100 citations · 243 across the 16 of their papers we have counts for
9 papers · 1 filter
Uncovering Hidden Inclusions of Vulnerable Dependencies in Real-World Java Projects
Stefan Schott, Serena Elisa Ponta, Wolfram Fischer +2
Open-source software (OSS) dependencies are a dominant component of modern software code bases. Using proven and well-tested OSS components lets developers reduce development time…
A Soundness and Precision Benchmark for Java Debloating Tools
Jonas Klauke, Tom Ohlmer, Stefan Schott +3
Modern software development reuses code by importing libraries as dependencies. Software projects typically include an average of 36 dependencies, with 80% being transitive, meanin…
Bytecode-centric Detection of Known-to-be-vulnerable Dependencies in Java Projects
Stefan Schott, Serena Elisa Ponta, Wolfram Fischer +2
On average, 71% of the code in typical Java projects comes from open-source software (OSS) dependencies, making OSS dependencies the dominant component of modern software code base…
Compilation of Commit Changes within Java Source Code Repositories
Stefan Schott, Wolfram Fischer, Serena Elisa Ponta +2
Java applications include third-party dependencies as bytecode. To keep these applications secure, researchers have proposed tools to re-identify dependencies that contain known vu…
The Used, the Bloated, and the Vulnerable: Reducing the Attack Surface of an Industrial Application
Serena Elisa Ponta, Wolfram Fischer, Henrik Plate +1
Software reuse may result in software bloat when significant portions of application dependencies are effectively unused. Several tools exist to remove unused (byte)code from an ap…
Code-based Vulnerability Detection in Node.js Applications: How far are we?
Bodin Chinthanet, Serena Elisa Ponta, Henrik Plate +4
With one of the largest available collection of reusable packages, the JavaScript runtime environment Node.js is one of the most popular programming application. With recent work s…
A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software
Serena E. Ponta, Henrik Plate, Antonino Sabetta +2
Advancing our understanding of software vulnerabilities, automating their identification, the analysis of their impact, and ultimately their mitigation is necessary to enable the d…
Vulnerable Open Source Dependencies: Counting Those That Matter
Ivan Pashchenko, Henrik Plate, Serena Elisa Ponta +2
BACKGROUND: Vulnerable dependencies are a known problem in today's open-source software ecosystems because OSS libraries are highly interconnected and developers do not always upda…
Modularity for Security-Sensitive Workflows
Daniel Ricardo dos Santos, Silvio Ranise, Serena Elisa Ponta
An established trend in software engineering insists on using components (sometimes also called services or packages) to encapsulate a set of related functionalities or data. By de…