiding bug-fixing models,
the approach required prompting developers to provide this context, which was
simulated through commit messages written after the bug-fixing code changes
were made. We instead propose using bug report discussions, which are available
before the task is performed and are also naturally occurring, avoiding the
need for any additional information from developers. For this, we augment
standard bug-fixing datasets with bug report discussions. Using these newly
compiled datasets, we demonstrate that various forms of natural language
context derived from such discussions can aid bug-fixing, even leading to
improved performance over using commit messages corresponding to the oracle
bug-fixing commits.

使用自然语言建模从 Bug 报告讨论中提取上下文信息自动修复软件缺陷，比使用提交信息导致更好性能提升。