Code rectification method and apparatus

Abstract

The disclosure provides a code rectification method, relates to the technical field of software development, and can be applied to the technical field of financial technology. The method is applied to a static scanning server and comprises the following steps: starting the static scanning server, starting a sandbox container on the static scanning server in a proxy mode; performing static scanning on a code file to be checked, the static scanning server being configured with a plurality of static rules; obtaining a scanning log after the static scanning through the sandbox container, judging whether the scanning log triggers at least one static rule, and if yes, determining that the code file to be checked is a code file to be modified, and obtaining rectification information corresponding to the code file to be modified and a code file after rectification from a problem rectification server. The disclosure further provides a code rectification device, an electronic device, a storage medium and a program product.

Description

Technical Field

[0001] This disclosure relates to the field of software development technology and can be used in the field of financial technology technology, specifically relating to a code rectification method, apparatus, electronic device and medium. Background Technology

[0002] Currently, during code technical debt rectification and access control checks for code submissions, many medium- to high-risk issues identified by static code scanning are primarily addressed through manual modifications by developers. However, for numerous risk issues with relatively fixed modification methods, the repetitive analysis and modification each time fails to meet developers' requirements for speed and reusability, thus reducing development efficiency.

[0003] Therefore, existing code scanning methods have many problems and the modification methods are relatively fixed. Manual code modification carries medium to high risks, increases the workload of developers, and reduces development efficiency. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a code remediation method, apparatus, electronic device and medium, which can reduce the time spent by developers on remediation of medium and high risk issues and improve development efficiency.

[0005] According to the first aspect of this disclosure, a code remediation method is provided, applied to a static scanning server. The method includes: starting the static scanning server and starting a sandbox container on the static scanning server using a proxy mode; performing a static scan on the code file to be checked, wherein the static scanning server is configured with multiple static rules; obtaining the scan logs after the static scan through the sandbox container, determining whether the scan logs trigger at least one static rule, and if so, determining that the code file to be checked is a code file to be modified, and obtaining the remediation information and the remediated code file corresponding to the code file to be modified from the problem remediation server.

[0006] According to embodiments of this disclosure, the sandbox container loads a code monitoring plugin after startup, which is used to monitor the call status of the static scanning server in real time and obtain the scan logs after static scanning.

[0007] According to embodiments of this disclosure, after determining whether the scan log triggers at least one static rule, the method further includes: if the scan log does not trigger at least one static rule, then submitting the code file to be inspected.

[0008] According to embodiments of this disclosure, after determining that the code file to be inspected is a code file to be modified, the method further includes: the sandbox container obtaining the text information corresponding to the code file to be modified and the triggered static rule identifier; and transmitting the text information and static rule identifier to the problem rectification server through the sandbox container.

[0009] According to embodiments of this disclosure, the text information includes rule explanations and line numbers of code.

[0010] According to embodiments of this disclosure, obtaining rectification information and rectified code files for corresponding code files to be modified from a problem rectification server specifically includes performing the following operations using the problem rectification server: matching the corresponding target rectification rule according to the static rule identifier; rectifying the code files to be modified according to the target rectification rule to generate rectification information and rectified code files; and feeding back the rectification information and rectified code files to the static scanning server through a sandbox container.

[0011] According to embodiments of this disclosure, the problem rectification server has a three-layer architecture, including an interface control layer, wherein: the interface control layer receives text information and static rule identifiers transmitted by the sandbox container, and feeds back rectification information and rectified code files to the sandbox container.

[0012] According to an embodiment of this disclosure, the problem rectification server is configured with a rule database. The rule database has multiple preset automatic rectification rules. The corresponding target rectification rule is matched according to the static rule identifier. The method also includes: determining whether there is at least one automatic rectification rule corresponding to the static rule identifier in the rule database. If so, the at least one existing automatic rectification rule is determined as the target rectification rule.

[0013] According to embodiments of this disclosure, determining whether there is at least one automatic rectification rule corresponding to a static rule identifier in the rule database further includes: if there is no at least one automatic rectification rule corresponding to a static rule identifier in the rule database, then determining that the static rule identifier cannot match the corresponding target rectification rule; the problem rectification server generates unrectified information and feeds the unrectified information and the code file to be modified back to the static scanning server through a sandbox container.

[0014] The second aspect of this disclosure provides a code remediation apparatus applied to a static scanning server. The apparatus includes: a sandbox startup module for starting the static scanning server and starting a sandbox container on the static scanning server using a proxy mode; a static scanning module for performing static scanning on the code file to be inspected, wherein the static scanning server is configured with multiple static rules; and a code remediation module for obtaining the scan logs after the static scan through the sandbox container, determining whether the scan logs trigger at least one static rule, and if so, determining that the code file to be inspected is a code file to be modified, and obtaining the remediation information and the remediated code file corresponding to the code file to be modified from the problem remediation server.

[0015] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the above-described code rectification method.

[0016] A fourth aspect of this disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the above-described code rectification method.

[0017] The fifth aspect of this disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described code rectification method.

[0018] Compared with the prior art, the code rectification method, apparatus, electronic device and medium provided in this disclosure have at least the following beneficial effects:

[0019] This disclosure allows for the immediate acquisition of automatically corrected files after Sonar static scanning of the development code detects high-risk issues, thereby improving work efficiency in the following two scenarios:

[0020] (1) Existing legacy applications suffer from significant technical debt, such as numerous static code stylesheet issues and high code complexity, which hinders the improvement of their DevOps standards. This disclosure can reduce the workload of developers manually fixing high-risk issues in existing code, allowing development teams to allocate more resources to development work.

[0021] (2) Currently, all code changes submitted by developers must undergo static code scanning using the Sonar service. Only code that does not violate medium- or high-risk rules can pass through the access control. This release automatically generates corrected documentation, which can effectively assist developers in correcting issues in new code, thereby quickly completing code submissions and improving development efficiency. Attached Figure Description

[0022] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0023] Figure 1 This illustration schematically depicts an application scenario of the code rectification method and apparatus according to embodiments of the present disclosure;

[0024] Figure 2 A flowchart illustrating a code rectification method according to an embodiment of the present disclosure is shown schematically;

[0025] Figure 3 A flowchart illustrating the scan log determination process according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 4 This schematically illustrates a flowchart following the confirmation of the code file to be modified according to an embodiment of the present disclosure;

[0027] Figure 5 A flowchart illustrating the process of obtaining the modified code file according to an embodiment of this disclosure is shown schematically.

[0028] Figure 6 A flowchart illustrating the target rectification rule matching according to an embodiment of the present disclosure is shown schematically;

[0029] Figure 7 A flowchart illustrating the automatic rectification rule determination according to an embodiment of the present disclosure is shown schematically.

[0030] Figure 8 This illustration schematically shows an operation flowchart of a code rectification method according to a specific embodiment of the present disclosure;

[0031] Figure 9 A block diagram of a code rectification apparatus according to embodiments of the present disclosure is schematically shown; and

[0032] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing a code rectification method according to an embodiment of the present disclosure. Detailed Implementation

[0033] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0034] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0035] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0036] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0037] The accompanying drawings illustrate several block diagrams and / or flowcharts. It should be understood that some blocks, or combinations thereof, in the block diagrams and / or flowcharts can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that, when executed by the processor, these instructions can create means for implementing the functions / operations described in these block diagrams and / or flowcharts. The technology of this disclosure can be implemented in hardware and / or software (including firmware, microcode, etc.). Alternatively, the technology of this disclosure can take the form of a computer program product stored on a computer-readable storage medium, which is available for use by or in conjunction with an instruction execution system.

[0038] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information comply with the provisions of relevant laws and regulations, necessary confidentiality measures have been taken, and there is no violation of public order and good morals.

[0039] In the technical solution disclosed herein, the user's authorization or consent is obtained before acquiring or collecting the user's personal information.

[0040] This disclosure provides a code remediation method, apparatus, device, storage medium, and program product, relating to the field of software development technology and applicable to the field of financial technology. The method is applied to a static scanning server and includes: starting the static scanning server; starting a sandbox container on the static scanning server using a proxy mode; performing a static scan on the code file to be checked, wherein the static scanning server is configured with multiple static rules; obtaining the scan logs after the static scan through the sandbox container; determining whether the scan logs trigger at least one static rule; if so, determining that the code file to be checked is a code file to be modified; and obtaining the remediation information and the remediated code file corresponding to the code file to be modified from the problem remediation server.

[0041] Before describing the specific embodiments of this disclosure in detail, the English or technical terms involved will be explained first to facilitate a better understanding of this disclosure.

[0042] Sonar: An open platform for code scanning and analysis. It can analyze project code in different programming languages ​​and integrate with various testing tools, code analysis tools, and continuous integration tools.

[0043] AOP (Aspect-Oriented Programming) is a programming approach that focuses on a specific step or stage of a business process. This step or stage is called an aspect. The goal is to reduce coupling between different parts of the business logic. There are two common basic principles for implementing AOP: proxy and behavior injection.

[0044] Jvm-sandbox: A JVM sandbox container, a non-intrusive runtime AOP solution for JVM that enables AOP solutions without restarting or intruding on the target JVM application.

[0045] `reportIssue`: Methods in the Sonar server's code scanning process will throw an informational message for lines that match the check rules.

[0046] Figure 1 The illustration schematically depicts an application scenario of the code rectification method and apparatus according to embodiments of this disclosure. It should be noted that... Figure 1 The examples shown are merely examples of application scenarios that can be applied to the embodiments of this disclosure, in order to help those skilled in the art understand the technical content of this disclosure, but do not mean that the embodiments of this disclosure cannot be used in other devices, systems, environments or scenarios.

[0047] like Figure 1 As shown, application scenario 100 according to this embodiment may include terminal device 101, static scanning server 102, network 103, and problem rectification server 104. Network 103 serves as a medium for providing a communication link between terminal device 101 and static scanning server 102, and also serves as a medium for providing a communication link between static scanning server 102 and problem rectification server 104. Network 103 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0048] Users can use terminal device 101 to interact with static scanning server 102 via network 103 to receive or send code files, etc. Various communication client applications can be installed on terminal device 101, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0049] Terminal device 101 can be various electronic devices with a display screen and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0050] The static scanning server 102 can be a server that provides various services, such as a backend management server that supports code files submitted by users using terminal device 101 (for example only). The backend management server can analyze and process the received code files and other data, and feed the processing results back to terminal device 101.

[0051] The static scanning server 102 also interacts with the problem rectification server 104 via the network 103 to analyze and process the code files, and receives the rectification information and rectified code files fed back by the problem rectification server 104, and determines the rectified code files to be submitted after the final scan is completed.

[0052] It should be noted that the code remediation method provided in this embodiment can generally be executed by the static scanning server 102. Correspondingly, the code remediation apparatus provided in this embodiment can generally be located within the static scanning server 102. The code remediation method provided in this embodiment can also be executed by a server or server cluster that is different from the static scanning server 102 and capable of communicating with the terminal device 101 and / or the static scanning server 102. Correspondingly, the code remediation apparatus provided in this embodiment can also be located within a server or server cluster that is different from the static scanning server 102 and capable of communicating with the terminal device 101 and / or the static scanning server 102.

[0053] It should be understood that Figure 1 The number of terminal devices, static scanning servers, networks, and problem rectification servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, static scanning servers, networks, and problem rectification servers can be included.

[0054] The following will be based on Figure 1 The described application scenarios, through Figures 2-8 The code rectification method of the embodiments of this disclosure will be described in detail.

[0055] Figure 2 A flowchart illustrating a code rectification method according to an embodiment of the present disclosure is shown schematically.

[0056] like Figure 2 As shown, the code rectification method of this embodiment is applied to a static scanning server and may include operations S210 to S230.

[0057] When operating S210, start the static scanning server and use the agent mode to start a sandbox container on the static scanning server.

[0058] The static scanning server can be, for example, a Sonar server, and the sandbox container can be, for example, a JVM-sandbox. After starting the Sonar server, the JVM-sandbox can be started on the Sonar server using agent mode, or agent startup. The code implementation can be, for example, `-javaagent: "** / sandbox-agentjar**"`.

[0059] Furthermore, the sandbox container loads a code monitoring plugin after startup, which is used to monitor the static scanning server's calls in real time and obtain the scan logs after the static scan.

[0060] For example, the code monitoring plugin could be sand-module-sonar-1.0.0-SNAPSHOT-jar-with-dependencies.jar, written within the JVM-sandbox framework. This plugin can be used to monitor the static scanning server's call activity in real time and retrieve the scan logs after the static scan. Placing this monitoring plugin in the JVM-sandbox user module directory (i.e., ${HOME} / .sandbox-module / ) will enable it to load on the sandbox container.

[0061] When operating S220, a static scan is performed on the code files to be checked. The static scan server is configured with multiple static rules.

[0062] The code file to be checked refers to the code that needs to be checked during the computer software development process. Usually, after developers finish writing the current development flow, they need to check the code style of all the code in the current development flow. All the code in the current development flow is the code file to be checked.

[0063] Static scanning is performed using a static scanning server, which is pre-configured with multiple static rules to determine whether there are any issues in the code that need to be addressed.

[0064] When operating S230, the scan logs after static scanning are obtained through the sandbox container. It is determined whether the scan logs trigger at least one static rule. If so, the code file to be checked is determined to be the code file to be modified. The corresponding rectification information and the rectified code file are obtained from the problem rectification server.

[0065] Once the static code rule scan is complete, if a rule is triggered, it can be determined that the code file to be checked needs to be modified. Then, the developers can obtain the corresponding rectification information from the issue rectification server and download the rectified code file.

[0066] Finally, after the code rectification is completed automatically, the code submitter should double-check whether the rectification is correct before submitting it themselves.

[0067] Through the embodiments of this disclosure, static code style issues can be automatically rectified during static code scanning. This disclosure automatically generates rectified code files, effectively assisting developers in rectifying issues in new code, thereby accelerating code submission and improving development efficiency.

[0068] Figure 3 A flowchart illustrating the scan log determination process according to an embodiment of the present disclosure is shown schematically.

[0069] like Figure 3 As shown, after determining whether the scan log has triggered at least one static rule in the above operation S230, it may also include operation S2301.

[0070] When operating S2301, if the scan log does not trigger at least one static rule, then submit the code file to be checked.

[0071] Therefore, this disclosure can determine whether to submit the original code file or the modified code file by using static rules.

[0072] Figure 4 The flowchart illustrating the process after the code file to be modified is confirmed according to an embodiment of the present disclosure is shown schematically.

[0073] like Figure 4 As shown, after determining that the code file to be checked is the code file to be modified in the above operation S230, it may also include operations S2302 to S2303.

[0074] In operation S2302, the sandbox container obtains the text information corresponding to the code file to be modified and the identifier of the triggered static rule.

[0075] Specifically, the text information may include a rule explanation and a line number of code. The text information and the triggered static rule identifier can be recorded by calling the `reportIssue` method in the Sonar server process and monitored by the code monitoring plugin in JVM-sandbox.

[0076] In operation S2303, text information and static rule identifiers are transmitted to the issue remediation server through a sandbox container.

[0077] Specifically, the issue rectification server can be accessed via the Hypertext Transfer Protocol (HTTP) by calling the Uniform Resource Locator (URL), and the text information and static rule identifiers (rule IDs) can be transmitted to the issue rectification server in JSON format.

[0078] In this embodiment, the problem rectification server has a three-layer architecture, including a user interface control layer. The user interface control layer can receive text information and static rule identifiers transmitted from the sandbox container, and can also send rectification information and rectified code files back to the sandbox container.

[0079] Specifically, this three-tier architecture can be, for example, a Spring Boot three-tier architecture, including a UI / UX controller layer, a business logic service layer, and a data access layer. The controller layer receives requests and data from the JVM-sandbox in the Sonar server. For example, based on the above, text information and static rule identifiers can be passed to the controller layer of the issue rectification server in JSON format.

[0080] Figure 5 A flowchart illustrating the process of obtaining the modified code file according to an embodiment of this disclosure is shown.

[0081] like Figure 5 As shown, the above operation S230, which involves obtaining the rectification information and the rectified code file corresponding to the code file to be modified from the problem rectification server, may specifically include using the problem rectification server to perform the following operations S510 to S530.

[0082] When operating S510, the corresponding target rectification rule is matched based on the static rule identifier.

[0083] When operating S520, the code files to be modified are rectified according to the target rectification rules, generating rectification information and rectified code files.

[0084] When operating S530, the rectification information and the rectified code files are fed back to the static scanning server through a sandbox container.

[0085] This demonstrates that the problem rectification server can adapt to different rectification rules based on different static rule identifiers in order to rectify the code files to be modified.

[0086] Figure 6 A flowchart illustrating target rectification rule matching according to an embodiment of the present disclosure is shown schematically.

[0087] like Figure 6 As shown in this embodiment, the problem rectification server is configured with a rule database, which has multiple preset automatic rectification rules. Based on this, the above-mentioned operation S510, which matches the corresponding target rectification rule according to the static rule identifier, may further include operation S5101.

[0088] In operation S5101, it is determined whether there is at least one automatic rectification rule corresponding to the static rule identifier in the rule database. If so, the at least one automatic rectification rule is identified as the target rectification rule.

[0089] Based on the static rule identifier of the Sonar server, match the configured automatic rectification rules in the rule database. If at least one automatic rectification rule is matched, the successfully matched automatic rectification rule is determined as the target rectification rule corresponding to the static rule identifier.

[0090] Figure 7 A flowchart illustrating the automatic rectification rule determination according to an embodiment of the present disclosure is shown.

[0091] like Figure 7 As shown, the determination of whether there is at least one automatic rectification rule corresponding to the static rule identifier in the rule database in the above operation S5101 may also include the following operations S51011 to S51012.

[0092] When operating S51011, if there is no automatic rectification rule corresponding to the static rule identifier in the rule database, it is determined that the static rule identifier cannot match the corresponding target rectification rule.

[0093] When operating S51012, the problem rectification server generates unrectified information and feeds the unrectified information and the code files to be modified back to the static scanning server through a sandbox container.

[0094] Therefore, if no automatic rectification rule is matched in operation S5101, it means that the static rule identifier has not been configured with a corresponding automatic rectification method, and thus the code file to be modified cannot be rectified.

[0095] Figure 8 The diagram illustrates the operation flowchart of a code rectification method according to a specific embodiment of the present disclosure.

[0096] like Figure 8 As shown, a specific embodiment of the code rectification method disclosed herein is given. The implementation process of this method can be as follows:

[0097] (1) The sand-module-sonar-1.0.0-SNAPSHOT-jar-with-dependencies.jar module is loaded after the JVM-sandbox starts. It will monitor the call status of the sonar server in real time and obtain the input parameters of the reportIssue method in the sonar server process.

[0098] (2) When developers submit code or perform routine code checks, they will call the Sonar server to perform static code scanning. If the code does not violate the static rules configured in the Sonar server, the scan is complete; otherwise, the Sonar server process will call the reportIssue method to record the triggered rule ID and text information (such as rule explanation and code line number), which will be monitored by the JVM-sandbox module.

[0099] (3) Obtain the input parameters from the reportIssue method, including the rule ID and text information;

[0100] (4) Access the problem rectification service via HTTP by calling the URL, and send the rule ID and file information to the controller layer of the problem rectification server in JSON format;

[0101] (5) The problem rectification server is a three-tier architecture of Spring Boot, which receives requests and data from the JVM-sandbox in the Sonar server through its controller layer;

[0102] (6) Based on the rule ID of the Sonar server, match the automatically corrective rules configured in the rule database. If an automatically corrective rule is matched, validate the string of the trigger rule's line number to locate the part of the code file that needs modification. If no match is found, it means that this rule does not have a corrective method configured.

[0103] For example, Table 1 below provides examples of automatic rectification rules from the rule database.

[0104] Table 1

[0105]

[0106] (7) By performing logical replacement on the file string, the error code statement is rectified, and the rectified code file and related rectification information are generated.

[0107] For example, Table 2 below provides an example of the automatic rectification code that matches the S1149 rule for rectification.

[0108] Table 2

[0109]

[0110] (8) The controller layer of the Spring Boot architecture responds to the JVM-sandbox of the Sonar server. The JVM-sandbox of the Sonar server receives the response, obtains the returned data, and prints the returned data in the scan log to complete the scan.

[0111] In summary, this disclosure, based on JVM-sandbox, obtains file scan information in real-time and non-intrusively during Sonar server rule scanning of code files to match code remediation methods, thereby standardizing and remediating the code files and outputting the remediated files. This disclosure automatically generates remediated files, effectively assisting developers in remediating issues in new code, thus enabling rapid code submission and improving development efficiency. Furthermore, this disclosure reduces the workload of developers manually remediating high-risk issues in existing code, allowing development teams to dedicate more resources to development work.

[0112] Based on the above code remediation methods, this disclosure also provides a code remediation device, which will be described below in conjunction with... Figure 9 The device is described in detail.

[0113] Figure 9 A block diagram of a code rectification apparatus according to an embodiment of the present disclosure is shown schematically.

[0114] like Figure 9 As shown, the code remediation device 900 of this embodiment is applied to a static scanning server and includes a sandbox startup module 910, a static scanning module 920, a code remediation module 930, and a code submission module 940.

[0115] The sandbox startup module 910 is used to start the static scanning server and launch the sandbox container on the static scanning server using a proxy mode. In one embodiment, the sandbox startup module 910 can be used to perform the operation S210 described above, which will not be repeated here.

[0116] The static scanning module 920 is used to perform static scanning on the code files to be inspected. The static scanning server is configured with multiple static rules. In one embodiment, the static scanning module 920 can be used to perform the operation S220 described above, which will not be repeated here.

[0117] The code remediation module 930 is used to obtain the scan logs after static scanning through the sandbox container, determine whether the scan logs trigger at least one static rule, and if so, determine that the code file to be checked is the code file to be modified. It then obtains the remediation information and the remediated code file from the issue remediation server. In one embodiment, the code remediation module 930 can be used to execute the operation S230 described above, which will not be repeated here.

[0118] Through the embodiments of this disclosure, static code style issues can be automatically rectified during code scanning. This disclosure automatically generates rectified code files, effectively assisting developers in rectifying issues in new code, thereby accelerating code submission and improving development efficiency.

[0119] According to embodiments of this disclosure, any multiple modules among the sandbox startup module 910, static scanning module 920, code remediation module 930, and code submission module 940 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the sandbox startup module 910, static scanning module 920, code remediation module 930, and code submission module 940 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the sandbox startup module 910, static scanning module 920, code rectification module 930, and code submission module 940 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0120] Figure 10 A block diagram schematically illustrates an electronic device suitable for implementing a code rectification method according to an embodiment of the present disclosure.

[0121] like Figure 10As shown, an electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0122] RAM 1003 stores various programs and data required for the operation of electronic device 1000. Processor 1001, ROM 1002, and RAM 1003 are interconnected via bus 1004. Processor 1001 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 1002 and / or RAM 1003. It should be noted that the programs may also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0123] According to embodiments of this disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to a bus 1004. The electronic device 1000 may also include one or more of the following components connected to the I / O interface 1005: an input section 1006 including a keyboard, mouse, etc.; an output section 1007 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN card, modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1010 as needed so that computer programs read from it can be installed into the storage section 1008 as needed.

[0124] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the code rectification method according to the embodiments of this disclosure.

[0125] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 1002 and / or RAM 1003 and / or one or more memories other than ROM 1002 and RAM 1003 described above.

[0126] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the code rectification methods provided in the embodiments of this disclosure.

[0127] When the computer program is executed by the processor 1001, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0128] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 1009, and / or installed from a removable medium 1011. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0129] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 1009, and / or installed from removable medium 1011. When the computer program is executed by processor 1001, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0130] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0131] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0132] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0133] The embodiments of this disclosure have been described above, but these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A code remediation method applied to a static scanning server, the method comprising: Start the static scanning server, and then start a sandbox container on the static scanning server using agent mode; After startup, the code monitoring plugin for the sandbox container is loaded. The code monitoring plugin is used to monitor the call status of the static scanning server in real time. The code files to be inspected are subjected to static scanning, and the static scanning server is configured with multiple static rules. The code monitoring plugin of the sandbox container obtains the scan log after the static scan, and determines whether the scan log triggers at least one of the static rules. If so, the code file to be checked is determined to be the code file to be modified. The text information corresponding to the code file to be modified and the triggered static rule identifier are obtained through the sandbox container; The text information and static rule identifiers are transmitted to the problem rectification server through the sandbox container; Based on the text information and static rule identifier, obtain the rectification information and the rectified code file corresponding to the code file to be modified from the problem rectification server.

2. The method according to claim 1, wherein, After determining whether the scan log triggers at least one of the static rules, the method further includes: If the scan log does not trigger at least one of the static rules, then submit the code file to be inspected.

3. The method according to claim 1, wherein, The text information includes rule explanations and line numbers of code.

4. The method according to claim 1, wherein, The step of obtaining the rectification information and the rectified code file corresponding to the code file to be modified from the problem rectification server based on the text information and static rule identifier specifically includes performing the following operations using the problem rectification server: Based on the static rule identifier, match the corresponding target rectification rule; The code file to be modified is rectified according to the target rectification rules, and rectification information and rectified code file are generated. The rectification information and the rectified code file are fed back to the static scanning server through the sandbox container.

5. The method according to claim 1, wherein, The problem rectification server has a three-tier architecture, including a user interface control layer, wherein: The interface control layer receives text information and static rule identifiers transmitted by the sandbox container, and feeds back the rectification information and the rectified code file to the sandbox container.

6. The method according to claim 4, wherein, The problem rectification server is configured with a rule database, which has multiple preset automatic rectification rules. The step of matching the corresponding target rectification rule based on the static rule identifier also includes: Determine whether there is at least one automatic rectification rule corresponding to the static rule identifier in the rule database. If so, determine the at least one automatic rectification rule as the target rectification rule.

7. The method according to claim 6, wherein, The step of determining whether there is at least one automatic rectification rule corresponding to the static rule identifier in the rule database further includes: If there is no automatic rectification rule corresponding to the static rule identifier in the rule database, it is determined that the static rule identifier cannot match the corresponding target rectification rule. The problem rectification server generates unrectified information and feeds back the unrectified information and the code file to be modified to the static scanning server through the sandbox container.

8. A code remediation device, applied to a static scanning server, the device comprising: The sandbox startup module is used to start the static scanning server and launch sandbox containers on the static scanning server using agent mode. After startup, the code monitoring plugin for the sandbox container is loaded. The code monitoring plugin is used to monitor the call status of the static scanning server in real time. The static scanning module is used to perform static scanning on the code files to be checked. The static scanning server is configured with multiple static rules. The code remediation module is used to obtain the scan logs after the static scan through the code monitoring plugin of the sandbox container, determine whether the scan logs trigger at least one of the static rules, and if so, determine that the code file to be checked is the code file to be modified. The text information corresponding to the code file to be modified and the triggered static rule identifier are obtained through the sandbox container; The text information and static rule identifier are transmitted to the issue rectification server through the sandbox container; based on the text information and static rule identifier, the rectification information and the rectified code file corresponding to the code file to be modified are obtained from the issue rectification server.

9. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images