{"id":"https://openalex.org/W4386802779","doi":"https://doi.org/10.1145/3624738","title":"A Closer Look at the Security Risks in the Rust Ecosystem","display_name":"A Closer Look at the Security Risks in the Rust Ecosystem","publication_year":2023,"publication_date":"2023-09-16","ids":{"openalex":"https://openalex.org/W4386802779","doi":"https://doi.org/10.1145/3624738"},"language":"en","primary_location":{"id":"doi:10.1145/3624738","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3624738","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5103021804","display_name":"Xiaoye Zheng","orcid":"https://orcid.org/0009-0001-9048-1930"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoye Zheng","raw_affiliation_strings":["Zhejiang University, China"],"raw_orcid":"https://orcid.org/0009-0001-9048-1930","affiliations":[{"raw_affiliation_string":"Zhejiang University, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060428816","display_name":"Zhiyuan Wan","orcid":"https://orcid.org/0000-0001-7657-6653"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiyuan Wan","raw_affiliation_strings":["Zhejiang University, China"],"raw_orcid":"https://orcid.org/0000-0001-7657-6653","affiliations":[{"raw_affiliation_string":"Zhejiang University, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100356803","display_name":"Yun Zhang","orcid":"https://orcid.org/0000-0002-3394-285X"},"institutions":[{"id":"https://openalex.org/I4400573310","display_name":"Hangzhou City University","ror":"https://ror.org/01wck0s05","country_code":null,"type":"education","lineage":["https://openalex.org/I4400573310"]},{"id":"https://openalex.org/I6469544","display_name":"City University of Macau","ror":"https://ror.org/04gpd4q15","country_code":"MO","type":"education","lineage":["https://openalex.org/I6469544"]}],"countries":["MO"],"is_corresponding":false,"raw_author_name":"Yun Zhang","raw_affiliation_strings":["Hangzhou City University, China"],"raw_orcid":"https://orcid.org/0000-0002-3394-285X","affiliations":[{"raw_affiliation_string":"Hangzhou City University, China","institution_ids":["https://openalex.org/I4400573310","https://openalex.org/I6469544"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044721876","display_name":"Rui Chang","orcid":"https://orcid.org/0000-0002-0178-0171"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Chang","raw_affiliation_strings":["Zhejiang University, China"],"raw_orcid":"https://orcid.org/0000-0002-0178-0171","affiliations":[{"raw_affiliation_string":"Zhejiang University, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5081036622","display_name":"David Lo","orcid":"https://orcid.org/0000-0002-4367-7201"},"institutions":[{"id":"https://openalex.org/I79891267","display_name":"Singapore Management University","ror":"https://ror.org/050qmg959","country_code":"SG","type":"education","lineage":["https://openalex.org/I79891267"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"David Lo","raw_affiliation_strings":["Singapore Management University, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-4367-7201","affiliations":[{"raw_affiliation_string":"Singapore Management University, Singapore","institution_ids":["https://openalex.org/I79891267"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.6034,"has_fulltext":false,"cited_by_count":15,"citation_normalized_percentile":{"value":0.96664639,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"33","issue":"2","first_page":"1","last_page":"30"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7822116613388062},{"id":"https://openalex.org/keywords/rust","display_name":"Rust (programming language)","score":0.7449537515640259},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.4791778326034546},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.46550896763801575},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4524967074394226},{"id":"https://openalex.org/keywords/code-reuse","display_name":"Code reuse","score":0.44683554768562317},{"id":"https://openalex.org/keywords/compiler","display_name":"Compiler","score":0.4202408194541931},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.32444438338279724},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.16663473844528198},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.0933319628238678},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.07182815670967102}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7822116613388062},{"id":"https://openalex.org/C197781089","wikidata":"https://www.wikidata.org/wiki/Q575650","display_name":"Rust (programming language)","level":2,"score":0.7449537515640259},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.4791778326034546},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.46550896763801575},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4524967074394226},{"id":"https://openalex.org/C2778583558","wikidata":"https://www.wikidata.org/wiki/Q771245","display_name":"Code reuse","level":3,"score":0.44683554768562317},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.4202408194541931},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.32444438338279724},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.16663473844528198},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0933319628238678},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.07182815670967102}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3624738","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3624738","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Life in Land","score":0.5,"id":"https://metadata.un.org/sdg/15"}],"awards":[{"id":"https://openalex.org/G5604651464","display_name":null,"funder_award_id":"62102358","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6502472312","display_name":null,"funder_award_id":"LQ21F020008","funder_id":"https://openalex.org/F4320338464","funder_display_name":"Natural Science Foundation of Zhejiang Province"},{"id":"https://openalex.org/G8823761551","display_name":null,"funder_award_id":"2022C01126","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320338464","display_name":"Natural Science Foundation of Zhejiang Province","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":48,"referenced_works":["https://openalex.org/W121297392","https://openalex.org/W1989385531","https://openalex.org/W2003652587","https://openalex.org/W2047794235","https://openalex.org/W2117798902","https://openalex.org/W2154183829","https://openalex.org/W2157353183","https://openalex.org/W2239505015","https://openalex.org/W2404969801","https://openalex.org/W2515891506","https://openalex.org/W2565788456","https://openalex.org/W2603712331","https://openalex.org/W2733373979","https://openalex.org/W2766411424","https://openalex.org/W2767905745","https://openalex.org/W2779850521","https://openalex.org/W2888328667","https://openalex.org/W2893945704","https://openalex.org/W2899036005","https://openalex.org/W2899407111","https://openalex.org/W2911270308","https://openalex.org/W2913530642","https://openalex.org/W2914982603","https://openalex.org/W2963748706","https://openalex.org/W2963934162","https://openalex.org/W2989443621","https://openalex.org/W2994905145","https://openalex.org/W3034030180","https://openalex.org/W3039784053","https://openalex.org/W3088691441","https://openalex.org/W3099830904","https://openalex.org/W3103647149","https://openalex.org/W3109383821","https://openalex.org/W3124116687","https://openalex.org/W3140595400","https://openalex.org/W3156480510","https://openalex.org/W3172189288","https://openalex.org/W3192457683","https://openalex.org/W3202751128","https://openalex.org/W3206881395","https://openalex.org/W3212191335","https://openalex.org/W4214512383","https://openalex.org/W4244051999","https://openalex.org/W4244536841","https://openalex.org/W4250967164","https://openalex.org/W4252684946","https://openalex.org/W4286331378","https://openalex.org/W4391558518"],"related_works":["https://openalex.org/W3096456556","https://openalex.org/W4240253816","https://openalex.org/W2169584677","https://openalex.org/W2979513934","https://openalex.org/W4232954277","https://openalex.org/W2020341030","https://openalex.org/W2749133591","https://openalex.org/W2367473450","https://openalex.org/W23346600","https://openalex.org/W2573230755"],"abstract_inverted_index":{"Rust":[0,18,29,35,46,58,78,103,128,145,194,227,263,286,343],"is":[1],"an":[2],"emerging":[3],"programming":[4,67],"language":[5,68],"designed":[6],"for":[7,86,277,293,387,445,451],"the":[8,15,28,42,45,74,95,102,108,116,123,127,139,144,150,153,157,160,166,173,193,201,205,212,218,225,239,245,282,285,294,303,324,334,341,345,353,366,369,380],"development":[9],"of":[10,17,27,33,39,44,89,110,122,152,159,180,211,224,247,252,281,302,314,368,402,404],"systems":[11],"software.":[12],"To":[13,171],"facilitate":[14,172],"reuse":[16],"code,":[19],"crates.io":[20,40],",":[21],"as":[22,105,107,229,231],"a":[23,60,119,135,178,319,330,399],"central":[24],"package":[25,325],"registry":[26],"ecosystem,":[30,104,146,195],"hosts":[31],"thousands":[32],"third-party":[34],"packages.":[36],"The":[37,390],"openness":[38],"enables":[41],"growth":[43],"ecosystem":[47],"but":[48,329],"comes":[49],"with":[50,265],"security":[51,55,124,140],"risks":[52,125,141],"by":[53,238,413,424,431],"severe":[54],"advisories.":[56],"Although":[57],"guarantees":[59],"software":[61,446],"program":[62],"to":[63,81,296,349,375,395,398,408,419],"be":[64,350,396],"safe":[65,411,415],"via":[66],"features":[69],"and":[70,98,163,187,209,221,234,250,256,273,300,356,363,427,448],"strict":[71],"compile-time":[72],"checking,":[73],"unsafe":[75,111,361,422,429,433],"keyword":[76],"in":[77,101,113,126,143,169,192,262,284],"allows":[79],"developers":[80],"bypass":[82],"compiler":[83],"safety":[84,97,272],"checks":[85],"certain":[87],"regions":[88,236],"code.":[90,370,405],"Prior":[91],"studies":[92],"empirically":[93],"investigate":[94],"memory":[96,271],"concurrency":[99,274],"bugs":[100],"well":[106,230],"usage":[109],"keywords":[112],"practice.":[114],"Nonetheless,":[115],"literature":[117],"lacks":[118],"systematic":[120],"investigation":[121,137],"ecosystem.":[129,287],"In":[130,312,340],"this":[131],"article,":[132],"we":[133,175,203,243,317,440],"perform":[134],"comprehensive":[136],"into":[138],"present":[142],"asking":[147],"\u201cwhat":[148],"are":[149,156,165],"characteristics":[151,158],"vulnerabilities,":[154,182,378],"what":[155],"vulnerable":[161,184,226,342,346,410,421,428],"packages,":[162,228,344],"how":[164,258],"vulnerabilities":[167,261,283,295,304,386],"fixed":[168],"practice?\u201d.":[170],"study,":[174],"first":[176],"compile":[177],"dataset":[179],"433":[181],"300":[183],"code":[185,235,254,335,347],"repositories,":[186],"218":[188],"vulnerability":[189,222,248,315,391],"fix":[190,260,392],"commits":[191,393],"spanning":[196],"over":[197,290,327],"7":[198],"years.":[199],"With":[200],"dataset,":[202],"characterize":[204,217,244],"types,":[206],"life":[207],"spans,":[208],"evolution":[210],"disclosed":[213,240],"vulnerabilities.":[214,241],"We":[215,268],"then":[216],"popularity,":[219],"categorization,":[220],"density":[223],"their":[232,310],"versions":[233],"affected":[237],"Finally,":[242],"complexity":[246],"fixes":[249,307],"localities":[251],"corresponding":[253],"changes,":[255],"inspect":[257],"practitioners":[259],"packages":[264,373,383],"various":[266],"localities.":[267],"find":[269],"that":[270],"issues":[275],"account":[276],"nearly":[278],"two":[279],"thirds":[280],"It":[288],"takes":[289],"2":[291],"years":[292],"become":[297],"publicly":[298],"disclosed,":[299],"one-third":[301],"have":[305,376],"no":[306],"committed":[308],"before":[309],"disclosure.":[311],"terms":[313],"density,":[316],"observe":[318],"continuous":[320],"upward":[321],"trend":[322,332],"at":[323,333,352],"level":[326,336],"time,":[328],"decreasing":[331],"since":[337],"August":[338],"2020.":[339],"tends":[348],"localized":[351,397],"file":[354],"level,":[355],"contains":[357],"statistically":[358],"significantly":[359],"more":[360,377,388],"functions":[362,412,416,430],"blocks":[364,423],"than":[365],"rest":[367],"More":[371],"popular":[372,382],"tend":[374,394,407],"while":[379],"less":[381],"suffer":[384],"from":[385],"versions.":[389],"limited":[400],"number":[401],"lines":[403,418],"Developers":[406],"address":[409],"adding":[414],"or":[417],"them,":[420,426],"removing":[425],"modifying":[432],"trait":[434],"implementations.":[435],"Based":[436],"on":[437],"our":[438],"findings,":[439],"discuss":[441],"implications,":[442],"provide":[443],"recommendations":[444],"practitioners,":[447],"outline":[449],"directions":[450],"future":[452],"research.":[453]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":3}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}