跟踪易受攻击的代码世系
Tracing Vulnerable Code Lineage
摘要：
本文介绍了来自MSR 2021 Hackcraft的结果。我们的团队调查包含已知安全漏洞的文件/项目，以及它们在开源软件中的存储库中的分布情况。这些安全漏洞可能通过代码重用传播，即使在不同版本的代码中修复了漏洞。我们利用World of Code基础设施从几乎完整的开源软件集合中发现文件级代码重复。本文描述了一种方法和一组工具，用于查找使用已知易受攻击文件的所有开源项目以及这些文件的任何以前版本。
英文摘要：
This paper presents results from the MSR 2021 Hackathon. Our team investigates files/projects that contain known security vulnerabilities and how widespread they are throughout repositories in open source software. These security vulnerabilities can potentially be propagated through code reuse even when the vulnerability is fixed in different versions of the code. We utilize the World of Code infrastructure to discover file-level duplication of code from a nearly complete collection of open source software. This paper describes a method and set of tools to find all open source projects that use known vulnerable files and any previous revisions of those files.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
