Quantifying Security Issues in Reusable JavaScript Actions in GitHub Workflows

Quantifying Security Issues in Reusable JavaScript Actions in GitHub Workflows

Overview

This replication package contains all the material required to replicate the analyses we made for our paper entitled Quantifying Security Issues in Reusable JavaScript Actions in GitHub Workflows, which has been accepted for publication at the MSR 2024 (the 21st International Conference on Mining Software Repositories). The materials provided here will guide you through the process of replicating our research findings.

This research is supported by the Fonds de la Recherche Scientifique - FNRS under grant numbers T.0149.22, F.4515.23, and J.0147.24.

Requirements

Before you proceed with replicating our analysis, ensure that you have the following prerequisites installed on your system:

Python 3.8 or higher

Dependencies listed in the requirements.txt file

Getting Started

To begin replicating our analysis, follow these steps:

Clone this repository to your local machine:

Navigate to the cloned directory:

Set up a Jupyter Lab environment to execute the provided notebooks.

Install the required dependencies using the requirements.txt file:

pip install -r requirements.txt

Data Replication

The data-raw folder contains all the data required to replicate the analysis. These data were obtained by running various notebooks. Here is a list of the notebooks and their resulting CSV files:

Extract Actions - actions.csv

Extract Releases - releases.csv

Extract Actions Type - types.csv

Check Manifests and Extract Dependencies - lock_dependencies.csv

Check Vulnerabilities - vulnerabilities.csv

Extract JS Entry Points and CodeQL Results - codeql_results_raw.csv, codeql_queries.csv

Extract Dependents - dependents.csv

Research Questions and Analysis

The data folder contains all the data required to replicate the paper-story notebook and the research questions. The research and analysis presented in the paper are based on two final datasets created from the data-raw files as follows:

Vulnerabilities in Dependency Network of Actions - actions_dependencies_vulnerabilities.parquet

Security Weaknesses in JavaScript Code of Actions - actions_code_vulnerabilities.parque