English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

In the open source software (OSS) ecosystem, there exists a complex softwaresupply chain, where developers upstream and downstream widely borrow and reusecode. This results in the widespread occurrence of recurring defects, missingfixes, and propagation issues. These are collectively referred to as cognatedefects, and their scale and threats have not received extensive attention andsystematic research. Software composition analysis and code clone detectionmethods are unable to cover the various variant issues in the supply chainscenario, while code static analysis, or static application security testing(SAST) techniques struggle to target specific defects. In this paper, wepropose a novel technique for detecting cognate defects in OSS through theautomatic generation of SAST rules. Specifically, it extracts key syntax andsemantic information from pre- and post-patch versions of code throughstructural comparison and control flow to data flow analysis, and generatesrules that matches these key elements. We have implemented a prototype toolcalled Patch2QL and applied it to fundamental OSS in C/C++. In experiments, wediscovered 7 new vulnerabilities with medium to critical severity in the mostpopular upstream software, as well as numerous potential security issues. Whenanalyzing downstream projects in the supply chain, we found a significantnumber of representative cognate defects, clarifying the threat posed by thisissue. Additionally, compared to general-purpose SAST and signature-basedmechanisms, the generated rules perform better at discover all variants ofcognate defects.

Patch2QL: Discover Cognate Defects in Open Source Software Supply Chain With Auto-generated Static Analysis Rules