一句话：在线实验表明，可见攻击场景和警告提示会影响开发者对不当输入验证漏洞的检测，仍有不少人即使被警告也未发现。
不当输入验证（IIV）虽易检测和修复，却仍普遍出现在软件中。本文研究开发者能在多大程度上检测 IIV，并探究其背后原因，以支持安全软件开发。作者开展了一项有 146 名参与者（其中 105 人具有至少三年专业软件开发经验）的在线实验。结果显示：存在可见的攻击场景有助于发现 IIV 漏洞；相当一部分最初未发现漏洞的开发者在被提示漏洞存在后能够识别它；但仍有 60 名参与者在被警告后也无法检测到该漏洞。此外，参与者进行代码评审的频率等因素也会影响 IIV 检测。
Improper Input Validation (IIV) is a software vulnerability that occurs when a system does not safely handle input data. Even though IIV is easy to detect and fix, it still commonly happens in practice. In this paper, we study to what extent developers can detect IIV and investigate underlying reasons. This knowledge is essential to better understand how to support developers in creating secure software systems. We conduct an online experiment with 146 participants, of which 105 report at least three years of professional software development experience. Our results show that the existence of a visible attack scenario facilitates the detection of IIV vulnerabilities and that a significant portion of developers who did not find the vulnerability initially could identify it when warned about its existence. Yet, a total of 60 participants could not detect the vulnerability even after the warning. Other factors, such as the frequency with which the participants perform code reviews, influence the detection of IIV. Preprint: https://arxiv.org/abs/2102.06251. Data and materials: https://doi.org/10.5281/zenodo.3996696.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{BrazFCB21,
title = {Why Don’t Developers Detect Improper Input Validation? '; DROP TABLE Papers; --},
author = {Larissa Braz and Enrico Fregnan and Gul Calikli and Alberto Bacchelli},
booktitle = {ICSE},
year = {2021},
doi = {10.1109/icse43902.2021.00054}
}