| 摘要: |
| 软件包库的安全性是软件供应链分析的重要一环, 但是现有研究和工具往往缺乏对软件包库中外部语言调用的有效分析. PyPI是Python语言的官方软件包库, 其中存储海量不同应用领域的Python软件包. 这些软件包除了包含Python语言编写的程序外, 还常包含通过Python的外部接口Python/C API调用的C/C++外部语言程序. 分析Python软件包库中外部语言调用的安全性对于保障软件供应链的安全可靠具有重要意义. 通过分析互操作官方文档以及互操作程序分析的相关方法和工具, 构建Python-C/C++互操作程序的漏洞基准套件, 其中包括9小类行为共计15种漏洞模式的基准测试程序, 覆盖内存、类型、异常、并发和数值这5大类语言特性以及安装量最大的16个包含C/C++外部调用的Python软件包中的互操作程序漏洞. 通过在漏洞基准套件上评估已有的先进Python-C/C++互操作漏洞检查工具, 对比分析现有研究和工具的可靠性、完备性和可扩展性, 分析总结Python-C/C++互操作安全分析的现状和不足. 通过分析超过700个漏洞警告, 确认在6个PyPI库中新发现3种共计21个实际漏洞. |
| 关键词: 软件供应链分析 跨语言互操作 漏洞检查 程序分析 漏洞基准库 |
| DOI：10.13328/j.cnki.jos.007584 |
| 分类号:TP311 |
| 基金项目:国家自然科学基金(62502226, 62202406); 计算机软件新技术全国重点实验室(南京大学)开放课题(KFKT2025B66); 江苏省高等学校基础科学(自然科学)研究项目(25KJB520029); 南京邮电大学引进人才科研启动基金(自然科学) (NY224026, NY224023, NY224001, NY223164); 南京邮电大学校级自然科学基金(NY224143) |
|
| Safety Analysis of C/C++ Foreign Language Calls in Python Software Package Repositories |
|
HU Ming-Zhe1, DING Qiu-Ran1, ZHANG Zi-Han1, XIE Jin-Yan1, YU Le1, HAN Li-Ping1,2
|
|
1.School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing 210023, China;2.State Key Laboratory for Novel Software Technology (Nanjing University), Nanjing 210093, China
|
| Abstract: |
| The safety of software package repositories is a critical aspect of software supply chain analysis, but existing research and tools often lack effective analysis of foreign language calls in the package repositories. As the official package repository for Python, PyPI stores a vast amount of Python software packages from various application domains. In addition to programs written in Python, these packages often include C/C++ foreign language programs that are called via Python’s foreign interface—the Python/C API. Analyzing the safety of foreign language calls in Python package repositories is crucial for ensuring the safety and reliability of software supply chains. By analyzing official documentation for interoperability and relevant methods and tools for interoperability program analysis, a bug benchmark suite for Python-C/C++ interoperability programs is established. This suite includes benchmark test programs for 15 bug patterns across nine categories, covering five language features of the memory, type, exception, concurrency, and numerical issues, as well as interoperability program bugs in the 16 most installed PyPI software packages that involve C/C++ foreign calls. By evaluating the existing state-of-the-art Python-C/C++ interoperability bug checkers on the bug benchmark suite, a comparative analysis of the reliability, completeness, and scalability of existing research and tools is conducted, with the current status and limitations of Python-C/C++ interoperability safety analysis analyzed and summarized. By analyzing more than 700 bug warnings, 21 new real-world bugs across three bug patterns are found in six PyPI repositories. |
| Key words: software supply chain analysis cross-language interoperability bug detection program analysis bug benchmark |
