Seth Michael Larson: Are insec... Note

Seth Michael Larson: Are insecure code completions a vulnerability?

A PyCharm plugin called "Full Line Completion" uses a local deep learning model to suggest entire lines of code. The author tested this feature and found that it suggested insecure code snippets. Initially, the plugin suggested disabling warnings for insecure requests when using urllib3. Subsequently, it proposed disabling certificate verification, which would expose applications to man-in-the-middle attacks. The author reported this behavior to JetBrains, who deemed it not a "direct security vulnerability." However, JetBrains requested the author not publicize the report, citing their Coordinated Disclosure Policy. After a 90-day waiting period, the author found the behavior unchanged in a newer version of the plugin. The author believes this type of issue exists across various code generation models and is not inherently a CVE-worthy security vulnerability. Nevertheless, they argue that addressing these insecure suggestions at the source is crucial to prevent users from inadvertently accepting vulnerable code. The author seeks community thoughts on this class of issues with code generation models.