Towards Understanding the Security Issues of Python Programs.

Python programming language has witnessed a steady increase in popularity over the past few decades. Renowned for its conciseness and readability, as well as its ease of learning and use, Python is widespread adoption has inevitably exposed it to a higher likelihood of encountering issues. Given that numerous code modifications exhibit repetitive and analogous patterns, an extensive examination of Python code-fixing patterns becomes imperative. Among these patterns, security-related issues hold significant importance due to their heightened risks and potential for substantial impact. Consequently, conducting research on security-related matters assumes utmost significance. In this paper, we conduct a thorough investigation to gain insights into the security issues prevalent in Python programs. Our approach involves collecting 413 popular open-source Python projects from GitHub and identifying 9,782 bug reports related to security concerns and their corresponding bug fixes. We employ automated clustering and manual summarization techniques, ultimately classifying them into 12 distinct categories, with six categories being of notable prevalence. We analyze the bug reports and commits within each high-frequency category, examining aspects such as severity, root causes, and employed fixing patterns. Leveraging the empirical findings, we discuss the broader implications drawn from the study and offer guidance to software developers, facilitating proactive avoidance of such issues in their projects.