Why Don't Developers Detect Improper Input Validation?'; DROP TABLE Papers; --
Larissa Braz, Enrico Fregnan, G\"ul \c{C}alikli, Alberto, Bacchelli

TL;DR
This study investigates why developers often fail to detect Improper Input Validation vulnerabilities, revealing that visibility of attack scenarios and review frequency influence detection, but many still miss vulnerabilities despite warnings.
Contribution
It provides empirical evidence on factors affecting developers' ability to detect IIV and highlights the importance of visibility and review practices in security detection.
Findings
Visibility of attack scenarios improves detection rates.
Warnings increase detection among initially unaware developers.
A significant number of developers still fail to detect vulnerabilities despite warnings.
Abstract
Improper Input Validation (IIV) is a software vulnerability that occurs when a system does not safely handle input data. Even though IIV is easy to detect and fix, it still commonly happens in practice. In this paper, we study to what extent developers can detect IIV and investigate underlying reasons. This knowledge is essential to better understand how to support developers in creating secure software systems. We conduct an online experiment with 146 participants, of which 105 report at least three years of professional software development experience. Our results show that the existence of a visible attack scenario facilitates the detection of IIV vulnerabilities and that a significant portion of developers who did not find the vulnerability initially could identify it when warned about its existence. Yet, a total of 60 participants could not detect the vulnerability even after the…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
