AegisAsync traces Python async behavior to flag risks
In plain words
Python async programs can have risks that depend on what happens to the same task later, or how execution continues after an error or cancellation.
AegisAsync is a static checker that follows compiled program instructions, connects related async events, and checks selected execution paths for six kinds of risk.
On a constructed test collection, it found all 180 labeled risks and made no false-positive reports on safe controls across five tested Python versions. This result applies to those test cases.
The research
Can a checker recognize an async risk when it depends on what happens to the same task later, or on how a program continues after cancellation? Those clues can be spread across operations and execution paths, so identifying a risky API call alone may not establish that the risk occurs.
AegisAsync links bytecode instructions, async events and symbolic objects, then checks bounded execution paths for six kinds of Python async risk.
On AsyncBench, a constructed collection of labeled async risks and safe programs, AegisAsync detects all 180 labeled risks and reports none on 14 safe controls across five CPython versions. It also detects all 90 risks in the three families shared with flake8-async, which detects 40.
In a stratified sample of PyPI artifacts, reviewers confirm 457 of 910 AegisAsync candidate records as unique bugs. Executable reproductions connect source-confirmed findings to runtime behavior across all six risk families.
The test results cover constructed cases, while package findings come from a stratified sample and a particular review protocol. AegisAsync’s bounded paths and object analysis can miss behaviors or produce false reports.
Analysis
Deep
- Original paper authors
- Baihong Chen, Wen Li
- Submitted to arXiv
- License
- arXiv non-exclusive