Hey bro can I copy your code? Sure just fix the bug first - vulnerability found in stackoverflow code

[williamcll]

A vulnerability was discovered inside a stackoverflow (a website that provides a lot of computing Q&As) page that has been copied for thousands of times 9 years ago. Since online coding Q&As rarely gets monitored, it is only recently that this issue was found.

Quote

The most copied StackOverflow Java code snippet of all time contains a bug.

 

The admission comes from the author of the snippet itself, Andreas Lundblad, a Java developer at Palantir, and one of the highest-ranked contributors to StackOverflow, a Q&A website for programming-related topics.An academic paper [PDF] published in 2018 identified a code snippet Lundblad posted on the site as the most copied Java code taken from StackOverflow and then re-used in open source projects.The code snippet was provided as an answer to a StackOverflow question posted in September 2010. The code snippet printed byte counts (123,456,789 bytes) in a human-readable format, like 123.5 MB.

 

Academics found that this code had been copied and embedded in more than 6,000 GitHub Java projects, more than any other StackOverflow Java snippet.

 

Image: Baltes et al.

In a blog post published last week, Lundblad admitted that the code was flawed and that it incorrectly converted byte counts into human-readable formats. Lundblad said he revisited the code after learning of the academic paper and its results. He looked at the code again and published a corrected version on his blog. But while Lundblad's code snippet contained a trivial conversion bug that only resulted in slightly inaccurate file size estimations, things could have been much worse. The code could have contained a security flaw, for example. If it did, then fixing all the vulnerable applications would have taken months or years, leaving users exposed to attacks. Even if it is universally understood that copy-pasting code from StackOverflow is a bad idea, developers still do it.The 2018 research paper showed just how widespread this practice was in the Java ecosystem, revealing that the vast majority of developers who copied popular StackOverflow answers didn't even bother to credit their source.

 

Software developers who copy code from StackOverflow without attribution are effectively hiding from fellow coders that they've introduced unvetted code inside a project.This might sound like an overly alarmistic statement, but a different academic research project published in October 2019 [PDF] showed that StackOverflow code snippets do contain vulnerabilities -- and that this is not just an urban myth that developers use to scare each other. The research paper found major security flaws in 69 of the most popular C++ code snippets posted on StackOverflow in the past ten years.

 

Researchers said they found these 69 vulnerable code snippets in a total of 2,859 GitHub projects, showing how one bad StackOverflow answer could wreak damage across an entire ecosystem of open source apps.

Source:https://www.zdnet.com/article/the-most-copied-stackoverflow-java-code-snippet-contains-a-bug/

https://fossbytes.com/stackoverflow-most-copied-code-snippet-has-a-bug/
Thoughts: Oh, this is going to be a pain to fix, while I guess a lot of the code might just be some people's homework, I do worry about the other ones that might be implemented into more crucial platofrms, and since this is Java I can see a lot of vulnerable devices out there that could be carrying this risk.

[vanished]

Hmm how much do you bet Minecraft has this bug

[GDRRiley]

understand the code don't just copy it. I get that takes time but it is faster to learn with an example that from scratch

[Sakkura]

39 minutes ago, williamcll said:

A vulnerability was discovered

No, it's not a vulnerability, just a fairly trivial bug. It doesn't pose any security risk.

 

The article just uses this as an example of how a piece of code can be copied widely, which would be a big problem if there was an actual security issue in it.

[minibois]

It's a bug at the most. Not a 'vulnerability'

But this does show the importance of unit tests.

 

Of course I do not expect everyone on Stack overflow to unit test everything they respond with, but if such a small rounding error is that important to your program, you should test its responses.

As a developer you will have to know what your user wants to see as a rounded down number, so you should write a couple of tests to see if the code responds as you suspect.

 

But seeing as it has been years and no one notified the original posted of the bug, it is not a large issue.

 

But still cool to see:

39 minutes ago, Sakkura said:

The article just uses this as an example of how a piece of code can be copied widely, which would be a big problem if there was an actual security issue in it.

Exactly! This is just showing the large scale use of Stack overflow responses in actual projects.

[colonel_mortis]

The news here is not a security vulnerability, just a subtle bug. However, there was some similar news recently that does involve security vulnerabilities - https://stackoverflow.blog/2019/11/26/copying-code-from-stack-overflow-you-might-be-spreading-security-vulnerabilities/.

[Levent]

This would make one hell of a social engineering by NSA to implement backdoors in peoples software.

[Kisai]

The issue here is how wannabe programmers just look up stuff on the web instead of figuring it out themselves. You're not supposed to copy-paste entire code bits , you're supposed to understand what it does and rewrite it to fit your use case.

 

Bugs aside, many examples out there are simply BAD. They reflect either old, inefficient, or quick-and-dirty solutions, not well thought out solutions. If you grep a solution to a problem from stackoverflow, keep in mind the person who wrote the response probably spent 10 minutes on it, not 3 days. 

 

A better resource is github. If the thing you want to do is a common thing that project X, Y, and Z use, then look at how X and Y do it and figure out how that works in the context of your project.

 

Most stackoverflow stuff tends to come in the form of "I need someone to answer my homework" and "this is what solves the literal question, no sanity checking"

 

[TrigrH]

Quote

 - vulnerability found in stackoverflow code

Quote

code snippet contained a trivial conversion bug that only resulted in slightly inaccurate file size estimations

watch out guys, you thought the intel vulnerabilities where bad

 /s

[BuckGup]

14 hours ago, GDRRiley said:

understand the code don't just copy it. I get that takes time but it is faster to learn with an example that from scratch

Good joke. The amount of people today that simply copy and paste from stack overflow is insane

[GDRRiley]

25 minutes ago, BuckGup said:

Good joke. The amount of people today that simply copy and paste from stack overflow is insane

I know, it is a problem.

[BuckGup]

2 minutes ago, GDRRiley said:

I know, it is a problem.

Like people getting paid $78,000/yr and have no clue how their code works but it does and that's all the manager cares about

[Kisai]

2 hours ago, BuckGup said:

Good joke. The amount of people today that simply copy and paste from stack overflow is insane

It it's probably 100 times worse than it's ever been since Wikipedia came about.

https://en.wikipedia.org/wiki/Category:Articles_with_example_C_code

 

Basically stackoverflow similar sites have someone ask a question like this:

 

https://stackoverflow.com/questions/3536153/c-dynamically-growing-array

 

Quote

I have a program that reads a "raw" list of in-game entities, and I intend to make an array holding an index number (int) of an indeterminate number of entities, for processing various things. I would like to avoid using too much memory or CPU for keeping such indexes...

 

So the logical thing here is to describe how to do a dynamic array in C, but the best answer would be "use a header-only library", eg https://github.com/eteran/c-vector , or https://github.com/nothings/stb/blob/master/stb_ds.h

 

The best answer as suggested is super-simple, and does no error checking. In fact you actually want as little error-checking as possible in memory allocations since they slow things down. Which is another reason why people will look for a C solution instead of a C++ one. If the user is using C++ or Java you would actually want to use the native implementation's of this.

 

And part of that comes from how complex memory management is. In a linked-list, you basically go "I have a series of arrays, the first array is X length, (data), the next array is Y length, (data)" where this is just one contigious piece of memory if allocated at compile time. At runtime however, that's not gauranteed, so instead you have "first array is X length, (pointer to data), next array is Y length, (pointer to data)" and those pointers will be scattered all over the place, which is less efficient than allocating like a 1MB block of memory and knowing you don't need that much memory.

 

Hence, many programs are developed with code that may not be the best solution for a specific use case. 

 

Now on the other hand, formatting questions tend to be more of a "I just need to get X value, how do I not make it spill out to 100 decimal places" and while these are simpler, the answers sometimes take the form of manual formatting a string, or using utility libraries that are overkill, or in the case of C++ and Java, using the actual functions that are part of the base language. Because of Unicode, things are not simple, and many programs don't care about how they format logging and will even smash the logging function because their process is multithreaded or forked and has to be done differently to avoid overwriting the buffer before it's written to disk.

 

Formatting tends to generate a lot of bugs because a lot of examples assume a very simple program, eg a homework assignment. They're not representative of how you'd want to do it in a production environment. It's probably fine for small throw-away tools, and minor bugs in the output don't matter because all you're looking for is the most significant digits. Yet, if you distribute that tool, other tools might rely on that output being a fixed way.