SACS: A Code Smell Dataset using Semi-automatic Generation Approach
Hanyu Zhang, Tomoji Kishi
备注：
We would like to withdraw our manuscript to make further revisions and improvements to its content and experimental analysis. We apologize for any inconvenience and appreciate your understanding
Code smell is a great challenge in software refactoring, which indicates latent design or implementation flaws that may degrade the software maintainability and evolution. Over the past of decades, the research on code smell has received extensive attention. Especially the researches applied machine learning-technique have become a popular topic in recent studies. However, one of the biggest challenges to apply machine learning-technique is the lack of high-quality code smell datasets. Manually constructing such datasets is extremely labor-intensive, as identifying code smells requires substantial development expertise and considerable time investment. In contrast, automatically generated datasets, while scalable, frequently exhibit reduced label reliability and compromised data quality. To overcome this challenge, in this study, we explore a semi-automatic approach to generate a code smell dataset with high quality data samples. Specifically, we first applied a set of automatic generation rules to produce candidate smelly samples. We then employed multiple metrics to group the data samples into an automatically accepted group and a manually reviewed group, enabling reviewers to concentrate their efforts on ambiguous samples. Furthermore, we established structured review guidelines and developed a annotation tool to support the manual validation process. Based on the proposed semi-automatic generation approach, we created an open-source code smell dataset, SACS, covering three widely studied code smells: Long Method, Large Class, and Feature Envy. Each code smell category includes over 10,000 labeled samples. This dataset could provide a large-scale and publicly available benchmark to facilitate future studies on code smell detection and automated refactoring.
Security Smells in Ansible and Chef Scripts: A Replication Study
上下文：安全气味是重复出现的编码模式，表明存在安全漏洞，需要进一步检查。由于基础设施即代码（IaC）脚本（如Ansible和Chef脚本）用于大规模配置基于云的服务器和系统，IaC脚本中的安全气味可用于使恶意用户能够利用所配置系统中的漏洞。目标：本文的目标是通过对Ansible和Chef脚本中的安全气味进行实证研究，帮助从业者在将基础设施开发为代码脚本时避免不安全的编码实践。方法学：我们进行了一项复制研究，我们对1，956个IaC脚本进行了定性分析，以确定用两种语言编写的IaC脚本的安全气味：Ansible和Chef。我们构建了一个名为Security Linter for Ansible and Chef scripts（SLAC）的静态分析工具，用于自动识别从813个开源软件库中收集的50，323个脚本中的安全气味。我们还提交了1,000个随机选择的气味事件的错误报告。结果：我们发现了两个在以前的工作中没有报道的安全气味：在case语句中缺少默认值和没有完整性检查。通过应用SLAC，我们识别出46，600次安全气味，其中包括7，849个硬编码密码。我们观察到94个bug报告中有65个是一致的，这表明Ansible和Chef脚本的安全气味与从业者之间的相关性。结论：我们观察到安全气味在Ansible和Chef脚本中普遍存在，类似于Puppet脚本。我们建议从业者使用（i）代码审查…
