论文标题
少更多：在代码审查期间支持开发人员漏洞检测
Less is More: Supporting Developers in Vulnerability Detection during Code Review
论文作者
论文摘要
从安全角度来审查源代码已被证明是一项艰巨的任务。确实，以前的研究表明，开发人员在代码审查期间通常会错过流行且易于检测的漏洞。最初的证据表明，重大原因可能在于审稿人的心理态度和共同的做法。在这项研究中，我们研究了在代码审查期间是否明确要求开发人员专注于安全性会影响漏洞的检测。此外，我们评估了提供安全清单以指导安全审查的效果。为此，我们对150名参与者进行了在线实验，其中71％的人报告具有三年或更长时间的专业发展经验。我们的结果表明，在代码审查期间，简单地要求审阅者专注于安全性增加了脆弱性检测的可能性的八倍。安全清单的存在并不能显着进一步改善结果，即使清单是针对正在审查的更改和更改中现有漏洞的量身定制的。这些结果提供了支持心理态度假设的证据，并呼吁在安全清单的有效性和设计上进行进一步的工作。数据和材料：https：//doi.org/10.5281/zenodo.6026291
Reviewing source code from a security perspective has proven to be a difficult task. Indeed, previous research has shown that developers often miss even popular and easy-to-detect vulnerabilities during code review. Initial evidence suggests that a significant cause may lie in the reviewers' mental attitude and common practices. In this study, we investigate whether and how explicitly asking developers to focus on security during a code review affects the detection of vulnerabilities. Furthermore, we evaluate the effect of providing a security checklist to guide the security review. To this aim, we conduct an online experiment with 150 participants, of which 71% report to have three or more years of professional development experience. Our results show that simply asking reviewers to focus on security during the code review increases eight times the probability of vulnerability detection. The presence of a security checklist does not significantly improve the outcome further, even when the checklist is tailored to the change under review and the existing vulnerabilities in the change. These results provide evidence supporting the mental attitude hypothesis and call for further work on security checklists' effectiveness and design. Data and materials: https://doi.org/10.5281/zenodo.6026291
