Security Vulnerabilities of Eclipse Application Programming Interfaces: An Empirical Analysis
Year: 2026
Type: article
Abstract: The Eclipse framework distinguishes between stable public APIs and less stable internal APIs; however, there is no formal assurance that these interfaces have been comprehensively evaluated for security vulnerabilities. Furthermore, previous studies revealed that many developers are unaware of most vulnerabilities. Applications that use security vulnerable APIs risk failing and are prone to malicious attacks if vulnerabilities are not fixed. Security vulnerability discovery is a difficult process and takes at least 3 years to discover and fix them. As a result, developers who depend on affected APIs are frequently compelled either to address these vulnerabilities independently or to discontinue their use. This study aims to identify interfaces within the Eclipse framework that are free from known security vulnerabilities and to recommend them for safer adoption by application developers. To achieve this objective, an empirical investigation was conducted using the SonarQube static analysis tool across 28 major Eclipse releases. The analysis focused on determining the presence and distribution of vulnerability-free interfaces. The study resulted in a dataset comprising approximately 222K public APIs and 292K internal APIs that were found to be free of detected security issues. The findings reveal that, on average, about 91.4% of public APIs and 85.3% of internal APIs across the analyzed releases do not exhibit security vulnerabilities. Furthermore, the average time required to remediate identified vulnerabilities was estimated at 1,425 days. These results offer valuable guidance for both API providers and users by identifying more reliable interfaces and providing an indication of the effort required to resolve security issues. Additionally, the dataset of vulnerability-free interfaces has been made publicly accessible via GitHub to support the development of more secure software systems.
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7204702972