Python应用中本地代码漏洞的综合研究
A Comprehensive Study of Native Code Bugs in Python Applications
- Washington State University（华盛顿州立大学）
机构由 AI 辅助整理，请以论文原文为准。
AI总结：
本文对GitHub真实Python项目的216个本地代码漏洞开展首次深入研究，剖析其多方面特征，获取了此类漏洞发生机制与修复策略的新见解。
AI中文摘要：
Python应用在机器学习框架、科学计算平台等关键软件领域广泛应用，其影响力已得到证实。这些应用常集成用C等低级编程语言编写的本地代码组件，这种多语言架构带来了性能提升、与各类运行时环境互操作更便捷等诸多优势。然而，本地代码（即本地代码漏洞）中的漏洞通常具有隐蔽性，也成为影响Python应用整体质量的重大额外挑战。尽管已有相关研究，但目前仍缺乏对Python应用中本地代码漏洞的全面理解。本文旨在开展此类漏洞的首次深入研究，以缩小这一认知差距，剖析其常见症状、引入位置、表现特征、根本原因及修复方案。基于对GitHub上真实Python项目中216个本地代码漏洞的广泛自动化与人工分析，我们获得了关于此类漏洞发生机制与修复策略的新发现和新见解。
英文摘要：
The impact of Python applications has been evidenced by their widespread presence in some of the most impactful software domains, such as machine learning frameworks and scientific computing platforms. These applications often integrate native code components written in a lower-level programming language like C. This multilingual construction brings various benefits such as greater performance efficiency and easier interoperability with diverse runtime environments. However, bugs in the native code (i.e., native code bugs), which are usually stealthy, also constitute a major additional challenge to the quality of the Python applications as a whole. Yet despite existing relevant studies, there remains a lack of comprehensive understanding of native code bugs in Python applications. In this paper, we aim to mitigate this knowledge gap through the first in-depth study of such bugs, dissecting their common symptoms, introducing locations, manifestation characteristics, root causes, and fixes. Based on our extensive automated and manual analyses of 216 native code bugs in real-world Python projects on GitHub, we obtained novel findings about and new insights into the occurrence mechanisms and resolution strategies of those bugs.
