Harmful content embedded in program elements within source code may have detrimental impact on mental health of software developers, and promote harmful behavior. Our key insight is that software developers may introduce harmful content into source code via diverse semantic-preserving program transformations when using Code Large Language Models (Code LLMs). To analyze the space of program transformations that may be used to introduce harmful content into auto-generated code, we conduct a preliminary study that revealed 32 different types of transformations that can be used to introduce harmful content in source code. Based on our study, we propose CHT, a novel coverage-based harmfulness testing framework that automatically synthesizes prompts using a set of prompt templates injected with diverse harmful keywords to perform various types of transformations on a set of mined benign programs. Instead of checking if the content moderation has been bypassed as prior testing approaches, CHT performs output damage measurement to assess potential harm that can be incurred by the generated outputs (i.e., natural language explanation and modified code). By considering output damage, CHT revealed several problems in Code LLMs: (1) bugs in content moderation for code (Code LLMs produce the harmful code without providing any warning), (2) inadequacy in performing code-related task (e.g., Code LLMs may resort to explaining the given code instead of performing the instructed transformation task), and (3) lenient content moderation (gives warning but the modified code with harmful content is still produced). Our evaluations of CHT on four Code LLMs and gpt-4o-mini (general LLM) show that content moderation in Code LLMs is relatively easy to bypass where LLMs may generate harmful keywords embedded within identifier names or code comments without giving any warning (65.93% in our evaluation). To improve the robustness of content moderation in code-related tasks, we propose a two-phase approach that checks if the prompt contains any harmful content before generating any output. Our evaluation shows that our proposed approach improves the content moderation of Code LLM by 483.76%.

In functional programming languages, such as Scala and Haskell, a higher-order function is a function that takes one or more functions as parameters or returns a function. Using higher-order functions in programs can increase the generality and reduce the redundancy of source code. To test a higher-order function, a tester needs to check the requirements and write another function as the test input. However, due to the complexity of higher-order functions, testing higher-order functions is a time-consuming and labor-intensive task. Testers have to spend an amount of manual effort in testing all higher-order functions. Such testing is infeasible if the time budget is limited, such as a period before a project release. In this paper, we propose an automatic approach, namely PHOF, which predicts whether a higher-order function will be called in the future. Higherorder functions that are most likely to be called should be tested first. Our approach can assist developers to reduce the number of higherorder functions under test. In PHOF, we extracted 24 features from source code and logs to train a predictive model based on known higher-order functions calls. We empirically evaluated our approach on 2854 higher-order functions from six real-world Scala projects. Experimental results show that PHOF based on the random forest algorithm and the SMOTE strategy performs well in the prediction of calls of higher-order functions. Our work can be used to support the scheduling of limited test resources.

Exception handling is widely used in software development to guarantee code robustness and system reliability. Developers are expected to choose appropriate handling strategies to ensure exceptions are handled properly without causing program crashes or unintended behaviors. However, making such choices is challenging especially for the novices due to lack of experience on exceptional flow design. To assist developers in deciding how to handle exceptions, we propose a method to automatically recommend exception handling strategies based on program context. This method learns practices of exception handling from existing high-quality projects and code by well-skilled developers. We extracted three type of program context (exceptional context, architectural context, and functional context) as features and applied machine learning techniques to recommend an optimized strategy of exception handling. We conducted the evaluation on 10 open source Java projects. Experimental results show that our approach reaches high prediction accuracy in choosing exception handling strategies.