A code vulnerability processing method and device

Abstract

The invention discloses a code loophole processing method and device, comprising: using code security scanning rules to analyze the code, inserting a hint code for expressing loophole information into the loophole position determined by the rule in the code, and scanning the code inserted into the hint code to generate an intermediate file; publish the intermediate file in the container, perform business tests on the vulnerabilities in the intermediate file according to the information provided by the prompt code to obtain corresponding business processing opinions, and write back the business processing opinions to the vulnerability positions of the intermediate files; analyze For the intermediate file that has been written back, the business relationship of the vulnerability is determined according to the prompt code and the corresponding business processing opinion, and the processing priority of the vulnerability is determined according to the business relationship. The invention can clarify the relationship between code loopholes and actual business, and improve loophole processing efficiency.

Description

technical field [0001] The present invention relates to the field of code security, and more particularly, to a code vulnerability processing method and device. Background technique [0002] Code security scanning refers to a method of checking code for security vulnerabilities through specific rules. Through this method, security vulnerabilities existing in the code can be found and modification suggestions can be provided. Security vulnerabilities can be found and carried out during the development process. Revise. At present, the main method of dealing with code security vulnerabilities is to manually analyze the scan results and analyze the corresponding code of the scanned vulnerabilities to determine whether there is a vulnerability. Although it can be directly repaired or judged as a false positive, in the code When there are many security vulnerabilities, it is impossible to determine the priority of the vulnerabilities, and can only be modified according to the vul...

AI Technical Summary

Problems solved by technology

At present, the processing method for code security vulnerabilities is mainly to manually analyze the scanning results and analyze the code corresponding to the scanned vulnerabilities to determine whether there is a vulnerability. Although it can be directly repaired or judged as a false positive, but in the code In the case of many security vulnerabilities, it is impossible to judge the priority of the vulnerabilities, and can only be modified according to the vulnerability level provided by the tool. Moreover, when the amount of code is large, a single developer cannot solve the specific business corresponding to the code with vulnerabilities. What is it? It is impossible to know what the impact on the business will be after the modification. The modification is relatively blind. If it is confirmed one by one, it will take a lot of time and the efficiency is very low.

[0003] There is currently no effective solution to the problems of chaotic business relationships, long time-consuming and low efficiency in code security scanning in the prior art

Images