A Double-Edged Sword? Software Reuse and Potential Security Vulnerabilities

Abstract

Reuse is a common and often-advocated software development practice. Significant efforts have been invested into facilitating it, leading to advancements such as software forges, package managers, and the widespread integration of open source components into proprietary software systems. Reused software can make a system more secure through its maturity and extended vetting, or increase its vulnerabilities through a larger attack surface or insecure coding practices. To shed more light on this issue, we investigate the relationship between software reuse and potential security vulnerabilities, as assessed through static analysis. We empirically investigated 301 open source projects in a holistic multiple-case methods study. In particular, we examined the distribution of potential vulnerabilities between the native code created by a project's development team and external code reused through dependencies, as well as the correlation between the ratio of reuse and the density of vulnerabilities. The results suggest that the amount of potential vulnerabilities in both native and reused code increases with larger project sizes. We also found a weak-to-moderate correlation between a higher reuse ratio and a lower density of vulnerabilities. Based on these findings it appears that code reuse is neither a frightening werewolf introducing an excessive number of vulnerabilities nor a silver bullet for avoiding them.

A comprehensive study of bloated dependencies in the Maven ecosystem

“…The major issue with bloated dependencies is that the final deployed binary file includes more code than necessary: an artificially large binary is an issue when the application is sent over the network (e.g., web applications) or it is deployed on small devices (e.g., embedded systems). Bloated dependencies could also embed vulnerable code that can be exploited, while being actually useless for the application (Gkortzis et al 2019). Overall, bloated dependencies needlessly increase the difficulty of managing and evolving software applications.…”

Current Issues in Software Re-Usability: A Critical Review of the Methodological & Legal Issues

“…The counterargument to this is that reused software can become more secure through its maturity and extensive vetting by other users. [14] investigated 301 open-source projects through a holistic multiple case-study methodology. What was concluded was that security vulnerabilities increase as the project size of the reusable software increases, especially when the user doesn't have a deep technical understanding over what they are necessarily using; i.e.…”

“…Security vulnerabilities ultimately link to legal issues as any cyber-attack, and subsequent loss of customer data, or business continuity may lead to legal challenges from customers, and thus a financial cost [15]. [14] summarized their findings with the comment "code reuse is neither a frightening werewolf introducing an excessive number of vulnerabilities nor a silver bullet for avoiding them". Legal issues surrounding software reuse can be summarized into three types of protection, namely patents, trademarks and author law.…”

Software reuse cuts both ways: An empirical analysis of its relationship with security vulnerabilities

“…Despite the existence of security mishaps and the initiatives to counteract them, to the best of our knowledge, there is a lack of large-scale studies that attempt to obtain an overview of how security vulnerabilities are associated with code reuse, so as to understand the phenomenon. To start filling this gap, we carried out a first exploratory study (Gkortzis et al, 2019) to investigate how potential vulnerabilities are distributed in open-source software-intensive systems, with regards to native code, i.e., written in-house by the software development team, and reused code, introduced through dependencies. We scope our research to answer concerns of software practitioners and researchers related to the potential security risks when they select to reuse software.…”

“…To achieve this goal, we considered a new set of 1244 Java projects and collected both disclosed vulnerabilities (reported in public datasets), 8 and potential vulnerabilities (detected based through static analysis). Adding to the initial characteristics we investigated (Gkortzis et al, 2019), we collected information regarding four characteristics of the projects and dependencies of our dataset, namely, (1) supported by wellknown communities, (2) belonging to an enterprise organization, (3) the number of their contributors, and (4) the frequency of usage in projects. In addition to the statistical analysis presented in our previous work we extended our analysis to incorporate the aforementioned dimensions.…”