CopypastaVulGuard - A browser extension to prevent copy and paste spreading of vulnerable source code in forum posts
- Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance consideringForums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions.…
Author: | Max van Aerssen, Christian Leich, Holger Schmidt, Salar Al Ali, Abdulkader Benni, Jakob Tanz |
---|---|
Fachbereich/Einrichtung: | Hochschule Düsseldorf / Fachbereich - Medien |
Hochschule Düsseldorf / Fachbereich - Medien / Digitale Vernetzung und Informationssicherheit | |
Document Type: | Conference Proceeding |
Year of Completion: | 2022 |
Language of Publication: | English |
Publisher: | Association for Computing Machinery |
Place of publication: | New York |
Parent Title (English): | ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security |
Article Number: | 148 |
Page Number: | 8 |
First Page: | 1 |
Last Page: | 8 |
DOI: | https://doi.org/10.1145/3538969.3538973 |
Corresponding Author: | Holger Schmidt |
Dewey Decimal Classification: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 000 Informatik, Informationswissenschaft, allgemeine Werke |
Licence (German): | keine Lizenz - nur Metadaten |
Release Date: | 2022/06/03 |