Insights from Running 24 Static Analysis Tools on Open Source Software Repositories

被引：0

作者：

Hashmat, Fabiha ^{[1
]}

Aljaali, Zeyad Alwaleed ^{[1
]}

Shen, Mingjie ^{[1
]}

Machiry, Aravind ^{[1
]}

机构：

[1] Purdue Univ, W Lafayette, IN 47907 USA

来源：

INFORMATION SYSTEMS SECURITY, ICISS 2024 | 2025年 / 15416卷

基金：

美国国家科学基金会;

关键词：

Program Analysis; OMEGA ANALYZER; GITHUB Network Projects; Static Analysis; OSSF critical repositories; VULNERABILITIES;

D O I：

10.1007/978-3-031-80020-7_13

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

OSS is important and useful. We want to ensure that it is of high quality and has no security issues. Static analysis tools provide easy-to-use and application-independent mechanisms to assess various aspects of a given code. Many effective open-source static analysis tools exist. In this paper, we perform the first comprehensive analysis using 24 open-source static analysis tools (through OMEGA ANALYZER) on 4,947 repositories. Our study identified several interesting findings, such as the distribution of errors in relation to the criticality score of repositories shows that repositories with a criticality score have the highest percentage of errors. We envision that our findings provide insights into the effectiveness of static analysis tools on OSS and future research directions in securing OSS repositories.

引用

页码：225 / 245

页数：21