Login | Register

A Qualitative Study of Vulnerability-Fixing Commits


A Qualitative Study of Vulnerability-Fixing Commits

Mkhallalati, Mouafak (2019) A Qualitative Study of Vulnerability-Fixing Commits. Masters thesis, Concordia University.

[thumbnail of Mkhallalati_MASc_S2020.pdf]
Text (application/pdf)
Mkhallalati_MASc_S2020.pdf - Accepted Version
Available under License Spectrum Terms of Access.


Security issues are a major concern in software development since the impact of exploiting security issues can be detrimental. Much of the prior work has proposed techniques that scan for and predict security vulnerabilities. However, in-depth, qualitative studies on software vulnerabilities are limited. Such studies can help the community better understand the types of vulnerabilities that exist and their potential impact in order to avoid them in the future. Therefore, in this thesis, we present the results of studying security issues faced by developers. Our study leverages data provided by the SAP research team, which contains security fixing commits related to open source Java projects used by SAP and manually curated and validated by their researchers. We study a statistically significant sample of those commits. In particular, we collect information from the related repositories, issue trackers, documentation and advisories with the aim to comprehend and categorize such security issues. Also, we provide the context required to understand the issue along with code examples extracted from each of the categories in our study. Our findings show that the vulnerabilities commonly facing developers are related to deserialization of untrusted data, zip slip, xml external entity processing, validation, authorization, race conditions, and information exposure. The fixes required to fix those vulnerabilities range from providing proper configuration of the used parser in the case of XML related issues to requiring in-depth knowledge of the code and the security issue as in vulnerabilities related to thread synchronization.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Computer Science and Software Engineering
Item Type:Thesis (Masters)
Authors:Mkhallalati, Mouafak
Institution:Concordia University
Degree Name:M.A. Sc.
Program:Software Engineering
Date:December 2019
Thesis Supervisor(s):Shihab, Emad
ID Code:986298
Deposited By: Mouafak Mkhallalati
Deposited On:23 Jun 2021 15:50
Last Modified:17 Aug 2022 16:20
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Research related to the current document (at the CORE website)
- Research related to the current document (at the CORE website)
Back to top Back to top