探索Python和JavaScript开源社区的安全意识
Exploring the Security Awareness of the Python and JavaScript Open Source Communities
摘要：
软件安全性无疑是当今软件工程的一个主要关注点。虽然人们对安全问题的认识水平往往很高，但实际经验表明，预防行动和对可能出现的问题的反应在现实中并不总是得到适当处理。通过分析开源社区中的大量提交，我们可以对开发人员缓解的漏洞进行分类，并研究其分布，解决时间等，以学习和改进安全管理流程和实践。在软件遗产图数据集的帮助下，我们调查了两种最流行的脚本语言- Python和JavaScript -从公共存储库收集的项目的提交，并确定了那些减轻代码中某个漏洞的提交（即漏洞解决提交）。一方面，我们确定了提交消息中提到的漏洞类型（根据CWE组），并比较了两个社区中的漏洞数量。另一方面，我们检查了漏洞发布日期与提交中首次引用漏洞之间的平均时间。我们发现，两个社区缓解的漏洞类型有很大的交集，但最普遍的漏洞是特定于语言的。此外，无论是JavaScript还是Python社区都不会对出现的安全漏洞做出快速反应，只有一些CWE组例外。
英文摘要：
Software security is undoubtedly a major concern in today's software engineering. Although the level of awareness of security issues is often high, practical experiences show that neither preventive actions nor reactions to possible issues are always addressed properly in reality. By analyzing large quantities of commits in the open-source communities, we can categorize the vulnerabilities mitigated by the developers and study their distribution, resolution time, etc. to learn and improve security management processes and practices. With the help of the Software Heritage Graph Dataset, we investigated the commits of two of the most popular script languages -- Python and JavaScript -- projects collected from public repositories and identified those that mitigate a certain vulnerability in the code (i.e. vulnerability resolution commits). On the one hand, we identified the types of vulnerabilities (in terms of CWE groups) referred to in commit messages and compared their numbers within the two communities. On the other hand, we examined the average time elapsing between the publish date of a vulnerability and the first reference to it in a commit. We found that there is a large intersection in the vulnerability types mitigated by the two communities, but most prevalent vulnerabilities are specific to language. Moreover, neither the JavaScript nor the Python community reacts very fast to appearing security vulnerabilities in general with only a couple of exceptions for certain CWE groups.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
