A method, system, device, and medium for improving code security scanning

Abstract

The application relates to the field of code security scanning, and discloses a method, a system, a device and a medium for improving code security scanning. The method comprises the following steps: obtaining front-end code and back-end code of a scanning project; determining a scanning type of the scanning project according to whether the front-end code and the back-end code are in the same scanning task; determining a mapping file containing a mapping relationship of the front-end code and the back-end code; loading the mapping file, and scanning the scanning project according to the scanning type of the scanning project; and updating a scanning result of the front-end code according to the mapping relationship of the mapping file and a scanning result of the back-end code. The method disclosed by the application is beneficial to improving the scanning efficiency and the scanning accuracy of the overall code of a project and reducing the workload of manual auditing.

Description

Technical Field

[0001] This invention relates to the field of code security scanning, and more particularly to a method, system, device, and medium for improving code security scanning. Background Technology

[0002] Code security scanning is generally static scanning, which includes two processes: compilation and scanning. Compilation is the process of compiling the code to be scanned into intermediate files. Some languages ​​require compilation before scanning, while others can be scanned without compilation or with only partial compilation.

[0003] In existing technologies, when performing security scans on code, code that cannot be scanned simultaneously in the same scan task must generally be scanned separately and then analyzed for vulnerabilities separately. For example, in cases where the front-end calls a back-end interface, vulnerability analysis can only be performed manually. For instance, if the front-end code does not perform validation for a certain value, but the back-end code does, in this situation, analysis based solely on the front-end code would identify a code security vulnerability, possibly classified as high or medium level. However, if analysis is combined with the back-end code, since the back-end interface actually performs the validation and it does not harm the actual business logic, the actual vulnerability level can be classified as low, or from the perspective of the overall project, it may not even be considered a vulnerability (in practice, from a coding standard perspective, front-end and back-end should perform validation separately). Because existing code security scan technologies cannot make such judgments, vulnerabilities are reported in multiple places where the front-end calls the back-end interface for validation. This leads to a significant amount of manual checking from a project perspective, requiring confirmation before these false positives are discovered. If there are too many such vulnerabilities, it will greatly reduce the efficiency of vulnerability analysis. Summary of the Invention

[0004] In view of this, the present invention proposes a method, system, device, and medium for improving code security scanning. Specifically, the proposed method for improving code security scanning, based on traditional code security scanning, combines front-end and back-end code security scanning. This is achieved by adding mapping files between front-end and back-end code, allowing for further checks of back-end code for vulnerabilities found in the front-end code. During the scanning process, it judges cases where the front-end code is not validated but the back-end code is. If a vulnerability is detected in the front-end code but validated in the back-end code, the actual danger of the vulnerability is reduced, and this vulnerability is marked in the scan results.

[0005] This invention proposes a method to improve code security scanning, which includes two aspects. Based on whether front-end and back-end code can be scanned in the same scanning task, it includes simultaneous scanning and non-simultaneous scanning. Simultaneous scanning allows front-end and back-end code to be scanned simultaneously in the same task. By analyzing the mapping file content of the front-end and back-end code, the mapping relationship between the front-end and back-end code is identified, and vulnerabilities detected in the front-end code are further scanned in the back-end code through the mapping relationship. Non-simultaneous scanning, on the other hand, prevents front-end and back-end code from being scanned simultaneously in the same task. When scanning the back-end code, the front-end code scan results and mapping file are loaded, and vulnerabilities detected in the front-end code scan results are further scanned in the back-end code through the mapping relationship.

[0006] To achieve the above objectives, one aspect of the present invention provides a method for improving code security scanning, comprising the following steps: obtaining front-end code and back-end code of a project to be scanned; determining the scan type of the project to be scanned based on whether the front-end code and the back-end code are in the same scanning task; determining a mapping file containing the mapping relationship between the front-end code and the back-end code; loading the mapping file; scanning the project to be scanned according to the scan type of the project to be scanned; and updating the scan result of the front-end code according to the mapping relationship of the mapping file and the scan result of the back-end code.

[0007] In some embodiments, determining the type of scan for the item to be scanned based on whether the front-end code and the back-end code are performed in the same scanning task includes:

[0008] Based on whether the code is compiled first and then the compiled files are scanned, it is determined whether the front-end code and the back-end code are scanned in the same scanning task; in response to being scanned in the same scanning task, the scanning type of the item to be scanned is determined to be simultaneous scanning; in response to not being scanned in the same scanning task, the scanning type of the item to be scanned is determined to be non-simultaneous scanning.

[0009] In some embodiments, loading the mapping file and scanning the project to be scanned according to the scanning type of the project to be scanned, and updating the scanning result of the front-end code according to the mapping relationship of the mapping file and the scanning result of the back-end code, includes: simultaneously scanning the front-end code and the back-end code, loading the mapping file during the scanning process; in response to a vulnerability being detected in the front-end code, searching for the existence of a parameter verification corresponding to the vulnerability in the back-end code through the mapping relationship of the mapping file, and in response to its existence, identifying the vulnerability and downgrading the severity of the vulnerability.

[0010] In some embodiments, loading the mapping file, scanning the project to be scanned according to the scanning type of the project to be scanned, and updating the scanning result of the front-end code according to the mapping relationship of the mapping file and the scanning result of the back-end code further includes: in response to a vulnerability being detected in the front-end code, checking whether a parameter corresponding to the vulnerability exists in the back-end code through the mapping relationship of the mapping file; in response to the vulnerability not existing, not identifying the vulnerability, and keeping the risk level of the vulnerability unchanged.

[0011] In some embodiments, loading the mapping file and scanning the project to be scanned according to the scanning type of the project to be scanned, and updating the scanning result of the front-end code according to the mapping relationship of the mapping file and the scanning result of the back-end code, includes: scanning the front-end code and saving the scanning result; compiling the back-end code first, and then scanning the compiled file, loading the scanning result of the front-end code and specifying the mapping file during the scanning process; in response to the presence of a vulnerability in the scanning result of the front-end code, searching for the existence of a parameter verification corresponding to the vulnerability in the back-end code through the mapping relationship of the mapping file, and in response to its existence, identifying the vulnerability and downgrading the severity of the vulnerability.

[0012] In some embodiments, loading the mapping file, scanning the project to be scanned according to the scanning type of the project to be scanned, and updating the scanning result of the front-end code according to the mapping relationship of the mapping file and the scanning result of the back-end code further includes: in response to the presence of a vulnerability in the scanning result of the front-end code, checking whether a parameter corresponding to the vulnerability exists in the back-end code through the mapping relationship of the mapping file; in response to the absence of the vulnerability, the vulnerability is not marked, and the danger level of the vulnerability remains unchanged.

[0013] In some embodiments, updating the scanning results of the front-end code based on the mapping relationship of the mapping file and the scanning results of the back-end code includes: updating the severity of vulnerabilities in the scanning results of the front-end code based on the mapping relationship of the mapping file and the scanning results of the back-end code, and identifying the file name and line number corresponding to the vulnerability in the back-end code.

[0014] Another aspect of this invention provides a system for improving code security scanning, the system comprising the following modules: a first module configured to acquire front-end code and back-end code of a project to be scanned; a second module configured to determine the scan type of the project to be scanned based on whether the front-end code and the back-end code are in the same scanning task; a third module configured to determine a mapping file containing the mapping relationship between the front-end code and the back-end code; and a fourth module configured to load the mapping file, scan the project to be scanned according to the scan type of the project to be scanned, and update the scan result of the front-end code according to the mapping relationship of the mapping file and the scan result of the back-end code.

[0015] In another aspect of the present invention, a computer device is also provided, including at least one processor; and a memory storing computer instructions executable on the processor, the instructions, when executed by the processor, implementing the steps of any of the methods described above.

[0016] In another aspect of the present invention, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements any of the method steps described above.

[0017] The present invention has at least the following beneficial effects: The present invention proposes a method, system, device and medium for improving code security scanning. The method for improving code security scanning provided by the present invention adds a mapping file between front-end code and back-end code. When a vulnerability is detected in the front-end code, the mapping relationship between the front-end and back-end code in the mapping file is identified, and further scanning is performed in the back-end code to check whether the vulnerability in the front-end code has been verified in the back-end code. This improves the overall code scanning efficiency and accuracy of the project and reduces the workload of manual review. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0019] Figure 1 A schematic diagram illustrating an embodiment of a method for improving code security scanning provided by the present invention;

[0020] Figure 2 This is a schematic diagram of another embodiment of a method for improving code security scanning provided by the present invention;

[0021] Figure 3 A schematic diagram illustrating an embodiment of a system for improving code security scanning provided by the present invention;

[0022] Figure 4 A schematic diagram of an embodiment of a computer device provided by the present invention;

[0023] Figure 5 This is a schematic diagram of an embodiment of a computer-readable storage medium provided by the present invention. Detailed Implementation

[0024] The following describes embodiments of the present invention. However, it should be understood that the disclosed embodiments are merely examples, and other embodiments may take various alternative forms.

[0025] Furthermore, it should be noted that all uses of the terms "first" and "second" in the embodiments of this invention are for the purpose of distinguishing two entities or parameters with the same name but different names. Therefore, "first" and "second" are merely for convenience of expression and should not be construed as limiting the embodiments of this invention. Subsequent embodiments will not elaborate on this further. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements may include not only those elements but also elements not expressly listed or inherent to those processes, methods, articles, or apparatuses.

[0026] One or more embodiments of this application will now be described with reference to the accompanying drawings.

[0027] Based on the above objectives, a first aspect of the present invention provides an embodiment of a method for improving code security scanning. Figure 1 The diagram shown is an embodiment of a method for improving code security scanning provided by the present invention. Figure 1 As shown, a method for improving code security scanning according to an embodiment of the present invention includes the following steps:

[0028] S1. Obtain the front-end and back-end code of the project to be scanned;

[0029] S2. Determine the scanning type of the project to be scanned based on whether the front-end code and the back-end code are in the same scanning task;

[0030] S3. Determine the mapping file containing the mapping relationship between the front-end code and the back-end code;

[0031] S4. Load the mapping file, scan the project to be scanned according to the scanning type of the project to be scanned, and update the scanning results of the front-end code according to the mapping relationship of the mapping file and the scanning results of the back-end code.

[0032] During code security scanning, some front-end and back-end code can be scanned simultaneously in a single scan task (simultaneous scanning); others cannot, requiring non-simultaneous scanning. Simultaneous scanning refers to the front-end and back-end code being scanned within the same task. For example, projects written in JavaScript, JSP, and Java, where JavaScript and JSP are typically used for front-end page implementation and Java handles back-end business logic, can have their front-end and back-end code scanned concurrently. Furthermore, by manually importing or automatically discovering mapping files for relevant interfaces in the front-end and back-end code, when vulnerabilities are found during front-end code scanning, the mapping files are used to check if corresponding validations are performed in the back-end code, ultimately confirming the vulnerability. Non-simultaneous scanning refers to a situation where front-end and back-end code cannot be scanned in the same scanning task. For example, projects written in JavaScript, Java, and C / C++ languages: JavaScript typically handles page implementation, Java handles interface implementation, and C / C++ handles back-end business logic. When scanning such projects, C / C++ code must be compiled before scanning, and its scanning method differs from that of Java and JavaScript, making simultaneous scanning impossible. This is called non-simultaneous scanning. This method requires that during back-end scanning, the mapping files of relevant interfaces between the front-end and back-end code are manually imported or automatically discovered to find vulnerabilities in the front-end code scan results. During back-end code scanning, it is determined whether corresponding verifications have been performed to ultimately identify vulnerabilities.

[0033] In existing technologies, when a project performs security scans on its code, each language of the front-end and back-end code is scanned according to its own scanning rules, and the scan results are output separately. There is no correlation between these scan results. In particular, if a certain input value is not validated in the front-end JavaScript or JSP, a corresponding vulnerability result will be generated directly, even if that value is validated in the back-end Java. In this case, the final scan result will still show the vulnerability, even though analysis reveals that the input value was validated in the back-end Java and is actually harmless. If many similar unvalidated input values ​​exist in the front-end code but are validated in the back-end API, it will lead to a large number of invalid vulnerabilities in the final scan results. This requires developers to perform extensive manual review, resulting in a waste of personnel resources.

[0034] Traditional code scanning tools have corresponding scanning rules for each programming language. During code security scanning, each language is scanned according to its respective rule. When code from different languages ​​calls each other, sometimes the backend methods are called directly in the frontend code. For example, frontend code (HTML or JavaScript) might call backend code (Java). In this case, code scanning tools typically examine the calling code based on its context to determine if vulnerabilities exist in the frontend code. However, for complex project code, files like YAML or XML are generally used as mapping files between the frontend and backend code to determine the specific backend interface called by the frontend. In such cases, code security scanning tools generally cannot load these files to perform code context checks.

[0035] Figure 2 The diagram shown is a schematic representation of another embodiment of a method for improving code security scanning provided by the present invention. Figure 2 As shown in this embodiment, for the front-end code and back-end code of a project, it is first necessary to determine whether the front-end code and back-end code can be scanned simultaneously.

[0036] When front-end and back-end code are deemed compatible for simultaneous scanning—for example, in a project where the front-end code is implemented using JavaScript and JSP (where JSP is considered front-end because it only handles page implementation), and the back-end code uses Java for business logic—it's understandable that in actual project implementations, the languages ​​used for simultaneous scanning of front-end and back-end code are not limited to those mentioned above; other languages ​​can be used depending on the specific project requirements.

[0037] When scanning both front-end and back-end code simultaneously, the system allows selecting the directories containing the front-end and back-end code and specifying a mapping file between them. This mapping file contains the mapping relationship between the front-end and back-end code, such as the respective classes and methods. If no mapping file is specified, the scan will look for files like YAML and XML, identifying the mapping file by checking if it contains both the front-end and back-end class names and method names. If both are present, the file is identified as the mapping file. It's understood that the file extension is not limited to the two types mentioned in this example; more extensions, such as JSON, can be added through customization.

[0038] During code scanning, the specified or custom mapping file is loaded, and based on the mapping relationship between the front-end and back-end contained in the mapping file, the mapping relationship of the front-end and back-end classes or methods recorded in the mapping file is recorded in the intermediate file of code security scanning.

[0039] When scanning front-end code, if a vulnerability is detected, such as an unvalidated class vulnerability, the system will further search for a mapping relationship between the corresponding class or method in the intermediate files. If such a mapping relationship exists, the system will further check the back-end code for validation of the corresponding parameters. If such a vulnerability exists, it will be marked in the detected front-end code vulnerability, indicating that the vulnerability is validated in the back-end code, along with the filename and line number of the validated code. The vulnerability level will also be defined according to relevant rules. Generally, for vulnerabilities where the front-end does not validate but the back-end does, the severity of the vulnerability will be reduced, or it may not even be considered a vulnerability (in fact, it has no impact on the project itself).

[0040] When scanning the front-end code, if a vulnerability is found, such as an unvalidated class vulnerability, the system will further search for the mapping relationship between the class or method corresponding to the vulnerability in the intermediate files. If it exists, the system will further check the back-end code for the corresponding parameter validation through the mapping relationship. If it does not exist, the system will label the vulnerability as not having any related validation in the back-end code. Since back-end code usually refers to server-side code, in such cases, the level of vulnerability is considered to remain unchanged regardless of whether the front-end has performed validation (in reality, it will have an impact on the project itself).

[0041] In cases where front-end and back-end code cannot be scanned simultaneously (i.e., when front-end and back-end code are scanned at different times), for example in a project where the front-end code uses JavaScript for page implementation, Java for interface implementation, and C / C++ for back-end business logic processing, it's understandable that in actual project implementations, the languages ​​used for front-end and back-end code that cannot be scanned simultaneously are not limited to the above; other languages ​​can be used depending on the specific needs of the project.

[0042] When scanning front-end and back-end code separately, the code for such projects typically doesn't reside in the same directory, and back-end C / C++ code needs to be compiled before scanning. Therefore, when scanning front-end and back-end code, C / C++ needs to be scanned separately, unlike JavaScript and Java which only require directory selection for scanning. When scanning JavaScript and Java, since C / C++ isn't scanned, if security vulnerabilities are found, the scan results should be saved using traditional code security scanning methods. When scanning back-end code, the functionality to select front-end code scan results and specify the mapping files between the front-end and back-end code should be added. Understandably, when scanning the backend code, you can choose to include the frontend code scan results. In this case, you need to add the functionality to specify the mapping file between the frontend and backend code, because the mapping file usually exists in the frontend code. Since the frontend code has already been scanned, the backend code scan cannot automatically load the mapping file, so you need to manually specify the file. If you don't specify the file, you can't perform subsequent scans. Alternatively, you can choose not to include the frontend code scan results. In this case, you don't need to specify the mapping file between the frontend and backend code, and you can directly scan the backend code. In this case, the frontend code scan results and the backend code scan results are independent of each other.

[0043] During backend code security scanning, the scan results of the frontend code and the corresponding mapping files are loaded. When generating the backend code scanning intermediate file, the mapping relationships between frontend and backend classes or methods in the mapping file are recorded in the intermediate file. Since the classes and methods of the frontend code in the mapping file only exist in the frontend code scan results, the intermediate file only records those classes and methods, not all of them. During backend code scanning, it first checks whether there is a corresponding mapping relationship between the class or method containing the security vulnerability in the frontend code and the backend code. If so, it checks whether there is a corresponding verification. If so, the vulnerability handling method is the same as for simultaneous scanning, and the frontend code scan results are updated. If not, the frontend code scan results remain unchanged.

[0044] When scanning front-end and back-end code, both simultaneous and non-simultaneous scanning will generate scan result identifiers. Front-end code scan results can be displayed independently of the back-end code (i.e., scan results not associated with the back-end code), or they can be displayed in conjunction with the back-end code, further showing the vulnerability validation performed in the back-end code, along with the filename and line number of the validated code, facilitating intuitive vulnerability auditing.

[0045] Based on the above objectives, a second aspect of the embodiments of the present invention proposes a system for improving code security scanning. Figure 3 The diagram shown is a schematic representation of an embodiment of a system for improving code security scanning provided by the present invention. Figure 3 As shown, the system for improving code security scanning provided by the present invention includes the following modules: a first module 011, configured to acquire the front-end code and back-end code of the project to be scanned; a second module 012, configured to determine the scan type of the project to be scanned based on whether the front-end code and the back-end code are in the same scan task; a third module 013, configured to determine a mapping file containing the mapping relationship between the front-end code and the back-end code; and a fourth module 014, configured to load the mapping file, scan the project to be scanned according to the scan type of the project to be scanned, and update the scan result of the front-end code according to the mapping relationship of the mapping file and the scan result of the back-end code.

[0046] To achieve the above objectives, a third aspect of the present invention provides a computer device. Figure 4 The diagram shown is a schematic representation of an embodiment of a computer device provided by the present invention. Figure 4 As shown, an embodiment of a computer device provided by the present invention includes the following modules: at least one processor 021; and a memory 022, the memory 022 storing computer instructions 023 that can be executed on the processor 021, the computer instructions 023 implementing the steps of any of the above methods when executed by the processor 021.

[0047] The present invention also provides a computer-readable storage medium. Figure 5 The diagram shown is a schematic representation of an embodiment of a computer-readable storage medium provided by the present invention. Figure 5 As shown, computer-readable storage medium 031 stores a computer program 032 that, when executed by a processor, performs the methods described above.

[0048] Finally, it should be noted that those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program for setting system parameters can be stored in a computer-readable storage medium. When executed, the program can include the processes of the embodiments of the above methods. The storage medium for the program can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc. The above computer program embodiments can achieve the same or similar effects as any of the corresponding foregoing method embodiments.

[0049] Furthermore, the method disclosed in the embodiments of the present invention can also be implemented as a computer program executed by a processor, which may be stored in a computer-readable storage medium. When the computer program is executed by the processor, it performs the functions defined in the method disclosed in the embodiments of the present invention.

[0050] Furthermore, the above-described method steps and system units can also be implemented using a controller and a computer-readable storage medium for storing a computer program that enables the controller to perform the functions of the above-described steps or units.

[0051] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in conjunction with the disclosure herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the functionality of various illustrative components, blocks, modules, circuits, and steps has been generally described. Whether this functionality is implemented as software or as hardware depends on the specific application and the design constraints imposed on the system as a whole. Those skilled in the art can implement the functionality in various ways for each specific application, but such implementation decisions should not be construed as departing from the scope of the embodiments disclosed herein.

[0052] In one or more exemplary designs, functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored as one or more instructions or code on or transmitted via a computer-readable medium. Computer-readable media include computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one location to another. Storage media may be any available medium accessible to a general-purpose or special-purpose computer. By way of example, and not limitation, computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage devices, disk storage devices or other magnetic storage devices, or any other medium that may be used to carry or store the required program code in the form of instructions or data structures and is accessible to a general-purpose or special-purpose computer or a general-purpose or special-purpose processor. Furthermore, any connection may be appropriately referred to as computer-readable media. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DOL), or wireless technologies such as infrared, radio, and microwave, then the aforementioned coaxial cable, fiber optic cable, twisted pair, DOL, or wireless technologies such as infrared, radio, and microwave are all included in the definition of media. As used herein, disks and optical discs include compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where disks typically reproduce data magnetically, while optical discs reproduce data optically using lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0053] The above are exemplary embodiments disclosed in this invention. However, it should be noted that various changes and modifications can be made without departing from the scope of the embodiments of this invention as defined by the claims. The functions, steps, and / or actions of the methods according to the disclosed embodiments described herein do not need to be performed in any particular order. Furthermore, although the elements disclosed in the embodiments of this invention may be described or claimed individually, they may be understood as multiple unless explicitly limited to a singular number.

[0054] It should be understood that, as used herein, the singular form “a” is intended to include the plural form as well, unless the context clearly supports an exception. It should also be understood that, as used herein, “and / or” refers to any and all possible combinations of one or more of the associated listed items.

[0055] The embodiment numbers disclosed in the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0056] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0057] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples. Within the framework of the invention, technical features of the above embodiments or different embodiments can be combined, and many other variations of different aspects of the invention exist, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the protection scope of the invention.

Claims

1. A method for improving code security scanning, characterized in that, The method includes: Obtain the front-end and back-end code of the project to be scanned; The scanning type of the project to be scanned is determined based on whether the front-end code and the back-end code are in the same scanning task. This includes: determining whether the front-end code and the back-end code are scanned in the same scanning task based on whether the code is first compiled and then the compiled files are scanned; in response to being scanned in the same scanning task, the scanning type of the project to be scanned is determined to be simultaneous scanning; in response to not being scanned in the same scanning task, the scanning type of the project to be scanned is determined to be non-simultaneous scanning. Determine the mapping file containing the mapping relationship between the front-end code and the back-end code; Loading the mapping file and scanning the project to be scanned according to its scanning type, updating the scanning results of the front-end code based on the mapping relationship of the mapping file and the scanning results of the back-end code, includes: The front-end code and the back-end code are scanned simultaneously, and the mapping file is loaded during the scanning process; In response to the detection of a vulnerability in the front-end code, the back-end code is searched for the existence of a parameter verification corresponding to the vulnerability through the mapping relationship of the mapping file. If the vulnerability exists, it is identified and the severity of the vulnerability is downgraded. If a vulnerability does not exist, it is not flagged, and the severity level of the vulnerability remains unchanged.

2. The method for improving code security scanning according to claim 1, characterized in that, The steps of loading the mapping file, scanning the project to be scanned according to its scanning type, and updating the scanning results of the front-end code based on the mapping relationship of the mapping file and the scanning results of the back-end code include: The front-end code is scanned, and the scan results are saved. The backend code is first compiled, and then the compiled files are scanned. During the scanning process, the scan results of the frontend code and the specified mapping file are loaded. In response to the presence of a vulnerability in the front-end code scan results, the back-end code is searched for the existence of a parameter verification corresponding to the vulnerability through the mapping relationship of the mapping file. If the vulnerability is found, it is identified and its severity is downgraded.

3. The method for improving code security scanning according to claim 2, characterized in that, The steps of loading the mapping file, scanning the project to be scanned according to the scanning type of the project to be scanned, and updating the scanning result of the front-end code according to the mapping relationship of the mapping file and the scanning result of the back-end code further include: in response to the presence of a vulnerability in the scanning result of the front-end code, checking whether the parameter corresponding to the vulnerability exists in the back-end code through the mapping relationship of the mapping file; in response to the absence of the vulnerability, the vulnerability is not marked, and the danger level of the vulnerability remains unchanged.

4. The method for improving code security scanning according to claim 1, characterized in that, The step of updating the front-end code scanning results based on the mapping relationship of the mapping file and the scanning results of the back-end code includes: The severity of vulnerabilities in the front-end code scanning results is updated based on the mapping relationship of the mapping file and the scanning results of the back-end code, and the file name and line number corresponding to the vulnerability in the back-end code are identified.

5. A system for improving code security scanning, characterized in that, include: The first module configures the acquisition of the front-end and back-end code of the project to be scanned. The second module is configured to determine the scanning type of the project to be scanned based on whether the front-end code and the back-end code are in the same scanning task. The third module configures a mapping file that determines the mapping relationship between the front-end code and the back-end code; The fourth module is configured to load the mapping file, scan the project to be scanned according to the scanning type of the project to be scanned, and update the scanning results of the front-end code according to the mapping relationship of the mapping file and the scanning results of the back-end code; The second module is also used to determine whether the front-end code and the back-end code are scanned in the same scanning task based on whether the code is compiled first and then the compiled files are scanned. In response to scanning within the same scanning task, the scanning type of the item to be scanned is determined to be simultaneous scanning; in response to scanning outside the same scanning task, the scanning type of the item to be scanned is determined to be non-simultaneous scanning. The fourth module is also used to scan the front-end code and the back-end code simultaneously, and load the mapping file during the scanning process; In response to the detection of a vulnerability in the front-end code, the back-end code is searched for the existence of a parameter verification corresponding to the vulnerability through the mapping relationship of the mapping file. If the vulnerability exists, it is identified and the severity of the vulnerability is downgraded. If a vulnerability does not exist, it is not flagged, and the severity level of the vulnerability remains unchanged.

6. A computer device, characterized in that, include: At least one processor; as well as A memory storing computer instructions executable on the processor, which, when executed by the processor, implement the steps of the method according to any one of claims 1-4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-4.

Images