Control and Data Flow in Security Smell Detection for Infrastructure as Code: Is It Worth the Effort?

Research output: Chapter in Book/Report/Conference proceedingConference paper

202 Downloads (Pure)


Infrastructure as Code is the practice of developing and maintaining computing infrastructure through executable source code. Unfortunately, IaC has also brought about new cyber attack vectors. Prior work has therefore proposed static analyses that detect security smells in Infrastructure as Code files. However, they have so far remained at a shallow level, disregarding the control and data flow of the scripts under analysis, and may lack awareness of specific syntactic constructs. These limitations inhibit the quality of their results. To address these limitations, in this paper, we present GASEL, a novel security smell detector for the Ansible IaC language. It uses graph queries on program dependence graphs to detect 7 security smells. Our evaluation on an oracle of 243 real-world security smells and comparison against two state-of-the-art security smell detectors shows that awareness of syntax, control flow, and data flow enables our approach to substantially improve both precision and recall. We further question whether the additional effort required to develop and run such an approach is justified in practice. To this end, we investigate the prevalence of indirection through control and data flow in security smells across more than 15 000 Ansible scripts. We find that over 55% of security smells contain data-flow indirection, and over 32% require a whole-project analysis to detect. These findings motivate the need for deeper static analysis tools to detect security vulnerabilities in IaC.
Original languageEnglish
Title of host publicationProceedings of the 2023 IEEE/ACM 20th International Conference on Mining Software Repositories (MSR 2023)
Number of pages12
ISBN (Electronic)979-8-3503-1184-6
Publication statusPublished - 15 May 2023
Event20th International Conference on Mining Software Repositories - Melbourne Convention Exhibition Center, Melbourne, Australia
Duration: 15 May 202316 May 2023

Publication series

NameProceedings - 2023 IEEE/ACM 20th International Conference on Mining Software Repositories, MSR 2023


Conference20th International Conference on Mining Software Repositories
Abbreviated titleMSR 2023
Internet address

Bibliographical note

Funding Information:
This research was partially funded by the “Cybersecurity Initiative Flanders” project and the Research Foundation Flanders (FWO) under Grant No. 1SD4321N. We thank Arne Van Quickelberghe for his efforts to conduct an initial investigation that made this work possible.

Publisher Copyright:
© 2023 IEEE.

Copyright 2023 Elsevier B.V., All rights reserved.


  • Infrastructure as Code
  • Ansible
  • code smells
  • security
  • program dependence graph
  • empirical study


Dive into the research topics of 'Control and Data Flow in Security Smell Detection for Infrastructure as Code: Is It Worth the Effort?'. Together they form a unique fingerprint.

Cite this