Source code positioning detection method and system, electronic device and storage medium
By generating bytecode files and converting them into intermediate code, and parsing the function sequence list, the false alarm problem under the regular expression fuzzy matching method is solved, and the accurate matching and location of source code functions is achieved, thus improving the accuracy of code detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HARBIN ANTIY TECH
- Filing Date
- 2022-05-07
- Publication Date
- 2026-05-15
AI Technical Summary
Existing regular expression fuzzy matching methods are prone to false alarms during source code function location, especially when functions with the same name exist in different modules, leading to matching errors.
By generating bytecode files and converting them into intermediate code, the function sequence table, which includes function attributes and call information, is parsed to achieve precise matching of function locations in the source code.
It solves the problem of false positives for functions with the same name in different modules, achieves accurate matching and location of source code functions, and improves the accuracy of code detection.
Smart Images
Figure CN114817920B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of static security detection technology, and in particular to a source code location detection method, system, electronic device, and storage medium. Background Technology
[0002] During the development of program source code, various factors may lead to potential security vulnerabilities. Attackers can use penetration testing to find these vulnerabilities, resulting in application attacks, server intrusions, data downloads, and business disruptions. To minimize (ideally avoid) security vulnerabilities in the code, vulnerability testing is typically performed after code development is complete.
[0003] Code vulnerability detection is generally divided into static detection and dynamic detection. In static detection, regular expression fuzzy matching is typically used to match source code functions in order to locate and trace the source code.
[0004] However, the inventors of this application discovered in the process of realizing this invention that the regular expression fuzzy matching method has a large number of false alarm problems. For example, when searching for functions that are not officially recommended or sensitive APIs (Application Program Interface), the matching will fail because functions with the same name exist in different modules in the source code. Summary of the Invention
[0005] In view of this, embodiments of the present invention provide a source code location detection method, system, electronic device, and storage medium, which can achieve accurate matching and location of source code functions, thereby solving the problem of false alarms for functions with the same name in different modules.
[0006] To achieve the above-mentioned objectives, the following technical solution is adopted:
[0007] In a first aspect, embodiments of the present invention provide a source code location detection method, the method comprising the following steps:
[0008] A corresponding bytecode file is generated based on the source code to be located; the bytecode file is analyzed to obtain the intermediate code corresponding to the bytecode file; the intermediate code is parsed to generate a function sequence list called in the source code to be located; the function sequence list contains: function attribute information and call information; the location information of the source code to be located is determined by matching and querying the function sequence list.
[0009] Optionally, the bytecode file includes: bytecode file structure information, metadata, and method information;
[0010] The step of analyzing the bytecode file to obtain the intermediate code corresponding to the bytecode file includes: loading the bytecode file based on code optimization and analysis tools; and converting the bytecode file into the corresponding intermediate code according to the bytecode file structure information, metadata, and method information.
[0011] Optionally, parsing the intermediate code to generate a function sequence list called in the source code to be located includes: traversing and querying functions with the same name in the intermediate code; extracting the attribute information and call information of the functions with the same name; and aggregating the obtained attribute information and call information of the functions with the same name to obtain a function sequence list called in the source code to be located.
[0012] Optionally, the function's attribute information includes: the function's namespace and / or the line number where the function is located; the call information includes: the function call name, the call parameters, and / or the parameter types.
[0013] Optionally, generating the corresponding bytecode file based on the source code to be located includes: compiling and analyzing the source code to be located; importing the compilation and analysis results into a symbol table; and annotating and semantically analyzing the compilation and analysis results based on the symbol table to obtain the bytecode file.
[0014] Secondly, embodiments of the present invention also provide a source code location detection system, the system comprising: a conversion program unit, an analysis program unit, a parsing program unit, and a matching program unit; the conversion program unit is used to generate a corresponding bytecode file based on the source code to be located; the analysis program unit is used to analyze the bytecode file to obtain intermediate code corresponding to the bytecode file; the parsing program unit is used to parse the intermediate code to generate a function sequence table called in the source code to be located; the function sequence table includes: function attribute information and call information; the matching program unit is used to determine the location information of the source code to be located by matching and querying according to the function sequence table.
[0015] Optionally, the bytecode file includes: bytecode file structure information, metadata, and method information; the step of analyzing the bytecode file to obtain the intermediate code corresponding to the bytecode file includes: loading the bytecode file based on code optimization and analysis tools; and converting the bytecode file into the corresponding intermediate code according to the bytecode file structure information, metadata, and method information.
[0016] Optionally, the parsing program unit includes: a traversal program module for traversing and querying functions with the same name in the intermediate code; an extraction program module for extracting the attribute information and call information of the functions with the same name; and an aggregation program module for aggregating the obtained attribute information and call information of the functions with the same name to obtain a sequence list of functions called in the source code to be located.
[0017] Optionally, the function's attribute information includes: the function's namespace and / or the line number where the function is located; the call information includes: the function call name, the call parameters, and / or the parameter types.
[0018] Optionally, the conversion program unit includes: a compiler module for compiling and analyzing the source code to be located; an import module for importing the compilation and analysis results into a symbol table; and an analysis module for annotating and semantically analyzing the compilation and analysis results based on the symbol table to obtain the bytecode file.
[0019] Thirdly, embodiments of the present invention provide an electronic device, including: one or more processors; a memory; wherein the memory stores one or more executable programs, and the one or more processors read the executable program code stored in the memory and run a source code location detection system corresponding to the executable program code, so as to execute any of the source code location detection methods described in the first aspect.
[0020] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the source code location and detection method described in any of the first aspects.
[0021] The source code location detection method, system, electronic device, and storage medium provided in this invention generate a corresponding bytecode file from the source code to be located, then convert the bytecode file into intermediate language code (i.e., intermediate code), and parse it to obtain a function sequence list called in the source code. Based on the specific information such as the function attributes and calls contained in the function sequence list, the location information and other information of the target function in the source code can be accurately matched, thus achieving accurate matching and location of source code functions and solving the problem of false positives for functions with the same name in different modules in the global matching method based on regular expressions. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0023] Figure 1 This is a flowchart illustrating an embodiment of the source code location detection method of the present invention;
[0024] Figure 2 This is a schematic flowchart of another embodiment of the source code location and detection method of the present invention;
[0025] Figure 3 This is a flowchart illustrating another embodiment of the source code location detection method of the present invention.
[0026] Figure 4 This is a schematic diagram of the source code function for locating and detecting results using a global matching method based on regular expressions.
[0027] Figure 5 This is a schematic diagram illustrating the source code function location and detection process based on an embodiment of the present invention.
[0028] Figure 6 This is a schematic block diagram of the architecture of an embodiment of the source code location and detection system of the present invention;
[0029] Figure 7 This is a schematic diagram of an embodiment of the electronic device of the present invention. Detailed Implementation
[0030] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
[0031] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0032] The source code location and detection method provided in this invention is applicable to static source code function detection scenarios. It facilitates rapid and accurate location of errors in the source code, enabling further analysis to determine if any errors or anomalies exist.
[0033] It should be noted that this method can be embedded in a manufactured physical product in the form of software, and the user can reproduce the method flow of this application when using the product.
[0034] Figure 1 This is a schematic flowchart of an embodiment of the source code location detection method of the present invention; see below. Figure 1 As shown, the source code location and detection method may include the following steps:
[0035] S110. Generate the corresponding bytecode file based on the source code to be located.
[0036] The bytecode file may contain: structural information, metadata, and method information.
[0037] The source code can be compiled by a compiler to obtain the corresponding bytecode class file, which is usually a .class file.
[0038] There are generally three methods to generate bytecode files: using the static method of the class, Class classOne = requireClass.class; using the getClass method of the class object, Class classTwo = requireClassInstance.getClass; and using the static method of the Class class, Class.forName Class classThree = Class.forName("fully qualified class name").
[0039] In some embodiments, generating the corresponding bytecode file based on the source code to be located includes: compiling and analyzing the source code to be located; importing the compilation and analysis results into a symbol table; and annotating and semantically analyzing the compilation and analysis results based on the symbol table to obtain the bytecode file.
[0040] The symbol table is a data structure used in language translators, such as compilers and interpreters.
[0041] In this embodiment, the source code is compiled and analyzed, the results are imported into the z symbol table, and then annotation and semantic analysis are performed to generate bytecode files, which are easy to analyze later.
[0042] S120. Analyze the bytecode file to obtain the intermediate code corresponding to the bytecode file.
[0043] In this embodiment, the bytecode file includes: bytecode file structure information, metadata, and method information;
[0044] like Figure 2 As shown, the step of analyzing the bytecode file to obtain the intermediate code corresponding to the bytecode file (step S120) includes: S122, loading the bytecode file based on a code optimization and analysis tool; wherein, the code optimization and analysis tool can be Soot, which is a Java-based tool for code optimization and analysis that can analyze source code and analyze intermediate files.
[0045] In this embodiment, bytecode can be converted into intermediate code that is easy to perform secondary analysis by using code optimization and analysis tools such as Soot.
[0046] S124. Based on the bytecode file structure information, metadata, and method information, convert the bytecode file into corresponding intermediate code.
[0047] Intermediate code is also called intermediate language code.
[0048] S130. Parse the intermediate code to generate a function sequence list called in the source code to be located; the function sequence list contains: function attribute information and call information;
[0049] The attribute and calling information of the function can be used to accurately locate the source code function information.
[0050] S140. Based on the function sequence list matching query, determine the location information of the source code to be located.
[0051] In this embodiment, a matching interface can be provided to quickly integrate the function sequence list obtained in step S130 into the static security scanning detection, which can achieve accurate target matching. Compared with the full information matching scheme, it can solve the problem of false alarms in locating functions with the same name under different modules.
[0052] Please refer to Figure 3 As shown, in some embodiments, the step of parsing the intermediate code and generating a function sequence list called in the source code to be located (step S130) includes: S132, traversing and querying functions with the same name in the intermediate code; S134, extracting the attribute information and call information of the functions with the same name; S136, aggregating the obtained attribute information and call information of the functions with the same name to obtain a function sequence list called in the source code to be located.
[0053] In this embodiment, by traversing and querying all functions with the same name in the intermediate code, and extracting their attribute information and call information for aggregation, a call sequence table of functions is obtained. This allows for tracing the call chain information such as the attributes, references, and context of all functions with the same name, providing accurate matching data support for tracing the source of functions with the same name in different modules in the future.
[0054] In some embodiments, the attribute information of the function includes: the namespace of the function and / or the line number where the function is located, etc.
[0055] The call information includes: function call name, call parameters and / or parameter types, and / or return value information, etc.
[0056] To help understand the technical solutions and their effects provided by the embodiments of the present invention, specific examples are described below:
[0057] The official Java documentation has published a list of deprecated functions in Java 8. Developers who include these deprecated functions in their code may create cybersecurity vulnerabilities. Therefore, after the source code is written, it needs to be tested or analyzed; source code testing is divided into static testing and dynamic testing.
[0058] In static source code testing (also known as static analysis or static detection), traditional static detection tools scan using a global matching method. If modules with the same function name exist in the source code, they will all be detected, resulting in false positives. For example, consider the following source code:
[0059]
[0060] By performing a global match on the deprecated function `java.net.URLDecoder.decode` in the aforementioned source code, it will match decode functions defined in other modules, generating false positives. The matching results are as follows: Figure 4 As shown in the last line of the matching results, the custom module function Confuse.decode was matched. Therefore, if there are too many functions with the same name defined in a module, it will cause a large number of false alarms, making subsequent repair work extremely difficult.
[0061] In this embodiment, by extracting bytecode, translating it into intermediate language code, and then parsing it, function attribute information and call information are obtained. This not only allows for precise matching of the target function but also enables the extraction of the function's parameter information, such as return type, package name, class name, and location information. Figure 5 As shown, accurate matching of source code functions has been achieved, solving the problem of false positives for functions with the same name in different modules.
[0062] In summary, the source code location detection method provided by this invention generates a corresponding bytecode file from the source code to be located, then converts the bytecode file into intermediate language code, and parses the function sequence list called in the source code. Based on the specific information of the functions contained in the function sequence list, the location information and other information of the target function in the source code can be accurately matched and located, thus solving the problem of false alarms for functions with the same name under different modules in the global matching method.
[0063] Example 2
[0064] Figure 6 This is a schematic block diagram of an embodiment of the source code location detection system of the present invention. (See attached diagram.) Figure 6As shown, the system includes: a conversion program unit 210, an analysis program unit 220, a parsing program unit 230, and a matching program unit 240; the conversion program unit 210 is used to generate a corresponding bytecode file based on the source code to be located; the bytecode file includes: structural information, metadata, and method information; the analysis program unit 220 is used to analyze the bytecode file to obtain the intermediate code corresponding to the bytecode file; the parsing program unit 230 is used to parse the intermediate code to generate a function sequence table called in the source code to be located; the function sequence table includes: function attribute information and call information; the matching program unit 240 is used to match and query according to the function sequence table to determine the location information of the source code to be located.
[0065] The source code location and analysis system provided in this embodiment can be used to execute... Figure 1 The technical solution of the method embodiment shown is similar in principle and technical effect to that of Embodiment 1, and will not be described in detail here. They can be referred to each other.
[0066] In this invention, as an optional embodiment, the bytecode file includes: bytecode file structure information, metadata, and method information; the step of analyzing the bytecode file to obtain the intermediate code corresponding to the bytecode file includes: loading the bytecode file based on code optimization and analysis tools; and converting the bytecode file into the corresponding intermediate code according to the bytecode file structure information, metadata, and method information.
[0067] In this invention, as an optional embodiment, the parsing program unit 230 includes: a traversal program module for traversing and querying functions with the same name in the intermediate code; an extraction program module for extracting the attribute information and call information of the functions with the same name; and an aggregation program module for aggregating the obtained attribute information and call information of the functions with the same name to obtain the sequence of functions called in the source code to be located.
[0068] In this invention, as an optional embodiment, the attribute information of the function includes: the namespace of the function and / or the line number where the function is located; the calling information includes: the function call name, the call parameters and / or the parameter types of the call.
[0069] In this invention, as an optional embodiment, the conversion program unit 210 includes: a compiler module for compiling and analyzing the source code to be located; an import program module for importing the compilation and analysis results into a symbol table; and an analysis program module for annotating and semantically analyzing the compilation and analysis results based on the symbol table to obtain the bytecode file.
[0070] The source code location and detection system provided in this embodiment of the invention, based on the same specific technical features as in Embodiment 1, can accurately match the location information and other information of the target function in the source code, achieving accurate matching and location of source code functions, and solving the problem of false alarms for functions with the same name under different modules in the global matching method based on regular expressions.
[0071] Example 3
[0072] Another embodiment of the present invention provides an electronic device, including one or more processors; a memory; the memory stores one or more executable programs, and the one or more processors read the executable program code stored in the memory to run the source code location and detection system provided in Embodiment 2 corresponding to the executable program code, so as to execute the source code location and detection method described in any of Embodiment 1.
[0073] Figure 7 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention, which can implement any of the methods described in Embodiment 1 of the present invention, such as... Figure 7 As shown, in an optional embodiment, the above-mentioned electronic device may include: a housing 41, a processor 42, a memory 43, a circuit board 44, and a power supply circuit 45, wherein the circuit board 44 is disposed inside the space enclosed by the housing 41, and the processor 42 and the memory 43 are disposed on the circuit board 44; the power supply circuit 45 is used to supply power to the various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program code; the processor 42 reads the executable program code stored in the memory 43 to run the source code location detection system corresponding to the executable program code, and is used to execute any of the source code location detection methods described in the aforementioned embodiment one.
[0074] For details on the specific execution process of the above steps by the processor 42 and the steps further executed by the processor 42 through running executable program code, please refer to the description of Embodiment 1 of the source code location detection method of the present invention, which will not be repeated here.
[0075] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by having mobile communication functions and are primarily designed to provide voice and data communication. These terminals include: smartphones (e.g., iPhone), multimedia phones, feature phones, and low-end phones. (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing functions, and generally also have mobile internet access capabilities. These terminals include: PDAs, MIDs, and UMPCs, such as iPads. (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include: audio and video playback modules (e.g., iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices. (4) Servers: Devices that provide computing services. Servers consist of processors, hard drives, memory, system buses, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability. (5) Other electronic devices with data interaction functions.
[0076] Another embodiment of the present invention provides a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the source code location and detection method described in any of the preceding embodiments.
[0077] As can be seen from the descriptions of the above embodiments, the source code location detection method and system disclosed in this embodiment can accurately extract target function information from the source code by gradually converting the source code into intermediate code of a custom format. This includes location information, module information, function parameter information, return value information, etc. Based on the specific information of the target function, accurate matching and location can be performed, which can solve the problem of false alarms in the detection results based on fuzzy matching mode in existing static detection tools.
[0078] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0079] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.
[0080] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can also be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.
[0081] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A source code location and detection method, characterized in that, The method includes the following steps: Generate the corresponding bytecode file based on the source code to be located; The bytecode file is analyzed to obtain the intermediate code corresponding to the bytecode file; The intermediate code is parsed to generate a function sequence list called in the source code to be located; the function sequence list contains: function attribute information and call information; The location information of the source code to be located is determined by matching and querying the function sequence list. The step of parsing the intermediate code to generate a list of function sequences called in the source code to be located includes: traversing and querying functions with the same name in the intermediate code; extracting the attribute information and call information of the functions with the same name; and aggregating the obtained attribute information and call information of the functions with the same name to obtain a list of function sequences called in the source code to be located.
2. The source code location and detection method according to claim 1, characterized in that, The bytecode file contains: bytecode file structure information, metadata, and method information; The analysis of the bytecode file to obtain the intermediate code corresponding to the bytecode file includes: The bytecode file is loaded using code optimization and analysis tools. Based on the bytecode file structure information, metadata, and method information, the bytecode file is converted into corresponding intermediate code.
3. The source code location and detection method according to claim 1, characterized in that, The attribute information of the function includes: the function's namespace and / or the line number where the function is located; The call information includes: function call name, call parameters and / or the parameter types.
4. The source code location and detection method according to claim 1, characterized in that, The process of generating the corresponding bytecode file based on the source code to be located includes: The source code to be located is compiled and analyzed; Import the compilation and analysis results into the symbol table; Based on the symbol table, annotations and semantic analysis are performed on the compilation and analysis results to obtain the bytecode file.
5. A source code location and detection system, characterized in that, The system includes: a conversion program unit, an analysis program unit, a parsing program unit, and a matching program unit; The conversion program unit is used to generate a corresponding bytecode file based on the source code to be located; the bytecode file includes: structural information, metadata, and method information; The analysis program unit is used to analyze the bytecode file to obtain the intermediate code corresponding to the bytecode file; The parsing program unit is used to parse the intermediate code and generate a function sequence list called in the source code to be located; the function sequence list includes: function attribute information and call information; The matching program unit is used to determine the location information of the source code to be located by matching and querying the function sequence list. The parsing program unit includes: The program module is used to iterate through and query functions with the same name in the intermediate code; The extraction module is used to extract the attribute information and call information of the function with the same name; The aggregation module is used to aggregate the attribute information and call information of the functions with the same name to obtain a sequence list of functions called in the source code to be located.
6. The source code location and detection system according to claim 5, characterized in that, The bytecode file contains: bytecode file structure information, metadata, and method information; The analysis program unit includes: The loader module is used to load the bytecode file based on code optimization and analysis tools; The conversion module is used to convert the bytecode file into corresponding intermediate code based on the bytecode file structure information, metadata, and method information.
7. An electronic device, characterized in that, include: One or more processors; Memory; The memory stores one or more executable programs, and the one or more processors read the executable program code stored in the memory and run the source code location and detection system corresponding to the executable program code to execute the source code location and detection method according to any one of claims 1 to 4.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the method described in any one of claims 1 to 4.