An Empirical Investigation of the Security Weaknesses in Open-Source Projects

With the increase of code reuse, the possibility of security vulnerabilities increases. Thus, tools for static analysis are widely used to evaluate open-source projects against security vulnerabilities. This research aims to empirically study common weakness types (CWEs), their frequencies, and the correlations between them and open-source project characteristics. The PVS-Studio tool analyzed 150 projects hosted on GitHub and written in C#, C++, and Java. The tool was used to investigate the common weaknesses found in these projects. Furthermore, our study has practical implications for developers and researchers interested in open-source project security. We have identified the factors that contribute to the presence of these weaknesses, and our statistical analyses have shed light on these factors. Notably, C++ projects tend to have more weaknesses. The most common types of weaknesses detected in these programming languages are CWE-571, 570, 690, 682, 476, 628, 563, 691, 704, and 393. The age of the project and the number of commits are found to be positively correlated with the number of detected weaknesses, while stars and forks have little impact. These findings highlight the need for caution when using open-source code, as it can have several vulnerabilities that can compromise the software's security. Therefore, it is crucial to scan the third-party code before incorporating it into projects.