一句话：指出现有研究尚未在大规模开源代码库中考察代码复用如何传播源项目已修复的漏洞（孤儿漏洞）。
开源软件的核心前提之一是允许将代码复制到其他项目（白盒复用）。这能加速新项目开发，但原项目中的代码缺陷（如漏洞）也可能随之扩散；即便漏洞已在被复制代码的原项目中修复，复用该代码的下游项目仍可能保留该漏洞，形成“孤儿漏洞”。然而，在近乎完整的开源代码集合背景下，这类漏洞的传播范围、潜在影响以及降低风险的可选途径仍缺乏研究。所给摘要仅明确提出这一研究空白与问题动机，未提供具体方法、数据集规模和实证结果。
Motivation: A key premise of open source software is the ability to copy code to other open source projects (white-box reuse). Such copying accelerates development of new projects, but the code flaws in the original projects, such as vulnerabilities, may also spread even if fixed in the projects from where the code was appropriated. The extent of the spread of vulnerabilities through code reuse, the potential impact of such spread, or avenues for mitigating risk of these secondary vulnerabilities has not been studied in the context of a nearly complete collection of open source code.
DOI 原文 ·
@inproceedings{paperbot6937,
title = {The extent of orphan vulnerabilities from code reuse in open source software},
author = {David Reid and Mahmoud Jahanshahi and Audris Mockus},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510216}
}