Do Not Attempt to Blame a File That May Be Irrelevant in Contributing to a Vulnerability

[nuthanmunaiah]

Description

archeogit blame does not consider the relevance of a file in contributing to a vulnerability when attempting to identify the commits that likely contributed to the vulnerability. The implementation is based on the assumption that any file involved in the commit that fixed a vulnerability is relevant to the vulnerability. However, the assumption is violated when files like test cases or change logs are updated when fixing the vulnerability. There is no need to subject these irrelevant files to the algorithm that identifies commits that likely contributed to the vulnerability because these irrelevant files likely have nothing to do with resolving the vulnerability itself.

Examples

The following examples help illustrate the issue.

• apache/struts@d934c6e is reported to have fixed CVE-2013-2115 in Apache Struts. The commit modified the four files enumerated below two of which are test files which, by their nature, are unlikely to have contributed to the vulnerability. As a result, these files must not be considered when attempting to identify vulnerability contributing commits given a vulnerability fixing commit.
  • core/src/main/java/org/apache/struts2/views/util/DefaultUrlHelper.java
  • core/src/test/java/org/apache/struts2/views/jsp/URLTagTest.java
  • core/src/test/java/org/apache/struts2/views/util/DefaultUrlHelperTest.java
  • xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java
• apache/httpd@2fa69ec is reported to have fixed CVE-2013-2115 in Apache httpd. The commit modified the two files enumerated below, one of which is a plaintext files used as a log of changes in the project which , by its nature, is unlikely to have contributed to the vulnerability. As a result, this file must not be considered when attempting to identify vulnerability contributing commits given a vulnerability fixing commit.
  • modules/cache/cache_util.c
  • CHANGES

Proposal

The proposed solution is to (a) develop an approach to accurately identify the irrelevant files affected by a vulnerability fixing commit and (b) ignore them when attempting to identify the vulnerability contributing commits.

[nuthanmunaiah]

The issue is now resolved as demonstrated by the output from archeogit blame for the two examples included in the description.

• CVE-2013-2115 in Apache Struts Fixed by apache/struts@d934c6e

  $ archeogit blame /data/repositories/struts/ d934c6e7430b7b98e43a0a085a2304bd31a75c3d --csv --filters docs nonsource test
  commit,path,contributor,frequency
  d934c6e7430b7b98e43a0a085a2304bd31a75c3d,core/src/main/java/org/apache/struts2/views/util/DefaultUrlHelper.java,c52cd98c9e9328b675e3601d5cc269a71e05944d,37
  d934c6e7430b7b98e43a0a085a2304bd31a75c3d,core/src/main/java/org/apache/struts2/views/util/DefaultUrlHelper.java,bb5694b8551f0d7c63cb3ceda1d404c25d9d3132,2
  d934c6e7430b7b98e43a0a085a2304bd31a75c3d,xwork-core/src/main/java/com/opensymphony/xwork2/ognl/SecurityMemberAccess.java,0c543aef318341ca9bd482e15f1637497b8a4dfd,5
  2021-08-10 16:16:31,698 - archeogit - blame excavation took 0.04 seconds

  The two test files (core/src/test/java/org/apache/struts2/views/jsp/URLTagTest.java and core/src/test/java/org/apache/struts2/views/util/DefaultUrlHelperTest.java) are no longer blamed.

• CVE-2013-2115 in Apache httpd Fixed by apache/httpd@2fa69ec

  $ archeogit blame /data/repositories/httpd/ 2fa69ec09458a7a6519eb1e960b1fee45da66143 --csv --filters docs nonsource test
  commit,path,contributor,frequency
  2fa69ec09458a7a6519eb1e960b1fee45da66143,modules/cache/cache_util.c,9f68cf201061348d3706768c3e61096867b64df2,2
  2021-08-10 16:16:31,830 - archeogit - blame excavation took 0.04 seconds

  The plaintext file (CHANGES) is no longer blamed.