A Study of Vulnerability Identifiers in Code Comments: Source, Purpose, and Severity
Abstract
Software vulnerability is one of the weaknesses in computer security that challenges developers to rectify. Software maintainers rely on code comments to maintain their source code, including fixing vulnerability issues. To facilitate understanding the security issues in the related code, vulnerability identifiers are commonly included in code comments. However, not all vulnerability-related code comments describe clearly the purposes of the inclusion of the identifiers. Based on this evidence, we investigate the importance of vulnerability identifiers contained in source code comments, which is the novelty of this paper. We performed a study of 1,491 code comments that refer to vulnerability identifiers to define their categories. We then applied a mixed-method approach to classifying the types of the related repository and code, the rationale of identifier references, and the severity level of vulnerabilities in the code. The results indicate that vulnerability identifiers in code comments are useful to notify security issues for the related source code, and our study widens up chances for future work to further investigate these problems.
Keywords
code comments, identifier, vulnerability
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Y. Nugroho, D. Gunawan, D. Puspa Putri, S. Islam and A. Alhefdhi, "A Study of Vulnerability Identifiers in Code Comments: Source, Purpose, and Severity," in Journal of Communications Software and Systems, vol. 18, no. 2, pp. 165-174, May 2022, doi: https://doi.org/10.24138/jcomss-2021-0124
@article{nugroho2022studyvulnerability,
author = {Yusuf Sulistyo Nugroho and Dedi Gunawan and Devi Afriyantari Puspa Putri and Syful Islam and Abdulaziz Alhefdhi},
title = {A Study of Vulnerability Identifiers in Code Comments: Source, Purpose, and Severity},
journal = {Journal of Communications Software and Systems},
month = {5},
year = {2022},
volume = {18},
number = {2},
pages = {165--174},
doi = {https://doi.org/10.24138/jcomss-2021-0124},
url = {https://doi.org/https://doi.org/10.24138/jcomss-2021-0124}
}