论文标题
关于在安全脆弱性修复中使用重构：Maven库的探索性研究
On the Use of Refactoring in Security Vulnerability Fixes: An Exploratory Study on Maven Libraries
论文作者
论文摘要
第三方图书馆依赖性在当今的软件开发中很普遍。随着安全漏洞的日益严重的威胁，及时应用安全修复程序对于保护软件系统很重要。因此，社区制定了一个软件和硬件弱点列表，称为共同弱点（CWE），以评估漏洞。先前的工作表明，诸如重构代码之类的维护活动可能与源代码中与安全有关的方面有可能相关。在这项工作中，我们通过分析与实践中漏洞修复的重构动作进行分析，探讨了重构与安全性之间的关系。我们进行了一项案例研究，分析了143个Maven文库，其中检测到了351个已知漏洞。令人惊讶的是，我们的探索结果表明，开发人员将重构操作纳入了修复程序，其中31.9％（在351个）漏洞中与重构动作搭配。我们设想这份简短的论文，以打开潜在的新方向，以激发自动化工具支持，使开发人员可以在维护其代码的同时更快地提供修复程序。
Third-party library dependencies are commonplace in today's software development. With the growing threat of security vulnerabilities, applying security fixes in a timely manner is important to protect software systems. As such, the community developed a list of software and hardware weakness known as Common Weakness Enumeration (CWE) to assess vulnerabilities. Prior work has revealed that maintenance activities such as refactoring code potentially correlate with security-related aspects in the source code. In this work, we explore the relationship between refactoring and security by analyzing refactoring actions performed jointly with vulnerability fixes in practice. We conducted a case study to analyze 143 maven libraries in which 351 known vulnerabilities had been detected and fixed. Surprisingly, our exploratory results show that developers incorporate refactoring operations in their fixes, with 31.9% (112 out of 351) of the vulnerabilities paired with refactoring actions. We envision this short paper to open up potential new directions to motivate automated tool support, allowing developers to deliver fixes faster, while maintaining their code.
