一句话：大规模实证揭示主流 SAST 工具对 C/C++、Java、Python 语言特定 Top CWE 的覆盖缺口与工具差异。
论文关注 SAST 工具虽宣称检测广泛 CWE，但受语言特性影响，其是否真正覆盖特定语言最重要的 CWE 并不清楚，导致工具能力与开发者安全需求之间存在缺口。作者对过去十年 197,016 条 CVE 采用启发式标注，为 C/C++、Java、Python 构建语言特定的 TopLan CWE 列表，并基于该数据集评估九款流行 SAST 工具。研究识别出工具覆盖缺口及工具特定性能特征，为理解 SAST 工具在语言相关安全需求上的实际能力提供实证依据。
Static Application Security Testing (SAST) tools play a key role in identifying vulnerabilities early in the development cycle. While these tools claim to detect a wide range of CWEs, their actual coverage is often unclear. In particular, due to language-specific characteristics, it is unclear to what extent SAST tools cover the CWEs most relevant to a given programming language, creating a gap between tool capabilities and developers’ security needs. To address these questions, this experience paper presents a large-scale empirical investigation into the gap between SAST Tools and Language-Specific Top CWEs. Using a heuristic labeling approach on 197,016 CVEs reported over the past decade, we construct the TopLan CWE Lists for three widely used programming languages: C/C++, Java, and Python. Based on these datasets, we evaluate nine popular SAST tools to identify coverage gaps and tool-specific performance characteristics.
@inproceedings{paperbot12248,
title = {Mind the Gap: Do Widely-Used SAST Tools Really Cover the Language-Specific Top CWEs?},
author = {Zhilin Li and Yiran Nie and Xianglong Qi and Jiwei Yan and Jun Yan},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837435}
}