A Study of C/C++ Code Weaknesses on Stack Overflow

Zhang, Haoxiang; Li, Heng; Chen, Tse-Hsun; Hassan, Ahmed E.

doi:10.1109/tse.2021.3058985

Cited by 18 publications

(10 citation statements)

References 37 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Previous studies have found that cppcheck had just a 0.78 false positive rate against a test suite of 650 common C/C++ bugs [3]. Zhang et al found that 85 out of 100 CWE instances detected by cppcheck were labelled as accurate with a strong agreement among the study's authors (Cohen's Kappa of 0.68) [42].…”

Section: Data Preprocessingmentioning

confidence: 89%

“…In order to determine the language of the code examples on these sites, we instead used the language detection tool Guesslang which has an accuracy of 90% according to it's documentation [14]. Then, we used a similar approach used in previous studies to reject code snippets that only contained pseudo code by ignoring snippets that contained less than the median SO line count of 5 lines [5,18,42].…”

Section: Data Collectionmentioning

confidence: 99%

“…It also allows for specific weaknesses to be suppressed. According to Zhang et al, cppcheck is able to identify 59 out of the 90 code weaknesses that are related to C and C++ [42]. Previous studies have found that cppcheck had just a 0.78 false positive rate against a test suite of 650 common C/C++ bugs [3].…”

Section: Data Preprocessingmentioning

confidence: 99%

“…We noticed that some claimed weaknesses in cppcheck were not accurate. We addressed this issue by suppressing certain CWE types in Cppcheck like CWE 563 (Assignment to Variable without Use) and by following a previous study [42] to suppress syntax errors and to ignore code snippets with less than 5 lines. In addition, the categorization of the 28 distinct CWE types into 8 weakness categories was done by both authors.…”

Section: Threats To Validitymentioning

confidence: 99%

“…Collaborative editing is introduced in forums like SO to allow users to suggest ways to improve the shared content. Previous studies offer valuable insight on the security of SO C/C++ code examples and the effect of post revisions [40][41][42]. However, what happens when a vulnerable code example is revised?…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Does Collaborative Editing Help Mitigate Security Vulnerabilities in Crowd-Shared IoT Code Examples?

Selvaraj

Uddin

2022

Proceedings of the 16th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement

View full text Add to dashboard Cite

Background: With the proliferation of crowd-sourced developer forums, Software developers are increasingly sharing more coding solutions to programming problems with others in forums. The decentralized nature of knowledge sharing on sites has raised the concern of sharing security vulnerable code, which then can be reused into mission critical software systems -making those systems vulnerable in the process. Collaborative editing has been introduced in forums like Stack Overflow to improve the quality of the shared contents. Aim: In this paper, we investigate whether code editing can mitigate shared vulnerable code examples by analyzing IoT code snippets and their revisions in three Stack Exchange sites: Stack Overflow, Arduino, and Raspberry Pi. Method:We analyze the vulnerabilities present in shared IoT C/C++ code snippets, as C/C++ is one of the most widely used languages in mission-critical devices and low-powered IoT devices. We further analyse the revisions made to these code snippets, and their effects. Results: We find several vulnerabilities such as CWE 788 -Access of Memory Location After End of Buffer, in 740 code snippets . However, we find the vast majority of posts are not revised, or revisions are not made to the code snippets themselves (598 out of 740). We also find that revisions are most likely to result in no change to the number of vulnerabilities in a code snippet rather than deteriorating or improving the snippet. Conclusions: We conclude that the current collaborative editing system in the forums may be insufficient to help mitigate vulnerabilities in the shared code. CCS CONCEPTS• Software and its engineering; • Security and privacy → Systems security; • Human Centered Computing → Collaborative and Social Computing;

show abstract

Section: Data Preprocessingmentioning

confidence: 89%

Section: Data Collectionmentioning

confidence: 99%

Section: Data Preprocessingmentioning

confidence: 99%

Section: Threats To Validitymentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Does Collaborative Editing Help Mitigate Security Vulnerabilities in Crowd-Shared IoT Code Examples?

Selvaraj

Uddin

2022

Proceedings of the 16th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement

View full text Add to dashboard Cite

show abstract

Are the smart contracts on Q&A site reliable?

Zhou,

Wang,

Liu

et al. 2024

Softw Pract Exp

View full text Add to dashboard Cite

Ethereum, as a leading blockchain platform, has attracted a significant number of practitioners. These practitioners require a platform for communication and collaborative problem‐solving, which led to Ethereum Stack Exchange (ESE), a Q&A site dedicated to Ethereum‐related issues. While the Q&A site facilitates communication among practitioners, it also introduces new challenges. Practitioners adopt code snippets from Q&A sites to address problems encountered. However, the quality of code snippets on ESE remains largely unexplored. Vulnerabilities and gas‐inefficient patterns in ESE may spread to the code in Ethereum and threaten its regular operation. In this article, we conduct an empirical study investigating the distribution of vulnerabilities and gas‐inefficient patterns in ESE. Further, we analyze the potential impact of vulnerabilities and gas‐inefficient patterns from ESE on Ethereum. However, we encounter a problem during the vulnerability and gas‐inefficient pattern detection. Established smart contract analysis tools in the mainstream realm necessitate complete source code files for thorough analysis, while codes on ESE are often incomplete code snippets. To address this, we introduce the AST‐based code clone detection technique to construct detectable files corresponding to code snippets. This enables us to detect vulnerabilities and gas‐inefficient patterns in code snippets. In the end, our findings demonstrate that 11.18% of the contract‐level code snippets and 4.06% of function‐level code snippets in ESE have vulnerabilities. And 27.21% of contract‐level code snippets and 17.89% of function‐level code snippets contain gas‐inefficient patterns. The additional consumption caused by the gas‐inefficient pattern in ESE is approximately $1,695,002. Based on these findings, we provide recommendations for both ESE and its users, aiming to foster collaborative efforts and create a more reliable Q&A site for practitioners.

show abstract