An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples

10/03/2019
by   Morteza Verdi, et al.
0

Software developers share programming solutions in Q A sites like Stack Overflow. The reuse of crowd-sourced code snippets can facilitate rapid prototyping. However, recent research shows that the shared code snippets may be of low quality and can even contain vulnerabilities. This paper aims to understand the nature and the prevalence of security vulnerabilities in crowd-sourced code examples. To achieve this goal, we investigate security vulnerabilities in the C++ code snippets shared on Stack Overflow over a period of 10 years. In collaborative sessions involving multiple human coders, we manually assessed each code snippet for security vulnerabilities following CWE (Common Weakness Enumeration) guidelines. From the 72,483 reviewed code snippets used in at least one project hosted on GitHub, we found a total of 69 vulnerable code snippets categorized into 29 types. Many of the investigated code snippets are still not corrected on Stack Overflow. The 69 vulnerable code snippets found in Stack Overflow were reused in a total of 2859 GitHub projects. To help improve the quality of code snippets shared on Stack Overflow, we developed a browser extension that allow Stack Overflow users to check for vulnerabilities in code snippets when they upload them on the platform.

READ FULL TEXT

page 1

page 2

page 3

page 4

research
09/28/2022

Does Collaborative Editing Help Mitigate Security Vulnerabilities in Crowd-Shared IoT Code Examples?

Background: With the proliferation of crowd-sourced developer forums, so...
research
05/28/2019

Analyzing and Supporting Adaptation of Online Code Examples

Developers often resort to online Q&A forums such as Stack Overflow (SO)...
research
10/15/2022

How security professionals are being attacked: A study of malicious CVE proof of concept exploits in GitHub

Proof-of-concept (PoC) of exploits for known vulnerabilities are widely ...
research
03/21/2019

Bootstrapping Cookbooks for APIs from Crowd Knowledge on Stack Overflow

Well established libraries typically have API documentation. However, th...
research
12/21/2021

Well Begun is Half Done: An Empirical Study of Exploitability Impact of Base-Image Vulnerabilities

Container technology, (e.g., Docker) is being widely adopted for deployi...
research
08/25/2023

A Large-Scale Study of IoT Security Weaknesses and Vulnerabilities in the Wild

Internet of Things (IoT) is defined as the connection between places and...
research
11/02/2021

The Security Risk of Lacking Compiler Protection in WebAssembly

WebAssembly is increasingly used as the compilation target for cross-pla...

Please sign up or login with your details

Forgot password? Click here to reset