| Bibliography | Joos, Pascal: Automated Repair of Warnings Raised by Static Analysis Tools. University of Stuttgart, Faculty of Computer Science, Electrical Engineering, and Information Technology, Master Thesis No. 109 (2025). 83 pages, english.
|
| Abstract | Static analysis tools are widely used by developers to detect bugs, vulnerabilities, and code smells. However, developers usually need to manually resolve reported warnings, which is a tedious and time-consuming task. As a result, many projects accumulate large numbers of unresolved warnings. Automatic repair of static analysis warnings seeks to address these challenges by reducing the required manual effort. We propose CodeCureAgent, a novel agentic approach for classifying and repairing static analysis warnings raised by static analysis tools. Unlike previous work, our approach does not follow a predetermined algorithm but incorporates the LLM as an agent capable of autonomously collecting relevant information, pursuing its own plan, and advancing its task. CodeCureAgent receives a target warning within a project, then classifies it as a true positive or false positive before moving on to the repair phase, where it fixes true positives and suppresses false positives. The approach is split into two sub-agents to address the classification and repair tasks separately. Both sub-agents operate in cycles of prompting an LLM, which answers by calling one of a set of provided tools, allowing to retrieve information, make plans, or suggest fixes. CodeCureAgent then extends the next prompt by the tool output. This cyclic pattern allows the agent to address the task incrementally by collecting relevant information on demand, trying different fixes, and learning from previous attempts. For validation, we embed the ChangeApprover, which performs a three-step validation by building the project, checking if the target warning is removed and no new warnings are introduced, and running tests. The ChangeApprover either approves or rejects the fix and gives the agent feedback on existing issues upon rejection. CodeCureAgent outputs a plausible fix for the target warning if approved by the ChangeApprover. We evaluate CodeCureAgent on a dataset of 1,000 warnings raised by SonarQube in Java code covering 291 distinct rules. Our approach creates plausible fixes for 96.8% of warnings with a mean cost of 2.9 cents per warning and outperforms two baselines, Sorald [9] and CORE [36], by 30.6% and 29.2%. Upon checking for the correctness of classification and the correctness of created fixes for 291 warnings with distinct rules, we find that CodeCureAgent has an end-to-end performance of 86.3%. This shows that our approach can reliably repair static analysis warnings and aid developers in improving code quality.
|