Survey of Open-source Software Component Vulnerability Detection and Automatic RepairTechnology

The unstoppable trend of software componentization and the development process of collaborative work mode by multiple individuals have led to the gradual formation of open-source software supply chains.While flourishing open-source software brings great convenience,open-source vulnerabilities quietly emerge along the supply chain,posing a threat to the security and reliability of software systems.Software composition analysis technology can provide substantial support for maintaining the security of fragile open-source software supply chains.It discovers and fixes potential vulnerabilities and risks in software projects through two core functions:open-source software component vulnerability detection and automatic repair.To deepen the understanding of relevant researchers on the practical application of software component analysis in security vulnerabilities,this paper reviews and summarizes the research progress and achievements in recent years on open-source software component vulnerability detection and automatic repair technologies.Furthermore,starting from the users' perspective,a summary and analysis of eight common software composition analysis tools based on eight analysis dimensions are provided.Finally,the existing challenges of open-source software component vulnerability detection and automatic repair technology are discussed,and their possible future development directions are explored.