Synopsys Company 1253 commercial codebases have been analyzed, and it was concluded that nearly all (99%) reviewed commercial applications contain at least one component with open source code, and 70% of the code in the reviewed repositories is open. In comparison, a similar study from 2015 found that the share of open code was 36%.
In most cases, the third-party open code used is not updated and has potential security issues — 91% of the examined codebases have open components that have not been updated for more than five years, or have been abandoned for at least two years and are not supported by developers. As a result, 75% of the discovered open code in repositories has unpatched known vulnerabilities, half of which are of high severity. In a sample from 2018, the share of code with vulnerabilities was 60%.
The most frequently encountered dangerous vulnerability was
issue (remote code execution) in the library for Node.js, with vulnerable versions found more than 500 times. The oldest unpatched vulnerability was an issue in the lpd daemon (), which was patched in 1999.
In addition to security, there is also a careless attitude towards compliance with open license conditions in the codebases of commercial projects.
In 73% of the codebases, problems with the legality of using open code were found, such as license incompatibilities (usually, GPL code is included in commercial products without opening the derivative product) or using code without specifying a license. 93% of all licensing issues occur in web and mobile applications. In games, virtual reality systems, multimedia, and entertainment programs, violations were noted in 59% of cases.
A total of 124 typical open components were identified during the study, which are commonly used in all codebases. The most popular of these are: jQuery (55%), Bootstrap (40%), Font Awesome (31%), Lodash (30%), and jQuery UI (29%). In terms of programming languages, the most popular are JavaScript (used in 74% of projects), C++ (57%), Shell (54%), C (50%), Python (46%), Java (40%), TypeScript (36%), C# (36%); Perl (30%) and Ruby (25%). The overall share of programming languages is:
JavaScript (51%), C++ (10%), Java (7%), Python (7%), Ruby (5%), Go (4%), C (4%), PHP (4%), TypeScript (4%), C# (3%), Perl (2%), and Shell (1%).
Source: opennet.ru
