An Empirical Study of Multi-language Security Patches in Open Source Software
摘要
Vulnerabilities in software repositories written in multiple programming languages present a major challenge to modern software quality assurance, especially those resulting from interactions between different languages. Existing static and dynamic program analysis tools are generally constrained to single-language analysis, while current deep-learning models lack the capability to process cross-language interactions effectively. To gain deeper insights into vulnerability patterns and patching behaviors in multi-language code, we conduct a measurement study on commits associated with multi-language security patches. We first collect a large-scale dataset of multi-language security patches from the MITRE corporation. We then analyze trends in language combinations, assess their proneness to vulnerabilities, and compare the severity of these vulnerabilities to those in single-language patches. Additionally, we classify patch patterns based on the types of language interactions to support automated program repair. To encourage further research, we release our dataset to the community, fostering deeper investigation into multi-language security patch development and enhancement.