Method and device for detecting defects of program source file

Abstract

The embodiment of the invention provides a method and a device for detecting defects of a program source file, and the method comprises the steps: analyzing a to-be-detected program source file, and obtaining a corresponding program language type; obtaining a corresponding front-end analysis program according to the program language type, wherein the front-end analysis program is a source code analysis program compiled by adopting the same language as the program language type; carrying out lexical, grammatical and semantic analysis on a to-be-tested program source file by adopting the front-end analysis program to obtain an intermediate representation file; obtaining a defect analysis program, performing source code simulation execution on the intermediate representation file by adoptingthe defect analysis program; control flow analysis and data flow analysis are completed in combination with a loading rule, defect points are determined, a source code analysis and defect detection separation technology is adopted, the defect coverage of source code detection is improved, and meanwhile the accuracy of source code defect detection is improved.

Description

technical field [0001] The invention relates to the technical field of file detection, in particular to a method and device for defect detection of program source files. Background technique [0002] Improper use of all programming languages ​​today presents some security risks and even vulnerabilities. Whether it is improper handling of polluted data due to program logic, or improper calls to APIs, it will bring risks to the entire system. [0003] The source code defect detection technology refers to analyzing and modeling the source code of the program, simulating the execution flow of the source code, checking the API calls in it, and finding out the problematic code. The usual practice is to use the source code to construct an abstract syntax tree, and simulate the association between the abstract syntax tree and its members. On this basis, the code is simulated and executed to find possible defects. [0004] For different languages, although their syntax varies grea...

AI Technical Summary

Problems solved by technology

From another point of view, this leads to the inconsistency between the language of the detection program and the language of the source code to be detected. Since the characteristics of different languages ​​usually have large differences, the following problems usually exist in cross-language statement translation and simulation execution These problems lead to inaccurate cross-language conversion, resulting in inaccurate defect detection:

[0005] 1) When performing lexical, grammatical and semantic analysis, the workload is heavy and error-prone, resulting in inconsistent analysis results with the original information

[0006] 2) When the version of the detected language is upgraded, the detection program also needs to be modified accordingly, and the modification cost is relatively high

[0007] 3) Due to the different language characteristics, some information will inevitably be lost when performing cross-language conversion, and this information is often useful, so that the information of the source code cannot be accurately described

Images