What We Learned Remediating XSS in GitHub Open Source Projects
summary
Built an automated remediation tool that targets XSS in JSPs across GitHub open-source repositories, downloading ~160,000 repos and isolating thousands of JSP files, then running a scanner plus a fixer and automated JSP source code modification. Results show vulnerabilities are bursty, forks and test code are common trouble spots, and GitHub asks for private disclosure rather than public issues. The system creates pull requests with diffs and is able to knock out ~20% of existing XSS for the scoped classes of bugs.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 4:00The challenge of remediation
- 7:41The problem of developer load
- 11:51Limitations of current tools
- 16:58Automated remediation strategy
- 22:32Case study and data analysis
- 28:55Findings from GitHub research
- 37:24Scaling and practical impact
- 43:31Disclosure and final thoughts
related talks
31m360° View of XSS
46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For All
01h 02mRevisiting XSS Sanitization
17mIs My (Open Source) Project Safe?
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
52mDemystifying Front-End Security
49mQuantifying the Probability of Flaws in Open Source