Open source vulnerability remediation tool

1. A method comprising:

a) receiving, by a remediation computer, a candidate application that uses a plurality of code libraries;

b) receiving, by the remediation computer, information regarding known library vulnerabilities;

c) identifying, by the remediation computer, one or more libraries in the plurality of code libraries that are vulnerable based upon the information;

d) for each of the one or more vulnerable libraries:

i) determining a library version that minimizes risk;

ii) incorporating the determined library version that minimizes risk into the candidate application to form a test application;

iii) performing an application test on the test application;

iv) if an application test score on the test application, that incorporates the determined library version that minimizes risk, is below a predetermined threshold, then incorporating the determined library version that minimizes risk into a final application precursor; and

e) determining, by the remediation computer, in response to d), a final application.

2. The method of claim 1 , wherein performing the application test comprises:

performing one or more of a plurality of tests including exclusion testing, build testing, functional testing, regression testing, performance testing, and user interface testing.

3. The method of claim 1 , wherein the method further comprises, in d):

if the application test score is above the predetermined threshold, then generating a notification that the determined library version is not acceptable and/or selecting another library version, and repeating steps d)ii), d)iii), and d)iv).

4. The method of claim 1 , wherein the method further comprises, in d), generating an error report summarizing errors in a functionality test, wherein the error report provides change recommendations and estimated time to fix the errors.

5. The method of claim 1 , wherein determining the library version that minimizes risk comprises:

evaluating one or more of a plurality of risk factors, including known security vulnerabilities, licensing risk, and operational risk.

6. The method of claim 2 , wherein the exclusion testing comprises:

building the test application without a vulnerable library;

performing a functionality test on the test application without the vulnerable library; and

if the functionality test is below a certain threshold, then recommending removal of the vulnerable library from the candidate application.

7. The method of claim 2 , wherein the user interface testing comprises:

capturing an image of a user interface of the candidate application;

capturing an image of a user interface of the test application;

hashing the images of the user interface of the candidate application and the user interface of the test application;

comparing the hash of the image of the candidate application user interface to the hash of the image of the test application user interface; and

if the hashes do not match, then generating an intermediate remediation score based on a number of pixels that do not match.

8. The method of claim 1 , wherein the method further comprises, in d):

determining, by the remediation computer, one or more locations of a vulnerable library of the one or more vulnerable libraries in the candidate application.

9. The method of claim 8 , wherein determining, by the remediation computer, the location of the vulnerable library in the candidate application comprises determining that a vulnerability is external to the candidate application, and determining that the vulnerable library is a library that is nearest to the external vulnerability.

10. The method of claim 1 , wherein one or more of the plurality of libraries in the candidate application are open source libraries.

11. A remediation computer comprising:

a processor; and

a computer readable medium comprising code, executable by the processor, for implementing a method comprising:

a) receiving a candidate application that uses a plurality of code libraries;

b) receiving information regarding known library vulnerabilities;

c) identifying one or more libraries in the plurality of code libraries that are vulnerable based upon the information;

d) for each of the one or more vulnerable libraries:

i) determining a library version that minimizes risk;

ii) incorporating the determined library version that minimizes risk into the candidate application to form a test application;

iii) performing an application test on the test application;

iv) if an application test score on the test application, that incorporates the determined library version that minimizes risk, is below a predetermined threshold, then incorporating the determined library version that minimizes risk into a final application precursor; and

e) determining, in response to d), a final application.

12. The remediation computer of claim 11 , further comprising:

a localization module;

an application testing module;

a risk assessment module; and

an error assessment module.

13. The computer of claim 11 , wherein performing the application test comprises:

performing one or more of a plurality of tests including exclusion testing, build testing, functional testing, regression testing, performance testing, and user interface testing.

14. The computer of claim 11 , wherein the method further comprises:

if the application test score is above the predetermined threshold, then generating a notification that the determined library version is not acceptable and/or selecting another library version, and repeating steps d)ii), d)iii), and d)iv).

15. The computer of claim 11 , wherein the method further comprises, in d), generating an error report summarizing errors in a functionality test, wherein the error report provides change recommendations and estimated time to fix the errors.

16. The computer of claim 11 , wherein determining the library version that minimizes risk comprises:

evaluating one or more of a plurality of risk factors, including known security vulnerabilities, licensing risk, and operational risk.

17. The computer of claim 13 , wherein the exclusion testing comprises:

building the test application without a vulnerable library;

performing a functionality test on the test application without the vulnerable library; and

if the functionality test is below a certain threshold, then recommending removal of the vulnerable library from the candidate application.

18. The computer of claim 13 , wherein the user interface testing comprises:

capturing an image of a user interface of the candidate application;

capturing an image of a user interface of the test application;

hashing the images of the user interface of the candidate application and the user interface of the test application;

comparing the hash of the image of the candidate application user interface to the hash of the image of the test application user interface; and

if the hashes do not match, then generating an intermediate remediation score based on a number of pixels that do not match.

19. The computer of claim 11 , wherein the method further comprises, in d):

determining, by the remediation computer, a location of a vulnerable library of the one or more vulnerable libraries in the candidate application.

20. The computer of claim 19 , wherein determining the location of the vulnerable library in the candidate application comprises determining a vulnerability is external to the candidate application, and determining that the vulnerable library is a library that is nearest to the external vulnerability.

21. The computer of claim 11 , wherein one or more of the plurality of libraries in the candidate application are open source.