Web page security testing method, device and computer-readable storage medium

Abstract

The present invention relates to the field of information security technology, and discloses a web page security testing method, comprising: receiving a web page associated information set, and classifying the web page associated information set into test points to obtain security test information, creating a security test thread channel corresponding to the security test information, running a pre-built web page automation operation script, obtaining web page operation information generated when the web page automation operation script is running in real time according to the security test thread channel, using the security test information and the web page operation information as parameters of a pre-built test script generation library, compiling the test script generation library to obtain a security test script, running the security test script to perform a security test on the web page and outputting the test results. The present invention also proposes a web page security testing device, an electronic device, and a computer-readable storage medium. The present invention can achieve a highly timely and fast web page security testing function.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device, electronic device, and computer-readable storage medium for web page security testing. Background Art

[0002] Web page security testing is a test in which web developers perform various web page operations on the web page to evaluate the stability of the web page, such as upload operations, registration operations, login operations, clickjacking operations, etc.

[0003] Currently, webpage security testing primarily relies on static scanning of pre-built code. Specifically, static scanning involves scanning the webpage using pre-defined scanning tools after the source code has been written and compiled, aiming to identify solutions to semantic flaws and security vulnerabilities within the code. Static scanning security testing is often time-sensitive, requiring only after the webpage is published. It also requires frequent code maintenance, resulting in high labor costs. Furthermore, static scanning security testing is often performed on a single item basis, making it slow. Summary of the Invention

[0004] The present invention provides a webpage security testing method, device, electronic device and computer-readable storage medium, the main purpose of which is to achieve a webpage security testing function with high timeliness and speed.

[0005] To achieve the above objectives, the present invention provides a webpage security testing method, comprising:

[0006] receiving a web page publishing request from a web page development terminal, and prompting the web page development terminal to publish a web page related information set according to the web page publishing request;

[0007] receiving the webpage-related information set, classifying the webpage-related information set according to test points of the webpage security test to obtain one or more security test information, and creating a security test thread channel corresponding to the one or more security test information;

[0008] Running a pre-built web page automation operation script, obtaining web page operation information generated by the web page automation operation script in real time according to the security test thread channel, and loading the security test information and the web page operation information into a pre-built information queue;

[0009] Regularizing all security test information and all webpage operation information in the information queue to obtain a regularized information set;

[0010] Using the regularized information set as a parameter of a pre-built test script generation library, compiling the test script generation library to obtain a security test script;

[0011] Run the security test script to perform a security test on the web page and output the test results.

[0012] Optionally, running a pre-built webpage automation operation script includes:

[0013] Inputting the security test information into the security test thread channel;

[0014] When the webpage automation operation script is running, the security test information is extracted from the security test thread channel until the webpage automation operation script is completed.

[0015] Optionally, the real-time acquisition of webpage operation information generated when the webpage automation operation script is executed includes:

[0016] When the security test thread channel receives the security test information, a pre-built web page information real-time monitoring script is started;

[0017] When the web page automation operation script is running, the web page information real-time monitoring script is used to record the running of the web page automation operation script to obtain web page operation information, and the web page operation information is input into the security test thread channel.

[0018] Optionally, regularizing all security test information and all webpage operation information in the information queue to obtain a regularized information set includes:

[0019] Using the corresponding relationship between the security test information and the webpage operation information in the pre-built webpage information real-time monitoring script, the security test information and the webpage operation information are divided into multiple batches;

[0020] The security test information and web page operation information that are larger than a preset information data volume threshold are removed to obtain a regularized information set.

[0021] Optionally, the method further includes:

[0022] When the security test script is completed, multiple groups of test logs corresponding to the security test script are generated;

[0023] Aggregate and output multiple groups of test logs.

[0024] In order to solve the above problems, the present invention further provides a webpage security testing device, which includes:

[0025] a test point classification module configured to receive a web page publishing request from a web page development terminal, prompt the web page development terminal to publish a web page associated information set according to the web page publishing request, receive the web page associated information set, classify the web page associated information set according to test points of a web page security test, obtain one or more security test information, and create a security test thread channel corresponding to the one or more security test information;

[0026] a webpage operation information generation module, configured to execute a pre-built webpage automation operation script, obtain in real time the webpage operation information generated by the execution of the webpage automation operation script according to the security test thread channel, and load the security test information and the webpage operation information into a pre-built information queue;

[0027] An information regularization module, configured to regularize all security test information and all webpage operation information in the information queue to obtain a regularized information set;

[0028] The security testing module is used to use the regularized information set as a parameter of a pre-built test script generation library, compile the test script generation library to obtain a security testing script, run the security testing script to perform security testing on the web page and output the test results.

[0029] In order to solve the above problem, the present invention further provides an electronic device, comprising:

[0030] a memory storing at least one instruction; and

[0031] The processor executes the instructions stored in the memory to implement any one of the webpage security testing methods described above.

[0032] In order to solve the above problems, the present invention also provides a computer-readable storage medium, which stores at least one instruction. The at least one instruction is executed by a processor in an electronic device to implement any one of the web page security testing methods described above.

[0033] The webpage security testing method proposed in the present invention first collects webpage-related information sets and creates a security testing thread channel. The early acquisition of the webpage-related information sets and the multi-threaded construction of the security testing thread channel improve the speed of subsequent webpage security testing while also maintaining timeliness, preventing sudden webpage security testing delays due to lack of data. The webpage-related information sets within the security testing thread channel are then regularized using a constructed webpage automation script. This regularized information further increases the speed of webpage security testing, thus achieving highly timely and rapid webpage security testing capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of a flow chart of a webpage security testing method provided by one embodiment of the present invention;

[0035] Figure 2 A schematic diagram of modules of a webpage security testing method provided by one embodiment of the present invention;

[0036] Figure 3 A schematic diagram of the internal structure of an electronic device for a webpage security testing method provided by an embodiment of the present invention;

[0037] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0038] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0039] The present invention provides a web page security testing method. Figure 1 FIG2 is a flow chart of a webpage security testing method according to an embodiment of the present invention. The method can be executed by a device, which can be implemented by software and / or hardware.

[0040] In this embodiment, the webpage security testing method includes:

[0041] S1. Receive a webpage publishing request from a webpage development terminal, and prompt the webpage development terminal to publish a webpage related information set according to the webpage publishing request.

[0042] The process of developing a webpage and bringing it to user use involves multiple processes and corresponding operations. Webpage security testing is extremely important and essential, as it affects the user experience, user privacy, and webpage stability. The webpage security testing described in this invention involves security testing performed by webpage developers while performing various webpage-related operations within a webpage.

[0043] The web page publishing request is an instruction that the web page has completed the development stage and is ready to be tested for users. In the present invention, the web page publishing request is first received, and then the web page security test is performed using the web page security testing method described in the present invention, and then the test is performed for users.

[0044] The web page associated information set is the relevant preparation information required before conducting the web page security test, and is the preliminary preparation work for the web page security test. For example, when conducting a login function test, it is necessary to provide a login account and login password, and the login account and login password are the web page associated information.

[0045] Furthermore, the web page associated information set can be divided into the following types according to the different test points of the web page security test: upload function test information, registration function test information, login function test information, verification code function test information, unauthorized function test information, clickjacking function test information, etc.

[0046] S2. Receive the webpage association information set, classify the webpage association information set according to the test points of the webpage security test, obtain one or more security test information, and create a security test thread channel corresponding to the one or more security test information.

[0047] The test points are divided according to different functional modules in the test web page, such as a test point for uploading a test through a web page, a test point for account login, etc.

[0048] The web page associated information set is classified to obtain the security test information, which includes upload function test information, registration function test information, login function test information, verification code function test information, unauthorized function test information, clickjacking function test information, etc.

[0049] The security test thread channels correspond one-to-one with the security test information. For example, upload function test information corresponds to the upload test thread channel, registration function test information corresponds to the registration test thread channel, and unauthorized function test information corresponds to unauthorized function test information. Furthermore, different security test thread channels can separate different web page full test tasks and perform them in parallel, improving the efficiency of the entire web page security test. The security test thread channels are expressed differently in different programming languages. For example, in the JAVA programming language, the security test thread channels can use the pre-packaged Thread class.

[0050] S3. Run a pre-built web page automation operation script, obtain web page operation information generated when the web page automation operation script is running in real time according to the security test thread channel, and load the security test information and the web page operation information into a pre-built information queue.

[0051] Preferably, the webpage automation operation script is a script that is pre-programmed and compiled and can automatically perform relevant webpage operation tests, such as upload function operation scripts, registration function operation scripts, login function operation scripts, verification code function operation scripts, unauthorized function operation scripts, clickjacking function operation scripts, etc. When the login function operation script is executed, the webpage will automatically obtain the login account and login password for webpage account login, and the login account and login password are the security test information.

[0052] In detail, the running of the pre-built web page automation operation script includes: using the security test thread channel as the transmission carrier of the security test information, and using the web page automation operation script to extract the security test information from the security test thread channel during the running stage until the web page automation operation script is completed.

[0053] In detail, the real-time acquisition of web page operation information generated when the web page automation operation script is running includes: when the security test thread channel receives the security test information, starting a pre-built web page information real-time monitoring script; when the web page automation operation script is running, using the web page information real-time monitoring script to record the running of the web page automation operation script to obtain web page operation information, and inputting the web page operation information into the security test thread channel.

[0054] Furthermore, the webpage information real-time monitoring script is pre-written in a programming language, such as using C++ to monitor the HTML of a webpage in real time through port access. If the HTML of the monitored webpage changes, the port accesses the HTML of the webpage and detects that the webpage has changed. The port then accesses the HTML to obtain the location of the changed webpage and the changed information, thereby obtaining webpage operation information. For example, in a webpage security test, to test whether the webpage login function is functioning properly, the login function operation script is called and run, causing the HTML information of the webpage to change, thereby obtaining the webpage operation information.

[0055] Preferably, the information queue aggregates all security test information and web page operation information, and stores the security test information and web page operation information in a corresponding manner. The information queue can be constructed using a stack, a database, or the like. For example, web page operation information related to login functions can correspond to security test information related to login account and password.

[0056] S4. Regularizing all security test information and all webpage operation information in the information queue to obtain a regularized information set.

[0057] In detail, the S4 includes:

[0058] By utilizing the correspondence between the security test information and the web page operation information in the pre-built web page information real-time monitoring script, the security test information and web page operation information are divided into multiple batches, and the security test information and web page operation information that are larger than a pre-set information data volume threshold are removed to obtain a regularized information set.

[0059] Furthermore, the preset information data volume threshold is for removing security test information and web page operation information with a large amount of information data, so as to prevent the security test information and web page operation information with a large amount of data from having a significant impact on the web page test.

[0060] S5. Use the regularized information set as a parameter of a pre-built test script generation library, and compile the test script generation library to obtain a security test script.

[0061] In detail, the test script generation library is a pre-built extensible web page security test library. Due to its extensibility, adding a new web page security test operation only requires adding test rules to the test script generation library, which has a higher degree of freedom.

[0062] {"payload_key":["first_payload","second_payload","third_payload",…]}

[0063] Among them, payload_key represents the parameter name of the test script generation library, and "first_payload", "second_payload", and "third_payload" represent the parameter values ​​corresponding to the parameter names of the test script generation library.

[0064] For example, in the security test of web page response, the test script generation library is expressed as:

[0065] {"payload":["first_payload","second_payload","third_payload"]}

[0066] Among them, "first_payload", "second_payload", and "third_payload" are all displayed in the form of arrays and expressed in the form of numbers. For example, first_payload indicates the time when the webpage is accessed, second_payload indicates the time when the webpage HTML changes, and third_payload indicates the time when the webpage responds to the access.

[0067] Furthermore, the compilation is to confirm whether the test script generation library is complete. If the compilation fails, it is necessary to prompt the web page developer to check the cause of the compilation error.

[0068] S6. Run the security test script. When the security test script is completed, generate a test log corresponding to the security test script and output the test log.

[0069] As described in S1, web page security testing is extremely important and indispensable in the process from development to user use of a web page. For example, when performing a login function test, if an abnormality is found in the login function test, it will be recorded through the operation log. For example, when the security test script is testing the security test of the web page response, if an abnormality is found in the web page response, it will be recorded through the operation log, and finally the operation log will be uniformly output for user inspection.

[0070] like Figure 2 FIG. 1 is a functional module diagram of the webpage security testing device of the present invention.

[0071] The webpage security tester 100 described in the present invention can be installed in an electronic device. Depending on the functionality implemented, the webpage security tester can include a test point classification module 101, a webpage operation information generation module 102, an information regularization module 103, and a security testing module 104. A module, also referred to as a unit, is a series of computer program segments that can be executed by an electronic device processor and perform a fixed function, and is stored in the electronic device's memory.

[0072] In this embodiment, the functions of each module / unit are as follows:

[0073] The test point classification module 101 is configured to receive a web page publishing request from a web page development terminal, prompt the web page development terminal to publish a web page associated information set according to the web page publishing request, receive the web page associated information set, classify the web page associated information set according to test points of a web page security test, obtain one or more security test information, and create a security test thread channel corresponding to the one or more security test information;

[0074] The webpage operation information generating module 102 is configured to execute a pre-built webpage automation operation script, obtain webpage operation information generated by the execution of the webpage automation operation script in real time according to the security test thread channel, and load the security test information and the webpage operation information into a pre-built information queue;

[0075] An information regularization module 103 is used to regularize all security test information and all webpage operation information in the information queue to obtain a regularized information set;

[0076] The security testing module 104 is configured to use the regularized information set as a parameter of a pre-built test script generation library, compile the test script generation library to obtain a security testing script, run the security testing script to perform security testing on the web page, and output the test results.

[0077] In detail, the specific implementation steps of each module of the webpage security testing device are as follows:

[0078] The test point classification module 101 receives a web page publishing request from a web page development end, prompts the web page development end to publish a web page associated information set according to the web page publishing request, receives the web page associated information set, classifies the web page associated information set according to the test points of the web page security test, obtains one or more security test information, and creates a security test thread channel corresponding to the one or more security test information.

[0079] The process of developing a webpage and bringing it to user use involves multiple processes and corresponding operations. Webpage security testing is extremely important and essential, as it affects the user experience, user privacy, and webpage stability. The webpage security testing described in this invention involves security testing performed by webpage developers while performing various webpage-related operations within a webpage.

[0080] The web page publishing request is an instruction that the web page has completed the development stage and is ready to be tested for users. In the present invention, the web page publishing request is first received, and then the web page security test is performed using the web page security testing method described in the present invention, and then the test is performed for users.

[0081] The web page associated information set is the relevant preparation information required before conducting the web page security test, and is the preliminary preparation work for the web page security test. For example, when conducting a login function test, it is necessary to provide a login account and login password, and the login account and login password are the web page associated information.

[0082] Furthermore, the web page associated information set can be divided into the following types according to the different test points of the web page security test: upload function test information, registration function test information, login function test information, verification code function test information, unauthorized function test information, clickjacking function test information, etc.

[0083] The test points are divided according to different functional modules in the test web page, such as a test point for uploading a test through a web page, a test point for account login, etc.

[0084] The web page associated information set is classified to obtain the security test information, which includes upload function test information, registration function test information, login function test information, verification code function test information, unauthorized function test information, clickjacking function test information, etc.

[0085] The security test thread channels correspond one-to-one with the security test information. For example, upload function test information corresponds to the upload test thread channel, registration function test information corresponds to the registration test thread channel, and unauthorized function test information corresponds to unauthorized function test information. Furthermore, different security test thread channels can separate different web page full test tasks and perform them in parallel, improving the efficiency of the entire web page security test. The security test thread channels are expressed differently in different programming languages. For example, in the JAVA programming language, the security test thread channels can use the pre-packaged Thread class.

[0086] The web page operation information generation module 102 runs a pre-built web page automation operation script, obtains the web page operation information generated when the web page automation operation script is running in real time according to the security test thread channel, and loads the security test information and the web page operation information into a pre-built information queue.

[0087] Preferably, the webpage automation operation script is a script that is pre-programmed and compiled and can automatically perform relevant webpage operation tests, such as upload function operation scripts, registration function operation scripts, login function operation scripts, verification code function operation scripts, unauthorized function operation scripts, clickjacking function operation scripts, etc. When the login function operation script is executed, the webpage will automatically obtain the login account and login password for webpage account login, and the login account and login password are the security test information.

[0088] In detail, the running of the pre-built web page automation operation script includes: using the security test thread channel as the transmission carrier of the security test information, and the web page automation operation script extracts the security test information from the security test thread channel during the running stage until the web page automation operation script is completed.

[0089] In detail, the real-time acquisition of web page operation information generated when the web page automation operation script is running includes: when the security test thread channel receives the security test information, starting a pre-built web page information real-time monitoring script; when the web page automation operation script is running, using the web page information real-time monitoring script to record the running of the web page automation operation script to obtain web page operation information, and inputting the web page operation information into the security test thread channel.

[0090] Furthermore, the webpage information real-time monitoring script is pre-written in a programming language, such as using C++ to monitor the HTML of a webpage in real time through port access. If the HTML of the monitored webpage changes, the port accesses the HTML of the webpage and detects that the webpage has changed. The port then accesses the HTML to obtain the location of the changed webpage and the changed information, thereby obtaining webpage operation information. For example, in a webpage security test, to test whether the webpage login function is functioning properly, the login function operation script is called and run, causing the HTML information of the webpage to change, thereby obtaining the webpage operation information.

[0091] Preferably, the information queue aggregates all security test information and web page operation information, and stores the security test information and web page operation information in a corresponding manner. The information queue can be constructed using a stack, a database, or the like. For example, web page operation information related to login functions can correspond to security test information related to login account and password.

[0092] The information regularization module 103 regularizes all the security test information and all the webpage operation information in the information queue to obtain a regularized information set.

[0093] In detail, the information regularization module 103 includes: utilizing the correspondence between the security test information and the web page operation information in the pre-built web page information real-time monitoring script, dividing the security test information and web page operation information into multiple batches, and removing the security test information and web page operation information that are greater than a pre-set information data volume threshold to obtain a regularized information set.

[0094] Furthermore, the preset information data volume threshold is for removing security test information and web page operation information with a large amount of information data, so as to prevent the security test information and web page operation information with a large amount of data from having a significant impact on the web page test.

[0095] The security testing module 104 uses the regularized information set as a parameter of a pre-built test script generation library, and compiles the test script generation library to obtain a security testing script.

[0096] In detail, the test script generation library is a pre-built extensible web page security test library. Due to its extensibility, adding a new web page security test operation only requires adding test rules to the test script generation library, which has a higher degree of freedom.

[0097] {"payload_key":["first_payload","second_payload","third_payload",…]}

[0098] Among them, payload_key represents the parameter name of the test script generation library, and "first_payload", "second_payload", and "third_payload" represent the parameter values ​​corresponding to the parameter names of the test script generation library.

[0099] For example, in the security test of web page response, the test script generation library is expressed as:

[0100] {"payload":["first_payload","second_payload","third_payload"]}

[0101] Among them, "first_payload", "second_payload", and "third_payload" are all displayed in the form of arrays and expressed in the form of numbers. For example, first_payload indicates the time when the webpage is accessed, second_payload indicates the time when the webpage HTML changes, and third_payload indicates the time when the webpage responds to the access.

[0102] Furthermore, the compilation is to confirm whether the test script generation library is complete. If the compilation fails, it is necessary to prompt the web page developer to check the cause of the compilation error.

[0103] As described in S1, web page security testing is extremely important and indispensable in the process from development to user use of a web page. For example, when performing a login function test, if an abnormality is found in the login function test, it will be recorded through the operation log. For example, when the security test script is testing the security test of the web page response, if an abnormality is found in the web page response, it will be recorded through the operation log, and finally the operation log will be uniformly output for user inspection.

[0104] like Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device for implementing a webpage security testing method according to the present invention.

[0105] The electronic device 1 may include a processor 12 , a memory 11 , and a bus, and may further include a computer program stored in the memory 11 and executable on the processor 12 .

[0106] The memory 11 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a mobile hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of the electronic device 1, such as a mobile hard disk of the electronic device 1. In other embodiments, the memory 11 can also be an external storage device of the electronic device 1, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 1. Furthermore, the memory 11 can also include both an internal storage unit of the electronic device 1 and an external storage device. The memory 11 can not only be used to store application software and various types of data installed in the electronic device 1, such as the code of the resource scheduling program, etc., but can also be used to temporarily store data that has been output or is to be output.

[0107] In some embodiments, the processor 12 may be composed of an integrated circuit, such as a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and a combination of various control chips. The processor 12 is the control core (Control Unit) of the electronic device, connecting the various components of the entire electronic device using various interfaces and lines. It executes or executes programs or modules stored in the memory 11 (such as executing a resource scheduling program) and calls data stored in the memory 11 to perform various functions of the electronic device 1 and process data.

[0108] The bus may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable connection and communication between the memory 11 and at least one processor 12, etc.

[0109] Figure 3 Only the electronic device with components is shown, and it can be understood by those skilled in the art that Figure 3 The structure shown does not constitute a limitation on the electronic device 1 , and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0110] For example, although not shown, the electronic device 1 may further include a power source (such as a battery) for powering the various components. Preferably, the power source may be logically connected to the at least one processor 10 via a power management device, thereby implementing functions such as charging management, discharging management, and power consumption management through the power management device. The power source may further include any components such as one or more DC or AC power sources, a recharging device, a power failure detection circuit, a power converter or inverter, a power status indicator, etc. The electronic device 1 may further include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0111] Furthermore, the electronic device 1 may also include a network interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device 1 and other electronic devices.

[0112] Optionally, the electronic device 1 may further include a user interface, which may be a display or an input unit (such as a keyboard). Optionally, the user interface may also be a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touch device. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device 1 and to display a visual user interface.

[0113] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0114] The request resource scheduling program 12 stored in the memory 11 of the electronic device 1 is a combination of multiple instructions. When running in the processor 10, it can achieve the following:

[0115] receiving a web page publishing request from a web page development terminal, and prompting the web page development terminal to publish a web page related information set according to the web page publishing request;

[0116] receiving the webpage-related information set, classifying the webpage-related information set according to test points of the webpage security test to obtain one or more security test information, and creating a security test thread channel corresponding to the one or more security test information;

[0117] Running a pre-built web page automation operation script, obtaining web page operation information generated by the web page automation operation script in real time according to the security test thread channel, and loading the security test information and the web page operation information into a pre-built information queue;

[0118] Regularizing all security test information and all webpage operation information in the information queue to obtain a regularized information set;

[0119] Using the regularized information set as a parameter of a pre-built test script generation library, compiling the test script generation library to obtain a security test script;

[0120] Run the security test script to perform a security test on the web page and output the test results.

[0121] Specifically, the specific implementation method of the processor 10 for the above instructions can refer to Figure 2 The description of the relevant steps in the corresponding embodiments will not be repeated here.

[0122] Furthermore, if the modules / units integrated in the electronic device 1 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The computer-readable medium may include any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0123] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the module division is merely a logical function division, and other division methods may be used in actual implementation.

[0124] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed across multiple network elements. Some or all of the modules may be selected to achieve the purpose of the solution of this embodiment according to actual needs.

[0125] In addition, the functional modules in various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or hardware plus software functional modules.

[0126] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0127] Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims rather than the foregoing description, and all changes that come within the meaning and range of equivalents of the claims are intended to be embraced therein. Any reference to a figure in a claim should not be construed as limiting the claim to which it relates.

[0128] Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in a system claim may also be implemented by a single unit or device through software or hardware. Second-order terms are used to indicate names and do not imply any particular order.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A webpage security testing method, characterized in that: The method comprises: receiving a web page publishing request from a web page development terminal, and prompting the web page development terminal to publish a web page related information set according to the web page publishing request, wherein the web page related information set is relevant preparation information required for performing various web page function security tests; receiving the webpage-related information set, classifying the webpage-related information set according to test points of the webpage security test to obtain one or more security test information, and creating a one-to-one corresponding security test thread channel for each security test information; Input the security test information into the security test thread channel; when the web page automation operation script is running, extract the security test information from the security test thread channel until the web page automation operation script is completed; according to the security test thread channel, when the security test thread channel receives the security test information, start a pre-built web page information real-time monitoring script; when the web page automation operation script is running, use the web page information real-time monitoring script to record the running of the web page automation operation script to obtain web page operation information, input the web page operation information into the security test thread channel, and load the security test information and the web page operation information into a pre-built information queue; Regularizing all security test information and all webpage operation information in the information queue to obtain a regularized information set; Using the regularized information set as a parameter of a pre-built test script generation library, compiling the test script generation library to obtain a security test script; Run the security test script to perform a security test on the web page and output the test results.

2. The webpage security testing method according to claim 1, wherein: The step of regularizing all security test information and all webpage operation information in the information queue to obtain a regularized information set includes: Using the corresponding relationship between the security test information and the webpage operation information in the pre-built webpage information real-time monitoring script, the security test information and the webpage operation information are divided into multiple batches; The security test information and web page operation information that are larger than a preset information data volume threshold are removed to obtain a regularized information set.

3. The webpage security testing method according to claim 1, wherein: The method further comprises: When the security test script is completed, multiple groups of test logs corresponding to the security test script are generated; Aggregate and output multiple groups of test logs.

4. A webpage security testing device, characterized in that: The device comprises: A test point classification module is configured to receive a web page publishing request from a web page development terminal, prompt the web page development terminal to publish a web page association information set based on the web page publishing request, wherein the web page association information set is relevant preparation information required for performing various web page function security tests, receive the web page association information set, classify the web page association information set according to the test points of the web page security test, obtain one or more security test information, and create a one-to-one corresponding security test thread channel for each security test information; A web page operation information generation module is used to input the security test information into the security test thread channel, extract the security test information from the security test thread channel when the web page automation operation script is running, until the web page automation operation script is completed, and according to the security test thread channel, when the security test thread channel receives the security test information, start a pre-built web page information real-time monitoring script, and when the web page automation operation script is running, use the web page information real-time monitoring script to record the running of the web page automation operation script to obtain web page operation information, input the web page operation information into the security test thread channel, and load the security test information and the web page operation information into a pre-built information queue; An information regularization module, configured to regularize all security test information and all webpage operation information in the information queue to obtain a regularized information set; The security testing module is used to use the regularized information set as a parameter of a pre-built test script generation library, compile the test script generation library to obtain a security testing script, run the security testing script to perform security testing on the web page and output the test results.

5. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the webpage security testing method according to any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the webpage security testing method according to any one of claims 1 to 3 is implemented.

Images