An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications
This study addresses security risks for web developers using Python packages, but it is incremental as it applies existing methods to new data.
The paper analyzed vulnerabilities in Python packages for web applications using PyPI and Safety DB data, finding that most vulnerabilities are modestly severe with input validation and cross-site scripting being most common, and that recent release histories are sufficient for statistical predictions.
This paper examines software vulnerabilities in common Python packages used particularly for web development. The empirical dataset is based on the PyPI package repository and the so-called Safety DB used to track vulnerabilities in selected packages within the repository. The methodological approach builds on a release-based time series analysis of the conditional probabilities for the releases of the packages to be vulnerable. According to the results, many of the Python vulnerabilities observed seem to be only modestly severe; input validation and cross-site scripting have been the most typical vulnerabilities. In terms of the time series analysis based on the release histories, only the recent past is observed to be relevant for statistical predictions; the classical Markov property holds.