Connect with us
Categories:
X

Technology

Project promises generation of bulk pull requests for patches

Published

on

Project promises generation of bulk pull requests for patches
Share this post:

Researchers are trialing methods to scale up the ability to roll out security fixes for vulnerable components across the open source ecosphere.

Tools such as CodeQL (GitHub’s code query language) enable scans for vulnerabilities across hundreds of thousands of open source software projects.

These utilities can be used to systematically identify basic security flaws – common bugs with relatively simple fixes – in projects hosted on GitHub and similar platforms.

Such low-lying bugs are legion and straightforward to find and fix, so the real difficulty for those seeking to bolster security comes from the difficulties involved in triaging, reporting, and fixing.

Rather than automating the creation of bug reports, which might easily put an extra burden on the maintainers of an open source project, security researcher Jonathan Leitschuh is helping to define and test a methodology to partially automate pull requests at scale.

During a recent series of talks first delivered at BSides Las Vegas and then during DEF CON last month, Leitschuh outlined a methodology for automating bulk pull request generation. The talk was entitled ‘Scaling the Security Researcher to Eliminate OSS Vulnerabilities Once and For All’.

 

The HUMAN factor

Leitschuh, the inaugural Dan Kaminsky Fellow at HUMAN Security, has carried out a research project that involved creating tools and techniques to industrialize the development of security fixes for open source software.

If widely used, the approach would mean that if a component used by multiple projects is found to be vulnerable, then protect maintainers would be promptly offered a pull request that patches the problem.

RECOMMENDED  Your daily horoscope for Tuesday, August 30, 2022

Leitschuh and his colleagues started off using Python scripts to make a number of pull requests to open source projects found vulnerable to the so-called ‘Zip Slip’ vulnerability.

More recently they have refined this methodology to make use of OpenRewrite (a style-preserving refactoring tool created at Netflix and now developed by Moderne).

In total, Leitschuh has used the technique described in his talk to create 590 automated pull requests targeting Zip Slip (a vulnerability in the JVM ecosystem) and two other vulnerabilities (partial path traversal and temporary directory hijacking). These bring his career total of pull requests to 5,200.

Leitschuh told Daily Swig that feedback from project maintainers about receiving automated pull requests had been mixed.

“The feedback I’ve gotten has been mixed. Lots of appreciative maintainers, and a few maintainers [were] upset,” the researcher explained.

“The Jenkins team has outright asked me not to issue [pull requests] against their organization.”

‘Inspiring’ follow-up research

The automated pull request approach omits unit tests that software developers like to see to verify that suggested amendments to their code base avoid breaking any functionality. In addition, the automated approach means that disclosures are made openly – an issue for eligibility under some, but not all, bug bounty programs.

Despite these potential drawbacks, feedback from security researchers about the automated pull request approach has largely been positive, according to Leitschuh.

The researcher concluded: “Responses from other security researchers [have been] generally quite positive. The value proposition is very easy to see when the idea is presented. I’ve inspired a few people to take on this research themselves for their own work, too.”

INSTALL:  All Naija Entertainment App Into Your Android Device
RECOMMENDED  Peter Obi is welcomed to commission a project in Rivers by Wike








Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Luka Modric celebrates after scoring Real Madrid's second goal against Celta Vigo.
Sports3 days ago

Luka Modric set to join Ronaldo in Saudi Arabia’s Al Nassr

WHO World Health Organization
Health3 days ago

WHO debunks claims that tuberculosis is caused by witchcraft, poison

Atiku Abubakar
News3 days ago

2023 Election: Why DSS must arrest Fani-Kayode – Atiku

PDP Logo Umbrella
News3 days ago

PDP suspends National Chairman

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories3 days ago

[STORY] THE PASTOR’S DAUGHTER (Final Episode 13)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 12)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 11)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 10)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 09)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 08)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 07)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 06)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 05)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 04)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 03)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 02)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Episode 01)

The Pastor Daughter Story by Miriam Edem _ ANE Story
ANE Stories1 week ago

[STORY] THE PASTOR’S DAUGHTER (Complete Episodes)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories1 week ago

[STORY] PAPA LOVES HIS GIRLS (Episode 16)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 15)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 14)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 13)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 12)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 11)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 10)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 09)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 08)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 07)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 06)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 05)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 04)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 03)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 02)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Episode 01)

Papa Loves His Girls by Opeyemi Ojerinde Akintunde_ANE Stories
ANE Stories2 weeks ago

[STORY] PAPA LOVES HIS GIRLS (Complete Episodes)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories2 weeks ago

[STORY] TIMISIRE THE GOLDEN GIRL (Final Episode 46)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories2 weeks ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 45)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories2 weeks ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 44)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories2 weeks ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 43)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories2 weeks ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 42)

ANE Billboard Hots