Quantifying Security Issues in Reusable JavaScript Actions in GitHub Workflows

Quantifying Security Issues in Reusable JavaScript Actions in GitHub Workflows Overview This replication package contains all the material required to replicate the analyses we made for our paper entitled Quantifying Security Issues in Reusable JavaScript Actions in GitHub Workflows, which has been accepted for publication at the MSR 2024 (the 21st International Conference on Mining Software Repositories). The materials provided here will guide you through the process of replicating our research findings. This research is supported by the Fonds de la Recherche Scientifique - FNRS under grant numbers T.0149.22, F.4515.23, and J.0147.24. Requirements Before you proceed with replicating our analysis, ensure that you have the following prerequisites installed on your system: Python 3.8 or higher Dependencies listed in the requirements.txt file Getting Started To begin replicating our analysis, follow these steps: Clone this repository to your local machine: Navigate to the cloned directory: Set up a Jupyter Lab environment to execute the provided notebooks. Install the required dependencies using the requirements.txt file: pip install -r requirements.txt Data Replication The data-raw folder contains all the data required to replicate the analysis. These data were obtained by running various notebooks. Here is a list of the notebooks and their resulting CSV files: Extract Actions - actions.csv Extract Releases - releases.csv Extract Actions Type - types.csv Check Manifests and Extract Dependencies - lock_dependencies.csv Check Vulnerabilities - vulnerabilities.csv Extract JS Entry Points and CodeQL Results - codeql_results_raw.csv, codeql_queries.csv Extract Dependents - dependents.csv Research Questions and Analysis The data folder contains all the data required to replicate the paper-story notebook and the research questions. The research and analysis presented in the paper are based on two final datasets created from the data-raw files as follows: Vulnerabilities in Dependency Network of Actions - actions_dependencies_vulnerabilities.parquet Security Weaknesses in JavaScript Code of Actions - actions_code_vulnerabilities.parque《GitHub工作流中可复用JavaScript动作的安全问题量化研究》 概述 本复现包包含复现我们论文所需的全部分析材料，该论文题为《GitHub工作流中可复用JavaScript动作的安全问题量化研究》，已被MSR 2024（第21届国际软件仓库挖掘大会，21st International Conference on Mining Software Repositories）接收发表。本包提供的材料将引导您完整复现本研究的成果。 本研究由比利时国家科学研究基金（Fonds de la Recherche Scientifique - FNRS）资助，资助编号为T.0149.22、F.4515.23与J.0147.24。 前置依赖 在开始复现本研究的分析前，请确保您的系统已安装以下前置条件： 1. Python 3.8及以上版本 2. requirements.txt 文件中列出的依赖项 快速上手 若要开始复现本研究的分析，请按照以下步骤操作： 1. 将本仓库克隆至本地计算机 2. 进入克隆得到的仓库目录 3. 配置Jupyter Lab环境以运行提供的Notebook文件 4. 使用requirements.txt文件安装所需依赖项，执行如下命令： pip install -r requirements.txt 数据复现 data-raw 文件夹包含复现分析所需的全部原始数据，此类数据通过运行各类Jupyter Notebook文件生成。以下为各Notebook脚本及其生成的CSV文件清单： - 动作提取脚本 → actions.csv - 版本发布提取脚本 → releases.csv - 动作类型提取脚本 → types.csv - 清单检查与依赖提取脚本 → lock_dependencies.csv - 漏洞检查脚本 → vulnerabilities.csv - JavaScript入口点与CodeQL结果提取脚本 → codeql_results_raw.csv、codeql_queries.csv - 依赖项提取脚本 → dependents.csv 研究问题与分析 data 文件夹包含复现paper-story Notebook以及解答研究问题所需的全部数据。本文呈现的研究与分析基于从data-raw文件集生成的两份最终数据集，具体如下： 1. 动作依赖网络中的漏洞 → actions_dependencies_vulnerabilities.parquet 2. 动作JavaScript代码中的安全弱点 → actions_code_vulnerabilities.parque