Programming Shortcuts ‘Lead To Security Risks’

Programmers may be inadvertently introducing common security bugs into their projects if they make use of code posted on social media, new research suggests.

A study carried out by researchers from Canadian and Iranian universities found that code snippets posted on Stack Overflow, a popular Q&A site for programmers, contained common weaknesses that later appeared in thousands of software projects.

The researchers manually reviewed some 72,483 snippets posted on Stack Overflow over the past ten years, finding a total of 69 vulnerable snippets categorised into 29 types.

All of the snippets reviewed had been used in at least one project on GitHub, a popular code-hosting site.

Vulnerability

While that frequency may appear low, the researchers found that the 69 vulnerable snippets had made their way into some  2,859 GitHub projects.

The researchers contacted the developers who had posted the vulnerable snippets, but many of the snippets remain uncorrected, with only 13 percent of developers saying they had fixed the code.

“Many of the investigated code snippets are still not corrected on Stack Overflow,” the researchers said in the study.

The most commonly found errors in the C++ snippets included a failure to properly check for exceptional conditions and improper validation of user input.

The researchers said they have developed a Chrome browser extension that automatically checks snippets for common code weaknesses as they are being uploaded by a developer.  They plan to release the extension when the research is formally published.

Crowdsourced code

Their paper, “An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples”, is being considered for possible publication in IEEE Transactions on Software Engineering.

Ashkan Sami, associate professor of computer science, engineering, and information technology at Shiraz University in Iran, said the research was intended to highlight the dangers of relying on social media generally for programming examples.

“It’s better for programmers to do it the hard way and learn secure coding,” he told industry publication The Register.

Matthew Broersma

Matt Broersma is a long standing tech freelance, who has worked for Ziff-Davis, ZDnet and other leading publications

Recent Posts

WhatsApp, Facebook Messenger To Integrate Chats – Report

Chat integration? Facebook is reportedly working to allow WhatsApp users to chat with Facebook Messenger…

10 hours ago

Apple Irish Back Tax Ruling Expected Next Week

Ruling in appeal against European Commission's order that Apple pay the Irish government $16 billion…

11 hours ago

Facebook Boycott Organisers Disappointed With Zuckerberg Meeting

No concessions. Organisers of the advertising boycott of Facebook left disappointed after meeting CEO Mark…

14 hours ago

Google Project Loon Finally Approved For Kenya Deployment

Two years after deal was first signed, Project Loon is approved by Kenyan government for…

15 hours ago

Tech Firms Withhold Data Sharing With Hong Kong

Tech giants pledge pause data sharing with authorities in Hong Kong, after China imposed draconian…

16 hours ago

Government ‘Planning Removal’ Of Huawei 5G Equipment

Government said to be considering dramatic reversal of earlier 5G plans on new security advice…

3 days ago