Search

Rust is an emerging programming language designed for the development of systems software. To facilitate the reuse of Rust code, crates.io, as a central package registry of the Rust ecosystem, hosts thousands of third-party Rust packages. The openness of crates.io enables the growth of the Rust ecosystem but comes with security risks by severe security advisories. Although Rust guarantees a software program to be safe via programming language features and strict compile-time checking, the unsafe keyword in Rust allows developers to bypass compiler safety checks for certain regions of code. Prior studies empirically investigate the memory safety and concurrency bugs in the Rust ecosystem, as well as the usage of unsafe keywords in practice. Nonetheless, the literature lacks a systematic investigation of the security risks in the Rust ecosystem. In this article, we perform a comprehensive investigation into the security risks present in the Rust ecosystem, asking "what are the characteristics of the vulnerabilities, what are the characteristics of the vulnerable packages, and how are the vulnerabilities fixed in practice?". To facilitate the study, we first compile a dataset of 433 vulnerabilities, 300 vulnerable code repositories, and 218 vulnerability fix commits in the Rust ecosystem, spanning over 7 years. With the dataset, we characterize the types, life spans, and evolution of the disclosed vulnerabilities. We then characterize the popularity, categorization, and vulnerability density of the vulnerable Rust packages, as well as their versions and code regions affected by the disclosed vulnerabilities. Finally, we characterize the complexity of vulnerability fixes and localities of corresponding code changes, and inspect how practitioners fix vulnerabilities in Rust packages with various localities. We find that memory safety and concurrency issues account for nearly two thirds of the vulnerabilities in the Rust ecosystem. It takes over 2 years for the vulnerabilities to become publicly disclosed, and one-third of the vulnerabilities have no fixes committed before their disclosure. In terms of vulnerability density, we observe a continuous upward trend at the package level over time, but a decreasing trend at the code level since August 2020. In the vulnerable Rust packages, the vulnerable code tends to be localized at the file level, and contains statistically significantly more unsafe functions and blocks than the rest of the code. More popular packages tend to have more vulnerabilities, while the less popular packages suffer from vulnerabilities for more versions. The vulnerability fix commits tend to be localized to a limited number of lines of code. Developers tend to address vulnerable safe functions by adding safe functions or lines to them, vulnerable unsafe blocks by removing them, and vulnerable unsafe functions by modifying unsafe trait implementations. Based on our findings, we discuss implications, provide recommendations for software practitioners, and outline directions for future research. [ABSTRACT FROM AUTHOR]

In this paper, a novel adsorbent which used polyvinyl alcohol, alginate and biochar was successfully made and been used to remove lead from aqueous solutions. Batch experiments were carried out to evaluate the adsorption capacities of Pb (II) on this bead. Experimental data were analysed by the model equations like Langmuir and Freundlich and adsorption kinetic constants were determined using pseudo-first-order (PFO) and pseudo-second-order (PSO). In this study, the adsorption characteristics of Pb (II) were well fitted by the Langmuir isotherm model and pseudo-second-order (PSO) kinetic model. The adsorption of Pb (II) onto PVA-biochar beads are spontaneous and exothermic at 303–333 K by the evidence of the changes in standard Gibbs free energy, standard enthalpy and standard entropy. The maximum adsorption capacity for Pb (II) was estimated to be 176.40 mg/g, which is comparable with other adsorbents. While the maximum adsorption increased varying the pH of initial solution from 2 to 6, the effect on the adsorption amount by the sodium ion concentration is not very large. The results of EDS spectra indicated that the existence of lead in polyvinyl alcohol (PVA)-biochar bead after adsorption, which proving the adsorption of lead. In XPS spectrum, the observed Pb elements also demonstrated that the lead was adsorbed by PVA-biochar bead. [ABSTRACT FROM AUTHOR]

Highlights In the present study, a discrete layer model was established to explore the vibration performance of Functionally Graded Carbon Nanotube‐Reinforced Composite (FG‐CNTRC) open cylindrical shells with damping film embedded based on the first‐order shell theory. There are four configurations of stacking arrangements considered for FG‐CNTRC open cylindrical shells with damping film embedded. The equivalent structural parameters of the top and bottom FG‐CNTRC panels are generated by implementing the extended mixing rule. Governing equations are derived based on the Hamilton principle and solved with the Naiver solution. Subsequently, after verifying the validity of this paper's solution by comparing it with the published literature, a parametric elaborated investigation discloses the variation patterns of vibration performance of four FG‐CNTRC open cylindrical shells with damping film embedded. The conclusions of the study can be used as a useful guide about open cylindrical composite shell structures with the design of high strength and damping. Discrete layer vibration model was bulit based on first‐order shell theory. Vbration performance of FG‐CNTRC open sandwich shells was studied. Variation patterns of frequency and loss factor was disclosed. [ABSTRACT FROM AUTHOR]

In this paper, a novel adsorbent which used polyvinyl alcohol, alginate and biochar was successfully made and been used to remove lead from aqueous solutions. Batch experiments were carried out to evaluate the adsorption capacities of Pb (II) on this bead. Experimental data were analysed by the model equations like Langmuir and Freundlich and adsorption kinetic constants were determined using pseudo-first-order (PFO) and pseudo-second-order (PSO). In this study, the adsorption characteristics of Pb (II) were well fitted by the Langmuir isotherm model and pseudo-second-order (PSO) kinetic model. The adsorption of Pb (II) onto PVA-biochar beads are spontaneous and exothermic at 303-333 K by the evidence of the changes in standard Gibbs free energy, standard enthalpy and standard entropy. The maximum adsorption capacity for Pb (II) was estimated to be 176.40 mg/g, which is comparable with other adsorbents. While the maximum adsorption increased varying the pH of initial solution from 2 to 6, the effect on the adsorption amount by the sodium ion concentration is not very large. The results of EDS spectra indicated that the existence of lead in polyvinyl alcohol (PVA)-biochar bead after adsorption, which proving the adsorption of lead. In XPS spectrum, the observed Pb elements also demonstrated that the lead was adsorbed by PVA-biochar bead.