CopypastaVulGuard - A browser extension to prevent copy and paste spreading of vulnerable source code in forum posts

  • Forums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance consideringForums such as Stack Overflow are used by many software developers to find a solution for a given coding problem. Found solutions, i.e. forum posts containing relevant source code, are utilized in a copy and paste manner. This behavior carries the risk that vulnerabilities contained in the source code of the forum posts are spread. Software developers should be able to identify vulnerable source code at an early stage, thereby preventing copying the corresponding source code. In this paper, we introduce the tool CopypastaVulGuard that identifies vulnerable source code in forum posts and allows software developers to omit the source code by marking the forum posts as dangerous. Our tool consists of a browser extension and a management application capable to address as examples SQL injections, remote code executions and deprecated functions based on a dump of the archive.org Stack Overflow data set. We present an evaluation of our tool's possible impact and relevance considering pros/cons and selected research questions.show moreshow less

Export metadata

Additional Services

Share in Twitter Search Google Scholar
Metadaten
Author:Max van Aerssen, Christian Leich, Holger Schmidt, Salar Al Ali, Abdulkader Benni, Jakob Tanz
Fachbereich/Einrichtung:Hochschule Düsseldorf / Fachbereich - Medien
Hochschule Düsseldorf / Fachbereich - Medien / Digitale Vernetzung und Informationssicherheit​
Document Type:Conference Proceeding
Year of Completion:2022
Language of Publication:English
Publisher:Association for Computing Machinery
Place of publication:New York
Parent Title (English):ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security
Article Number:148
Page Number:8
First Page:1
Last Page:8
DOI:https://doi.org/10.1145/3538969.3538973
Corresponding Author:Holger Schmidt
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 000 Informatik, Informationswissenschaft, allgemeine Werke
Licence (German):keine Lizenz - nur Metadaten
Release Date:2022/06/03
Accept ✔
Diese Webseite verwendet technisch erforderliche Session-Cookies. Durch die weitere Nutzung der Webseite stimmen Sie diesem zu. Unsere Datenschutzerklärung finden Sie hier.