{"id":"https://openalex.org/W3123074563","doi":"https://doi.org/10.1145/3408897","title":"Security Smells in Ansible and Chef Scripts","display_name":"Security Smells in Ansible and Chef Scripts","publication_year":2021,"publication_date":"2021-01-20","ids":{"openalex":"https://openalex.org/W3123074563","doi":"https://doi.org/10.1145/3408897","mag":"3123074563"},"language":"en","primary_location":{"id":"doi:10.1145/3408897","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3408897","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5069063267","display_name":"Akond Rahman","orcid":"https://orcid.org/0000-0002-5056-757X"},"institutions":[{"id":"https://openalex.org/I63920570","display_name":"Tennessee Technological University","ror":"https://ror.org/05drmrq39","country_code":"US","type":"education","lineage":["https://openalex.org/I63920570"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Akond Rahman","raw_affiliation_strings":["Tennessee Technological University, Cookeville, TN, USA"],"raw_orcid":"https://orcid.org/0000-0002-5056-757X","affiliations":[{"raw_affiliation_string":"Tennessee Technological University, Cookeville, TN, USA","institution_ids":["https://openalex.org/I63920570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101684353","display_name":"Md Rayhanur Rahman","orcid":"https://orcid.org/0000-0003-4980-7350"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]},{"id":"https://openalex.org/I2801313472","display_name":"North Central State College","ror":"https://ror.org/04b6b6f76","country_code":"US","type":"education","lineage":["https://openalex.org/I2801313472"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Md Rayhanur Rahman","raw_affiliation_strings":["NC State University, Raleigh, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NC State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535","https://openalex.org/I2801313472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5024034818","display_name":"Chris Parnin","orcid":"https://orcid.org/0000-0001-6182-815X"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]},{"id":"https://openalex.org/I2801313472","display_name":"North Central State College","ror":"https://ror.org/04b6b6f76","country_code":"US","type":"education","lineage":["https://openalex.org/I2801313472"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chris Parnin","raw_affiliation_strings":["NC State University, Raleigh, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NC State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535","https://openalex.org/I2801313472"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028171895","display_name":"Laurie Williams","orcid":"https://orcid.org/0000-0003-3300-6540"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]},{"id":"https://openalex.org/I2801313472","display_name":"North Central State College","ror":"https://ror.org/04b6b6f76","country_code":"US","type":"education","lineage":["https://openalex.org/I2801313472"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Laurie Williams","raw_affiliation_strings":["NC State University, Raleigh, NC, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NC State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535","https://openalex.org/I2801313472"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.8463,"has_fulltext":false,"cited_by_count":69,"citation_normalized_percentile":{"value":0.97619305,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":"30","issue":"1","first_page":"1","last_page":"31"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.8335971236228943},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7691359519958496},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5502309799194336},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.489062637090683},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.43792468309402466},{"id":"https://openalex.org/keywords/provisioning","display_name":"Provisioning","score":0.4309060871601105},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.3973456621170044},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.3019794225692749},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.1627139449119568},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.12443622946739197},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.08360496163368225}],"concepts":[{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.8335971236228943},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7691359519958496},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5502309799194336},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.489062637090683},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.43792468309402466},{"id":"https://openalex.org/C172191483","wikidata":"https://www.wikidata.org/wiki/Q1071806","display_name":"Provisioning","level":2,"score":0.4309060871601105},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.3973456621170044},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.3019794225692749},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.1627139449119568},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.12443622946739197},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.08360496163368225}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3408897","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3408897","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.6200000047683716,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":49,"referenced_works":["https://openalex.org/W42836620","https://openalex.org/W1500946169","https://openalex.org/W1656502710","https://openalex.org/W1986222079","https://openalex.org/W1990393403","https://openalex.org/W2014843353","https://openalex.org/W2021458971","https://openalex.org/W2053154970","https://openalex.org/W2065076704","https://openalex.org/W2095881341","https://openalex.org/W2103239853","https://openalex.org/W2152874840","https://openalex.org/W2153575752","https://openalex.org/W2153887189","https://openalex.org/W2164777277","https://openalex.org/W2172433705","https://openalex.org/W2263636531","https://openalex.org/W2267596186","https://openalex.org/W2278224729","https://openalex.org/W2295782180","https://openalex.org/W2402800985","https://openalex.org/W2559885217","https://openalex.org/W2618689158","https://openalex.org/W2619205510","https://openalex.org/W2698406033","https://openalex.org/W2729314777","https://openalex.org/W2796047065","https://openalex.org/W2807298173","https://openalex.org/W2883411629","https://openalex.org/W2889545716","https://openalex.org/W2890052409","https://openalex.org/W2947593054","https://openalex.org/W2955656327","https://openalex.org/W2963995913","https://openalex.org/W3008316250","https://openalex.org/W3030599819","https://openalex.org/W3036348283","https://openalex.org/W3090625769","https://openalex.org/W3103898014","https://openalex.org/W3106158252","https://openalex.org/W3123074563","https://openalex.org/W4206109607","https://openalex.org/W4210726200","https://openalex.org/W4213190682","https://openalex.org/W4235354960","https://openalex.org/W4238083912","https://openalex.org/W4281564584","https://openalex.org/W4300678113","https://openalex.org/W4394377240"],"related_works":["https://openalex.org/W2141388993","https://openalex.org/W1978034799","https://openalex.org/W2999607548","https://openalex.org/W2956597637","https://openalex.org/W2293245356","https://openalex.org/W4225160120","https://openalex.org/W23486959","https://openalex.org/W2155353733","https://openalex.org/W1588942021","https://openalex.org/W4384518368"],"abstract_inverted_index":{"Context:":[0],"Security":[1,126],"smells":[2,40,84,108,138,165,189,212,224,252],"are":[3,8,29],"recurring":[4],"coding":[5,70],"patterns":[6],"that":[7,190,235],"indicative":[9],"of":[10,61,82,187,200,210,236,248],"security":[11,39,83,107,137,164,188,211,223,251],"weakness":[12],"and":[13,26,35,87,117,130,176,215,230,255,262],"require":[14],"further":[15],"inspection.":[16],"As":[17],"infrastructure":[18,74],"as":[19,24,75],"code":[20,76,260],"(IaC)":[21],"scripts,":[22,28,232],"such":[23],"Ansible":[25,86,116,129,214,229,254],"Chef":[27,88,131,216,231,256],"used":[30,46],"to":[31,47,51,65,105,134,225,234,243],"provision":[32],"cloud-based":[33],"servers":[34],"systems":[36],"at":[37],"scale,":[38],"in":[41,54,85,113,139,168,173,228,253],"IaC":[42,103,110],"scripts":[43,77,104,111,132,141,217,257],"could":[44],"be":[45,226],"enable":[48],"malicious":[49],"users":[50],"exploit":[52],"vulnerabilities":[53],"the":[55,201,208,237,246,249],"provisioned":[56],"systems.":[57],"Goal:":[58],"The":[59],"goal":[60],"this":[62],"article":[63],"is":[64],"help":[66],"practitioners":[67,242],"avoid":[68],"insecure":[69],"practices":[71],"while":[72],"developing":[73],"through":[78],"an":[79],"empirical":[80],"study":[81,95],"scripts.":[89,239],"Methodology:":[90],"We":[91,119,149,161,195,221,240],"conduct":[92],"a":[93,121],"replication":[94],"where":[96],"we":[97,183],"apply":[98],"qualitative":[99],"analysis":[100,123,265],"with":[101],"1,956":[102],"identify":[106,136,162,184],"for":[109,128,154,198,213],"written":[112],"two":[114,163],"languages:":[115],"Chef.":[118],"construct":[120],"static":[122,264],"tool":[124],"called":[125],"Linter":[127],"(SLAC)":[133],"automatically":[135],"50,323":[140],"collected":[142],"from":[143],"813":[144],"open":[145],"source":[146],"software":[147],"repositories.":[148],"also":[150],"submit":[151],"bug":[152,204],"reports":[153],"1,000":[155],"randomly":[156],"selected":[157],"smell":[158],"occurrences.":[159],"Results:":[160],"not":[166],"reported":[167],"prior":[169],"work:":[170],"missing":[171],"default":[172],"case":[174],"statement":[175],"no":[177],"integrity":[178],"check.":[179],"By":[180],"applying":[181],"SLAC":[182],"46,600":[185],"occurrences":[186],"include":[191],"7,849":[192],"hard-coded":[193],"passwords.":[194],"observe":[196,222],"agreement":[197],"65":[199],"responded":[202],"94":[203],"reports,":[205],"which":[206],"suggests":[207],"relevance":[209],"amongst":[218],"practitioners.":[219],"Conclusion:":[220],"prevalent":[227],"similarly":[233],"Puppet":[238],"recommend":[241],"rigorously":[244],"inspect":[245],"presence":[247],"identified":[250],"using":[258],"(i)":[259],"review,":[261],"(ii)":[263],"tools.":[266]},"counts_by_year":[{"year":2026,"cited_by_count":6},{"year":2025,"cited_by_count":12},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":17},{"year":2022,"cited_by_count":12},{"year":2021,"cited_by_count":10},{"year":2020,"cited_by_count":2}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}