Mini-apps, which run on super-apps, have attracted a large number of users due to their lightweight nature and the convenience of supporting the authorized use of super-app user information. Super-apps employ encryption to protect the transmission of sensitive identity information authorized by users to the mini-app, using the session key as the key. However, we have identified a risk of session key leakage, which could be exploited to maliciously manipulate sensitive user identity information, thereby posing a significant threat to user data security. To reveal this damage, we explore potential business scenarios of session key leakage in detail. Nevertheless, the diversity in design among various mini-apps makes automated testing of these business scenarios at a large scale challenging. This diversity is reflected in the inconsistent naming of identical types of controls and the disparate execution orders of controls within the same business scenarios across different mini-apps. To overcome these challenges, we propose Whiskey, which can adaptively and intelligently optimize dynamic testing strategies for mini-apps with diverse designs using large language models to detect session key leakage at scale. We evaluated Whiskey on 157,063 WeChat mini-apps and 10,000 TikTok mini-apps, and found that 15,712 of WeChat mini-apps and 678 of TikTok mini-apps had session key leakage vulnerabilities. Further analysis showed that this leakage could lead to account takeover and promotion abuse attacks. We responsibly reported the detection results to Tencent and the mini-app vendors. At the time of submission, 17 reported issues had been assigned CNVD IDs.

In this paper, we study the problem of online matrix completion (MC) aiming to achieve robustness to the variations in both low-rank subspace and noises. In contrast to existing methods, we progressively fit a specific Gaussian Mixture Model (GMM) for noises at each time slot, which ensures the adaptiveness of the model to dynamic complex noises under real application scenarios. Consequently, we formalize the online MC into an optimization problem based on the GMM regularizer. In particular, embedding the EM framework, we proposed a fast and memory-efficient online MC algorithm to solve the resulting optimization problem. The performance of the proposed method is substantiated on both synthetic and real-world data sets.

Tensor completion (TC) attempts to estimate the missing tensor entries from partial observations. Over the past decade, a tremendous amount of work has focused on this problem, which has given rise to a few excellent TC methods. Thus, a critical question is how to verify the optimality of TC models, especially when the underlying tensor is unknown, which is a common scenario in practice. The only existing method available-data validation-addresses the problem based on the validation set. While straightforward, this method may lead to a nonoptimal model, especially in scenarios with high missing ratios, and noise. In this work, we propose a self-validation method, which accounts for a metric named the identifiability measure, defined based on the generalization of isomeric conditions in the tensor case. It is noteworthy that the identifiability measure can verify the optimality of TC models without the use of any validation set. Extensive numerical experiments conducted on both synthetic, and real-world datasets empirically validate the superiority of the proposed method over the data validation approach.