缓解 Maven 生态系统中开源漏洞的持续性
Mitigating Persistence of Open-Source Vulnerabilities in Maven Ecosystem
AI总结：
本文针对 Maven 生态系统中漏洞因上游库阻断补丁而持续存在的问题，提出 Ranger 方案自动恢复兼容安全的依赖版本范围，可恢复 75.64% 的范围并自动修复 90.32% 的受影响下游项目。
摘要：
来自第三方库（TPLs）的漏洞已被揭示为对 Maven 生态系统构成威胁。尽管漏洞披露后会迅速发布补丁，但社区中的库和应用程序仍在使用存在漏洞的版本，这使得漏洞在 Maven 生态系统中持续存在（例如，臭名昭著的 Log4Shell 自 2021 年以来至今仍对 Maven 生态系统产生重大影响）。学术界和工业界的研究人员都提出了面向用户的标准和解决方案来应对漏洞，但这些解决方案无法解决整个生态系统范围内持续存在的漏洞，因为这需要社区集体努力及时采用补丁而不引入破坏性问题。为了寻求生态系统范围的解决方案，我们首先开展了一项实证研究，以考察 Maven 生态系统中持续存在漏洞的普遍程度。然后，我们通过实现一种基于最新依赖关系图监控漏洞下游依赖项的算法，识别出受影响的库以进行警报。在此基础上，我们进一步定量揭示了上游库阻断补丁是导致漏洞持续存在的原因。在审查了现有对策的缺陷之后，为了解决这些问题，我们提出了一种范围恢复解决方案（Ranger），用于自动为下游依赖项恢复兼容且安全的依赖版本范围。自动恢复不需要社区的人工干预，以代码为中心的兼容性保证确保了向已修补版本的平滑升级。此外，Ranger 与生态系统监控相结合，可以及时提醒开发者注意阻断补丁的库，并建议灵活的版本范围以快速解除对补丁版本的阻断。通过评估，Ranger 能够恢复 75.64% 的版本范围，从而自动修复了 90.32% 的存在漏洞的下游项目。
英文摘要：
Vulnerabilities from third-party libraries (TPLs) have been unveiled to threaten the Maven ecosystem. Despite patches being released promptly after vulnerabilities are disclosed, the libraries and applications in the community still use the vulnerable versions, which makes the vulnerabilities persistent in the Maven ecosystem (e.g., the notorious Log4Shell still greatly influences the Maven ecosystem nowadays from 2021). Both academic and industrial researchers have proposed user-oriented standards and solutions to address vulnerabilities, while such solutions fail to tackle the ecosystem-wide persistent vulnerabilities because it requires a collective effort from the community to timely adopt patches without introducing breaking issues. To seek an ecosystem-wide solution, we first carried out an empirical study to examine the prevalence of persistent vulnerabilities in the Maven ecosystem. Then, we identified affected libraries for alerts by implementing an algorithm monitoring downstream dependents of vulnerabilities based on an up-to-date dependency graph. Based on them, we further quantitatively revealed that patches blocked by upstream libraries caused the persistence of vulnerabilities. After reviewing the drawbacks of existing countermeasures, to address them, we proposed a solution for range restoration (Ranger) to automatically restore the compatible and secure version ranges of dependencies for downstream dependents. The automatic restoration requires no manual effort from the community, and the code-centric compatibility assurance ensures smooth upgrades to patched versions. Moreover, Ranger along with the ecosystem monitoring can timely alert developers of blocking libraries and suggest flexible version ranges to rapidly unblock patch versions. By evaluation, Ranger could restore 75.64% of ranges which automatically remediated 90.32% of vulnerable downstream projects.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
