Vulnerabilities in software repositories written in multiple programming languages present a major challenge to modern software quality assurance, especially those resulting from interactions between different languages. Existing static and dynamic program analysis tools are generally constrained to single-language analysis, while current deep-learning models lack the capability to process cross-language interactions effectively. To gain deeper insights into vulnerability patterns and patching behaviors in multi-language code, we conduct a measurement study on commits associated with multi-language security patches. We first collect a large-scale dataset of multi-language security patches from the MITRE corporation. We then analyze trends in language combinations, assess their proneness to vulnerabilities, and compare the severity of these vulnerabilities to those in single-language patches. Additionally, we classify patch patterns based on the types of language interactions to support automated program repair. To encourage further research, we release our dataset to the community, fostering deeper investigation into multi-language security patch development and enhancement.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

An Empirical Study of Multi-language Security Patches in Open Source Software

  • Shiyu Sun,
  • Yunlong Xing,
  • Grant Zou,
  • Xinda Wang,
  • Kun Sun

摘要

Vulnerabilities in software repositories written in multiple programming languages present a major challenge to modern software quality assurance, especially those resulting from interactions between different languages. Existing static and dynamic program analysis tools are generally constrained to single-language analysis, while current deep-learning models lack the capability to process cross-language interactions effectively. To gain deeper insights into vulnerability patterns and patching behaviors in multi-language code, we conduct a measurement study on commits associated with multi-language security patches. We first collect a large-scale dataset of multi-language security patches from the MITRE corporation. We then analyze trends in language combinations, assess their proneness to vulnerabilities, and compare the severity of these vulnerabilities to those in single-language patches. Additionally, we classify patch patterns based on the types of language interactions to support automated program repair. To encourage further research, we release our dataset to the community, fostering deeper investigation into multi-language security patch development and enhancement.