security-vulnerability-repair

# Skill: security-vulnerability-repair ## 1. Capability Definition & Real Case * **Professional Definition**: The ability to identify, repair, or proactively prevent security-relevant flaws—such as injections, missing access checks, timing attacks, or unsafe parsing—within a codebase. This comprises parsing vulnerability descriptions or security test suite logs, mapping the threat model to Trust Boundaries, and editing code to restore or build security invariants (e.g., parameterized queries, constant-time evaluations, URL sanitization) while rigorously preserving intended functional behaviors. * **Dimension Hierarchy**: Repository Maintenance and Repair->Issue-Driven Repair->security-vulnerability-repair ### Real Case **[Case 1]** * **Initial Environment**: A web application repository includes a failing test showing that crafted login input can bypass authentication by altering the generated query. The repository contains request handlers, query helpers, and authentication tests. * **Real Question**: Repair the login flow so malicious input cannot change the meaning of the database query. * **Real Trajectory**: Trace the login request from handler to query construction, confirm unsafe string interpolation, replace it with parameterized query handling, and run the targeted authentication security tests plus standard login regressions. * **Real Answer**: The login path now binds user input safely and rejects malicious query-shaping input while preserving valid authentication behavior. * **Why this demonstrates the capability**: This is a security-repair task because the failure is defined by exploitability. The agent must understand the vulnerability mechanism, patch the security boundary, and verify both exploit closure and preserved functionality. --- **[Case 2]** * **Initial Environment**: A Java service includes a vulnerability report explaining that a token-validation step omits an integrity check before accepting a session token. Regression tests include one newly failing security case and multiple passing session-management tests. * **Real Question**: Add the missing cryptographic validation step before accepting session tokens. * **Real Trajectory**: Inspect the token verification path, compare expected validation sequence with neighboring helpers, insert the integrity check before claims are trusted, and rerun the security test together with session lifecycle tests. * **Real Answer**: Session tokens are only accepted after the full validation sequence completes, including the previously omitted integrity verification step. * **Why this demonstrates the capability**: The task specifically evaluates security repair because the patch must restore a protection guarantee. The correct trajectory requires security-aware reasoning about validation order and trust boundaries. --- **[Case 3]** * **Initial Environment**: A web-based CMS repository is missing the converter logic for rich text Draft.js entities. The environment provides a Draft.js to HTML conversion pipeline and a test suite targeting stored XSS vulnerabilities. * **Real Question**: Implement the 'link_entity' function in the contentstate converter to handle URLs, ensuring that all external links are properly sanitized against dangerous URI schemes. * **Real Trajectory**: The agent audits the module, extracts constraints, and implements mapping logic for page IDs using a raw anchor tag template. Running the tests reveals a security failure where the 'javascript:' scheme can be injected. The agent refines the logic by integrating the project's 'check_url' utility to enforce a strict scheme allow-list. Functional verification confirms links are correct, and security verification confirms sanitization. * **Real Answer**: A 'link_entity' converter that utilizes a 'check_url' wrapper to strip malicious schemes from external anchor tags while preserving internal page linking logic. * **Why this demonstrates the capability**: This extends vulnerability repair into 'Secure Feature Development'. Success requires the agent to recognize security risks (Stored XSS) in a newly requested feature and apply robust, project-specific mitigations before finalizing the implementation. ## Pipeline Execution Instructions To synthesize data for this capability, you must strictly follow a 3-phase pipeline. **Do not hallucinate steps.** Read the corresponding reference file for each phase sequentially: 1. **Phase 1: Environment Exploration** Read the exploration guidelines to discover raw knowledge seeds: `references/EXPLORATION.md` 2. **Phase 2: Trajectory Selection** Once Phase 1 is complete, read the selection criteria to evaluate the trajectory: `references/SELECTION.md` 3. **Phase 3: Data Synthesis** Once a trajectory passes Phase 2, read the synthesis instructions to generate the final data: `references/SYNTHESIS.md`