How do Library Maintainers Refactor to Secure Software? A Study of Maven Releases

Third-party library dependencies have become prominent in today's software development; however, the threat of security vulnerabilities in dependencies is a growing concern. In addition to adding new features, fixing bugs, and evolving code, a library maintainer needs to consider the security of their libraries when evolving their code. Maruyama[31]proposed secure refactoring to secure code; however, it is unknown the extent to which secure refactoring is practiced in the wild. To fill this gap, in this large empirical study, we want to understand the role in which refactoring plays in securing code from known vulnerabilities. Results of our preliminary study of 351 vulnerabilities that detected 7,853 refactorings confirmed the presence of secure refactoring, causing us to expand the definition of secure refactoring into secure-release refactoring. Conducting a mixed-method empirical study, we show that secure-release refactoring is usually released in the major and pre-release versions, while the most frequent secure-release refactoring beingAdd Method Annotation,Change Variable Type,Rename Variable Type, Rename MethodandChange Parameter Type. For our qualitative investigation of512 samples, we confirm that secure-release refactoring security fixes are not involved in complex tasks but for singular tasks. Interestingly, we reveal several relationships between the type of maintenance task and secure-release refactoring. Our findings are a step towards understanding how refactoring is used to secure code, opening up avenues for future work that contribute to promoting secure dependencies <strong>Contents</strong> <strong>forRQ2.xlsx</strong> <strong>original sheet </strong> <strong>secure-release-refactoring operations (7,853</strong><strong>)</strong> Fix URL - The link of vulnerability fixing commit Refactoring URL - The link of commit with refactoring operation timing - The time period of refactoring operation. It has three periods (i) before, (ii) same (iii) after. Secure Category - It is a vulnerabilities Category. Refactoring Pattern - It is a refactoring operation. CommitComment - Commit message of the refactoring commit. <strong>for_RQ2 sheet </strong> <strong>Sampling Dataset for RQ2(512)</strong> Fix URL - The link of vulnerability fixing commit Refactoring URL - The link of commit with refactoring operation timing - The time period of refactoring operation. It has three periods (i) before, (ii) same (iii) after. Secure Category - It is a vulnerabilities Category. Refactoring Pattern - It is a refactoring operation. CommitComment - Commit message of the refactoring commit. CountOf - It is the task for single/multiple Corrective - It is the task for classifying corrective task or not Adaptive - It is the task for classifying adaptive task or not Perfective - It is the task for classifying perfective task or not Ner Feature - It is the task for classifying new feature task or not count_of_rule - It is the TRUE count between corrective and new feature. <strong>data.json</strong> <strong>All secure-release-refactoring operations for Preliminary and RQ1(7,853)</strong> <strong>Structure</strong> <strong> &lt;repository name&gt; : [</strong> {"github_link" : [ "https://github.com/..."], "fix_commit_id" : ["132r3rf2sfy3hs", ...], "secure_category" : "Injection", "secure_release-refactoring_count" : 3 "fixed_files" : ["Manager.java",...], "version" : "2.0", "version_release" : "major", "same_secure_release_refactoring" : [ {"refactoring_commit_id" : "1fg3bq3b...", "refactoring_operation" : "Add Method Annotation", "refactoring_commit_message" : "add annotation. "} ], "before_secure_release_refactoring" : [ {"refactoring_commit_id" : "1fg3bq3b...", "refactoring_operation" : "Add Method Annotation", "refactoring_commit_message" : "add annotation. "} ], "after_secure_release_refactoring" : [ {"refactoring_commit_id" : "1fg3bq3b...", "refactoring_operation" : "Add Method Annotation", "refactoring_commit_message" : "add annotation. "} ] } ]