https://arxiv.org/abs/2107.12699

close this message

Donate to arXiv

Please join the Simons Foundation and our generous member
organizations in supporting arXiv during our giving campaign
September 23-27. 100% of your contribution will fund improvements and
new initiatives to benefit arXiv's global scientific community.

DONATE

[secure site, no need to create account]

Skip to main content
Cornell University
We gratefully acknowledge support from
the Simons Foundation and member institutions.
 
arXiv.org > cs > arXiv:2107.12699
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Software Engineering

arXiv:2107.12699 (cs)
[Submitted on 27 Jul 2021]

Title:A Large-Scale Security-Oriented Static Analysis of Python
Packages in PyPI

Authors:Jukka Ruohonen, Kalle Hjerppe, Kalle Rindell
Download PDF

    Abstract: Different security issues are a common problem for open
    source packages archived to and delivered through software
    ecosystems. These often manifest themselves as software
    weaknesses that may lead to concrete software vulnerabilities.
    This paper examines various security issues in Python packages
    with static analysis. The dataset is based on a snapshot of all
    packages stored to the Python Package Index (PyPI). In total,
    over 197 thousand packages and over 749 thousand security issues
    are covered. Even under the constraints imposed by static
    analysis, (a) the results indicate prevalence of security issues;
    at least one issue is present for about 46% of the Python
    packages. In terms of the issue types, (b) exception handling and
    different code injections have been the most common issues. The
    subprocess module stands out in this regard. Reflecting the
    generally small size of the packages, (c) software size metrics
    do not predict well the amount of issues revealed through static
    analysis. With these results and the accompanying discussion, the
    paper contributes to the field of large-scale empirical studies
    for better understanding security problems in software
    ecosystems.

Comments: Submitted
Subjects: Software Engineering (cs.SE); Cryptography and Security
          (cs.CR)
Cite as:  arXiv:2107.12699 [cs.SE]
          (or arXiv:2107.12699v1 [cs.SE] for this version)

Submission history

From: Jukka Ruohonen [view email]
[v1] Tue, 27 Jul 2021 09:57:25 UTC (588 KB)
Full-text links:

Download:

  * PDF
  * Other formats

(license)
Current browse context:
cs.SE
< prev   |   next >
new | recent | 2107
Change to browse by:
cs
cs.CR

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

a export bibtex citation Loading...

Bibtex formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Mendeley logo Reddit logo ScienceWISE logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
( ) Code & Data

Code and Data Associated with this Article

[ ] arXiv Links to Code Toggle
arXiv Links to Code & Data (What is Links to Code & Data?)
( ) Related Papers

Recommenders and Search Tools

[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)
( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs and how to get involved.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack