论文标题
关于回归漏洞的探索性研究
An Exploratory Study on Regression Vulnerabilities
论文作者
论文摘要
背景：安全回归是在以前未受影响的软件系统中引入的漏洞。它们通常是由于源代码更改（例如，错误修复）而发生的，并且可能会产生严重的影响。 目的：增加对安全回归的理解。这是开发安全软件工程的重要一步。 方法：我们对Mozilla进行了探索性混合方法研究。首先，我们分析了78个回归漏洞和72个错误报告，其中错误修复了Mozilla的回归漏洞。我们研究开发人员如何在这些错误报告中进行互动，如何执行更改以及在什么条件下引入回归漏洞。其次，我们对参与漏洞诱发的错误修复的许多Mozilla开发人员进行了五次半结构化访谈。 结果：在错误修复过程中未讨论软件安全性。开发人员的主要关注点是手头上的错误的复杂性以及社区解决该问题的压力。此外，开发人员不必担心回归漏洞，并假设工具会检测到它们。确实，动态分析工具帮助发现了Mozilla的30％的回归漏洞。 结论：这些结果提供了证据，尽管工具支持有助于识别回归漏洞，但在错误修复过程中可能不足以确保安全性。此外，我们的结果要求在安全工具支持方面进行进一步的工作，以及如何在错误修复过程中整合它们。 数据和材料：https：//doi.org/10.5281/zenodo.6792317
Background: Security regressions are vulnerabilities introduced in a previously unaffected software system. They often happen as a result of source code changes (e.g., a bug fix) and can have severe effects. Aims: To increase the understanding of security regressions. This is an important step in developing secure software engineering. Method: We perform an exploratory, mixed-method case study of Mozilla. First, we analyze 78 regression vulnerabilities and 72 bug reports where a bug fix introduced a regression vulnerability at Mozilla. We investigate how developers interact in these bug reports, how they perform the changes, and under what conditions they introduce regression vulnerabilities. Second, we conduct five semi-structured interviews with as many Mozilla developers involved in the vulnerability-inducing bug fixes. Results: Software security is not discussed during bug fixes. Developers' main concerns are the complexity of the bug at hand and the community pressure to fix it. Moreover, developers do not to worry about regression vulnerabilities and assume tools will detect them. Indeed, dynamic analysis tools helped finding around 30% of regression vulnerabilities at Mozilla. Conclusions: These results provide evidence that, although tool support helps identify regression vulnerabilities, it may not be enough to ensure security during bug fixes. Furthermore, our results call for further work on the security tooling support and how to integrate them during bug fixes. Data and materials: https://doi.org/10.5281/zenodo.6792317
