A method and system for static detection of stored procedures based on database dictionary

Abstract

The present invention discloses a database dictionary based storage process static detection method and system. The method comprises: step one, establishing a connection with a database dictionary server; step two, querying a database dictionary table, acquiring all storage process objects of a current database user, and constructing a to-be-detected object list; step three, determining whether an undetected object exists in the to-be-detected object list, and if exists, performing code parsing on a storage process of the undetected object to generate a syntax tree and an annotation list, and adding the undetected object to a global symbol tree; step four, according to the syntax tree and annotation list that are generated in step three and the global symbol tree, generating a local symbol stack in an abstract syntax tree traversing process and calling a static detection component, and performing static detection on the storage process of the undetected object, so as to obtain a static detection result; and step five, generating a static detection report according to the static detection result.

Description

technical field [0001] The invention relates to the field of static testing, and belongs to computer-aided static testing technology, in particular to a method and system for static testing of stored procedures based on database dictionaries. Background technique [0002] Static testing means that the program under test does not run on the machine, but uses manual detection and computer-aided static detection to detect documents or programs. With the continuous development of computer technology and the continuous expansion of software scale, computer-aided static testing has become the most important means of program static testing. Computer-aided static detection refers to scanning the program code through lexical analysis, syntax analysis and other technologies, and then detecting the syntax, structure, process, interface, etc. of the code to verify whether the code meets the normative, security, reliability, maintainability, etc. A code instrumentation technique for met...

AI Technical Summary

Problems solved by technology

The common feature of these tools and methods is that the code file is the scanning object. This method has many defects for the database storage process, which limits the static detection ability.

Taking the SonarCuber tool as an example, due to the lack of table structure information involved in the stored procedure, it is impossible to check the implicit conversion in the WHERE condition, and it is impossible to judge whether there is a risk of string length overflow in the SELECT INTO statement, and these check items are exactly database storage. Very important static detection content in the process

Images