Static Analysis of the Source Code of Python Applications

Abstract

One of the popular methods of software code analysis is the static analysis method. This method allows not only to check the code for compliance with the language specification, but also to find potential vulnerabilities. The work performs a static analysis of a corpus of open source Python application. Using the Bandit library, statistical indicators of various categories of potential vulnerabilities are found, a rating table of vulnerabilities found in the studied data set is built. A qualitative analysis of threats is carried out according to their danger based on the CWE catalog data. The purpose of this work is to analyze a corpus of open source Python listings for potential vulnerabilities using a static analyzer and rank threats based on the potential vulnerabilities found. Thus, the study should answer the following questions: Q1. What categories of potential vulnerabilities in the CWE catalog are most common in Python open source projects? Q2. What categories of tests (checks) of the Bandit library found the most vulnerabilities? Q3. Is there a correlation between the obtained statistical data and the OWASP rating data?