MethodLevelAnalyzer
commented
3 years ago Hi, I am contacting you on behalf of the research team from the Technical University of Delft, The Netherlands. In our recent study, we have carefully selected a limited number of active and professional repositories from the open-source community to learn from. So every feedback counts! :)
We appreciate it if you could contribute to our research by answering just a few questions (either using the above checkboxes or the fully anonymous questionnaire from here: https://forms.gle/n6oXZUwYysMUnVDn6). This will take less than a minute. Moreover, we will give credit to your repository in the upcoming paper.
harwey
Vulnerability Information
Bumps apache-httpclient from 4.5.2 to 4.5.3.
Listed dependency org.apache.httpcomponents:httpclient contains vulnerable methods which are called from this project. This vulnerability appears to affect httpclient package versions lower than 4.5.3 (excluding). The vulnerability has been fixed in version 4.5.3, as can be seen from the package release notes.
Vulnerable method calls
IppSendDocumentOperation.sendRequest(CupsPrinter printer, URI uri, ByteBuffer ippBuf, InputStream documentStream, CupsAuthentication creds)
CloseableHttpClient.execute(HttpUriRequest request)
URIBuilder.normalizePath(String path)
IppCreateJobOperation.sendRequest(CupsPrinter printer, URI uri, ByteBuffer ippBuf, CupsAuthentication creds)
CloseableHttpClient.execute(HttpUriRequest request)
URIBuilder.normalizePath(String path)
What do the columns represent?
The 1st column in the table indicates the method in this repository that was found to be affected by vulnerable methods from the httpclient package.
The 2nd column indicates the httpclient method that was directly called from this repository.
The 3rd column indicates the origin vulnerable method in the httpclient package. According to our dataset, this is one of the methods that produces the HTTPCLIENT-1803 vulnerability. This method was found to be internally chain-called in the httpclient package by the method listed in column 2.
How were the results generated?
This vulnerability was analyzed specifically for usage in this project using the FASTEN Project. Statical method-level analysis was used to check for usage of vulnerable methods in the project.
Method calls between your project and httpclient have been mapped into a directed graph. From this graph, it could be then be seen whether any vulnerable httpclient methods are being called from within your project.
Research Scope
We are a team of 3 BSc Computer Science students at the TU Delft. Our goal is to conduct research on how developers react to method-level vulnerability information that affects their projects. We would highly appreciate if you could help us with our research and please tick statements which apply to you below.
First impression checklist
After fixing vulnerability checklist