This story draft by @escholar has not been reviewed by an editor, YET.

Qualitative Examples Generated by GitHub Copilot

EScholar: Electronic Academic Papers for Scholars HackerNoon profile picture
0-item

Table of Links

Abstract and I. Introduction

II. Related Work

III. Technical Background

IV. Systematic Security Vulnerability Discovery of Code Generation Models

V. Experiments

VI. Discussion

VII. Conclusion, Acknowledgments, and References


Appendix

A. Details of Code Language Models

B. Finding Security Vulnerabilities in GitHub Copilot

C. Other Baselines Using ChatGPT

D. Effect of Different Number of Few-shot Examples

E. Effectiveness in Generating Specific Vulnerabilities for C Codes

F. Security Vulnerability Results after Fuzzy Code Deduplication

G. Detailed Results of Transferability of the Generated Nonsecure Prompts

H. Details of Generating non-secure prompts Dataset

I. Detailed Results of Evaluating CodeLMs using Non-secure Dataset

J. Effect of Sampling Temperature

K. Effectiveness of the Model Inversion Scheme in Reconstructing the Vulnerable Codes

L. Qualitative Examples Generated by CodeGen and ChatGPT

M. Qualitative Examples Generated by GitHub Copilot

M. Qualitative Examples Generated by GitHub Copilot

Listing 12 and Listing 13 show two examples of the generated codes by GitHub Copilot that contain security vulnerabilities. Listing 12 depicts a generated code that contain CWE-022, which is known as path traversal vulnerability. In this example, lines 1 to 6 are the non-secure prompt, and the rest of the code is the completion of the given non-secure prompt. The code in Listing 12 contains a path traversal vulnerability at line 10, where it enables arbitrary file write during tar file extraction. Listing 13 shows a generated code that contains CWE-079, this issue is related to cross-site scripting attacks. Lines 1 to 8 of Listing 13 contain the input non-secure prompt, and the rest of the code is the completion of the non-secure prompt. The code in this figure contains a cross-site scripting vulnerability in line 12.


Listing 8: A vulnerable Python code example generated by ChatGPT. The code contains a CWE-022 vulnerability in line 23. In this example, the first eight lines are the non-secure prompt, and the rest of the code is the completion of the given non-secure prompt.


Fig. 9: The success rate of generating target codes over different thresholds of code similarity. The codes are generated using our FS-Code approach. We use fuzzy matching as the code similarity threshold.


Listing 6: Python code reconstructed using our FS-Code approach. The vulnerable part of the target Python code was used as the last part of the FS-Code prompt. (a) represents the target code that contains a CWE-611 vulnerability. The first nine lines are the prompt, and lines 10 to 12 are the vulnerable part of the code. (b) shows the closest generated code to the target code generated by the ChatGPT model. In the generated code, lines 1 to 5 are p


Listing 9: A vulnerable Python code example generated by ChatGPT. The code contains a CWE-089 vulnerability in line 22. In this example, the first ten lines are the non-secure prompt, and the rest of the code is the completion of the given non-secure prompt.


Listing 7: C code reconstructed using our FS-Code approach. The vulnerable part of the target C code was used as the last part of the FS-Code prompt. (a) represents the target code that contains a CWE-476 vulnerability. The first six lines are the prompt, and lines 7 to 24 are the vulnerable part of the code. (b) shows the closest generated code to the target code generated by the CodeGen model. Here, lines 1 to 4 are the prompt. The fuzzy similarity score between (a) and (b) is 68.


Listing 10: A vulnerable C code example generated by CodeGen. The code contains a severe CWE-787 vulnerability in line 25. In this example, the first seven lines are the nonsecure prompt, and the rest of the code is the completion of the given non-secure prompt.


Listing 11: A vulnerable C code example generated by CodeGen. The code contains multiple vulnerabilities of type CWE-787 (lines 10, 11 and 17). In this example, the first nine lines are the non-secure prompt, and the rest of the code is the completion of the given non-secure prompt.


Listing 12: A vulnerable code example generated by GitHub Copilot. The code contains a CWE-022 vulnerability in line 10. In this example, the first six lines are the non-secure prompt, and the rest of the code is the completion of the given nonsecure prompt.


Listing 13: A vulnerable code example generated by GitHub Copilot. The code contains a CWE-079 vulnerability in line 12. In this example, the first eight lines are the non-secureprompt, and the rest of the code is the completion of the given non-secure prompt.


Authors:

(1) Hossein Hajipour, CISPA Helmholtz Center for Information Security ([email protected]);

(2) Keno Hassler, CISPA Helmholtz Center for Information Security ([email protected]);

(3) Thorsten Holz, CISPA Helmholtz Center for Information Security ([email protected]);

(4) Lea Schonherr, CISPA Helmholtz Center for Information Security ([email protected]);

(5) Mario Fritz, CISPA Helmholtz Center for Information Security ([email protected]).

This paper is available on arxiv under CC BY-NC-SA 4.0 DEED license.


Catchpoint
L O A D I N G
. . . comments & more!

About Author

EScholar: Electronic Academic Papers for Scholars HackerNoon profile picture
EScholar: Electronic Academic Papers for Scholars@escholar
We publish the best academic work (that's too often lost to peer reviews & the TA's desk) to the global tech community
Read my storiesAbout @escholar

Topics

#codelmsec-benchmark#code-security#black-box-models#code-generation#language-models#vulnerability-detection#ai-assisted-programming#github-copilot

Around The Web...

Read on Terminal Reader Terminal
Read this story w/o Javascript Lite

Join HackerNoonloading
Latest technology trends. Customized Experience. Curated Stories. Publish Your Ideas

Trending Topics

blockchaincryptocurrencyhackernoon-top-storyprogrammingsoftware-developmenttechnologystartuphackernoon-booksBitcoinbooks