SoylentNews is people
SoylentNews
from the when-you-get-what-you-asked-for-only-to-learn-it-was-not-what-you-wanted dept.
Surprise! Copying Crummy Code from Stack Overflow Leads to Vulnerable GitHub Jobs:
In a research paper submitted to pre-print service ArXiv, six computer science boffins who hail from Shiraz University, Iran, Polytechnique Montreal University, Quebec, Canada, and Chamran University, Iran – Morteza Verdi, Ashkan Sami, Jafar Akhondali, Foutse Khomh, Gias Uddin, and Alireza Karami Motlagh – say that they looked at more than 72,000 C++ code snippets in 1,325 Stack Overflow posts and found 69 vulnerable snippets of 29 different types.
That's not a lot in absolute terms but those 69 vulnerable snippets show up in 2,589 GitHub projects. The researchers say they notified the authors of affected projects and some, but not all, chose to fix the flaws, which consist of known CWEs.
The paper, "An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples," is being reviewed for possible publication in the journal IEEE Transactions on Software Engineering.
[...]The research echoes an academic paper from 2017 that found 1,161 insecure code snippets posted on Stack Overflow had been copied and pasted into 1.3m Android applications available on Google Play.
The boffins relied on a Stack Overflow data set called SOTorrent data-set Version 2018-09-23. It covers posts from 2008 through 2018 and contains some duplicate code snippets.
The researchers chose to focus on C++ because it's popular, particularly for embedded, resource-constrained programs and large, distributed systems. Vulnerabilities in such systems, they contend, are likely to have a significant impact.
The most frequently found CWEs[1] were CWE-1006 (Bad Coding Practices, CWE-754 (Improper Check for Unusual or Exceptional Conditions), and CWE-20 (Improper Input Validation).
[...]the researchers developed a Chrome extension to help developers be more mindful of security when copying and pasting Stack Overflow code snippets. The extension checks copied code against the CWE database and throws up an alert if the snippet is flawed. Uddin said the plan is to release it when the paper is formally published.
[1] CWE: Common Weakness Enumeration
Do not deploy what you do not understand? Whodathunkit?
(Score: 2) by stretch611 on Sunday October 06 2019, @05:08PM
True, good programmers use Stack Overflow as well... not just because of Open Source software having crappy if any documentation, but also due to commercial tools having crappy documentation as well.
But the good programmers don't just copy it verbatim. They modify the code to suit their particular need and compare it to other ways of accomplishing the same results and evaluating which is the best way.
Now with 5 covid vaccine shots/boosters altering my DNA :P