.png){kind=icon}
返回
A Study of C/C plus plus Code Weaknesses on Stack Overflow
.png){kind=icon}
PRE
AI
DOI：10.1109/TSE.2021.3058985.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Stack Overflow hosts millions of solutions that aim to solve developers' programming issues. In this crowdsourced question answering process, Stack Overflow becomes a code hosting website where developers actively share its code. However, code snippets on Stack Overflow may contain security vulnerabilities, and if shared carelessly, such snippets can introduce security problems in software systems. In this paper, we empirically study the prevalence of the Common Weakness Enumeration- CWE, in code snippets of C/C++ related answers. We explore the characteristics of Code(w) , i.e., code snippets that have CWE instances, in terms of the types of weaknesses, the evolution of Code(w), and who contributed such code snippets. We find that: 1) 36 percent (i.e., 32 out of 89) CWE types are detected in Code(w) on Stack Overflow. Particularly, CWE-119, i.e., improper restriction of operations within the bounds of a memory buffer, is common in both answer code snippets and real-world software systems. Furthermore, the proportion of Code(w )doubled from 2008 to 2018 after normalizing by the total number of C/C++ snippets in each year. 2) In general, code revisions are associated with a reduction in the number of code weaknesses. However, the majority of Code(w) had weaknesses introduced in the first version of the code, and these Code(w) were never revised since then. Only 7.5 percent of users who contributed C/C++ code snippets posted or edited code with weaknesses. Users contributed less code with CWE weakness when they were more active (i.e., they either revised more code snippets or had a higher reputation). We also find that some users tended to have the same CWE type repeatedly in their various code snippets. Our empirical study provides insights to users who share code snippets on Stack Overflow so that they are aware of the potential security issues. To understand the community feedback about improving code weaknesses by answer revisions, we also conduct a qualitative study and find that 62.5 percent of our suggested revisions are adopted by the community. Stack Overflow can perform CWE scanning for all the code that is hosted on its platform. Further research is needed to improve the quality of the crowdsourced knowledge on Stack Overflow.
Keyword:
Code security
C/C plus
empirical software engineering
crowdsourced knowledge sharing and management
stack overflow
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
5.6
论文数:
2.9K
被引数:
1.1W
机构
引用论文
.png){kind=icon}
分享收藏
Study of nano-twinned Cu prepared by low-temperature electrodeposition and its thermal stability低温电沉积制备纳米孪晶Cu及其热稳定性研究
PREAI
分享收藏Tuning bandwidth enhancement in waveguide optical second‐harmonic generation device using phase‐reversed quasi‐phasematching grating通过相位反转准相位匹配光栅优化波导光学二次谐波发生器件的带宽增强
PREAI
分享收藏How Do Users Revise Answers on Technical Q&A Websites? A Case Study on Stack Overflow用户如何在技术问答网站上修改答案？堆栈溢出的案例研究
PREAI
分享收藏
查看更多内容