So many code vulnerabilities originate from Stack Overflow. I see these issues as part of my daily work reviewing code.
Here are just a few sources discussing it:
- Take care copy-and-pasting that code from Stack Overflow
- Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security
- Watch Out For Insecure Stack Overflow Answers!
Stack Overflow is obviously not the only seeder of vulnerable code, as found recently by researchers: Leveraging Flawed Tutorials for Seeding Large-Scale Web Vulnerability Discovery
So how should it be handled? I have three suggestions:
Do not let anyone post copyable vulnerable code.
- If someone posts code that is known to be vulnerable, it should be in a form of a picture instead of copyable text.
- If a reviewer spots vulnerable code, it should be replaced by a picture of the code or flagged to be replaced.
Instead of:
String user = request.getParameter('user');
String query = 'SELECT * FROM Users where userName='' + user + ''';
- Make it hard to copy by (for example) using it in a
onContextMenu="return false"
paragraph.
- Wrap it in a red frame