一句话：大规模分析 Maven 上下游依赖调用，揭示上游漏洞对下游项目的可达性、路径复杂度与开发者认知。
开源项目大量复用依赖库，上游库漏洞会威胁整个生态。现有 SCA 工具虽能依据漏洞库检测脆弱依赖，但误报率高，甚至高达 73.3% 的下游项目实际安全。为更精确理解威胁，本文在 Maven 生态中收集 44,450 个 (CVE, 上游, 下游) 关系实例，分析下游到上游项目之间约 5000 万次调用。研究从漏洞可达性、可达路径复杂度以及下游项目与开发者对上游漏洞的认知等方面展开，并报告多项发现。这些发现有助于整体理解 Maven 生态中上游漏洞对下游项目的威胁，并为后续研究提供指导。
Modern software systems are increasingly relying on dependencies from the ecosystem. A recent estimation shows that around 35% of an open-source project's code come from its depended libraries. Unfortunately, open-source libraries are often threatened by various vulnerability issues, and the number of disclosed vulnerabilities is increasing steadily over the years. Such vulnerabilities can pose significant security threats to the whole ecosystem, not only to the vulnerable libraries themselves, but also to the corresponding downstream projects. Many Software Composition Analysis (SCA) tools have been proposed, aiming to detect vulnerable libraries or components referring to existing vulnerability databases. However, recent studies report that such tools often generate a large number of false alerts. Particularly, up to 73.3% of the projects depending on vulnerable libraries are actually safe. Aiming to devise more precise tools, understanding the threats of vulnerabilities holistically in the ecosystem is significant, as already performed by a number of existing studies. However, previous researches either analyze at a very coarse granularity (e.g., without analyzing the source code) or are limited by the study scales. This study aims to bridge such gaps. In particular, we collect 44,450 instances of (CVE, upstream, downstream) relations and analyze around 50 million invocations made from downstream to upstream projects to understand the potential threats of upstream vulnerabilities to downstream projects in the Maven ecosystem. Our investigation makes interesting yet significant findings with respect to multiple aspects, including the reach-ability of vulnerabilities, the complexities of the reachable paths as well as how downstream projects and developers perceive upstream vulnerabilities. We believe such findings can not only provide a holistic understanding towards the threats of upstream vulnerabilities in the Maven ecosystem, but also can guide future researches in this field.
@inproceedings{WuYWLZJ23,
title = {Understanding the Threats of Upstream Vulnerabilities to Downstream Projects in the Maven Ecosystem},
author = {Yulun Wu and Zeliang Yu and Ming Wen and Qiang Li and Deqing Zou and Hai Jin},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00095}
}