Method and system for finding the optimal version of open source components in software projects

Abstract

The present invention discloses a method and system for solving the optimal version of open source components in a software project, which comprises: obtaining a dependency tree of the open source components of a target project; using a backtracking method, starting from each root node of the dependency tree, and traversing and processing each subtree of the dependency tree in turn; to obtain a sorting solution set of the subtree; by comprehensively analyzing the sorting solution sets of all subtrees, to obtain a comprehensive solution set corresponding to the target project; according to the comprehensive solution set, combined with the dependency tree corresponding to each sorting solution recorded above, to parse out the optimal solution set of the open source component push version corresponding to the target project; through the above method, starting from the perspective of the entire target project, on the basis of analyzing the risk of each open source component, all the open source components in the target project are comprehensively provided with an optimal version recommendation set, thereby avoiding invalid open source component version recommendations, making the recommendations more effective, so as to adapt to the current target project.

Description

Technical Field

[0001] The present invention relates to the technical field of open source component version sorting, and in particular to a method and system for solving the optimal version of an open source component in a software project. Background Art

[0002] In the field of software development, the third-party components (open source components) in the project are generally analyzed through the software composition analysis (SCA) tool, and the risk information such as vulnerabilities and licenses of these components is displayed. A replacement version is recommended for these problematic third-party components to solve the problem. Although the replacement version may fix the problem of the current component, due to the corresponding dependencies between the various open source components in the project, new problematic components may be introduced after the replacement version. Therefore, the problem of third-party components in the project cannot be fundamentally solved. Summary of the invention

[0003] The purpose of the present invention is to solve the deficiencies of the above technical problems and to provide a method and system for solving the optimal version of open source components in a software project, which can integrate all open source components in the project and give the optimal recommended version to avoid invalid replacement.

[0004] In order to achieve the above object, the present invention discloses a method for solving the optimal version of open source components in a software project, which comprises:

[0005] Analyze the dependencies of open source components in the target project to generate a dependency tree with a tree graph structure;

[0006] According to the depth-first strategy, a backtracking method is adopted to start from each root node of the dependency tree and traverse and process each subtree of the dependency tree in sequence;

[0007] The traversal processing method for any of the subtrees comprises the following steps:

[0008] a: Determine whether the risk level of the open source component at any node is greater than a preset value. If not, execute step b; if yes, execute step c;

[0009] b: define the open source component at the root node of the subtree as one of the selection solutions of the subtree, record the information of the current dependency tree, and proceed to step c;

[0010] c: Replace the version of the open source component at the root node of the subtree, and regenerate the dependency tree;

[0011] d: Execute steps a to c in this way repeatedly until all versions of the open source components at the root node of the subtree are replaced to obtain a set of sorting solutions for the subtree;

[0012] By comprehensively analyzing the selected solution sets of all subtrees, a comprehensive solution set corresponding to the target project is obtained;

[0013] According to the comprehensive solution set, combined with the dependency tree corresponding to each of the selected solutions recorded above, an optimal solution set of the push version of the open source component corresponding to the target project is parsed.

[0014] Preferably, the method further includes a preprocessing method for the target project: using an open source component analysis tool to process the target project to obtain the open source components in the target project, and at the same time obtaining the vulnerability exploitation difficulty of each open source component, and quantifying the vulnerability exploitation difficulty;

[0015] Analyzing and quantifying the accessibility of each open source component vulnerability according to the source code of the open source component and the dependency tree;

[0016] In the traversal method, the risk level is evaluated by the difficulty and accessibility of exploiting the vulnerabilities of the open source components.

[0017] Preferably, in the traversal processing method, in step a, when the judgment result is yes, the dependency information of the current subtree is recorded at the same time;

[0018] If a sorting solution does not exist for a certain subtree, the risk of the subtree is calculated for the dependency information of the open source component of the root node of the subtree in each version, and the open source component corresponding to the one with the lowest risk is taken as the sorting solution for the subtree.

[0019] The present invention also discloses a system for solving the optimal version of open source components in a software project, which includes a dependency tree generation module and a dependency tree processing module;

[0020] The dependency tree generation module is used to analyze the dependencies of the open source components in the target project to generate a dependency tree with a tree graph structure;

[0021] The relationship tree processing module is used to traverse and process each subtree of the dependency tree in sequence starting from each root node of the dependency tree by backtracking according to a depth-first strategy. The relationship tree processing module includes a sorting solution set generation module, a comprehensive solution generation module, and an optimal solution set generation module;

[0022] The sorting solution set generation module includes a traversal module, a collection module, a recording module, a replacement module, an update module, a first parsing module and a second parsing module;

[0023] The traversal module is used to traverse and detect the risk of the open source component at any node of any subtree;

[0024] The collection module is used to collect the open source components of the root nodes of the subtrees where the risk of any node is not greater than a preset value, and define the open source components as one of the selection solutions of the subtrees;

[0025] The recording module is used to record the dependency tree information currently corresponding to the subtree having a node with a risk degree greater than a preset value;

[0026] The replacement module is used to replace the open source component version at the root node in the subtree;

[0027] The update module is used to update the dependency tree of the target project after each replacement of the open source component;

[0028] The first parsing module is used to parse out a comprehensive solution set corresponding to the target project based on all the sorting solutions collected by the collecting module;

[0029] The second parsing module is used to parse out an optimal solution set of the push version of the open source component corresponding to the target project according to the content recorded by the recording module and the comprehensive solution set.

[0030] Preferably, it further comprises a first preprocessing module, a second preprocessing module and a risk assessment module;

[0031] The first preprocessing module is used to process the target project using an open source component analysis tool to obtain open source components in the target project, obtain the vulnerability exploitation difficulty of each open source component, and quantify the vulnerability exploitation difficulty;

[0032] The second preprocessing module is used to analyze and quantify the reachability of each open source component vulnerability according to the source code of the open source component and the dependency tree;

[0033] The risk assessment module is used to assess the risk by the difficulty of exploiting the vulnerability of the open source component and the accessibility.

[0034] The present invention also discloses a system for solving the optimal version of open source components in a software project, which comprises:

[0035] one or more processors;

[0036] Memory;

[0037] and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for executing the method for solving the optimal version of the open source component in the software project as described above.

[0038] The present invention also discloses a computer-readable storage medium, which includes a computer program. The computer program can be executed by a processor to complete the method for solving the optimal version of the open source component in the software project as described above.

[0039] Compared with the prior art, the method for solving the optimal version of open source components in a software project of the present invention starts from the perspective of the entire target project, analyzes the risk of each open source component, and comprehensively gives an optimal version recommendation set for all open source components in the target project. That is, for different target projects, the same open source component may have different recommended versions, thereby avoiding invalid open source component version recommendations and making the recommendations more effective to adapt to the current target project. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 The present invention is a flowchart of a method for solving the optimal version of an open source component in a software project in an embodiment of the present invention.

[0041] Figure 2 for Figure 1 The traversal processing method flow chart is shown in FIG.

[0042] Figure 3 It is a schematic diagram of the dependency graph structure in an embodiment of the present invention.

[0043] Figure 4 for Figure 3 The dependency tree is regenerated after the open source component version of the root node of Neutron Tree 1 is changed. DETAILED DESCRIPTION

[0044] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0045] The present embodiment discloses a method for solving the optimal version of the open source components in the software project, so as to make the best and effective recommendation for the version of the open source components used in the software development project, and use the recommended corresponding version of the open source components in the project without introducing new risks. To facilitate understanding of the method in the present embodiment, the basic knowledge involved is first explained. In software development projects, in order to improve development efficiency, a large number of open source components (also called third-party components) are generally used. The open source components used in the project can be analyzed through the software component analysis tool (SCA). For each project, there are dependencies between the several open source components used. These open source components can be divided into directly dependent components and indirectly dependent components according to the dependency level. The first-level open source components that the project depends on are called directly dependent components, and the open source components that the first-level and deeper-level open source components depend on are called indirect dependent components. Figure 3 The dependency tree of the target project shown has two subtrees, subtree 1 and subtree 2. The two subtrees each have a direct dependency component, namely DA1 and DB1. The direct dependency component DA1 has three indirect dependency components IC1, ID1, and IE1. The direct dependency component DB1 has an indirect dependency component IF1. DA1 represents version 1 of the direct dependency component A, and IC1 represents version 1 of the indirect dependency component C. The rest are similar and will not be repeated here.

[0046] Since most of the risks of indirectly dependent components are brought by their directly dependent components, in the embodiment of the present invention, version replacement is recommended only for directly dependent components. However, it should be understood that when the version of the directly dependent component is replaced, it may also cause changes in the spacing dependent components.

[0047] Specifically, Figure 1 In this embodiment, the method for solving the optimal version of the open source component in the software project includes the following steps:

[0048] S1: Get all open source components involved in the target project.

[0049] S2: Analyze the dependencies of the open source components in the target project to generate a dependency tree with a tree graph structure, such as Figure 3 .

[0050] S3: According to the depth-first strategy, a backtracking method is used to traverse and process each subtree of the dependency tree in sequence, starting from each root node (DA1 / DB1) of the dependency tree;

[0051] like Figure 2 , the traversal processing method for any of the subtrees comprises the following steps:

[0052] a: Determine whether the risk level of the open source component at any node is greater than a preset value. If not, execute step b; if yes, execute step c;

[0053] b: define the open source component at the root node of the subtree as one of the selection solutions of the subtree, and proceed to step c;

[0054] c: Replace the version of the open source component at the root node of the subtree, and regenerate the dependency tree;

[0055] d: Repeat steps a to c until all versions of the open source components at the root node of the subtree are replaced to obtain a set of sorting solutions for the subtree.

[0056] S4: Then, a set of sorting solutions of all subtrees in the dependency tree is obtained through the above traversal processing method;

[0057] S5: Perform comprehensive analysis on the selected solution sets of all subtrees to obtain a comprehensive solution set corresponding to the target project;

[0058] S6: According to the comprehensive solution set, combined with the dependency tree corresponding to each of the selected solutions recorded above, an optimal solution set of the push version of the open source component corresponding to the target project is parsed.

[0059] The principle of the above method flow is further described in detail below.

[0060] In the target project, there are five open source components involved, namely A, B, C, D, E, and F. The generated dependency tree is as follows: Figure 3 As shown, A and B are directly dependent components, and C, D, E, and F are indirectly dependent components.

[0061] Use the traversal method to process subtree 1:

[0062] First, the risk of DA1 (directly dependent on open source component A, version 1) is judged, then IC1, then ID1, and then back to IC1, from IC1 to IE1, and then back to DA1 from IE1. If one of the risk levels of DA1, IC1, ID1, and IE1 is greater than the preset value, the version of DA1 at the root node of subtree 1 is replaced and upgraded to version 2, i.e. DA2. Since the indirect dependent components may also change after the direct dependent components are updated, it may affect multiple other indirect dependencies in the project. Therefore, the dependency tree needs to be regenerated, such as Figure 4, after the new dependency tree is generated, IC1 becomes IC2. Then, based on the regenerated dependency tree, the risk is judged from DA2 of subtree 1 to IE1. If the risk of any of DA2, IC2, ID1, and IE1 is not greater than the preset value, DA2 is used as one of the sorting solutions of subtree 1, and the information of the current dependency tree is recorded for subsequent comparison and analysis. If the open source component A also has version 3, DA2 is replaced with DA3, and DA3 is judged according to the above process whether it belongs to one of the sorting solutions of subtree 1. Similarly, all the sorting solutions of subtree 1 are found to form a sorting solution set of subtree 1, such as {A2, A3, A5}.

[0063] According to the above processing method for subtree 1, subtree 2 in the target project is processed to obtain a sorting solution set {B2, B4, B5} of subtree 2.

[0064] Based on the sorting solution set of subtree 1 and the sorting solution set of subtree 2, the comprehensive solution set corresponding to the target project is obtained: {(A2, B2), (A2, B4), (A2, B5), (A3, B2), (A3, B4), (A3, B5), (A5, B2), (A5, B4), (A5, B5)}.

[0065] Those skilled in the art know that in a software project, when a certain direct dependency component is changed, it will affect the change of the indirect dependency component of its subtree, which may affect the overall risk of the project. Therefore, according to the dependency tree corresponding to each of the selected solutions recorded above, each pair of comprehensive solutions (such as A2 and B2) is compared to see if there is a conflict. For example, according to the dependency tree recorded in the selected solution DA2, the spacing dependency component IC1 in subtree 1 becomes IC2. At the same time, according to the dependency tree recorded in the selected solution DB2, the indirect dependency component IC1 is introduced in subtree 2. In the same project, two versions of the same open source component cannot appear, so this pair of comprehensive solutions (A2 and B2) is an invalid solution. Therefore, according to the comprehensive solution set, combined with the dependency tree corresponding to each of the selected solutions recorded above, the optimal solution set of the push board version of the open source component corresponding to the target project is parsed, such as {(A2, B4), (A3, B4), (A3, B5)}.

[0066] Furthermore, in another preferred embodiment of the method for solving the optimal version of the open source component in the software project of the present invention, it also includes a preprocessing method for the target project:

[0067] Using an open source component analysis tool to process the target project to obtain open source components in the target project, and at the same time obtain the vulnerability exploitation difficulty of each open source component, and quantify the vulnerability exploitation difficulty;

[0068] The accessibility of each open source component vulnerability is analyzed and quantified according to the source code of the open source component and the dependency tree.

[0069] In the traversal method, the risk level is evaluated by the difficulty and accessibility of exploiting the vulnerabilities of the open source components.

[0070] In this embodiment, by preprocessing the target project, it is convenient to evaluate the risk of open source components. Specifically, in this embodiment, the difficulty and accessibility of vulnerability exploitation of open source components are quantified through a scoring strategy. After obtaining several open source components and their vulnerability exploitation difficulties through the open source component analysis tool, since the vulnerability exploitation difficulty is divided into high-easy-to-exploit and difficult-to-exploit, the risk of highly-easy-to-exploit vulnerabilities is set to 100 points, and the risk of difficult-to-exploit vulnerabilities is set to 1 point. Similarly, the accessibility of vulnerabilities includes reachable and unreachable. The risk of reachable vulnerabilities is set to 100 points, and the risk of unreachable vulnerabilities is set to 1 point. Then, the risk of each open source component is comprehensively calculated based on the quantified vulnerability exploitation difficulty and accessibility. The risk greater than 100 points is set as super-risk or high-risk, and should be replaced with other versions, that is, the preset value used to judge the risk of open source components at any node in the above embodiment is set to 100.

[0071] In addition, when using the above traversal processing method, it is possible that a subtree does not have a sorting solution, that is, for the subtree, there is no version of the open source component as the root node, so that the risk of the open source component at any node of the subtree is less than the preset value. In this regard, in step a of the traversal processing method, when the judgment result is yes, that is, the risk of the open source component at a node in the current subtree is greater than the preset value, and the open source component (such as DA1) at the root node of the current subtree is a non-sorting solution, then, before replacing the version of the open source component at the root node of the subtree, first record the dependency information of the current subtree. In this way, if all versions of the open source components at the root node of the subtree cannot meet the conditions of the sorting solution later, then, according to the dependency information of the subtree recorded above, the risk of the subtree is calculated for each version of the open source component at the root node of the subtree, and the open source component corresponding to the lowest risk is taken as the sorting solution of the subtree.

[0072] In summary, according to the above-mentioned embodiments, the method for solving the optimal version of open source components in a software project disclosed by the present invention starts from the perspective of the entire target project, analyzes the risk of each open source component, and comprehensively provides an optimal version recommendation set for all open source components in the target project. That is, for different target projects, the same open source component may have different recommended versions, thereby avoiding invalid open source component version recommendations and making the recommendations more effective to adapt to the current target project.

[0073] The present invention also discloses a system for solving the optimal version of open source components in a software project, which includes a dependency tree generation module and a dependency tree processing module.

[0074] The dependency tree generation module is used to analyze the dependencies of the open source components in the target project to generate a dependency tree with a tree graph structure.

[0075] The relationship tree processing module is used to traverse and process each subtree of the dependency tree in sequence starting from each root node of the dependency tree according to the depth-first strategy and the backtracking method. The relationship tree processing module includes a sorting solution set generation module, a comprehensive solution generation module and an optimal solution set generation module.

[0076] The sorting solution set generation module includes a traversal module, a collection module, a recording module, a replacement module, an update module, a first parsing module and a second parsing module.

[0077] The traversal module is used to traverse and detect the risk of the open source component at any node of any subtree.

[0078] The collection module is used to collect the open source components of the root node of the subtree where the risk of any node is not greater than a preset value, and define the open source component as one of the selection solutions of the subtree.

[0079] The recording module is used to record the dependency tree information currently corresponding to the subtree having a node with a risk degree greater than a preset value.

[0080] The replacement module is used to replace the open source component version at the root node in the subtree.

[0081] The update module is used to update the dependency tree of the target project after each replacement of the open source component.

[0082] The first parsing module is used to parse out a comprehensive solution set corresponding to the target project based on all the sorting solutions collected by the collection module.

[0083] The second parsing module is used to parse out an optimal solution set of the push version of the open source component corresponding to the target project according to the content recorded by the recording module and the comprehensive solution set.

[0084] Furthermore, the above system also includes a first preprocessing module, a second preprocessing module and a risk assessment module.

[0085] The first preprocessing module is used to process the target project using an open source component analysis tool to obtain the open source components in the target project, obtain the vulnerability exploitation difficulty of each of the open source components, and quantify the vulnerability exploitation difficulty.

[0086] The second preprocessing module is used to analyze and quantify the reachability of each open source component vulnerability according to the source code of the open source component and the dependency tree.

[0087] The risk assessment module is used to assess the risk by the difficulty of exploiting the vulnerability of the open source component and the accessibility.

[0088] The working principle and method of the system in this embodiment are detailed in the above method embodiment and will not be repeated here.

[0089] The present invention also discloses another system for solving the optimal version of open source components in a software project, which includes one or more processors, a memory and one or more programs, wherein one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the program includes instructions for executing the method for solving the optimal version of open source components in the software project as described above. The processor can adopt a general central processing unit (CPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits to execute related programs to implement the functions required to be executed by the modules in the system for solving the optimal version of open source components in the software project of the embodiment of the present application, or to execute the method for solving the optimal version of open source components in the software project of the method embodiment of the present application.

[0090] The present invention also discloses a computer-readable storage medium, which includes a computer program, and the computer program can be executed by a processor to complete the method for solving the optimal version of the open source component in the software project as described above. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium can be a read-only memory (ROM), or a random access memory (RAM), or a magnetic medium, such as a floppy disk, a hard disk, a tape, a magnetic disk, or an optical medium, such as a digital versatile disc (DVD), or a semiconductor medium, such as a solid state disk (SSD), etc.

[0091] The embodiment of the present application also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of an electronic device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the electronic device executes the above-mentioned method for solving the optimal version of the open source component in the software project.

[0092] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A method for finding the optimal version of an open source component in a software project, characterized in that: include: Analyze the dependencies of open source components in the target project to generate a dependency tree with a tree graph structure; According to the depth-first strategy, a backtracking method is adopted to start from each root node of the dependency tree and traverse and process each subtree of the dependency tree in sequence; The traversal processing method for any of the subtrees comprises the following steps: a: Determine whether the risk level of the open source component at any node is greater than a preset value. If not, execute step b; if yes, execute step c; b: define the open source component at the root node of the subtree as one of the selection solutions of the subtree, record the information of the current dependency tree, and proceed to step c; c: Replace the version of the open source component at the root node of the subtree, and regenerate the dependency tree; d: Execute steps a to c in this way repeatedly until all versions of the open source components at the root node of the subtree are replaced to obtain a set of sorting solutions for the subtree; By comprehensively analyzing the selected solution sets of all subtrees, a comprehensive solution set corresponding to the target project is obtained; According to the comprehensive solution set, combined with the dependency tree corresponding to each of the selected solutions recorded above, an optimal solution set of the push version of the open source component corresponding to the target project is parsed.

2. The method for finding the optimal version of open source components in a software project according to claim 1, characterized in that: The method also includes a preprocessing method for the target project: using an open source component analysis tool to process the target project to obtain the open source components in the target project, and at the same time obtaining the vulnerability exploitation difficulty of each open source component, and quantifying the vulnerability exploitation difficulty; Analyzing and quantifying the accessibility of each open source component vulnerability according to the source code of the open source component and the dependency tree; In the traversal processing method, the risk level is evaluated by the difficulty and accessibility of exploiting the vulnerability of the open source component.

3. The method for finding the optimal version of open source components in a software project according to claim 2, characterized in that: In the traversal processing method, in step a, when the judgment result is yes, the dependency information of the current subtree is recorded at the same time; If a sorting solution does not exist for a certain subtree, the risk of the subtree is calculated for the dependency information of the open source component of the root node of the subtree in each version, and the open source component corresponding to the one with the lowest risk is taken as the sorting solution for the subtree.

4. A system for finding the optimal version of an open source component in a software project, characterized in that: It includes a dependency tree generation module and a dependency tree processing module; The dependency tree generation module is used to analyze the dependencies of the open source components in the target project to generate a dependency tree with a tree graph structure; The relationship tree processing module is used to traverse and process each subtree of the dependency tree in sequence starting from each root node of the dependency tree by backtracking according to a depth-first strategy. The relationship tree processing module includes a sorting solution set generation module, a comprehensive solution generation module, and an optimal solution set generation module; The sorting solution set generation module includes a traversal module, a collection module, a recording module, a replacement module, an update module, a first parsing module and a second parsing module; The traversal module is used to traverse and detect the risk of the open source component at any node of any subtree; The collection module is used to collect the open source components of the root nodes of the subtrees where the risk of any node is not greater than a preset value, and define the open source components as one of the selection solutions of the subtrees; The recording module is used to record the dependency tree information currently corresponding to the subtree having a node with a risk degree greater than a preset value; The replacement module is used to replace the open source component version at the root node in the subtree; The update module is used to update the dependency tree of the target project after each replacement of the open source component; The first parsing module is used to parse out a comprehensive solution set corresponding to the target project based on all the sorting solutions collected by the collecting module; The second parsing module is used to parse out an optimal solution set of the push version of the open source component corresponding to the target project according to the content recorded by the recording module and the comprehensive solution set.

5. The system for finding the optimal version of open source components in a software project according to claim 4, characterized in that: It also includes a first preprocessing module, a second preprocessing module and a risk assessment module; The first preprocessing module is used to process the target project using an open source component analysis tool to obtain open source components in the target project, obtain the vulnerability exploitation difficulty of each open source component, and quantify the vulnerability exploitation difficulty; The second preprocessing module is used to analyze and quantify the reachability of each open source component vulnerability according to the source code of the open source component and the dependency tree; The risk assessment module is used to assess the risk by the difficulty of exploiting the vulnerability of the open source component and the accessibility.

6. A system for finding the optimal version of an open source component in a software project, characterized in that: include: one or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs comprising instructions for executing the method for solving the optimal version of open source components in a software project as described in any one of claims 1 to 3.

7. A computer-readable storage medium, characterized in that: The method comprises a computer program which can be executed by a processor to complete the method for solving the optimal version of the open source component in the software project as claimed in any one of claims 1 to 3.

Images