Sunday, June 7, 02:37
Home security Copying codes from Stack Overflow leads to GitHub vulnerabilities

Copying codes from Stack Overflow leads to GitHub vulnerabilities

Very often, when the developers have a problem with him code they get used to copy-pasting code snippets from the popular Stack Overflow forum to resolve it.

However a new one research recently conducted, entitled "An Empirical Study of C ++ Vulnerabilities in Crowd-Sourced Code Examples", indicates that this practice raises serious issues security.

Copying codes can lead to vulnerabilities

Looking at more than 72.000 C ++ code snippets taken from Stack Overflow's 1.325 posts, the research authors discovered 69 vulnerable 29 snippets of different types.

Although this number may seem small, compared to the enormous amount of work on GitHub, the 69 vulnerabilities discovered, appeared in 2.589 GitHub repos, and this is certainly worrying.

Although the researchers they took responsibility for notifying project developers on GitHub, only some of them wanted to fix the deficiencies that were common CWEs (Common Weakness Enumeration).

The purpose of the research was to describe how the code passes through Stack Overflow on GitHub and how using codes without careful control can lead to possible vulnerabilities in software.

For this study, the team chose to focus on C ++-based projects. Most of the CWEs found were CWE-20 (Improper Input Validation), CWE-754 (Improper Check for Unusual or Exceptional Conditions) and CWE-1006 (Bad Coding Practices).

Incorrect use of the platform

The Stack Overflow forum is mainly used for questions and answers. Many developers who submit code snippets as a solution may not have a proper understanding of code security.

Which means that using these excerpts is no better. It is preferable for a developer to devote a little more time and effort to adopt safer practices programming.

But there is a solution

Many developers have a hard time leaving Stack Overflow completely. With this in mind, researchers have developed an extension Chrome, which can help determine the security of a code.

Installing it extension, checks the code being copied, compared to the CWE database, and the developer is notified if the snippet of the code contains known defects.

The extension is scheduled for release soon. Stay short.

LEAVE ANSWER

Please enter your comment!
Please enter your name here

Absent Mia
Absent Miahttps://www.secnews.gr
Being your self, in a world that constantly tries to change you, is your greatest achievement

LIVE NEWS

Lyrics from AI technology or from people: Can you tell them apart?

While a large percentage of people can recognize when they are talking on a chatbot instead of a human operator, it seems that this is not the case ...

Technology and children: When are they ready for safe use?

Today's children and teens use various messaging apps and social media to ...

Call of Duty Black Ops Cold War: The first video leaked

The first video from the gameplay of Call of Duty 2020, which is rumored to be called Black Ops Cold War, has just been revealed.

Elon Musk: "It's time to break up Amazon"

Elon Musk intensifies the fight with Jeff Bezos with a new tweet: The General Manager of Tesla Inc., Elon Musk, said ...

Attack on America's 5G towers on Saturday!

Protests over 5G connectivity are scheduled to take place over the weekend, according to NATE. According to a recommendation that was identified ...

Windows 10 Updates: You can block them with Wu10Man!

Microsoft launched the Windows 10 update in May 2020, so it will be available on your computer soon ....

ECh0raix Ransomware: New campaign targets QNAP NAS devices!

Malicious agents behind eCh0raix Ransomware have launched a new campaign targeting QNAP NAS devices. ECh0raix was observed ...

Mac: How to change the storage location of your screenshots?

When you take screenshots on your Mac device using the Shift-Command-3 shortcut to take a screenshot of the entire computer screen or Shift-Command-4 ...

Malware USBCulprit: Aims devices that are not connected to a network

Did you think that devices without any connection to a local or other network (air-gapped devices) are safe? Think again! The USBCulprit malware that ...

Free Microsoft Teams: You can finally create meetings!

Users of the free version of Microsoft Teams can now create video meetings. The change, identified by ...