search

natehill / rochester

presentation for IL 2015
MIT License
0 stars 0 forks source link

Academic research on vulnerable c++ code snippet #3

Open JafarAkhondali opened 5 years ago

JafarAkhondali commented 5 years ago

Dear Nate Hill, We are a group of Academic researchers. We are analyzing vulnerable C++ code snippets migrated from StackOverflow to GitHub. Our research will be published in Academic publications and will not be used in any Industrial application. We noted a vulnerable code snippet in your repository that was most likely copied from Stack Overflow. The vulnerability exists in this source code file of your repository.

Please verify our report here with regards to the above vulnerability to assist you. Link to report with four questions for you related to the vulnerability (should not take more than 5 minutes to answer).

Here is a summary of the vulnerable code snippet:

Description:

This answer will not work for many of Unicode characters, please do not consider strings only as ASCII. Since it's Json related function it'll most likely end up having characters from user and may have Unicode characters as well.

Mitigation:

As suggested in answer, use this answer instead.

Please verify our report here with regards to the above vulnerability to assist you. Link to report with four questions for you related to the vulnerability (should not take more than 5 minutes to answer).

Sincerely yours, Morteza Verdi, Shiraz university, E-mail: m.verdi@shirazu.ac.ir Jafar Akhondali, Shiraz university, E-mail: jafar.akhondali@yahoo.com Ashkan Sami, Shiraz university, E-mail: ashkan.sami@gmail.com Foutse Khomh, Polytechnique Montreal, E-mail: foutse.khomh@polymtl.ca, website: http://www.khomh.net/ Gias Uddin, Polytechnique Montreal, E-mail: gias98@gmail.com, website: https://giasuddin.github.io Alireza Karami motlagh, Shahid Chamran University, E-mail: alireza.karami.m@gmail.com

JafarAkhondali commented 5 years ago

Hi, Looks like you didn't complete the survey, can you finish it up? It would take less than 5 minutes. Thanks again. Link to report

JafarAkhondali commented 5 years ago

Hi, Looks like you didn't complete the survey, can you finish it up? It would take less than 5 minutes. Thanks again. Link to report

JafarAkhondali commented 5 years ago

Hi, Looks like you didn't complete the survey, can you finish it up? It would take less than 5 minutes. Thanks again. Link to report