Skip to content

Latest commit

 

History

History
83 lines (69 loc) · 6.79 KB

update-2024-04.md

File metadata and controls

83 lines (69 loc) · 6.79 KB

OpenRefactory Update: April 2024

Scan Results

Link to results: https://docs.google.com/spreadsheets/d/1K8dc6SrSEoqqh46cFisZM1tiN4CigaXsqkCKfCM8UTs/edit#gid=228743971

We first show the work done month over month. This is followed by the cumulative results. Finally we show language specific breakdown of the cumulative results.

April

Month Dec 2023 Jan 2024 Feb 2024 Mar 2024 Apr 2024
Projects analyzed 328 300 530 780 712
Projects with no bugs 293 279 525 776 708
Total bugs filed 56 13 7 7 4
Security/Reliability bugs filed 15 8 6 5 2
Bugs with a fix suggestion 50 10 2 2 4
Bugs with a PoC exploit 4 1 2 3 0
Fixes merged by maintainers 27 10 5 3 4
Security/Reliability fixes merged 6 6 2 1 0
Fixes ignored by maintainers 1 1 1 0 2
Reports still open 28 2 1 4 0

High Severity Bugs* (Cumulative)

Month Dec 2023 Jan 2024 Feb 2024 Mar 2024 Apr 2024
Weak Crypto 8 8 8 8 8
Data Race 2 5 5 5 6
XSS 5 5 7 8 8
Log Injection 4 4 4 4 4
Path Manipulation 0 0 3 5 5
Insecure Deserialization 2 2 2 2 2
OS Command Injection 0 0 0 2 2
Inappropriate umask 1 1 1 1 1
Open Redirect 0 1 1 1 1
Security Misconfiguration 1 1 1 1 1
Sensitive Data Leak 1 1 1 1 1
SSRF 1 1 1 1 1
TOTAL 25 29 34 39 40
  • A high severity bug is any one of the following: (1) An injection related bug, (2) a weak cryptography related bug, (3) an access control related bug (4) a security or a reliability bug that is typically of medium priority but has been categorized as a high priority bug because it is found in a popular project (100+ forks).

Cumulative Data

Month Aug 2023 Sep 2023 Oct 2023 Nov 2023 Dec 2023 Jan 2024 Feb 2024 Mar 2024 Apr 2024
Projects analyzed 132 458 809 1,079 1,407 1,707 2,237 3,017 3,729
Projects with no bugs 98 398 718 938 1,231 1,510 2,035 2,811 3,519
Total bugs filed 33 75 113 168 224 237 244 251 255
Security/Reliability bugs filed 12 23 43 79 94 102 108 113 115
Total high severity bugs filed* - - - - 25 29 34 39 40
Bugs with a fix suggestion 26 64 94 140 190 200 202 204 208
Bugs with a PoC exploit 6 13 18 22 26 27 29 32 32
Fixes merged by maintainers 15 (45%) 38 (51%) 54 (48%) 76 (45.3%) 103 (46%) 113 (47.7%) 118 (48.4%) 121 (48.2%) 125 (49.01%)
Security/Reliability fixes merged Not measured Not measured 13 (30%) 25 (31.6%) 31 (32.9%) 37 (36.2%) 39 (36.1%) 40 (35.4%) 40 (34.78%)
Fixes ignored by maintainers Not measured 8 (11%) 7 (6%) 9 (5.3%) 10 (4.5%) 11 (4.6%) 12 (4.9%) 12 (4.78%) 14 (5.5%)
Reports still open Not measured 29 (39%) 52 (46%) 83 (49.4%) 111 (49.5%) 113 (47.7%) 114 (46.7%) 118 (47.01%) 116 (45.49%)

Language Specific Data (Cumulative)

Language Python Java Go TOTAL
# of total projects analyzed 3,383 190 156 3,729
# of total zerofix projects 3,213 170 136 3,519
# of total bugs filed 205 22 28 255
# of total security/reliablity bugs filed 90 12 13 115
# of total bugs with fix suggestion 178 6 24 208
# of total POC exploit 26 5 1 32
# of total merged fixes 104 6 15 125
# of total merged security/reliability fixes 29 3 8 40
# of total ignored/rejected fixes 12 1 1 14
# of total open fixes 89 15 12 116

Attestations

Link to attestations: https://github.com/OpenRefactory-Inc/attestations. A sample attestation JSON can be found here.

Cumulative Data

Month Mar 2024 Apr 2024
Total # of Unique Projects 16 282
Total # of Unique Releases/Versions 75 1360
Total # of Generated Attestations 75 738