SakulFlee/SEAR-Research-Report
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
SEAR Research Report
97 commits 8 branches 0 tags 254 KiB
  • TeX 71.5%
  • Java 28.5%
Find a file
Exact
Lukas Weber 9e2c1b784c
 Merge pull request #10 from Sakul6499/renovate/org.apache.maven.plugins-maven-surefire-plugin-3.x 
Update dependency org.apache.maven.plugins:maven-surefire-plugin to v3
2023-04-01 06:04:39 +02:00
code Merge pull request #10 from Sakul6499/renovate/org.apache.maven.plugins-maven-surefire-plugin-3.x 2023-04-01 06:04:39 +02:00
tex Rewrote results 2020-02-28 15:21:55 +01:00
.gitignore Updated ignore file 2020-02-27 18:22:44 +01:00
README.md Updated project structure and further content added 2020-01-10 14:49:19 +01:00
renovate.json Add renovate.json 2022-06-26 10:17:47 +00:00
report.tex Changed sections to fit new layout 2020-02-27 20:49:34 +01:00
sources.bib Reformatted sources 2020-02-27 22:27:02 +01:00

README.md

SEAR Research Report

This repository holds the content of our SEAR research report and all connected assets.

Main research question

What are the potential risks and threads of utilizing Java Dependency-Injections in an application?

Secondary research questions

  • What is Java Dependency-Injection?
  • What kind of Java Dependency-Injection are there? 'wanted dependency injection' (Plugin-System) 'abuse of wanted Dependency-Injection' 'unwanted Dependency-Injection' [-> only mention]
  • What are the positive benefits vs. negative impacts?
  • How does Java Dependency-Injection work?
    • Implemented Plugin-System
    • External dependencies

Hypothesis

Increasing security measures of a packaged application and plugin-system will reduce potential threads and risks of Java Dependency-Injection.

Definition

X: Security Measures of the packaged application and plugin-system Y: Threads and Risks of Java Dependency-Injection P: Java + source of plugins/libraries/dependencies I: User-error (e.g. manual overwrite of dependencies or plugins; OUTSIDE of the system)

Capture hypothesis

P: Security knowledge X: System/Environment security I: "User (security) Error/Issue" Y: Potential damage / risk / threads

Security Knowledge → System Security → Potential damage / risk / threads ↑ "User (security) Error/Issue"

How to capture hypothesis

Showing difference in secure applications and insecure applications. How and which potential risks are possible?

Method

  • Experiment
  • Empirical
  • Qualitative