迈向有效的安全代码评审：一项关于安全相关编码弱点的实证研究
Toward Effective Secure Code Reviews: An Empirical Study of Security-Related Coding Weaknesses
AI总结：
本文通过分析 OpenSSL 与 PHP 的 135,560 条评审评论，实证考察安全相关编码弱点的识别与处置情况，揭示当前代码评审在安全问题管理上的不足。
摘要：
尽早识别安全问题受到鼓励，以减少其对软件系统潜在的负面影响。代码评审是一种被广泛使用的方法，允许开发人员手动检查修改后的代码，在软件开发生命周期中发现安全问题。然而，现有的代码评审研究通常聚焦于已知漏洞，而忽视了编码弱点；这些编码弱点可能引发真实世界中的安全问题，并且通过代码评审更容易被发现。代码评审在识别此类编码弱点方面的实践尚未得到充分研究。为更好地理解这一点，我们在 OpenSSL 和 PHP 两个大型开源项目中开展了一项实证案例研究。基于 135,560 条代码评审评论，我们发现评审者在 40 个编码弱点类别中的 35 个里提出了安全关切。令人惊讶的是，一些与过往漏洞相关的编码弱点，如内存错误和资源管理，被讨论的频率低于漏洞本身。开发人员在许多情况下（39%-41%）尝试解决所提出的安全关切，但相当一部分仅得到确认（30%-36%），还有一些因解决方案存在分歧而未被修复（18%-20%）。这突出表明，即使编码弱点已被识别，仍可能在代码评审中被遗漏。我们的研究结果表明，评审者能够在代码评审期间识别导致安全问题的各类编码弱点。然而，这些结果也揭示了当前代码评审实践中的不足，表明需要更有效的机制或支持，以提高代码评审中对安全问题管理的意识。
英文摘要：
Identifying security issues early is encouraged to reduce the latent negative impacts on software systems. Code review is a widely-used method that allows developers to manually inspect modified code, catching security issues during a software development cycle. However, existing code review studies often focus on known vulnerabilities, neglecting coding weaknesses, which can introduce real-world security issues that are more visible through code review. The practices of code reviews in identifying such coding weaknesses are not yet fully investigated. To better understand this, we conducted an empirical case study in two large open-source projects, OpenSSL and PHP. Based on 135,560 code review comments, we found that reviewers raised security concerns in 35 out of 40 coding weakness categories. Surprisingly, some coding weaknesses related to past vulnerabilities, such as memory errors and resource management, were discussed less often than the vulnerabilities. Developers attempted to address raised security concerns in many cases (39%-41%), but a substantial portion was merely acknowledged (30%-36%), and some went unfixed due to disagreements about solutions (18%-20%). This highlights that coding weaknesses can slip through code review even when identified. Our findings suggest that reviewers can identify various coding weaknesses leading to security issues during code reviews. However, these results also reveal shortcomings in current code review practices, indicating the need for more effective mechanisms or support for increasing awareness of security issue management in code reviews.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
