Method-Level Data in GitHub Pull Request Descriptions

Method-Level Data in GitHub Pull Request Descriptions: Effects on Developers' Prioritization and Facilitation of Fixing Vulnerable Dependencies

Popovici, Tudor (TU Delft Electrical Engineering, Mathematics and Computer Science; TU Delft Software Technology)

Keshani, M. (mentor)
Proksch, S. (mentor)
Katsifodimos, A (graduation committee)

Delft University of Technology

Computer Science and Engineering

CSE3000 Research Project

2021-07-02

Modern software development involves the usage of external third-party software projects as direct dependencies. Nonetheless, developers of a dependant project have no control over critical aspects such as development and testing of the dependency. This can put the reliant repositories at risk through vulnerabilities, which can be exploited by malicious attackers. Automated dependency maintenance tools can mitigate the risks, but have an observed shortcoming: they have decreased vulnerability detection accuracies due to their package-level analysis approach.
In this study, a total of 6.717 active projects hosted on GitHub have been analysed using a method-level vulnerability analysis, discovering 24 projects affected by 4 distinct exposures. The developers have been notified through GitHub Pull Requests, which contained the methods in their projects that called vulnerable dependency methods. This was done with the aim of finding answers to: (i) whether the provided method call information makes developers prioritize the task of fixing vulnerabilities, (ii) whether the fine-grained information facilitates the exposures handling process.
Developers' reactions to the method-level data were collected through means of a survey. Collected data revealed that the fine-grained information in the PRs did have a positive effect on the developers' prioritization of fixing the vulnerable dependencies. Moreover, the provided data also facilitated the maintainers' fix process to some extent. However, due to the limited amount of recorded responses, the answer to the research question could not be concluded.

Dependency Analysis
Method-Level
Vulnerability
Package-Level
Dependabot
GitHub
Pull Requests
Dependency
Dependant

http://resolver.tudelft.nl/uuid:ccdc8271-b2e7-459a-af92-348509a514e5

Student theses

bachelor thesis

© 2021 Tudor Popovici