我用 GPT-3 在单个代码库中发现 213 个安全漏洞

#include <stdio.h> int main(int argc, char **argv) {    char *secret = "This is a secret!\n";     printf external link(argv[1]);     return 0;}

using Microsoft.AspNetCore.Http;using Microsoft.AspNetCore.Mvc;using Microsoft.Extensions.Logging;using System;using System.Collections.Generic;using System.Linq;using System.Threading.Tasks;
namespace WebFox.Controllers{    [Route("api/[controller]")]    [ApiController]    public class LogInjection : ControllerBase    {        private readonly ILogger<LogInjection> _logger;


        public LogInjection(ILogger<LogInjection> logger)        {            _logger = logger;        }
        [HttpGet("{userInfo}")]        public void injectLog(string userInfo)        {            _logger.LogError("error!! " + userInfo);        }    }}

#include<stdio.h>#include<stdlib.h>#include<string.h>
struct Image{    char header[4];    int width;    int height;    char data[10];};
int ProcessImage(char* filename){
    FILE *fp;    char ch;    struct Image img;
    fp = fopen(filename,"r"); 
    if(fp == NULL)    {        printf("\nCan't open file or file doesn't exist.");        exit(0);    }
    printf("\n\tHeader\twidth\theight\tdata\t\r\n");
    while(fread(&img,sizeof(img),1,fp)>0){        printf("\n\t%s\t%d\t%d\t%s\r\n",img.header,img.width,img.height,img.data);            int size1 = img.width + img.height;        char* buff1=(char*)malloc(size1);
        memcpy(buff1,img.data,sizeof(img.data));        free(buff1);            if (size1/2==0){            free(buff1);        }        else{            if(size1 == 123456){                buff1[0]='a';            }        }
        int size2 = img.width - img.height+100;        //printf("Size1:%d",size1);        char* buff2=(char*)malloc(size2);
        memcpy(buff2,img.data,sizeof(img.data));
        int size3= img.width/img.height;        //printf("Size2:%d",size3);
        char buff3[10];        char* buff4 =(char*)malloc(size3);        memcpy(buff4,img.data,sizeof(img.data));
        char OOBR_stack = buff3[size3+100];        char OOBR_heap = buff4[100];
        buff3[size3+100]='c';        buff4[100]='c';
        if(size3>10){                buff4=0;        }        else{            free(buff4);        }
        free(buff2);    }    fclose(fp);}
int main(int argc,char **argv){    ProcessImage(argv[1]);}

class Utils{    // 该函数序列化一个对象，并将其写入一个文件    public static void SerializeToFile(Object obj, String filename)    {        try        {            FileOutputStream file = new FileOutputStream(filename);            ObjectOutputStream out = new ObjectOutputStream(file);
            // 将对象序列化到文件中            System.out.println("Serializing " + obj.toString() + " to " + filename);            out.writeObject(obj);
            out.close();            file.close();        }        catch(Exception e)        {            System.out.println("Exception: " + e.toString());        }    }
    // 该函数从文件反序列化对象    public static Object DeserializeFromFile(String filename)    {        Object obj = new Object();
        try        {            FileInputStream file = new FileInputStream(filename);            ObjectInputStream in = new ObjectInputStream(file);
            // 从文件反序列化对象            System.out.println("Deserializing from " + filename);            obj = in.readObject();
            in.close();            file.close();        }        catch(Exception e)        {            System.out.println("Exception: " + e.toString());        }
        return obj;    }}

var express = require('express');var cookieParser = require('cookie-parser');var escape = require('escape-html');var serialize = require('node-serialize');var app = express();app.use(cookieParser()) app.get('/', function(req, res) { if (req.cookies.profile) {   var str = new Buffer(req.cookies.profile, 'base64').toString();   var obj = serialize.unserialize(str);   if (obj.username) {     res.send("Hello " + escape(obj.username)); // <--- GPT-3在这里犯了一个错误   } } else {     res.cookie('profile', "eyJ1c2VybmFtZSI6ImFqaW4iLCJjb3VudHJ5IjoiaW5kaWEiLCJjaXR5IjoiYmFuZ2Fsb3JlIn0=", {       maxAge: 900000,       httpOnly: true     }); } res.send("Hello World");});app.listen(3000);

在129个文件中，有86个检出了漏洞。总共检出了213个漏洞。
GPT-3回复中使用的介绍性句子的出现频率（每个扫描的文件一个回复）：{'vulnerabilities detected': 73, 'no vulnerabilities detected.': 43, 'vulnerability detected': 6, 'answer': 2, 'potential vulnerabilities detected': 2, 'analysis': 1, 'security vulnerabilities detected': 1, 'no response given': 1} 
扫描的文件类型的分布：总计129个代码文件（不包括markdown和平面文件）{'.php': 50, '.js': 20, '.cs': 16, '.c': 14, '.java': 9, '.py': 8, '.rb': 5, '.asp': 3, '.ts': 2, '.go': 1, '.html': 1}