Static code scanning method and device

Abstract

The embodiments of this specification provide a static code scanning method and device, wherein the static code scanning method includes: constructing a syntax recognizer based on a specified programming language in advance, wherein the syntax recognizer is used to recognize the syntax of multiple programming languages, and at least one of the multiple programming languages ​​is different from the specified programming language; obtaining the target static code to be scanned, wherein the programming language of the target static code belongs to any one or more programming languages ​​among the multiple programming languages; inputting the target static code into the syntax recognizer for parsing, and obtaining a syntax tree corresponding to the target static code in the specified programming language; and determining the scanning result of the target static code in the specified programming language based on the syntax tree. Static codes in different programming languages ​​can be scanned, and the obtained syntax trees and scanning results are all in the specified programming language, which allows developers to quickly get started and perform subsequent maintenance.

Description

Technical Field

[0001] The embodiments of the present specification relate to the technical field of static code scanning, and in particular to a static code scanning method. Background Art

[0002] With the continuous development of computer technology, software development has also entered a period of rapid development. When developing software, it is necessary to test the code in the software by checking for leaks and filling gaps. Among them, static code scanning is a technical means of using scanning tools to check for leaks and fill gaps in software codes.

[0003] In the prior art, when performing static code scanning, different programming languages ​​are scanned using the scanning framework corresponding to the programming language, which requires developers or maintenance personnel to master multiple programming languages, which increases learning and maintenance costs. Therefore, an effective solution is urgently needed to solve the above problems. Summary of the invention

[0004] In view of this, an embodiment of this specification provides a static code scanning method. One or more embodiments of this specification also relate to a static code scanning device, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a static code scanning method is provided, including:

[0006] Preliminarily constructing a grammar identifier based on a specified programming language, wherein the grammar identifier is used to identify grammars of multiple programming languages, at least one of the multiple programming languages ​​being different from the specified programming language;

[0007] Acquire a target static code to be scanned, wherein a programming language of the target static code belongs to any one or more programming languages ​​among the multiple programming languages;

[0008] Inputting the target static code into the syntax recognizer for parsing, and obtaining a syntax tree corresponding to the target static code in the specified programming language;

[0009] According to the syntax tree, a scanning result of the target static code in the specified programming language is determined.

[0010] Optionally, the grammar recognizer includes a lexical analyzer and a grammar analyzer;

[0011] Inputting the target static code into the syntax recognizer for parsing, and obtaining a syntax tree corresponding to the target static code in the specified programming language, including:

[0012] Inputting the target static code into the lexical analyzer for lexical analysis, and outputting a byte symbol stream corresponding to the target static code in the specified programming language;

[0013] The byte symbol stream is input into the syntax analyzer for syntax analysis, and a syntax tree corresponding to the target static code in the specified programming language is output.

[0014] Optionally, inputting the target static code into the lexical analyzer for lexical analysis includes:

[0015] Converting the target static code into a character stream;

[0016] The character stream is input to the lexical analyzer for lexical analysis.

[0017] Optionally, a grammar recognizer is pre-built based on a specified programming language, including:

[0018] Predefine a syntax template corresponding to each programming language in the multiple programming languages;

[0019] The syntax templates corresponding to the programming languages ​​are input into a preset code generator, and converted based on the specified programming language to obtain the syntax identifier.

[0020] Optionally, determining a scanning result of the target static code in the specified programming language according to the syntax tree includes:

[0021] Traversing the syntax tree, and extracting string literals in the syntax tree;

[0022] A scanning result of the target static code in the specified programming language is generated according to the string literal.

[0023] Optionally, traversing the syntax tree to extract string literals in the syntax tree includes:

[0024] Traversing the syntax tree to determine at least one literal syntax node of the syntax tree;

[0025] According to the at least one literal syntax node, a string literal in the syntax tree is extracted.

[0026] Optionally, extracting the string literal in the syntax tree according to the at least one literal syntax node includes:

[0027] For any literal syntax node, determine whether the string literal corresponding to the literal syntax node is compliant according to the preset compliance conditions;

[0028] If so, extract the string literal corresponding to the literal syntax node.

[0029] Optionally, after extracting the string literal corresponding to the literal syntax node, the following is further included:

[0030] Mark the string literal with a compliance flag.

[0031] Optionally, after determining the scanning result of the target static code in the specified programming language according to the syntax tree, the method further includes:

[0032] The scanning result is parsed to determine and display the vulnerability of the target static code.

[0033] Optionally, parsing the scan result to determine and display the vulnerability of the target static code includes:

[0034] Parsing the scan results to determine vulnerabilities in the target static code;

[0035] The scanning result and the target static code are displayed in combination, and the vulnerabilities of the target static code are marked.

[0036] According to a second aspect of the embodiments of this specification, a static code scanning device is provided, including:

[0037] A construction module is configured to construct a grammar identifier based on a specified programming language in advance, wherein the grammar identifier is used to recognize grammars of multiple programming languages, at least one programming language among the multiple programming languages ​​is different from the specified programming language;

[0038] An acquisition module is configured to acquire a target static code to be scanned, wherein a programming language of the target static code belongs to any one or more programming languages ​​among the multiple programming languages;

[0039] A parsing module is configured to input the target static code into the syntax recognizer for parsing, and obtain a syntax tree corresponding to the target static code in the specified programming language;

[0040] The determination module is configured to determine the scanning result of the target static code in the specified programming language according to the syntax tree.

[0041] According to a third aspect of an embodiment of this specification, a computing device is provided, including:

[0042] Memory and processor;

[0043] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the static code scanning method are implemented.

[0044] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned static code scanning method are implemented.

[0045] According to a fifth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned static code scanning method.

[0046] This specification provides a static code scanning method, which pre-builds a syntax recognizer based on a specified programming language, wherein the syntax recognizer is used to recognize the syntax of multiple programming languages, at least one of the multiple programming languages ​​is different from the specified programming language; obtains the target static code to be scanned, wherein the programming language of the target static code belongs to any one or more of the multiple programming languages; inputs the target static code into the syntax recognizer for parsing, and obtains the syntax tree corresponding to the target static code under the specified programming language; according to the syntax tree, determines the scanning result of the target static code under the specified programming language. By pre-building a syntax recognizer based on the specified programming language, static codes of different programming languages ​​can be scanned, and the obtained syntax trees and scanning results are all in the specified programming language, which allows developers to quickly get started and perform subsequent maintenance. In addition, using the static code scanning provided in this specification, hard-coded text hidden in the static code can be scanned in advance, and the copywriting leakage can be managed at the source, improving the multi-language user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a schematic diagram of a page of a cross-line scanning result in the prior art;

[0048] Figure 2 is a flow chart of a static code scanning method provided by an embodiment of this specification;

[0049] Figure 3 It is a structural schematic diagram of a scanning tool in a static code scanning method provided by an embodiment of this specification;

[0050] Figure 4 is a flow chart of another static code scanning method provided by an embodiment of this specification;

[0051] Figure 5 It is a schematic diagram showing the display of scanning results in a static code scanning method provided in one embodiment of the present specification;

[0052] Figure 6 is a flowchart of another static code scanning method provided by an embodiment of this specification;

[0053] Figure 7 is a processing flow chart of a static code scanning method provided by an embodiment of this specification;

[0054] Figure 8 It is a structural schematic diagram of a static code scanning device provided by an embodiment of this specification;

[0055] Fig. 9 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0056] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0057] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0058] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0059] First, the terms involved in one or more embodiments of this specification are explained.

[0060] ANTLR (ANother Tool for Language Recognition): A parser generator framework for programming language recognition.

[0061] Code Gen: Code generation technology that can generate different target codes based on custom templates.

[0062] Visitor pattern: a design pattern that separates data operations from data structures.

[0063] Listener pattern: A variation of the observer pattern. First, the callback function is registered to the observed object. When the observed object changes, the observer / listener is notified through the callback function.

[0064] AST (Abstract Syntax Tree): Abstract syntax tree, an abstract representation of the grammatical structure of source code.

[0065] String literal: refers to a sequence of characters enclosed in two quotation marks or double quotation marks in the code, such as "string" or "literal". String literal is an object of array type.

[0066] Then, the static code scanning method provided in this specification is briefly described.

[0067] With the continuous development of computer technology, software development has also entered a period of rapid development. When developing software, it is necessary to test the code in the software by checking for leaks and filling gaps. Among them, static code scanning is a technical means of using scanning tools to check for leaks and fill gaps in software codes.

[0068] In the prior art, when performing static code scanning, different programming languages ​​are scanned using the scanning framework corresponding to the programming language. This requires developers or maintenance personnel to master multiple programming languages, which increases learning and maintenance costs. Popular static code scanning tools in the industry, such as SonarQube, use different frameworks for different programming languages: org.eclipse.jdt.core is used to scan java (the programming language is Java), and jison (the programming language is JavaScript) is used to scan JavaScript. This means that the maintenance personnel need to master at least two programming languages, Java and JavaScript, to complete the relevant development work, which results in high learning and maintenance costs. In addition, the multilingual user experience on existing PC clients and mobile apps is inferior to the English user experience, and there is a certain amount of text missing, see Figure 1 , Figure 1 This is a page diagram of a cross-line scanning result in the prior art: there are a certain amount of multi-language texts that are missed on the International Station app, and the scanning results of the static code are needed to assist in management. The existing static code scanning does not construct a syntax tree, but only processes the static code line by line, and matches the Chinese characters that appear in it through regular expressions to implement missed translation checks. However, when encountering cross-line scanning results, false positives will occur.

[0069] Therefore, this specification provides a static code scanning method, which pre-builds a syntax recognizer based on a specified programming language, wherein the syntax recognizer is used to recognize the syntax of multiple programming languages, and at least one of the multiple programming languages ​​is different from the specified programming language; obtains the target static code to be scanned, wherein the programming language of the target static code belongs to any one or more programming languages ​​of the multiple programming languages; inputs the target static code into the syntax recognizer for parsing, and obtains the syntax tree corresponding to the target static code under the specified programming language; according to the syntax tree, determines the scanning result of the target static code under the specified programming language. By pre-building a syntax recognizer based on the specified programming language, static codes of different programming languages ​​can be scanned, and the obtained syntax trees and scanning results are all under the specified programming language, which allows developers to quickly get started and perform subsequent maintenance. In addition, using the static code scanning provided in this specification, hard-coded text hidden in the static code can be scanned in advance, and the copywriting leakage can be governed at the source, improving the multi-language user experience.

[0070] In this specification, a static code scanning method is provided. This specification also relates to a static code scanning device, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0071] See also Figure 2 , Figure 2 A flowchart of a static code scanning method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0072] Step 202: Preliminarily construct a grammar identifier based on a specified programming language, wherein the grammar identifier is used to identify grammars of multiple programming languages, at least one of the multiple programming languages ​​is different from the specified programming language.

[0073] The execution subject of the static code scanning method may be a computing device with a static code scanning function, such as a server or terminal with a static code scanning function.

[0074] Specifically, a programming language is a language that can be recognized by both computers and humans, which allows programmers to accurately define the data that the computer needs to use and precisely define the actions that should be taken in different situations; a specified programming language refers to a pre-set programming language, such as a pre-specified programming language in Java, JavaScript, C language, etc.

[0075] In one or more optional embodiments of the present specification, when a grammar recognizer is pre-built based on a specified programming language, a programming language may be pre-designated as the specified programming language, and then a grammar recognizer that can convert multiple programming languages ​​into the specified programming language is built based on a preset building strategy or setting strategy. In this way, the efficiency of building a grammar recognizer can be improved.

[0076] In one or more optional embodiments of the present specification, a grammar template may be set for each programming language, and then a grammar identifier may be generated based on each grammar template and the specified programming language. That is, a grammar identifier may be constructed based on the specified programming language in advance, and the specific implementation process may be as follows:

[0077] Predefine a syntax template corresponding to each programming language in the multiple programming languages;

[0078] The syntax templates corresponding to the programming languages ​​are input into a preset code generator, and converted based on the specified programming language to obtain the syntax identifier.

[0079] Specifically, a syntax template refers to a template for writing static code using a programming language; a code generator refers to a functional module that can generate code.

[0080] In actual applications, corresponding syntax templates can be defined in advance for each programming language, such as a Java syntax template for the Java programming language, a JavaScript syntax template for the JavaScript programming language, an HTML syntax template for the HTML programming language, and an Objective-C syntax template for the Objective-C programming language. Then, each defined syntax template is input to a code generator, which converts each syntax template to generate a syntax recognizer corresponding to the specified programming language.

[0081] It should be noted that the code generator can also generate different syntax recognizers based on each syntax template. For example, the code generator generates a first syntax recognizer corresponding to a specified programming language based on a Java syntax template, the code generator generates a second syntax recognizer corresponding to a specified programming language based on a JavaScript syntax template, the code generator generates a third syntax recognizer corresponding to a specified programming language based on an HTML syntax template, and the code generator generates a fourth syntax recognizer corresponding to a specified programming language based on an Objective-C syntax template.

[0082] In this way, by constructing a grammar recognizer through grammar templates corresponding to each of the multiple programming languages, the grammar recognizer can recognize the grammar or static code corresponding to the multiple programming languages, thereby improving the recognition accuracy of the grammar recognizer.

[0083] Step 204: Acquire a target static code to be scanned, wherein a programming language of the target static code belongs to any one or more programming languages ​​among the multiple programming languages.

[0084] On the basis of constructing a grammar recognizer based on a specified programming language in advance, further, a target static code is obtained.

[0085] Specifically, the static code may be a code written in one programming language, or may be a code written in multiple programming languages, which is not limited in this specification.

[0086] In actual applications, there are many ways to obtain the target static code to be scanned. For example, the operator may send a static code scanning instruction to the execution subject, or send an instruction to obtain the target static code. Accordingly, after receiving the instruction, the execution subject starts to obtain the static code; or the server may automatically obtain the target static code to be scanned at preset time intervals. For example, after a preset time, a server with a static code scanning function automatically obtains the target static code to be scanned; or after a preset time, a terminal with a static code scanning function automatically obtains the target static code to be scanned stored locally. This specification does not limit the method of obtaining the target static code to be scanned.

[0087] Step 206: Input the target static code into the syntax recognizer for parsing to obtain a syntax tree corresponding to the target static code in the specified programming language.

[0088] On the basis of obtaining the target static code to be scanned, the target static code is further input into a syntax recognizer for parsing, thereby obtaining a syntax tree corresponding to the target static code in a specified programming language.

[0089] Specifically, a syntax tree (Syntax tree), also known as an abstract syntax tree (AST), is an abstract representation of the grammatical structure of the source code. It represents the grammatical structure of a programming language in a tree form, and each node on the tree represents a structure in the source code.

[0090] In one or more optional embodiments of the present specification, the acquired target static code to be scanned can be input into a syntax recognizer, which performs syntax recognition on the target static code to obtain an initial syntax tree, and converts the initial syntax tree into a syntax tree in a specified programming language, that is, a syntax tree corresponding to the target static code in the specified programming language. In this way, the efficiency of obtaining the syntax tree can be improved.

[0091] In one or more optional embodiments of the present specification, the syntax recognizer includes a lexical analyzer and a syntax analyzer. At this time, the acquired target static code to be scanned can also be input into the lexical analyzer for lexical analysis, and then input into the syntax analyzer for syntax analysis, so as to obtain the syntax tree corresponding to the target static code in the specified programming language. That is, in the case where the syntax recognizer includes a lexical analyzer and a syntax analyzer, the target static code is input into the syntax recognizer for parsing, and the syntax tree corresponding to the target static code in the specified programming language is obtained. The specific implementation process can be as follows:

[0092] Inputting the target static code into the lexical analyzer for lexical analysis, and outputting a byte symbol stream corresponding to the target static code in the specified programming language;

[0093] The byte symbol stream is input into the syntax analyzer for syntax analysis, and a syntax tree corresponding to the target static code in the specified programming language is output.

[0094] Specifically, a lexical analyzer refers to a program that converts input text into a lexical symbol stream or a byte symbol stream; lexical analysis refers to the process of dividing text into lexical symbol streams or byte symbol streams; a syntactic analyzer refers to a program that converts a lexical symbol stream or a byte symbol stream into a grammatical parse tree or a grammatical tree; syntactic analysis refers to the process of converting a lexical symbol stream or a byte symbol stream into a grammatical parse tree or a grammatical tree.

[0095] In practical applications, the target static code can be input into the lexical analyzer in the syntax recognizer, and the lexical analyzer performs lexical analysis on the target static code, that is, converting the target static code into a byte symbol stream in a specified programming language; and then the byte symbol stream in the specified programming language is input into the syntax analyzer in the syntax recognizer, and the syntax analyzer performs syntax analysis on the byte symbol stream, that is, converting the byte symbol stream in the specified programming language into a syntax tree in the specified programming language. In this way, the accuracy of the acquired byte symbol stream can be improved, and the accuracy of the syntax tree can be further improved, which is conducive to improving the scanning efficiency and accuracy of the target static code.

[0096] It should be noted that the target static code can be directly input into the lexical analyzer for lexical analysis, or the target static code can be first converted into a character stream, and then the character stream is input into the lexical analyzer for lexical analysis. That is, the target static code is input into the lexical analyzer for lexical analysis, and the specific implementation process can also be as follows:

[0097] Converting the target static code into a character stream;

[0098] The character stream is input to the lexical analyzer for lexical analysis.

[0099] In actual applications, the target static code is first converted into a character stream (char stream), and then the converted character stream is passed to the lexer for lexical analysis to obtain the byte symbol stream (token stream) corresponding to the target static code in the specified programming language. In this way, the target static code is first converted into a character stream, and then input into the lexical analyzer for lexical analysis, which is conducive to improving the efficiency and accuracy of lexical analysis.

[0100] For example, lexical analysis and syntax analysis can be implemented by the following code.

[0101] public List <scanresult>scanJsx(String filePath) {

[0102] try (InputStream inputStream = ScannerUtils.readFileAsInputStream(filePath)) {

[0103] / / Pass the charStream to the Lexer

[0104] Lexer lexer = new JavaScriptLexer(CharStreams.fromStream(inputStream));

[0105] / / Get a TokenStream on the Lexer

[0106] TokenStream tokenStream = new CommonTokenStream(lexer);

[0107] / / Create a Parser on the token stream

[0108] JavaScriptParser parser = new JavaScriptParser(tokenStream);

[0109] parser.setBuildParseTree(true); / / Generate the syntax tree

[0110] / / Get the top node of the AST

[0111] JavaScriptParser.ProgramContext programContext = parser.program();

[0112] List <string>lines = ScannerUtils.readAllLines(filePath);

[0113] IRuleCenter ruleCenter = ruleCenterFactory.getRuleCenter(Language.JS); / / Get rules

[0114] JsxListener jsxListener = new JsxListener(filePath, lines,ruleCenter);

[0115] ParseTreeWalker walker = new ParseTreeWalker();

[0116] walker.walk(jsxListener, programContext); / / Start traversing the syntax tree

[0117] List <scanresult>scanResultList = jsxListener.getScanResultList();

[0118] return scanResultList;

[0119] } catch (IOException e) {

[0120] log.error("Failed to scan:{}", filePath, e);

[0121] }

[0122] return new ArrayList<>();

[0123] }

[0124] Step 208: Determine the scanning result of the target static code in the specified programming language according to the syntax tree.

[0125] After the target static code is input into the syntax recognizer for parsing, and then a syntax tree corresponding to the target static code in the specified programming language is obtained, a scanning result of the target static code in the specified programming language is further determined based on the syntax tree.

[0126] In actual applications, after obtaining the syntax tree corresponding to the target static code in the specified programming language, the syntax tree is further analyzed to obtain relevant information of the target static code from the syntax tree, and then the scanning result of the target static code in the specified programming language is obtained based on the relevant information.

[0127] In one or more optional embodiments of the present specification, the syntax tree may be traversed to extract string literals in the syntax tree, and then the scanning result may be determined based on the string literals. That is, the scanning result of the target static code in the specified programming language may be determined. The specific implementation process may be as follows:

[0128] Traversing the syntax tree, and extracting string literals in the syntax tree;

[0129] A scanning result of the target static code in the specified programming language is generated according to the string literal.

[0130] Specifically, a string literal is a sequence of characters enclosed in double quotes.

[0131] In practical applications, the syntax tree can be input into a literal identifier, and the string literal in the syntax tree can be extracted by the literal identifier. Furthermore, the string literal is input into a result generator, and the result generator generates a scan result based on the string literal, that is, a scan result of the target static code in a specified programming language. For example, the result generator writes the string literal into an XML file to obtain a scan result. In this way, the efficiency and accuracy of extracting string literals can be effectively improved, and the efficiency and accuracy of generating scan results can be further improved.

[0132] In one or more optional embodiments of the present specification, when traversing the syntax tree and extracting the string literal in the syntax tree, the literal syntax node in the syntax tree may be determined first, and then the string literal may be extracted based on the literal syntax node. That is, traversing the syntax tree and extracting the string literal in the syntax tree, the specific implementation process may be as follows:

[0133] Traversing the syntax tree to determine at least one literal syntax node of the syntax tree;

[0134] According to the at least one literal syntax node, a string literal in the syntax tree is extracted.

[0135] Specifically, a literal syntax node refers to a syntax node in a syntax tree.

[0136] In practical applications, the syntax tree can be input into the literal recognizer, which traverses the syntax tree, determines each literal syntax node of the syntax tree, and then recognizes and extracts the string literals in each literal syntax node according to the preset extraction rules. In this way, the literal syntax nodes of the syntax tree are first determined, and then the string literals are extracted based on the literal syntax nodes. This can quickly locate the string literals in the target static code, thereby ensuring the integrity and accuracy of the string literals.

[0137] It should be noted that the traditional way to traverse the syntax tree is mainly to use the visitor pattern, which is a good choice when traversing a relatively simple syntax tree. The visitor pattern requires developers to manually visit each literal syntax node in the syntax tree, which can control the process of traversing the syntax tree, and each visit method has a return value. However, developers must visit literal syntax nodes through explicit method calls, such as (manually calling the visit function). If you forget to visit a literal syntax node, the child nodes of the literal syntax node will not be visited. For complex syntax trees, such as the syntax tree of JSX, 200+ literal syntax nodes will bring expensive development costs.

[0138] See also Figure 3 , Figure 3 It is a structural diagram of a scanning tool in a static code scanning method provided by an embodiment of the present specification, that is, a structural diagram of ANTLR4, including a scanning main entry, a lexical analyzer, a syntax analyzer, a literal identifier and a listener. Among them, the scanning main entry is used to obtain the target static code; the lexical analyzer is used to convert the target static code into a byte symbol stream; the syntax analyzer is used to parse the byte symbol stream into a syntax tree; the literal identifier, also known as the Parse Tree Walker, is used to call the listener to traverse the syntax tree; the listener includes a collection unit (recognizes and collects string literals), a callback function definition unit (defines callback functions such as the addition and removal of literal syntax nodes), a callback function interface definition unit (defines the interface of callback functions such as the addition and removal of literal syntax nodes) and a listener interface unit (defines the mode required by the literal identifier). In this way, the listener mode can be called to traverse the syntax tree without manually writing traversal code. The literal recognizer can be used to achieve fully automatic traversal of the syntax tree, and the literal syntax nodes can be directly captured. There is no need to develop visit functions separately for all literal syntax nodes, which reduces the workload and avoids the omission of literal syntax nodes.

[0139] In order to improve access efficiency, access integrity and reduce development costs, the listener mode can be used to traverse the syntax tree. That is, the syntax tree can be input into the literal recognizer, and the literal recognizer traverses the syntax tree based on the listener mode, listens to or determines each literal syntax node of the syntax tree, and then recognizes and extracts the string literals in each literal syntax node according to the preset extraction rules. In this way, when traversing a syntax tree with a wide variety of literal syntax nodes, such as the JSX syntax tree, using the listener mode to traverse the syntax tree can improve access efficiency and integrity, greatly reduce development costs, and help improve the rate of static code scanning while ensuring accuracy.

[0140] In addition, in order to ensure the accuracy of the scanning results, it is also necessary to determine whether the string literal meets the preset compliance conditions, and extract the string literal that meets the preset compliance conditions. That is, according to the at least one literal syntax node, the string literal in the syntax tree is extracted. The specific implementation process can be as follows:

[0141] For any literal syntax node, determine whether the string literal corresponding to the literal syntax node is compliant according to the preset compliance conditions;

[0142] If so, extract the string literal corresponding to the literal syntax node.

[0143] Specifically, the preset compliance condition refers to a pre-set condition for measuring whether a string literal complies with a rule or requirement.

[0144] In actual applications, when extracting string literals, for any literal syntax node, first identify the string literal corresponding to the literal syntax node, and then determine whether the string literal is compliant based on the preset compliance conditions, or determine whether the string literal meets the preset compliance conditions. If so, it means that the string literal corresponding to the literal syntax node is compliant, and then extract the string literal corresponding to the literal syntax node. In this way, only extracting compliant string literals can reduce the amount of data processing, which is beneficial to improving the scanning efficiency of the target static code.

[0145] It should be noted that due to its own implementation reasons, the i18n detection tool cannot accurately identify the static code that spans multiple lines, resulting in a low accuracy rate in the scanning results. Therefore, the accuracy of static code scanning can be improved by generating the static code into a syntax tree, and accurately judging whether the extracted string literal is compliant based on the context information of the syntax tree. In other words, the preset compliance condition is determined based on the context information of the syntax tree.

[0146] See also Figure 4 , Figure 4 This is a flowchart of another static code scanning method provided by an embodiment of the present specification: first read the target static code; then perform lexical analysis on the target static code to obtain a byte symbol stream; then perform syntactic analysis on the byte symbol stream to obtain a syntax tree; then traverse the syntax tree to collect legal string literals; and then generate a scanning result based on the string literals.

[0147] In addition, non-compliant string literals can also be extracted, that is, for any literal syntax node, according to the preset compliance conditions, determine whether the string literal corresponding to the literal syntax node is compliant; if not, extract the string literal corresponding to the literal syntax node. However, in order to avoid confusing non-compliant string literals with compliant string literals, at least one of the non-compliant string literals and compliant string literals can be marked, such as after obtaining the compliant string literal, it is also necessary to mark the compliant string literal, that is, after extracting the string literal corresponding to the literal syntax node, it is also necessary to mark the string literal with a compliance mark; for example, after obtaining the non-compliant string literal, it is also necessary to mark the non-compliant string literal with a non-compliant mark; for example, the compliant string literal is marked with a compliance mark, and the non-compliant string literal is marked with a non-compliant mark.

[0148] In one or more optional embodiments of the present specification, in order to facilitate developers to view the vulnerabilities of the target static code and improve the target static code, the vulnerabilities of the target static code in the scan result can also be determined and displayed. That is, after determining the scan result of the target static code in the specified programming language according to the syntax tree, it also includes:

[0149] The scanning result is parsed to determine and display the vulnerability of the target static code.

[0150] Specifically, a vulnerability refers to a defect or problematic content in the target static code.

[0151] In actual applications, the vulnerabilities in the target static code can be determined based on the scanning results, and the vulnerabilities in the target static code can be displayed through a display, a smart screen, etc., that is, the vulnerabilities in the target static code can be directly displayed.

[0152] In one or more optional embodiments of the present specification, in order to facilitate developers to quickly locate the location of vulnerabilities in the target static code, the vulnerabilities of the target static code in the scan results can be first determined, and then the scan results and the target static code are displayed in combination, and the vulnerabilities of the target static code are marked, that is, the scan results are parsed, and the vulnerabilities of the target static code in the specified programming language are determined and displayed, including:

[0153] Parsing the scan results to determine vulnerabilities in the target static code;

[0154] The scanning result and the target static code are displayed in combination, and the vulnerabilities of the target static code are marked.

[0155] In actual applications, the vulnerabilities in the target static code can be determined based on the scanning results, and the scanning results and the target static code can be displayed together through a display, a smart screen, etc. At the same time, the vulnerabilities of the target static code in the scanning results can be marked, such as displaying the vulnerabilities of the target static code in the scanning results by underlining, so that users can view the defect details.

[0156] See also Figure 5 , Figure 5 This is a schematic diagram of displaying scanning results in a static code scanning method provided in an embodiment of the present specification: the scanning results and the target static code are displayed in combination, and the vulnerabilities of the target static code are displayed by underlining.

[0157] See also Figure 6 , Figure 6 This is a flowchart of another static code scanning method provided by an embodiment of this specification, comprising the following steps:

[0158] Step 1: Define Java syntax template, JavaScript syntax template, HTML syntax template, and Objective-C syntax template.

[0159] That is, a syntax template corresponding to each programming language in multiple programming languages ​​is predefined.

[0160] Step 2: Input each syntax template into the code generator.

[0161] Step 3: Build a grammar recognizer.

[0162] That is, the code generator converts each syntax template to obtain a program in a specified programming language, which is also a syntax recognizer.

[0163] Step 4: Analyze the target static code, obtain the syntax tree, and send it to the literal recognizer.

[0164] That is, the target static code is input into the lexical analyzer of the syntax recognizer for lexical analysis, and the byte symbol stream corresponding to the target static code in the specified programming language is output; the byte symbol stream is then input into the syntax analyzer of the syntax recognizer for syntax analysis, and the syntax tree corresponding to the target static code in the specified programming language is output.

[0165] Step 5: Traverse the syntax tree, get the string literal, and send it to the result generator.

[0166] That is, the literal recognizer traverses the syntax tree, extracts the string literals in the syntax tree and sends them to the result generator.

[0167] Step 6: Generate the scan results and send them to the dashboard server.

[0168] That is, the result generator generates the scanning result of the target static code in the specified programming language according to the string literal, and sends it to the kanban server.

[0169] Step 7: Analyze the scan results to identify vulnerabilities and display them.

[0170] That is, the dashboard server parses the scan results, determines the vulnerabilities of the target static code, and renders and displays them.

[0171] This specification provides a static code scanning method, which pre-builds a syntax recognizer based on a specified programming language, wherein the syntax recognizer is used to recognize the syntax of multiple programming languages, at least one of the multiple programming languages ​​is different from the specified programming language; obtains the target static code to be scanned, wherein the programming language of the target static code belongs to any one or more of the multiple programming languages; inputs the target static code into the syntax recognizer for parsing, and obtains the syntax tree corresponding to the target static code under the specified programming language; according to the syntax tree, determines the scanning result of the target static code under the specified programming language. By pre-building a syntax recognizer based on the specified programming language, static codes of different programming languages ​​can be scanned, and the obtained syntax trees and scanning results are all in the specified programming language, which allows developers to quickly get started and perform subsequent maintenance. In addition, using the static code scanning provided in this specification, hard-coded text hidden in the static code can be scanned in advance, and the copywriting leakage can be managed at the source, improving the multi-language user experience.

[0172] The following combination Figure 7 , taking the application of the static code scanning method provided in this specification in practical applications as an example, the static code scanning method is further described. Figure 7 A processing flow chart of a static code scanning method provided by an embodiment of the present specification is shown, which specifically includes the following steps.

[0173] Step 702: pre-define a syntax template corresponding to each programming language in a plurality of programming languages.

[0174] Step 704: Input the syntax template corresponding to each programming language into a preset code generator, convert it based on the specified programming language, and obtain a syntax recognizer.

[0175] The grammar identifier is used to identify the grammars of multiple programming languages, and at least one programming language among the multiple programming languages ​​is different from the specified programming language.

[0176] Step 706: Obtain a target static code to be scanned, wherein a programming language of the target static code belongs to any one or more programming languages ​​among a plurality of programming languages.

[0177] Step 708: Input the target static code to the lexical analyzer of the syntax recognizer for lexical analysis, and output a byte symbol stream corresponding to the target static code in the specified programming language.

[0178] Optionally, the target static code is input into a lexical analyzer of a syntax recognizer for lexical analysis, including:

[0179] Convert the target static code into a character stream;

[0180] The character stream is input to the lexical analyzer of the syntax recognizer for lexical analysis.

[0181] Step 710: Input the byte symbol stream to the syntax analyzer of the syntax recognizer for syntax analysis, and output a syntax tree corresponding to the target static code in the specified programming language.

[0182] Step 712: Traverse the syntax tree to determine at least one literal syntax node of the syntax tree.

[0183] Step 714: For any literal syntax node, determine whether the string literal corresponding to the literal syntax node is compliant according to a preset compliance condition.

[0184] If yes, execute step 716, if no, execute step 718.

[0185] Step 716: Extract the string literal corresponding to the literal syntax node, and mark the string literal with a compliance flag.

[0186] Step 718: Extract the string literal corresponding to the literal syntax node, and mark the string literal with a non-compliant identifier.

[0187] Step 720: Generate a scan result of the target static code in a specified programming language according to the string literal.

[0188] Step 722: Analyze the scan results, determine the vulnerabilities of the target static code and display them.

[0189] Step 724: Analyze the scan results to determine the vulnerabilities of the target static code.

[0190] Step 726: The scanning result and the target static code are displayed together, and the vulnerabilities of the target static code are marked.

[0191] This manual provides a static code scanning method. By building a syntax recognizer based on a specified programming language in advance, static codes in different programming languages ​​can be scanned. The obtained syntax trees and scanning results are all in the specified programming language, allowing developers to quickly get started and perform subsequent maintenance. In addition, using the static code scanning provided in this manual, hard-coded text hidden in the static code can be scanned in advance, and text leakage can be managed at the source, improving the multi-language user experience.

[0192] Corresponding to the above method embodiment, this specification also provides a static code scanning device embodiment, Figure 8 FIG. 1 shows a schematic diagram of a static code scanning device provided by an embodiment of the present specification. Figure 8 As shown, the device comprises:

[0193] A construction module 802 is configured to construct a grammar identifier based on a specified programming language in advance, wherein the grammar identifier is used to recognize grammars of multiple programming languages, at least one of the multiple programming languages ​​is different from the specified programming language;

[0194] The acquisition module 804 is configured to acquire a target static code to be scanned, wherein the programming language of the target static code belongs to any one or more programming languages ​​among the multiple programming languages;

[0195] A parsing module 806 is configured to input the target static code into the syntax recognizer for parsing, and obtain a syntax tree corresponding to the target static code in the specified programming language;

[0196] The determination module 808 is configured to determine the scanning result of the target static code in the specified programming language according to the syntax tree.

[0197] Optionally, the grammar recognizer includes a lexical analyzer and a grammar analyzer;

[0198] The analysis module 806 is further configured to:

[0199] Inputting the target static code into the lexical analyzer for lexical analysis, and outputting a byte symbol stream corresponding to the target static code in the specified programming language;

[0200] The byte symbol stream is input into the syntax analyzer for syntax analysis, and a syntax tree corresponding to the target static code in the specified programming language is output.

[0201] Optionally, the parsing module 806 is further configured to:

[0202] Converting the target static code into a character stream;

[0203] The character stream is input to the lexical analyzer for lexical analysis.

[0204] Optionally, the construction module 802 is further configured to:

[0205] Predefine a syntax template corresponding to each programming language in the multiple programming languages;

[0206] The syntax templates corresponding to the programming languages ​​are input into a preset code generator, and converted based on the specified programming language to obtain the syntax identifier.

[0207] Optionally, the determining module 808 is further configured to:

[0208] Traversing the syntax tree, and extracting string literals in the syntax tree;

[0209] A scanning result of the target static code in the specified programming language is generated according to the string literal.

[0210] Optionally, the determining module 808 is further configured to:

[0211] Traversing the syntax tree to determine at least one literal syntax node of the syntax tree;

[0212] According to the at least one literal syntax node, a string literal in the syntax tree is extracted.

[0213] Optionally, the determining module 808 is further configured to:

[0214] For any literal syntax node, determine whether the string literal corresponding to the literal syntax node is compliant according to the preset compliance conditions;

[0215] If so, extract the string literal corresponding to the literal syntax node.

[0216] Optionally, the device further comprises a marking module configured to:

[0217] Mark the string literal with a compliance flag.

[0218] Optionally, the device further includes a first display module, configured to:

[0219] The scanning result is parsed to determine and display the vulnerability of the target static code.

[0220] Optionally, the device further includes a second display module configured to:

[0221] Parsing the scan results to determine vulnerabilities in the target static code;

[0222] The scanning result and the target static code are displayed in combination, and the vulnerabilities of the target static code are marked.

[0223] This specification provides a static code scanning device, which pre-builds a syntax recognizer based on a specified programming language, wherein the syntax recognizer is used to recognize the syntax of multiple programming languages, at least one of the multiple programming languages ​​is different from the specified programming language; obtains the target static code to be scanned, wherein the programming language of the target static code belongs to any one or more of the multiple programming languages; inputs the target static code into the syntax recognizer for parsing, and obtains the syntax tree corresponding to the target static code under the specified programming language; and determines the scanning result of the target static code under the specified programming language based on the syntax tree. By pre-building a syntax recognizer based on the specified programming language, static codes of different programming languages ​​can be scanned, and the obtained syntax trees and scanning results are all in the specified programming language, which allows developers to quickly get started and perform subsequent maintenance. In addition, using the static code scanning provided in this specification, hard-coded text hidden in the static code can be scanned in advance, and the copywriting leakage can be managed at the source, improving the multi-language user experience.

[0224] The above is a schematic scheme of a static code scanning device of this embodiment. It should be noted that the technical scheme of the static code scanning device and the technical scheme of the static code scanning method described above are of the same concept, and the details not described in detail in the technical scheme of the static code scanning device can be found in the description of the technical scheme of the static code scanning method described above.

[0225] Fig. 9 The structure block diagram of a computing device 900 provided according to an embodiment of the present specification is shown. The components of the computing device 900 include but are not limited to a memory 910 and a processor 920. The processor 920 is connected to the memory 910 via a bus 930, and a database 950 is used to store data.

[0226] The computing device 900 also includes an access device 940 that enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 940 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0227] In one embodiment of the present specification, the above components of the computing device 900 and Fig. 9 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Fig. 9 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0228] The computing device 900 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 900 may also be a mobile or stationary server.

[0229] The processor 920 is used to execute the following computer executable instructions, which implement the steps of the above-mentioned static code scanning method when executed by the processor.

[0230] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the static code scanning method described above are of the same concept, and the details of the technical scheme of the computing device not described in detail can be found in the description of the technical scheme of the static code scanning method described above.

[0231] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned static code scanning method.

[0232] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the static code scanning method described above are of the same concept, and the details not described in detail in the technical scheme of the storage medium can be found in the description of the technical scheme of the static code scanning method described above.

[0233] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned static code scanning method.

[0234] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the static code scanning method described above are of the same concept, and the details not described in detail in the technical scheme of the computer program can be found in the description of the technical scheme of the static code scanning method described above.

[0235] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0236] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0237] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0238] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0239] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.< / scanresult> < / string> < / scanresult>

Claims

1. A static code scanning method, comprising: Preliminarily constructing a grammar identifier based on a specified programming language, wherein the grammar identifier is used to identify the grammar of multiple programming languages, at least one of the multiple programming languages ​​is different from the specified programming language, and the preliminarily constructing the grammar identifier based on the specified programming language includes: pre-defining a grammar template corresponding to each of the multiple programming languages; inputting the grammar template corresponding to each programming language into a preset code generator, converting it based on the specified programming language, and obtaining the grammar identifier; Acquire a target static code to be scanned, wherein a programming language of the target static code belongs to any one or more programming languages ​​among the multiple programming languages; Inputting the target static code into the syntax recognizer for parsing, and obtaining a syntax tree corresponding to the target static code in the specified programming language; According to the syntax tree, a scanning result of the target static code in the specified programming language is determined.

2. The method according to claim 1, wherein the grammar recognizer comprises a lexical analyzer and a grammar analyzer; Inputting the target static code into the syntax recognizer for parsing, and obtaining a syntax tree corresponding to the target static code in the specified programming language, including: Inputting the target static code into the lexical analyzer for lexical analysis, and outputting a byte symbol stream corresponding to the target static code in the specified programming language; The byte symbol stream is input into the syntax analyzer for syntax analysis, and a syntax tree corresponding to the target static code in the specified programming language is output.

3. The method according to claim 2, inputting the target static code into the lexical analyzer for lexical analysis, comprising: Converting the target static code into a character stream; The character stream is input to the lexical analyzer for lexical analysis.

4. The method according to claim 1, determining the scanning result of the target static code in the specified programming language according to the syntax tree, comprises: Traversing the syntax tree, and extracting string literals in the syntax tree; A scanning result of the target static code in the specified programming language is generated according to the string literal.

5. The method according to claim 4, traversing the syntax tree and extracting the string literals in the syntax tree, comprising: Traversing the syntax tree to determine at least one literal syntax node of the syntax tree; According to the at least one literal syntax node, a string literal in the syntax tree is extracted.

6. The method according to claim 5, extracting the string literal in the syntax tree according to the at least one literal syntax node, comprising: For any literal syntax node, determine whether the string literal corresponding to the literal syntax node is compliant according to the preset compliance conditions; If so, extract the string literal corresponding to the literal syntax node.

7. The method according to claim 6, after extracting the string literal corresponding to the literal syntax node, further comprises: Mark the string literal with a compliance flag.

8. The method according to claim 1, after determining the scanning result of the target static code in the specified programming language according to the syntax tree, further comprises: The scanning result is parsed to determine and display the vulnerability of the target static code.

9. The method according to claim 8, parsing the scan result, determining and displaying the vulnerability of the target static code, comprises: Parsing the scan results to determine vulnerabilities in the target static code; The scanning result and the target static code are displayed in combination, and the vulnerabilities of the target static code are marked.

10. A static code scanning device, comprising: A construction module is configured to construct a grammar identifier based on a specified programming language in advance, wherein the grammar identifier is used to identify the grammar of multiple programming languages, at least one of the multiple programming languages ​​is different from the specified programming language, and the construction module is further configured to: predefine a grammar template corresponding to each of the multiple programming languages; input the grammar template corresponding to each programming language into a preset code generator, convert it based on the specified programming language, and obtain the grammar identifier; An acquisition module is configured to acquire a target static code to be scanned, wherein a programming language of the target static code belongs to any one or more programming languages ​​among the multiple programming languages; A parsing module is configured to input the target static code into the syntax recognizer for parsing, and obtain a syntax tree corresponding to the target static code in the specified programming language; The determination module is configured to determine the scanning result of the target static code in the specified programming language according to the syntax tree.

11. A computing device comprising: Memory and processor; The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the static code scanning method according to any one of claims 1 to 9 are implemented.

12. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the static code scanning method according to any one of claims 1 to 9.

Images