A method and apparatus for security hardening based on programming language libraries

Abstract

The application discloses a security reinforcement method and device based on a programming language library, and aims to solve the technical problem that site administrators currently usually manually reinforce the security of sites, and the sites are prone to missing replacement and missing modification. The method comprises the following steps: obtaining a programming language script matched with a regular expression from a target folder storing a script file according to the regular expression; renaming a script name corresponding to the programming language script according to a preset script dictionary, so as to obtain a specified script name after renaming; determining a hyper text markup language document referencing the programming language script, and modifying the name of the programming language script referenced in the hyper text markup language document according to the specified script name.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a security reinforcement method and device based on programming language library. BACKGROUND

[0002] Programming language refers to a language with certain syntax rules that can be accepted and processed by a computer, such as jQuery. jQuery is a fast and simple JavaScript framework that encapsulates commonly used JavaScript code. It provides a simple JavaScript design pattern and optimizes HTML document operations, event handling, animation design and Ajax interaction.

[0003] However, as the version of jQuery is continuously released, the security vulnerability problem of the old version of jQuery, such as xss problem, is increasingly prominent. Therefore, in order to ensure the security of the website, security reinforcement of jQuery is often required when building a website. The current jQuery security reinforcement usually adopts a manual method. However, for large websites that rely on multiple versions of jQuery, manual reinforcement may result in missed changes or missed modifications, which cannot achieve the expected security reinforcement effect. SUMMARY

[0004] In order to solve the above problems, the present application provides a security reinforcement method based on programming language library, which comprises: obtaining a programming language script matched with a regular expression from a target folder storing a script file according to a preset regular expression; renaming a script name corresponding to the programming language script according to a preset script dictionary to obtain a specified script name after renaming; determining a hypertext markup language document referencing the programming language script, and modifying the name of the programming language script referenced in the hypertext markup language document according to the specified script name.

[0005] In an implementation manner of the present application, after obtaining the specified script name after renaming, the method further comprises: in response to a scanning operation on the programming language script, performing fuzzy processing on the version number of the programming language script; the fuzzy processing is used to modify the version number of the programming language script into a fuzzy version number different from the original state.

[0006] In an implementation manner of the present application, the programming language script matched with the regular expression is obtained, specifically comprising: matching the corresponding programming language script from the target folder storing the script file according to the preset regular expression, and determining the storage path and the script name of the programming language script; writing the storage path into a path log, and writing the script name into a name log.

[0007] In an implementation form of the present application, before renaming the script name corresponding to the programming language script, the method further comprises: obtaining version information contained in the script names of the plurality of programming language scripts, and classifying the plurality of programming language scripts according to the major version number in the version information; determining version information definition rules corresponding to each class, and defining the version information of the plurality of programming language scripts according to the version information definition rules to generate a script dictionary.

[0008] The embodiment of the present application provides a secure hardening device based on a programming language library in an application scenario, and the device comprises:

[0009] at least one processor; and

[0010] a memory in communication connection with the at least one processor; wherein

[0011] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0012] According to a preset regular expression, a programming language script matched with the regular expression is obtained from a target folder storing script files;

[0013] According to a preset script dictionary, a script name corresponding to the programming language script is renamed to obtain a specified script name after renaming;

[0014] A hypertext markup language document referencing the programming language script is determined, and the name of the programming language script referenced in the hypertext markup language document is modified according to the specified script name.

[0015] The embodiment of the present application provides a secure hardening method based on a programming language library, and the method comprises: according to a preset regular expression, a programming language script matched with the regular expression is obtained from a target folder storing script files; a secure script of the programming language script is obtained, and a script name corresponding to the secure script is renamed to obtain a specified script name after renaming; the programming language script in the target folder is deleted, and the secure script is migrated to a storage path corresponding to the programming language script; a hypertext markup language document referencing the programming language script is determined; the name of the programming language script referenced in the hypertext markup language document is modified according to the specified script name after renaming, and a reference address of a version migration auxiliary script is added in the hypertext markup language document.

[0016] In an implementation form of the present application, after obtaining the specified script name after renaming, the method further comprises: obtaining a version migration auxiliary script, and storing the version migration auxiliary script to the root directory of the target folder.

[0017] In an implementation form of the present application, the programming language script is a jQuery script.

[0018] In an implementation form of the present application, the second version number of the security script is higher than the first version number of the programming language script.

[0019] The embodiments of the present application provide a security reinforcement device based on a programming language library in another application scenario, and the device comprises:

[0020] at least one processor; and

[0021] a memory in communication connection with the at least one processor; wherein

[0022] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0023] According to a preset regular expression, a programming language script matched with the regular expression is obtained from a target folder storing a script file;

[0024] obtain a security script of the programming language script, and rename a script name corresponding to the security script to obtain a specified script name after renaming;

[0025] delete the programming language script in the target folder, and migrate the security script to a storage path corresponding to the programming language script;

[0026] determine a hypertext markup language document referencing the programming language script;

[0027] According to the specified script name, the name of the programming language script referenced in the hypertext markup language document is modified, and a reference address of a version migration auxiliary script is added in the hypertext markup language document.

[0028] The security reinforcement method based on the programming language library provided by the present application can bring the following beneficial effects:

[0029] The programming language script is matched by the regular expression, the script name of the programming language script is renamed, and the version number of the programming language script is processed. In this way, the security reinforcement of the programming language script can be realized without changing the reference program of the hypertext markup language document, which is more stable and more convenient. The security script of the programming language script is obtained, and the original programming language script is replaced by the high-version security script. In this way, the security vulnerability that may exist in the low-version script is avoided by the migration and replacement of the script version, which is more secure. The reference address of the version migration auxiliary script is added in the hypertext markup language document, and the compatibility between different versions of the programming language script is realized. BRIEF DESCRIPTION OF DRAWINGS

[0030] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0031] Figure 1 A flowchart of a security hardening method based on a programming language library provided by an embodiment of the application;

[0032] Figure 2 An execution flowchart provided by an embodiment of the application;

[0033] Figure 3 A flowchart of another security hardening method based on a programming language library provided by an embodiment of the application;

[0034] Figure 4 Another execution flowchart provided by an embodiment of the application;

[0035] Figure 5 A structural diagram of a security hardening device based on a programming language library in an application scenario provided by an embodiment of the application;

[0036] Figure 6 A structural diagram of another security hardening device based on a programming language library in an application scenario provided by an embodiment of the application. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the application clearer, the technical solutions of the application will be described clearly and completely below in conjunction with the embodiments of the application and the corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the application, but not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0038] The technical solutions provided by the embodiments of the application will be described in detail below with reference to the drawings.

[0039] As shown in the drawings, the security hardening method based on a programming language library provided by an embodiment of the application comprises: Figure 1 S101: According to a preset regular expression, a programming language script matched with the regular expression is obtained from a target folder in which a script file is stored.

[0040]

[0041] ​The regular expression is a pre-written matching rule for matching the corresponding programming language script (for example, a jQuery script) from the target folder storing the script file. The server can determine the storage path of the jQuery script matched with the regular expression through string matching, so as to obtain the jQuery script from the target folder storing the script file. While obtaining the jQuery script, the server also determines the storage path and the script name of the jQuery script, and writes the storage path into the path log and the script name into the name log. The server records the matching information log, so that the error reason can be determined according to the log when an error occurs later.

[0042] S102: Renaming the script name corresponding to the programming language script according to the preset script dictionary, to obtain a specified script name after renaming.

[0043] The security reinforcement of the jQuery script is essentially a process of hiding the real version information of the jQuery script. After obtaining the jQuery script, if the version information is to be hidden, the jQuery script needs to be renamed according to the rule in the script dictionary.

[0044] In an embodiment, the script dictionary is a self-defined script name renaming rule. The server obtains the version information contained in the script names of a plurality of jQuery scripts, and classifies the plurality of jQuery scripts according to the major version number in the version information. For example, the server obtains the script names of the jQuery scripts as jquery-3.0.0.js, jquery-3.1.1.js, jquery-2.1.4.js and jquery-1.11.1.js. For the script name of the name jquery-3.0.0.js, the script name includes the easily exposed version information 3.0.0, wherein the numbers of the version number from left to right represent the major version number, the sub-version number and the stage version number.

[0045] The server can classify the obtained jQuery scripts according to the major version number in the version information, and formulate corresponding version information definition rules for each category, that is, jQuery scripts with the same major version number are listed in the same category and have the same version information definition rule. For each category, the server can define the version information of each jQuery script included in the category according to the version information definition rule, thereby determining the mapping relationship between the original version information and the redefined version information of the jQuery script according to the redefined version information, and generating a script dictionary for multiple jQuery scripts, which includes the redefined script names of jQuery scripts with different version numbers. The version information definition rule defines the version information in the script name, and the major version number information is reserved to a certain extent, and the other version number information is defined ambiguously. For example, the major version number of jquery-2.1.4.js is 2, and the major version number of jquery-1.11.1.js is 1, which belong to two different categories, while jquery-3.0.0.js and jquery-3.1.1.js belong to the same category because their major version numbers are 3. Through the version definition rule, jquery-1.11.1.js is defined as jquery.n1.js, jquery-2.1.4.js is defined as jquery.n2.js, and jquery-3.0.0.js and jquery-3.1.1.js are defined as jquery.n3.js. In this way, the script dictionary has definition rules for multiple jQuery scripts with different versions, and through the mapping relationship between the original version information and the redefined version information, the exposed version information in the script name can be hidden, achieving the purpose of security reinforcement.

[0046] After hiding the script name of the jQuery script, the server will also respond to the scanning operation for the jQuery script and perform fuzzy processing on the version number of the jQuery script after opening the jQuery. For example, the version number 1.11.1 of jquery-1.11.1.js is modified to a fuzzy version number 9.9.9 different from the original state. It should be noted that when performing fuzzy processing, the fuzzy version number should be different from the major version number, the minor version number and the stage version number of the original version number, so as to achieve the purpose of re-enforcing the version information of the jQuery script through the fuzzy version number.

[0047] S103: Determine the hypertext markup language document referencing the programming language script, and modify the name of the programming language script referenced in the hypertext markup language document according to the specified script name.

[0048] The server determines a Hyper Text Markup Language (HTML) document referencing the jQuery script, and determines the reference address of the jQuery script and the script name of the jQuery script from the HTML document. Then, according to a preset script dictionary, a specified script name that has a mapping relationship with the script name of the jQuery script is determined, and the original script name of the jQuery script is changed to the specified script name. For example, the reference address of the jQuery script in the HTML document is <script src＝" src lib jquery-3.0.0.js">< / script> , and the specified script name of the jQuery script is jquery.n3.js, the server changes the corresponding script name to jquery.n3.js, and changes the script reference address to <script src＝" src lib jquery-3.0.0.js">< / script> . Thus, the security reinforcement of the jQuery script is completed. This reinforcement method does not need to modify the reference code additionally, and has high stability.

[0049] Figure 2 An execution flow diagram provided by an embodiment of the present application is shown in FIG. 1. As shown in FIG. 1, the server scans a target path where a target folder is located by using a regular expression, to obtain the script name and storage path of a jQuery script. According to a preset script dictionary, the jQuery script obtained is renamed, and the reference name and reference path in an HTML document referencing the jQuery script are modified. Figure 2

[0050] The above is a security reinforcement method based on a programming language library provided by an embodiment of the present application, which is suitable for a site requiring high stability. The present application also provides a security reinforcement method based on a programming language library, which aims to improve the security of the reinforcement process. The flow is shown in FIG. 2. Figure 3

[0051] S301: According to a preset regular expression, a programming language script matched with the regular expression is obtained from a target folder storing script files.

[0052] The server can determine the storage path of the jQuery script matched with the regular expression by string matching through the regular expression, so as to obtain the jQuery script from the target folder storing script files. While obtaining the jQuery script, the server also determines the storage path of the jQuery script, and writes the storage path into a path log, so that the error cause can be determined according to the log when an error occurs later.

[0053] S302: A security script of the programming language script is obtained, and the script name corresponding to the security script is renamed to obtain a specified script name after renaming. ​​

[0054] Since the low version (also referred to as the old version) of the jQuery script is less secure, when performing security reinforcement, the original low version jQuery script is generally replaced with a high version secure script to ensure the security of the site. For example, the high version (also referred to as the new version) of the jquery-3.0.0.js secure script can be jquery-3.4.0.js. After obtaining the secure script, the server also needs to rename the script name to further ensure the security of the script. It should be noted that the renaming here can be achieved by using the script dictionary mentioned above.

[0055] However, compatibility problems are prone to occur when referencing the high version secure script. To ensure smooth migration of the jQuery script, after renaming the high version secure script of the jQuery script, the server needs to obtain the version migration auxiliary script jquery-migrate.js and store it in the root directory of the target folder for subsequent reference.

[0056] S303: Delete the programming language script in the target folder, and migrate the secure script to the storage path corresponding to the programming language script.

[0057] After adding the version migration auxiliary script under the root directory of the target folder, the server needs to delete the jQuery script in the target folder and migrate the secure script to the storage path corresponding to the jQuery script, so as to realize the version migration of the jQuery script.

[0058] S304: Determine the Hyper Text Markup Language (HTML) document referencing the programming language script.

[0059] The server determines the Hyper Text Markup Language (HTML) document referencing the jQuery script, and determines the reference address of the jQuery script and the script name of the jQuery script from the HTML document. For example, the reference address of the jquery-3.0.0.js script is <script src＝" src lib jquery-3.0.0.js">< / script> .

[0060] S305: Modify the name of the programming language script referenced in the Hyper Text Markup Language (HTML) document according to the specified script name, and add the reference address of the version migration auxiliary script in the Hyper Text Markup Language (HTML) document.

[0061] The server replaces the original script name of the jQuery script in the reference address with the specified script name of the safe script, for example, the high version safe script of jquery-3.0.0.js is jquery-3.4.0.js, and the script name of jquery-3.4.0.js is renamed to jquery.n3.js. The server can change the original script name to jquery.n3.js, and accordingly, the reference address is changed to <script src＝" src lib jquery.n3.js">< / script> At this time, the server also needs to add the reference address of the version migration auxiliary script of the jQuery script in the reference path, that is, <script src=" / src / lib / jquery-migrate.js">. By adding the version migration auxiliary script, the forward compatibility of the interface can be met after the original low version jQuery script is replaced by the high version safe script, and the low version script is compatible while the low version jQuery script is secured. This kind of reinforcement method is safer, but the compatibility of the version may be affected after reinforcement, so additional modification of the reference code is often required.

[0062] Figure 4 Another execution flow diagram provided by an embodiment of the present application is provided. As shown in Figure 4 , the window form scans the target path where the target folder is located to determine the storage path of the jQuery script, obtains the high version safe script and the version migration auxiliary script of the jQuery script, and places the migration auxiliary script in the root directory of the target folder. In the original storage path of the jQuery script, the high version safe script is replaced by the original jQuery script, and the script name in the HTML document referring to the jQuery script is modified.

[0063] The server realizes the visualization of the jQuery script reinforcement process through the winform window form technology. The site operation and maintenance personnel can trigger the operation through the visual interface constructed by the window form to call the server to execute the corresponding reinforcement method, and realize the security reinforcement of the jQuery script.

[0064] The above is the method embodiment provided by the present application. Based on the same idea, some embodiments of the present application also provide a device corresponding to the above method.

[0065] Figure 5 A structure diagram of a security reinforcement device based on a programming language library in an application scenario provided by an embodiment of the present application is provided. As shown in Figure 5 , the device comprises:

[0066] at least one processor; and

[0067] a memory in communication connection with the at least one processor; wherein

[0068] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0069] According to a preset regular expression, a programming language script matched with the regular expression is obtained from a target folder storing a script file;

[0070] According to a preset script dictionary, a script name corresponding to the programming language script is renamed to obtain a specified script name after renaming;

[0071] A hypertext markup language document referencing the programming language script is determined, and the name of the programming language script referenced in the hypertext markup language document is modified according to the specified script name.

[0072] Figure 6 Another application scenario of the security reinforcement device based on the programming language library provided by the embodiment of the application is provided. As shown in Figure 6 The device includes:

[0073] at least one processor; and

[0074] a memory in communication connection with the at least one processor; wherein

[0075] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0076] According to a preset regular expression, a programming language script matched with the regular expression is obtained from a target folder storing a script file;

[0077] A safe script of the programming language script is obtained, and a script name corresponding to the safe script is renamed to obtain a specified script name after renaming;

[0078] The programming language script in the target folder is deleted, and the safe script is migrated to a storage path corresponding to the programming language script;

[0079] A hypertext markup language document referencing the programming language script is determined;

[0080] According to the specified script name, the name of the programming language script referenced in the hypertext markup language document is modified, and a reference address of a version migration auxiliary script is added in the hypertext markup language document.

[0081] Each of the embodiments in the present application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0082] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0083] The above only describes the embodiments of the present application and is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of the claims of the present application.

Claims

1. A method for security hardening based on programming language libraries, characterized by, The method comprises: According to the preset regular expression, the programming language script matched with the regular expression is obtained from the target folder storing the script file; According to the preset script dictionary, the script name corresponding to the programming language script is renamed to obtain the specified script name after renaming; Determine the hypertext markup language document referencing the programming language script, and modify the name of the programming language script referenced in the hypertext markup language document according to the specified script name; After obtaining the specified script name after renaming, the method further comprises: In response to the scanning operation for the programming language script, the version number of the programming language script is processed; the processing is used to modify the version number of the programming language script to a fuzzy version number different from the original state.

2. The method of claim 1, wherein, Obtaining the programming language script matched with the regular expression comprises: According to the preset regular expression, the corresponding programming language script is matched from the target folder storing the script file, and the storage path and script name of the programming language script are determined; The storage path is written into the path log, and the script name is written into the name log.

3. The method of claim 1, wherein the method further comprises: Before renaming the script name corresponding to the programming language script, the method further comprises: Obtain the version information contained in the script name of the plurality of programming language scripts, classify the plurality of programming language scripts according to the major version number in the version information; Determine the version information definition rule corresponding to each category, and define the version information of the plurality of programming language scripts according to the version information definition rule to generate a script dictionary.

4. A security-hardened device based on a programming language library, characterized by, The device comprises: At least one processor; and The memory is in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to: According to the preset regular expression, the programming language script matched with the regular expression is obtained from the target folder storing the script file; According to the preset script dictionary, the script name corresponding to the programming language script is renamed to obtain the specified script name after renaming; Determine the hypertext markup language document referencing the programming language script, and modify the name of the programming language script referenced in the hypertext markup language document according to the specified script name; After obtaining the specified script name after renaming, the method further comprises: In response to the scanning operation for the programming language script, the version number of the programming language script is processed; the processing is used to modify the version number of the programming language script to a fuzzy version number different from the original state.

5. A method for security hardening based on a programming language library, characterized by, The method comprises: According to the preset regular expression, the programming language script matched with the regular expression is obtained from the target folder storing the script file; Obtain the security script of the programming language script, and rename the script name corresponding to the security script to obtain the specified script name after renaming; delete the programming language script in the target folder, and migrate the security script to a storage path corresponding to the programming language script; determine a hypertext markup language document referencing the programming language script; modify a name of the programming language script referenced in the hypertext markup language document according to the specified script name, and add a reference address of a version migration auxiliary script in the hypertext markup language document; after obtaining the renamed specified script name, the method further includes: in response to a scanning operation on the programming language script, perform fuzzy processing on a version number of the programming language script; the fuzzy processing is used to modify the version number of the programming language script to a fuzzy version number different from an original state.

6. The method of claim 5, wherein the method further comprises: after obtaining the renamed specified script name, the method further includes: obtain a version migration auxiliary script, and store the version migration auxiliary script at a root directory of the target folder.

7. The method of claim 5, wherein the method further comprises: The programming language script is a jQuery script.

8. The method of claim 5, wherein the method further comprises: The second version number of the security script is higher than the first version number of the programming language script.

9. A security-hardened device based on a programming language library, characterized by, The device includes: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to: obtain, from a target folder storing script files, a programming language script matched with a preset regular expression according to the regular expression; obtain a security script of the programming language script, and rename a script name corresponding to the security script to obtain a renamed specified script name; delete the programming language script in the target folder, and migrate the security script to a storage path corresponding to the programming language script; determine a hypertext markup language document referencing the programming language script; modify a name of the programming language script referenced in the hypertext markup language document according to the specified script name, and add a reference address of a version migration auxiliary script in the hypertext markup language document; after obtaining the renamed specified script name, the method further includes: in response to a scanning operation on the programming language script, perform fuzzy processing on a version number of the programming language script; the fuzzy processing is used to modify the version number of the programming language script to a fuzzy version number different from an original state.

Images