PyFlow: An Inter-procedural Static Analysis Framework for Python

2026-08-07

AI Summary

This work addresses the challenges of high-precision interprocedural static analysis in Python, which arise from its dynamic typing, dynamic dispatch, metaprogramming capabilities, and complex object model. To tackle these issues, we present PyFlow—the first general-purpose static analysis framework for Python based on the Interprocedural Finite Distributive Subset (IFDS) formulation. PyFlow leverages a multi-stage intermediate representation and parameterized abstract domains, enabling developers to specify only the data-flow semantics while automatically handling interprocedural hypergraph construction, fixed-point computation, and summary caching. Experimental evaluation demonstrates that PyFlow achieves the highest recall and F1 scores among nine state-of-the-art tools on both synthetic and real-world benchmarks, while maintaining precision comparable to advanced taint analysis engines—marking the first efficient and highly accurate application of IFDS to Python.

Abstract

Static program analysis infers program properties automatically. Yet precise interprocedural analysis remains challenging, and dynamically typed languages amplify the difficulty. Python is particularly problematic: dynamic dispatch, first-class functions, metaprogramming, pervasive exceptions, and an object model based on descriptors and attribute-driven lookup collectively impede precise reasoning. We present PyFlow, a generic IFDS-based static-analysis framework for Python. PyFlow provides a multi-stage intermediate-representation pipeline and a generic IFDS solver parameterized by abstract domains. Analysis developers implement only the dataflow semantics; the framework constructs the supergraph, performs fixed-point iteration, and caches summaries. We implement a taint analysis in \pyflow and evaluate it against eight Python SAST tools (DevSkim, Dlint, Bandit, Bearer, CodeQL, Pysa, Semgrep, and Snyk) on the synthetic and real-world benchmarks from a recent ICSE~'26 study. On the synthetic benchmark, PyFlow achieves the best aggregate recall and F1 score among all nine tools. On the real-world benchmark, it attains the highest recall and F1 score while maintaining precision competitive with taint-based engines. We conclude with lessons learned from building IFDS analyses for Python.

Problem

• interprocedural analysis
• static analysis
• Python
• dynamic typing
• program analysis

Innovation

• IFDS
• static analysis
• Python
• inter-procedural analysis
• taint analysis