Methods, devices, equipment, and computer storage media for detecting vulnerabilities in third-party components

Abstract

This invention relates to the field of Fintech technology, and discloses a method, apparatus, device, and computer storage medium for detecting vulnerabilities in third-party components. The method includes: receiving a component vulnerability detection request and obtaining the project source code corresponding to the request; performing a project build operation based on the source code to obtain a project directory and a component dependency tree; obtaining first information of third-party components in the project directory and second information of third-party components corresponding to each node in the dependency tree; comparing the first and second information as component information with vulnerability information in a preset vulnerability database; obtaining target component information matching the vulnerability information; and locating the target third-party component based on the target component information. This invention constructs a component dependency tree to determine the dependencies between components, facilitating rapid and accurate component location and avoiding incomplete component vulnerability detection.

Description

Technical Field

[0001] This invention relates to the field of financial technology (Fintech), and more particularly to methods, apparatus, devices, and computer storage media for detecting vulnerabilities in third-party components. Background Technology

[0002] With the rapid development of internet technology, especially internet financial technology (Fintech), more and more technologies (big data, distributed systems, blockchain, artificial intelligence, etc.) are being applied in the financial field.

[0003] Financial services are becoming increasingly diverse, with each service corresponding to a project's source code. This source code calls open-source third-party components. When a third-party component malfunctions, the current method involves scanning the relevant file directories of the project's source code to identify the vulnerable component. However, many components with the same or similar names exist in these directories, leading to false positives or false negatives during scanning. Furthermore, third-party components can be directly or indirectly imported. Direct imports refer to components that are directly imported by the project itself, while indirect imports are components that are imported by the project and then imported again. By directly analyzing configuration files, only directly imported third-party components can be identified, while indirectly imported ones may be missed. Consequently, it is difficult to query and update indirectly imported third-party components when they malfunction. Summary of the Invention

[0004] The main objective of this invention is to propose a method, apparatus, device, and computer storage medium for detecting vulnerabilities in third-party components, aiming to solve the technical problems that current third-party components are prone to false alarms or missed alarms when they malfunction, and that it is difficult to accurately and comprehensively update the vulnerabilities of all third-party components.

[0005] To achieve the above objectives, the present invention provides a method for detecting vulnerabilities in third-party components, the method comprising the following steps:

[0006] Receive a component vulnerability detection request and obtain the project source code corresponding to the component vulnerability detection request;

[0007] Execute a project build operation based on the project source code to obtain the project directory and component dependency tree;

[0008] Obtain first information of third-party components in the project directory and second information of third-party components corresponding to each node in the component dependency tree. Compare the first information and the second information as component information with vulnerability information in a preset vulnerability database.

[0009] Obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information.

[0010] Optionally, the third-party components include first-type components and second-type components;

[0011] The step of performing a project build operation based on the project source code to obtain the project directory and component dependency tree includes:

[0012] The source code of the project is scanned to obtain the configuration file associated with the source code of the project;

[0013] Based on the configuration file associated with the project source code, retrieve the first type of component and determine whether there is a configuration file associated with the first type of component;

[0014] If a configuration file associated with the first type of component exists, then the second type of component is retrieved based on the configuration file associated with the first type of component, and it is determined whether a configuration file associated with the second type of component exists.

[0015] Retrieve new second-type components based on the configuration files associated with the second-type components, until no configuration files are associated with the new second-type components;

[0016] Assign the first type of component to the parent node, assign the second type of component to the child node, and assign the new second type of component to the new child node to construct a component dependency tree.

[0017] Optionally, the step of performing a project build operation based on the project source code to obtain the project directory and component dependency tree includes:

[0018] The preset integration tool is invoked to scan the project source code and build the project, thereby obtaining the build code corresponding to the project source code and the project directory of the build code;

[0019] Traverse the project directory of the build code to determine if there is a configuration file associated with the build code;

[0020] If a configuration file associated with the build code exists, obtain the file format of the configuration file associated with the build code;

[0021] Based on the file format, select and invoke the preset component tree construction instruction to construct the component dependency tree.

[0022] Optionally, the step of obtaining first information of third-party components in the project directory and second information of third-party components corresponding to each node in the component dependency tree, and comparing the first information and the second information as component information with vulnerability information in a preset vulnerability database, includes:

[0023] Obtain third-party components in the project directory, as well as component runtime information and component call information of the third-party components, and use the component runtime information and component call information as the first information;

[0024] Obtain the third-party components corresponding to each node in the component dependency tree, as well as the component name, component identifier, component version number, and component path of the third-party components, and use the component name, component identifier, component version number, and component path as the second information;

[0025] The first information and the second information are used as component information, and the component information is saved to a preset component information list;

[0026] The component information in the component information list is compared with the vulnerability information in the preset vulnerability database.

[0027] Optionally, after the steps of obtaining the first information of third-party components in the project directory and the second information of third-party components corresponding to each node in the component dependency tree, and comparing the first information and the second information as component information with vulnerability information in a preset vulnerability database, the method includes:

[0028] If the component name in the component information is different from the component name in the vulnerability information, then the component information and the vulnerability information are determined to be mismatched.

[0029] If the component name in the component information is the same as the component name in the vulnerability information, then the first component version number corresponding to the component name in the component information is compared with the second component version number corresponding to the component name in the vulnerability information.

[0030] If the version number of the first component is less than or equal to the version number of the second component, then the component information is determined to match the vulnerability information.

[0031] Optionally, the step of obtaining target component information matching the vulnerability information and locating the target third-party component based on the target component information includes:

[0032] Obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information;

[0033] Query the component dependency tree to determine whether there is a parent node third-party component associated with the target third-party component;

[0034] If there is no parent node third-party component associated with the target third-party component, then the target third-party component is determined to be a directly imported component, and the target third-party component is upgraded.

[0035] If there is a parent node third-party component associated with the target third-party component, the target third-party component is determined to be an indirectly introduced component. The component dependency tree is then traced back to the directly introduced component, and all third-party components on the target third-party component and its directly introduced branch are synchronously upgraded.

[0036] Optionally, after the steps of obtaining target component information matching the vulnerability information and locating the target third-party component based on the target component information, the method further includes:

[0037] When a project update is detected, retrieve the updated project source code;

[0038] Perform a project build operation based on the updated project source code to obtain a new component dependency tree;

[0039] Obtain the component information of the third-party components corresponding to each node in the new component dependency tree, and perform the step of comparing the component information with the vulnerability information in the preset vulnerability database.

[0040] Furthermore, to achieve the above objectives, the present invention also provides a third-party component vulnerability detection device, the third-party component vulnerability detection device comprising:

[0041] The request receiving module is used to receive component vulnerability detection requests and obtain the project source code corresponding to the component vulnerability detection request.

[0042] The component tree building module is used to perform project building operations based on the project source code to obtain the project directory and component dependency tree.

[0043] The comparison module is used to obtain the first information of the third-party components in the project directory and the second information of the third-party components corresponding to each node in the component dependency tree, and compare the first information and the second information as component information with the vulnerability information in the preset vulnerability database.

[0044] The vulnerability location module is used to obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information.

[0045] In addition, to achieve the above objectives, the present invention also provides a third-party component vulnerability detection device, the third-party component vulnerability detection device comprising: a memory, a processor, and a third-party component vulnerability upgrade program stored on the memory and executable on the processor, wherein when the third-party component vulnerability upgrade program is executed by the processor, it implements the steps of the third-party component vulnerability detection method as described above.

[0046] In addition, to achieve the above objectives, the present invention also provides a computer storage medium storing a third-party component vulnerability upgrade program, wherein when the third-party component vulnerability upgrade program is executed by a processor, the third-party component vulnerability detection method described above is implemented.

[0047] This invention provides a method, apparatus, device, and computer storage medium for detecting vulnerabilities in third-party components. In this embodiment, a component vulnerability detection request is received, and the corresponding project source code is obtained. A project build operation is performed based on the project source code to obtain a project directory and a component dependency tree. Component information of the third-party components corresponding to each node in the component dependency tree is obtained, and the component information is compared with vulnerability information in a preset vulnerability database. Target component information matching the vulnerability information is obtained, and the target third-party component is located and upgraded based on the target component information. In this embodiment, by constructing a component dependency tree, the dependency relationships between various third-party components can be determined, distinguishing between directly and indirectly introduced components. When a vulnerability occurs in a component, the component information of the third-party component is obtained based on the component dependency tree, and the target third-party component to be upgraded is located based on the component information. Then, the component is upgraded. This eliminates the need for manual search and upgrade by maintenance personnel, allowing for rapid and accurate location of the target third-party component, effectively improving the efficiency of vulnerability component remediation. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of the present invention;

[0049] Figure 2 This is a flowchart illustrating the first embodiment of the third-party component vulnerability detection method of the present invention;

[0050] Figure 3 This is a schematic diagram of the functional modules of an embodiment of the third-party component vulnerability detection device of the present invention.

[0051] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0052] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0053] like Figure 1 As shown, Figure 1 This is a schematic diagram of the device structure of the hardware operating environment involved in the embodiments of the present invention.

[0054] The third-party component vulnerability detection device in this embodiment of the invention can be a PC or a server device running a Java Virtual Machine.

[0055] like Figure 1 As shown, the third-party component vulnerability detection device may include: a processor 1001, such as a CPU; a network interface 1004; a user interface 1003; a memory 1005; and a communication bus 1002. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be high-speed RAM or stable non-volatile memory, such as a disk drive. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0056] Those skilled in the art will understand that Figure 1 The device structure shown does not constitute a limitation on the device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0057] like Figure 1 As shown, the memory 1005, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a third-party component vulnerability upgrade program.

[0058] exist Figure 1 In the device shown, the network interface 1004 is mainly used to connect to the backend server and communicate with the backend server; the user interface 1003 is mainly used to connect to the client (user terminal) and communicate with the client; and the processor 1001 can be used to call the computer program corresponding to the third-party component vulnerability upgrade stored in the memory 1005 and execute the operations in the third-party component vulnerability detection method described below.

[0059] Based on the above hardware structure, an embodiment of the third-party component vulnerability detection method of the present invention is proposed.

[0060] Reference Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the third-party component vulnerability detection method of the present invention. The third-party component vulnerability detection method in this embodiment includes:

[0061] Step S10: Receive a component vulnerability detection request and obtain the project source code corresponding to the component vulnerability detection request.

[0062] The third-party component vulnerability detection method is applied to the third-party component vulnerability detection device, which is the hardware carrier of the computer program corresponding to the third-party component vulnerability upgrade. The third-party component vulnerability detection device communicates with the data platforms of different financial institutions (including banking institutions, insurance institutions, or securities institutions, etc.), and data transmission can be realized between the third-party component vulnerability detection device and the data platforms of financial institutions.

[0063] The third-party component vulnerability detection device receives component vulnerability detection requests. The triggering method for component vulnerability detection requests is not specifically limited. That is, component vulnerability detection requests can be triggered actively by the user, such as when the user enters "vulnerability detection" on the terminal. In addition, component vulnerability detection requests can also be triggered automatically by the third-party component vulnerability detection device. For example, if the third-party component vulnerability upgrade is set to automatically perform component vulnerability detection at the beginning of each month, the third-party component vulnerability detection device will automatically trigger the component vulnerability detection request at the beginning of the month.

[0064] When a third-party component vulnerability detection device receives a component vulnerability detection request, it obtains the source code of the project corresponding to the component vulnerability detection request. The source code refers to the code written by the developers.

[0065] Step S20: Perform a project build operation based on the project source code to obtain the project directory and component dependency tree.

[0066] The third-party component vulnerability detection device performs a project build operation based on the project source code to obtain the project directory and component dependency tree. Typically, after project development is complete, third-party components are not directly stored in the directory; instead, their information is stored in configuration files. When the code is deployed or run, a build is required, and the third-party components are retrieved from the third-party server according to the configuration file. To avoid missing indirectly imported components due to only detecting configuration files, in this embodiment, the third-party component vulnerability detection device performs a project build operation based on the project source code and constructs the component dependency tree based on the built code.

[0067] In this embodiment, the specific method by which the third-party component vulnerability detection device performs project building is not limited. Specifically, the project building methods include: Method 1, where software developers manually build different projects individually; Method 2, using a preset integration tool (a preset integration tool refers to a pre-set tool for project building, such as Jenkins, a Java-based continuous integration tool used to monitor continuously repetitive tasks; Jenkins functions include: 1. continuous software version release / testing projects; 2. monitoring externally executed tasks) for automated building. It is understood that the built code will need to be scanned subsequently, and continuous integration tools offer several advantages, therefore, they should be prioritized for project building.

[0068] In this embodiment, the specific method by which the third-party component vulnerability detection device constructs the component dependency tree is not limited. Specifically, the component dependency tree construction methods include: Method 1: The third-party component vulnerability detection device pulls directly imported third-party components based on the project's build code. Then, the device traces whether there are indirectly imported third-party components based on the directly imported third-party components until the tracing is complete, and constructs a component dependency tree based on the import relationship of each third-party component; Method 2: The device traverses the project directory of the build code to determine whether there is a configuration file associated with the build code. If a configuration file associated with the build code exists, the device obtains the file format of the configuration file associated with the build code; and selects and calls a preset component tree construction instruction based on the file format to construct the component dependency tree.

[0069] In this embodiment, the third-party component vulnerability detection device performs a project build operation based on the project source code to obtain the project directory and component dependency tree. This method can find all third-party components in the project and the dependencies between each third-party component, thus avoiding the inability to perform accurate upgrade operations when third-party components are faulty.

[0070] Step S30: Obtain the first information of the third-party components in the project directory and the second information of the third-party components corresponding to each node in the component dependency tree, and compare the first information and the second information as component information with the vulnerability information in the preset vulnerability database.

[0071] The third-party component vulnerability detection device obtains component information for each node in the component dependency tree corresponding to the third-party component. The device then compares this component information with vulnerability information in a pre-set vulnerability database (which is a pre-configured vulnerability component repository). Specifically, this includes:

[0072] Step a1: Obtain the third-party components in the project directory, as well as the component running information and component calling information of the third-party components, and use the component running information and component calling information as the first information;

[0073] Step a2: Obtain the third-party components corresponding to each node in the component dependency tree, as well as the component name, component identifier, component version number, and component path of the third-party components, and use the component name, component identifier, component version number, and component path as the second information;

[0074] Step a3: Use the first information and the second information as component information, and save the component information to a preset component information list;

[0075] Step a4: Compare the component information in the component information list with the vulnerability information in the preset vulnerability database.

[0076] That is, the third-party component vulnerability detection device obtains third-party components in the project directory, as well as the component runtime information and component call information of the third-party components. The component runtime information and component call information are used as the first information. The third-party component vulnerability detection device can directly collect the component information of the third-party components in the component dependency tree by traversing the configuration file. The component information includes, but is not limited to, the component name, component identifier (the component identifier refers to the unique identification information of the component, such as groupId, artifactId), component version number, and component path. The third-party component vulnerability detection device uses the first information and the second information as the component information and stores the obtained component information.

[0077] The third-party component vulnerability detection device compares the component information with the vulnerability information in a preset vulnerability database to determine whether the third-party component has a vulnerability. Specifically, the device compares the component name, groupId, artifactId, version number, and other information of each third-party component in the component dependency tree with the vulnerability information in the preset vulnerability database (which can be downloaded from the official CVE (Common Vulnerabilities & Exposures) website or the NIST (National Institute of Standards and Technology) website; the database mainly contains the correspondence between components, version numbers, and CVE numbers) to determine whether the third-party component has a vulnerability. In this embodiment, determining whether a third-party component has a vulnerability includes:

[0078] Step b1: If the component name in the component information is different from the component name in the vulnerability information, then it is determined that the component information and the vulnerability information do not match.

[0079] Step b2: If the component name in the component information is the same as the component name in the vulnerability information, then compare the first component version number corresponding to the component name in the component information with the second component version number corresponding to the component name in the vulnerability information.

[0080] Step b3: If the version number of the first component is less than or equal to the version number of the second component, then it is determined that the component information matches the vulnerability information.

[0081] In other words, the third-party component vulnerability detection device compares the component name in the component information with the component name in the vulnerability information. If the component name in the component information is different from the component name in the vulnerability information, it is determined that the component information and the vulnerability information do not match, that is, the component corresponding to the vulnerability information does not exist in the default vulnerability database. If the component name in the component information is the same as the component name in the vulnerability information, it compares the first component version number corresponding to the component name in the component information with the second component version number corresponding to the component name in the vulnerability information. If the first component version number is less than or equal to the second component version number, it is determined that the component information and the vulnerability information match. If the first component version number is greater than the second component version number, it is determined that the component information and the vulnerability information do not match.

[0082] In this embodiment, the third-party component vulnerability detection device accurately identifies vulnerable components by comparing the component name and version number in the component information with the component name and version number in the vulnerability information.

[0083] Step S40: Obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information.

[0084] The third-party component vulnerability detection device acquires target component information that matches vulnerability information. Based on the target component information, the device locates the target third-party component, determines its type, and upgrades it accordingly. Specifically, this includes:

[0085] Step c1: Obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information;

[0086] Step c2: Query the component dependency tree to determine whether there is a parent node third-party component associated with the target third-party component;

[0087] Step c3: If there is no parent node third-party component associated with the target third-party component, then it is determined that the target third-party component is a directly imported component, and the target third-party component is upgraded.

[0088] Step c4: If there is a parent node third-party component associated with the target third-party component, then the target third-party component is determined to be an indirectly introduced component. The component dependency tree is used to trace back to the directly introduced component, and all third-party components on the target third-party component and the directly introduced component branch are upgraded synchronously.

[0089] That is, the third-party component vulnerability detection device locates the target third-party component based on the target component information, and further determines the type of the target third-party component. Based on the type of the target third-party component, the third-party component vulnerability detection device determines the upgrade strategy for the target third-party component, so that the vulnerable components in the component dependency tree of the project are fully upgraded.

[0090] In this embodiment, by constructing a component dependency tree, the dependency relationships between various third-party components can be determined, distinguishing between directly imported and indirectly imported components. When a component has a vulnerability, the component information of the third-party component can be obtained based on the component dependency tree. The target third-party component to be upgraded can be located based on the component information, and then the component can be upgraded. This eliminates the need for maintenance personnel to manually search for upgrades, and can quickly and accurately locate the target third-party component, effectively improving the efficiency of repairing vulnerable components.

[0091] The third-party component vulnerability detection method in this embodiment is applied in financial institutions. When financial business experiences delays due to third-party component vulnerabilities, the third-party component vulnerability detection device quickly and accurately locates components based on the component dependency tree, and comprehensively upgrades the components, thereby reducing the delays in financial business processing caused by third-party component failures.

[0092] Furthermore, based on the first embodiment of the third-party component vulnerability detection method of the present invention, a second embodiment of the third-party component vulnerability detection method of the present invention is proposed.

[0093] This embodiment is a refinement of step S20 in the first embodiment. This embodiment provides a specific implementation method for a third-party component vulnerability detection device to construct a component dependency tree:

[0094] The source code of the project is scanned to obtain the configuration file associated with the source code of the project;

[0095] Based on the configuration file associated with the project source code, retrieve the first type of component and determine whether there is a configuration file associated with the first type of component;

[0096] If a configuration file associated with the first type of component exists, then the second type of component is retrieved based on the configuration file associated with the first type of component, and it is determined whether a configuration file associated with the second type of component exists.

[0097] Retrieve new second-type components based on the configuration files associated with the second-type components, until no configuration files are associated with the new second-type components;

[0098] Assign the first type of component to the parent node, assign the second type of component to the child node, and assign the new second type of component to the new child node to construct a component dependency tree.

[0099] In essence, the third-party component vulnerability detection device scans the project's source code to obtain the configuration files associated with the project's source code. Based on these configuration files, the device retrieves first-type components (directly imported third-party components) from the component server. It then determines if a configuration file associated with the first-type component exists. If no such configuration file exists, no further action is taken. If a configuration file exists, the device retrieves second-type components (indirectly imported third-party components) based on these configuration files and determines if a configuration file associated with them exists. The device retrieves new second-type components based on their configuration files until no new configuration file associated with a new second-type component exists. Finally, the device assigns the first-type components to parent nodes, the second-type components to child nodes, and new second-type components to new child nodes, thus constructing the component dependency tree.

[0100] In this embodiment, the third-party component vulnerability detection device traces back from the first type of component to obtain the second type of component, until there are no new second type of component, thus constructing a component dependency tree. In this embodiment, by constructing a component dependency tree, it is convenient to quickly locate components, and at the same time, it can distinguish between directly introduced components and indirectly introduced components, avoiding omissions during component upgrades.

[0101] Furthermore, based on the above embodiments of the third-party component vulnerability detection method of the present invention, a third embodiment of the third-party component vulnerability detection method of the present invention is proposed.

[0102] This embodiment is a refinement of step S20 in the first embodiment. This embodiment provides another specific implementation method for the third-party component vulnerability detection device to build a component dependency tree:

[0103] The preset integration tool is invoked to scan the project source code and build the project, thereby obtaining the build code corresponding to the project source code and the project directory of the build code;

[0104] Traverse the project directory of the build code to determine if there is a configuration file associated with the build code;

[0105] If a configuration file associated with the build code exists, obtain the file format of the configuration file associated with the build code;

[0106] Based on the file format, select and invoke the preset component tree construction instruction to construct the component dependency tree.

[0107] That is, the third-party component vulnerability detection device calls a preset integration tool (a preset integration tool refers to a pre-set tool for project building, such as the Jenkins tool; the preset integration tool is the same as in the first embodiment and will not be described again in this embodiment) to scan the project source code and build the project, obtaining the build code corresponding to the project source code; the third-party component vulnerability detection device traverses the project directory of the build code to determine whether there is a configuration file associated with the build code; if there is a configuration file associated with the build code, the third-party component vulnerability detection device obtains the configuration file associated with the build code, the configuration file includes pom.xml and build.gradle; the third-party component vulnerability detection device selects and calls a preset component tree building tool (component tree building tools include Maven and Gradle) according to the type of the configuration file, and builds the component dependency tree through the build instructions in the component tree building tool.

[0108] For example, third-party component vulnerability detection devices often include pre-set component tree building tools, such as Maven and Gradle. Maven typically parses a configuration file named pom.xml, and the command to build the component dependency tree is: `mvn dependency:tree`. Gradle typically parses a configuration file named build.gradle, and the command to build the component dependency tree is: `gradle app:dependencies`. The process of building the component dependency tree is as follows:

[0109] 1. Traverse the project directory to check if there are relevant configuration files. If there is a pom.xml, use the Maven approach; if there is a build.gradle, use the Gradle approach.

[0110] 2. Call the preset component tree build instructions according to the format of the configuration file. If the project uses Maven, execute mvn dependency:tree to get the dependency tree and store it; if the project uses Gradle, execute gradle app:dependencies to get the dependency tree and store it.

[0111] For example, the component dependency tree format is as follows:

[0112] [INFO]+-org.apache.poi:poi-ooxml:jar:3.10-FINAL:compile

[0113] [INFO]|+-org.apache.poi:poi:jar:3.10-FINAL:compile

[0114] [INFO]||\-commons-codec:commons-codec:jar:1.9:comp ile

[0115] [INFO]|+-org.apache.poi:poi-ooxml-schemas:jar:3.10-FIN AL:compile

[0116] [INFO]|\-dom4j:dom4j:jar:1.6.1:compile

[0117] [INFO]|\-xml-apis:xml-apis:jar:1.0.b2:compile

[0118] In the dependency tree above, `[INFO]+-org.apache.poi:poi-ooxml:jar:3.10-FINAL:compile` represents third-party components directly imported by the project, while the components listed below are those indirectly imported. Component information is separated by colons. The first field (org.apache.poi) is the component's groupId, the second field (poi-ooxml) is the component's artifactId, and the fourth field (3.10-FINAL) is the component's version number. After parsing, the component name, groupId, artifactId, version number, and parent component information for each component are stored.

[0119] In this embodiment, the third-party component vulnerability detection device calls the corresponding build instructions in the component tree building tool according to the format of the configuration file to execute the component dependency tree building operation, which facilitates quick and easy component location. At the same time, it can distinguish between directly imported components and indirectly imported components, avoiding omissions during component upgrades.

[0120] Furthermore, based on the above embodiments of the third-party component vulnerability detection method of the present invention, a fourth embodiment of the third-party component vulnerability detection method of the present invention is proposed.

[0121] This embodiment is a step following step S40 in the first embodiment. The difference between this embodiment and the above embodiments is that:

[0122] When a project update is detected, retrieve the updated project source code;

[0123] Perform a project build operation based on the updated project source code to obtain a new component dependency tree;

[0124] Obtain the component information of the third-party components corresponding to each node in the new component dependency tree, and perform the step of comparing the component information with the vulnerability information in the preset vulnerability database.

[0125] That is, the third-party component vulnerability detection device detects the status of the project source code in real time. When the project is updated, the third-party component vulnerability detection device obtains the updated project source code. The third-party component vulnerability detection device performs a project build operation based on the updated project source code to obtain a new component dependency tree. The third-party component vulnerability detection device obtains the component information of the third-party components corresponding to each node in the new component dependency tree, and performs the step of comparing the component information with the vulnerability information in the preset vulnerability database in the first embodiment. For details, please refer to the first embodiment, which will not be repeated in this embodiment.

[0126] In this embodiment, the third-party component vulnerability detection device monitors the status of the project source code in real time. When the project source code is updated, it performs project building and component dependency tree building operations on the updated source code. This selectively builds code branches, avoiding the need to build all branches. When code is committed, the latest modified branch can be automatically pulled for building and subsequent scanning. This allows for the discovery of problematic components earlier in the development phase, rather than waiting until later testing or security checks, improving remediation efficiency and reducing remediation costs.

[0127] Reference Figure 3 This invention provides a third-party component vulnerability detection device, which includes:

[0128] The request receiving module 10 is used to receive component vulnerability detection requests and obtain the project source code corresponding to the component vulnerability detection request.

[0129] The component tree building module 20 is used to perform project building operations based on the project source code to obtain the project directory and component dependency tree.

[0130] The comparison module 30 is used to obtain the first information of the third-party components in the project directory and the second information of the third-party components corresponding to each node in the component dependency tree, and compare the first information and the second information as component information with the vulnerability information in the preset vulnerability database.

[0131] The vulnerability location module 40 is used to obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information.

[0132] In one embodiment, the third-party component includes a first type of component and a second type of component; the component tree construction module 20 includes:

[0133] The code scanning unit is used to scan the source code of the project and obtain the configuration file associated with the source code of the project.

[0134] The first judgment unit is used to retrieve the first type of component based on the configuration file associated with the project source code and to determine whether there is a configuration file associated with the first type of component.

[0135] The second judgment unit is used to, if there is a configuration file associated with the first type of component, retrieve the second type of component according to the configuration file associated with the first type of component, and determine whether there is a configuration file associated with the second type of component.

[0136] The component retrieval unit is used to retrieve new second-type components based on the configuration files associated with the second-type components, until there are no configuration files associated with the new second-type components.

[0137] A dependency tree building unit is used to assign the first type of component to the parent node, the second type of component to the child node, and the new second type of component to the new child node to build a component dependency tree.

[0138] In one embodiment, the component tree construction module 20 includes:

[0139] The scanning build unit is used to call a preset integration tool to scan the project source code to build the project, and obtain the build code corresponding to the project source code and the project directory of the build code;

[0140] The traversal judgment unit is used to traverse the project directory of the build code and determine whether there is a configuration file associated with the build code;

[0141] The format acquisition unit is used to acquire the file format of the configuration file associated with the build code if a configuration file associated with the build code exists.

[0142] The tool invocation unit is used to select and invoke a preset component tree construction instruction according to the file format to construct a component dependency tree.

[0143] In one embodiment, the acquisition and comparison module 30 includes:

[0144] The first acquisition unit is used to acquire third-party components in the project directory, as well as component operation information and component call information of the third-party components, and to use the component operation information and component call information as first information;

[0145] The second acquisition unit is used to acquire the third-party components corresponding to each node in the component dependency tree, as well as the component name, component identifier, component version number and component path of the third-party components, and to use the component name, component identifier, component version number and component path as second information;

[0146] An information storage unit is used to store the first information and the second information as component information and save the component information to a preset component information list;

[0147] The information comparison unit is used to compare the component information in the component information list with the vulnerability information in the preset vulnerability database.

[0148] In one embodiment, the third-party component vulnerability detection device includes:

[0149] The first determination module is used to determine that the component information and the vulnerability information do not match if the component name in the component information is different from the component name in the vulnerability information.

[0150] The version number comparison module is used to compare the first component version number corresponding to the component name in the component information with the second component version number corresponding to the component name in the vulnerability information if the component name in the component information is the same as the component name in the vulnerability information.

[0151] The second determination module is used to determine whether the component information matches the vulnerability information if the version number of the first component is less than or equal to the version number of the second component.

[0152] In one embodiment, the vulnerability location module 40 includes:

[0153] A component location unit is used to acquire target component information that matches the vulnerability information, and locate the target third-party component based on the target component information.

[0154] The node determination unit is used to query the component dependency tree to determine whether there is a parent node third-party component associated with the target third-party component;

[0155] The first upgrade unit is used to determine that the target third-party component is a directly imported component and upgrade the target third-party component if there is no parent node third-party component associated with the target third-party component.

[0156] The second upgrade unit is used to determine that the target third-party component is an indirectly introduced component if there is a parent node third-party component associated with the target third-party component, and to trace back to the directly introduced component according to the component dependency tree, and to synchronously upgrade the target third-party component and all third-party components on the branch of the directly introduced component.

[0157] In one embodiment, the third-party component vulnerability detection device includes:

[0158] The update acquisition module is used to acquire the updated project source code when an update is detected.

[0159] The project build module is used to perform project build operations based on the updated project source code to obtain a new component dependency tree;

[0160] The acquisition and comparison module is used to acquire the component information of the third-party components corresponding to each node in the new component dependency tree, and to perform the step of comparing the component information with the vulnerability information in the preset vulnerability database.

[0161] In this embodiment, by constructing a component dependency tree, the dependency relationships between various third-party components can be determined, and components that are directly introduced and indirectly introduced can be distinguished. When a vulnerability occurs in a component, the component information of the third-party component can be obtained based on the component dependency tree, which facilitates quick and accurate location of the target third-party component to be upgraded, improves the efficiency of repairing vulnerable components, and reduces false alarms.

[0162] The methods implemented when the various modules in the third-party component vulnerability detection device are executed in this embodiment can be referred to the various embodiments of the third-party component vulnerability detection method of the present invention, and will not be repeated here.

[0163] In this embodiment of the invention, a computer storage medium is also provided.

[0164] The present invention stores a third-party component vulnerability upgrade program on a computer storage medium. When the third-party component vulnerability upgrade program is executed by the processor, it implements the steps of the third-party component vulnerability detection method described above.

[0165] The method implemented when the third-party component vulnerability upgrade program running on the processor is executed can be referred to in various embodiments of the third-party component vulnerability detection method of the present invention, and will not be repeated here.

[0166] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0167] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0168] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0169] The above are merely preferred embodiments of the present invention and do not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for detecting vulnerabilities in third-party components, characterized in that, The third-party component vulnerability detection method includes the following steps: Receive a component vulnerability detection request and obtain the project source code corresponding to the component vulnerability detection request; Execute a project build operation based on the project source code to obtain the project directory and component dependency tree; The step of performing a project build operation based on the project source code to obtain the project directory and component dependency tree includes: scanning the project source code to obtain the configuration file associated with the project source code; pulling a first type of component from the component server based on the configuration file associated with the project source code, and determining whether there is a configuration file associated with the first type of component; if there is a configuration file associated with the first type of component, pulling a second type of component based on the configuration file associated with the first type of component, and determining whether there is a configuration file associated with the second type of component; pulling a new second type of component based on the configuration file associated with the second type of component, until there is no configuration file associated with the new second type of component; assigning the first type of component to a parent node, assigning the second type of component to a child node, and assigning the new second type of component to a new child node to construct the component dependency tree; Obtain first information of third-party components in the project directory and second information of third-party components corresponding to each node in the component dependency tree. Compare the first information and the second information as component information with vulnerability information in a preset vulnerability database. The third-party components include the first type of components and the second type of components. Obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information.

2. The third-party component vulnerability detection method as described in claim 1, characterized in that, The step of performing a project build operation based on the project source code to obtain the project directory and component dependency tree further includes: The preset integration tool is invoked to scan the project source code and build the project, thereby obtaining the build code corresponding to the project source code and the project directory of the build code; Traverse the project directory of the build code to determine if there is a configuration file associated with the build code; If a configuration file associated with the build code exists, obtain the file format of the configuration file associated with the build code; Based on the file format, select and invoke the preset component tree construction instruction to construct the component dependency tree.

3. The third-party component vulnerability detection method as described in claim 1, characterized in that, The step of obtaining first information about third-party components in the project directory and second information about third-party components corresponding to each node in the component dependency tree, and comparing the first information and the second information as component information with vulnerability information in a preset vulnerability database, includes: Obtain third-party components in the project directory, as well as component runtime information and component call information of the third-party components, and use the component runtime information and component call information as the first information; Obtain the third-party components corresponding to each node in the component dependency tree, as well as the component name, component identifier, component version number, and component path of the third-party components, and use the component name, component identifier, component version number, and component path as the second information; The first information and the second information are used as component information, and the component information is saved to a preset component information list; The component information in the component information list is compared with the vulnerability information in the preset vulnerability database.

4. The third-party component vulnerability detection method as described in claim 1, characterized in that, After the steps of obtaining the first information of third-party components in the project directory and the second information of third-party components corresponding to each node in the component dependency tree, and comparing the first information and the second information as component information with vulnerability information in a preset vulnerability database, the method includes: If the component name in the component information is different from the component name in the vulnerability information, then the component information and the vulnerability information are determined to be mismatched. If the component name in the component information is the same as the component name in the vulnerability information, then the first component version number corresponding to the component name in the component information is compared with the second component version number corresponding to the component name in the vulnerability information. If the version number of the first component is less than or equal to the version number of the second component, then the component information is determined to match the vulnerability information.

5. The third-party component vulnerability detection method as described in claim 1, characterized in that, The step of obtaining target component information matching the vulnerability information and locating the target third-party component based on the target component information includes: Obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information; Query the component dependency tree to determine whether there is a parent node third-party component associated with the target third-party component; If there is no parent node third-party component associated with the target third-party component, then the target third-party component is determined to be a directly imported component, and the target third-party component is upgraded. If there is a parent node third-party component associated with the target third-party component, the target third-party component is determined to be an indirectly introduced component. The component dependency tree is then traced back to the directly introduced component, and all third-party components on the target third-party component and its directly introduced branch are synchronously upgraded.

6. The third-party component vulnerability detection method as described in any one of claims 1-5, characterized in that, After the steps of obtaining target component information matching the vulnerability information and locating the target third-party component based on the target component information, the method further includes: When a project update is detected, retrieve the updated project source code; Perform a project build operation based on the updated project source code to obtain a new component dependency tree; Obtain the component information of the third-party components corresponding to each node in the new component dependency tree, and perform the step of comparing the component information with the vulnerability information in the preset vulnerability database.

7. A third-party component vulnerability detection device, characterized in that, The third-party component vulnerability detection device includes: The request receiving module is used to receive component vulnerability detection requests and obtain the project source code corresponding to the component vulnerability detection request. The component tree building module is used to perform project building operations based on the project source code to obtain the project directory and component dependency tree. The component tree construction module includes: a code scanning unit for scanning the project source code to obtain configuration files associated with the project source code; a first judgment unit for pulling a first type of component from the component server based on the configuration files associated with the project source code and determining whether a configuration file associated with the first type of component exists; a second judgment unit for pulling a second type of component based on the configuration files associated with the first type of component if a configuration file associated with the first type of component exists, and determining whether a configuration file associated with the second type of component exists; a component pulling unit for pulling a new second type of component based on the configuration files associated with the second type of component until no configuration file associated with the new second type of component exists; and a dependency tree construction unit for assigning the first type of component to a parent node, assigning the second type of component to a child node, and assigning the new second type of component to a new child node to construct a component dependency tree. The comparison module is used to obtain the first information of the third-party components in the project directory and the second information of the third-party components corresponding to each node in the component dependency tree, and compare the first information and the second information as component information with the vulnerability information in the preset vulnerability database. The third-party components include the first type of components and the second type of components. The vulnerability location module is used to obtain target component information that matches the vulnerability information, and locate the target third-party component based on the target component information.

8. A third-party component vulnerability detection device, characterized in that, The third-party component vulnerability detection device includes: a memory, a processor, and a third-party component vulnerability upgrade program stored on the memory and capable of running on the processor; When the third-party component vulnerability upgrade program is executed by the processor, it implements the steps of the third-party component vulnerability detection method as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that, The computer storage medium stores third-party component vulnerability upgrade programs. When the third-party component vulnerability upgrade program is executed by the processor, it implements the steps of the third-party component vulnerability detection method as described in any one of claims 1 to 6.

Images