It has become common practice for software projects to adopt third-party dependencies. Developers are encouraged to update any outdated dependency to remain safe from potential threats of vulnerabilities. In this study, we present an approach to aid developers show whether or not a vulnerable code is reachable for JavaScript projects. Our prototype, S\=ojiTantei, is evaluated in two ways (i) the accuracy when compared to a manual approach and (ii) a larger-scale analysis of 780 clients from 78 security vulnerability cases. The first evaluation shows that S\=ojiTantei has a high accuracy of 83.3%, with a speed of less than a second analysis per client. The second evaluation reveals that 68 out of the studied 78 vulnerabilities reported having at least one clean client. The study proves that automation is promising with the potential for further improvement.
翻译：软件项目采用第三方依赖性已成为常见做法。鼓励开发商更新任何过时的依赖性,以保持安全,免受潜在的脆弱性威胁。在本研究中,我们提出了一个援助开发商的方法,以表明JavaScript项目能否获得一个脆弱的代码。我们的原型S ⁇ ojiTantei以两种方式进行了评价:(一) 与人工方法相比的准确性;(二) 对78个安全脆弱性案例中的780个客户进行大规模分析。第一次评估显示S ⁇ ojiTantei的高度精度为83.3%,每个客户的速率低于第二次分析。第二次评估显示,在所研究的78个脆弱性中,有68个报告至少有一个清洁客户。这项研究证明,自动化很有潜力,可以进一步改进。
相关内容
微信扫码咨询专知VIP会员