# StaticFixer: From Static Analysis to Static Repair

arXiv: https://arxiv.org/abs/2307.12465 · HTML: https://mlsanity.com/paper/2307.12465/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Jul 2023.

## Built on by (most cited first, 4 of 4)

- [RepairAgent: An Autonomous, LLM-Based Agent for Program Repair](https://mlsanity.com/paper/2403.17134/) (2024)
- [Frustrated with Code Quality Issues? LLMs can Help!](https://mlsanity.com/paper/2309.12938/) (2023)
- [PredicateFix: Repairing Static Analysis Alerts with Bridging Predicates](https://mlsanity.com/paper/2503.12205/) (2025)
- [Catching Developers in the Flow: Low-Latency Agentic Program Repair at Google Scale](https://mlsanity.com/paper/2610.07289/) (2026)

## Abstract (arXiv)

Static analysis tools are traditionally used to detect and flag programs that violate properties. We show that static analysis tools can also be used to perturb programs that satisfy a property to construct variants that violate the property. Using this insight we can construct paired data sets of unsafe-safe program pairs, and learn strategies to automatically repair property violations. We present a system called sysname, which automatically repairs information flow vulnerabilities using this approach. Since information flow properties are non-local (both to check and repair), sysname also introduces a novel domain specific language (DSL) and strategy learning algorithms for synthesizing non-local repairs. We use sysname to synthesize strategies for repairing two types of information flow vulnerabilities, unvalidated dynamic calls and cross-site scripting, and show that sysname successfully repairs several hundred vulnerabilities from open source sc JavaScript repositories, outperforming neural baselines built using sc CodeT5 and sc Codex. Our datasets can be downloaded from urlhttp://aka.ms/StaticFixer.