  In the open source software (OSS) ecosystem, there exists a complex software
supply chain, where developers upstream and downstream widely borrow and reuse
code. This results in the widespread occurrence of recurring defects, missing
fixes, and propagation issues. These are collectively referred to as cognate
defects, and their scale and threats have not received extensive attention and
systematic research. Software composition analysis and code clone detection
methods are unable to cover the various variant issues in the supply chain
scenario, while code static analysis, or static application security testing
(SAST) techniques struggle to target specific defects. In this paper, we
propose a novel technique for detecting cognate defects in OSS through the
automatic generation of SAST rules. Specifically, it extracts key syntax and
semantic information from pre- and post-patch versions of code through
structural comparison and control flow to data flow analysis, and generates
rules that matches these key elements. We have implemented a prototype tool
called Patch2QL and applied it to fundamental OSS in C/C++. In experiments, we
discovered 7 new vulnerabilities with medium to critical severity in the most
popular upstream software, as well as numerous potential security issues. When
analyzing downstream projects in the supply chain, we found a significant
number of representative cognate defects, clarifying the threat posed by this
issue. Additionally, compared to general-purpose SAST and signature-based
mechanisms, the generated rules perform better at discover all variants of
cognate defects.
