Date of Award

2022

Publisher

North Dakota State University

Document Type

Thesis

Degree Awarded

Master of Science (MS)

Program

Computer Science

Department

Computer Science

College

Engineering

Faculty Advisor

Zubair, Malik Muhammad

Description

Java developers rely on code reusability because of its time and effort reduction advantage. However, they are exposed to vulnerabilities in publicly available open-source software (OSS) projects. This study employed a multi-stage research approach to investigate the extent to which open-source Java projects are secured. The research process includes text analysis of Java’s Common Vulnerabilities and Exposures (CVE) descriptions and static code analysis using GitHub’s CodeQL. This study found (a) cross-site scripting, (b) buffer overflow (though analyzed as array index out of bounds), (c) data deserialization, (d) input non-validation for an untrusted object, and (e) validation method bypass as the prevalent Java’s vulnerabilities from the MITRE CVEs. The static code analysis of the compatible seven (7) Java projects out of the 100 top projects cloned from GitHub revealed a 71.4% presence of the array index out-of-bounds vulnerability.

Rights

NDSU policy 190.6.2

Rights Link

https://www.ndsu.edu/fileadmin/policy/190.pdf

Handle Identifier

https://hdl.handle.net/10365/33288

Download

Share

COinS