A code detection method, device, apparatus and storage medium

Abstract

The application discloses a code detection method and device, equipment and storage medium, and relates to the technical field of computers, and comprises the following steps: determining to-be-scanned code data, and creating a scanning job based on the to-be-scanned code data; the scanning job is sent to a cluster node together with a preset code scanning rule group, so that the cluster node scans the scanning job based on the preset code scanning rule group, and a scanning result is obtained; if the scanning result is scanning failure, un-passed scanning code data is displayed, so that the un-passed scanning code data is modified to obtain modified data; if the scanning result of the modified data is scanning success, the modified data is submitted to a code library. The scanning job is sent to the cluster node, scanning is performed based on the preset code scanning rule group, all codes are scanned through a scanning tool and different scanning rules, manpower and time cost are saved, and development efficiency and safety are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a code detection method, device, equipment and storage medium. Background Art

[0002] Existing open-source scanning services require automated scanning through third-party scheduled tasks. Task triggering is complex to configure and the triggering conditions are limited, making them difficult to use. Incremental code scanning is not supported, requiring only a single scan of the project's code, with no ability to filter code files. Scheduled automatic builds are not supported, nor is email push notifications for scan results. Distributed scanning is not supported, requiring only a single node to scan, resulting in significant time-consuming scans. Test reports after scanning are rudimentary and cannot be visually modified or edited. Scanning rules cannot be customized, and the scanning programming language support is limited. These shortcomings of current open-source scanning tools create significant user difficulties, complex installation and configuration, and the need to integrate multiple third-party components to achieve a single effect, creating significant user frustration. If project development code involves multiple programming languages, using open-source scanning tools may require deploying multiple tools simultaneously to achieve the desired results. This significantly reduces efficiency and impacts user experience. Differences in scanning rules between multiple scanning tools can also pose security risks to project code. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a code detection method, device, equipment and storage medium that can save manpower and time costs and improve development efficiency and security. The specific solution is as follows:

[0004] In a first aspect, the present application discloses a code detection method, which is applied to an intelligent code scanning platform, comprising:

[0005] Determining code data to be scanned, and creating a scanning job based on the code data to be scanned;

[0006] Sending the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result;

[0007] If the scanning result is a scanning failure, displaying the failed scanning code data so as to modify the failed scanning code data to obtain modified data;

[0008] If the scanning result of the modified data is a successful scan, the modified data is submitted to the code library.

[0009] Optionally, the creating a scanning job based on the code data to be scanned includes:

[0010] A real-time scanning job and / or an offline scanning job is created based on the code data to be scanned.

[0011] Optionally, sending the scanning job and the preset code scanning rule group to the cluster node includes:

[0012] If the scanning job is the offline scanning job, pulling first target code information after merging all branches in the current project corresponding to the offline scanning job from the code library;

[0013] Sending the first target code information, the offline scanning job, and the preset code scanning rule group to the cluster node;

[0014] Or, if the scanning job is the real-time scanning job, then pulling the current branch code information that meets the preset trigger condition from the code library;

[0015] Obtaining difference code information between the first target code information and the current branch code information to obtain second target code information;

[0016] The second target code information, the real-time scanning job, and the preset code scanning rule group are sent to the cluster node.

[0017] Optionally, before sending the scanning job and the preset code scanning rule group to the cluster node, the method further includes:

[0018] Determining whether the cluster node corresponding to the scanning operation is used for the first time;

[0019] If the cluster node is used for the first time, add the cluster node, and after connecting to the cluster node using the user and password of the cluster node, deploy a scanner and corresponding services on the cluster node;

[0020] If the cluster node is not used for the first time, the cluster node is directly determined.

[0021] Optionally, the sending of the scanning job and the preset code scanning rule group to a cluster node so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result includes:

[0022] Obtaining target information of the cluster nodes; the target information includes the number of cluster nodes and cluster node performance;

[0023] dividing the scanning job based on the target information to obtain divided scanning jobs;

[0024] The divided scanning jobs and the preset code scanning rule group are sent to the corresponding cluster nodes, so that the scanning jobs are scanned by the scanner on the cluster nodes based on the preset code scanning rule group, and a scanning result is obtained.

[0025] Optionally, before sending the scanning job and the preset code scanning rule group to the cluster node, the method further includes:

[0026] Setting a rule manager, in which rules are set in a preset rule setting method, and corresponding tag information is set for the rules; the preset rule setting method includes creating, importing, exporting, enabling, and disabling, and the rules include the preset code scanning rules, the preset scanning result scoring rules, and the preset search rules;

[0027] Based on the programming language of the intelligent code scanning platform, acquiring the rules corresponding to the programming language to obtain the preset code scanning rules;

[0028] A problem list is set based on the tag information to display the non-compliance reasons, problem levels, and problem handling status corresponding to the scan results.

[0029] Optionally, if the scanning result is a scanning failure, displaying the failed scanning code data so as to modify the failed scanning code data to obtain modified data, including:

[0030] If the scanning result is a scanning failure, displaying the failed scanning code data;

[0031] Obtain the non-compliance reason for the failed scan code data from the problem list to obtain a current non-compliance reason;

[0032] Modifying the failed scan code data corresponding to all the current non-compliance reasons in the problem list in batches to obtain the modified data;

[0033] Determine whether the non-compliance reason is a violation of coding standards;

[0034] If so, and the unscanned code data satisfies the current preset writing rule, changing the problem processing status of the unscanned code data to a misjudgment;

[0035] Mark all the failed scan code data whose problem handling status is misjudgment, and add the problem handling status corresponding to the misjudgment to the whitelist.

[0036] In a second aspect, the present application discloses a code detection device, which is applied to an intelligent code scanning platform, comprising:

[0037] A job creation module, configured to determine code data to be scanned and create a scanning job based on the code data to be scanned;

[0038] A scanning module, configured to send the scanning job and a preset code scanning rule group to a cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result;

[0039] a code modification module, configured to display failed scan code data if the scan result is a scan failure, so as to modify the failed scan code data to obtain modified data;

[0040] The code submission module is configured to submit the modified data to a code library if the scan result of the modified data is successful.

[0041] In a third aspect, the present application discloses an electronic device, comprising:

[0042] Memory, used to store computer programs;

[0043] A processor is used to execute the computer program to implement the steps of the code detection method disclosed above.

[0044] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the code detection method disclosed above is implemented.

[0045] It can be seen that the present application provides a code detection method, including: determining the code data to be scanned, and creating a scanning job based on the code data to be scanned; sending the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node can scan the scanning job based on the preset code scanning rule group and obtain the scanning result; if the scanning result is a scanning failure, then displaying the code data that failed to scan, so as to modify the code data that failed to scan and obtain the modified data; if the scanning result of the modified data is a scanning success, then submitting the modified data to the code library. It can be seen that the present application supports operations such as adding, deleting, modifying, and checking jobs by creating a scanning job, sending the scanning job and the preset code scanning rule group to the cluster node, and realizing scanning of all codes through a scanning tool and different scanning rules. By displaying the code data that failed to scan when the scan fails, the code modification is completed, saving manpower and time costs, and improving development efficiency and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0047] Figure 1 A flow chart of a code detection method disclosed in this application;

[0048] Figure 2 A schematic diagram of a specific code detection structure disclosed in this application;

[0049] Figure 3 This is a flow chart of a specific code detection method disclosed in this application;

[0050] Figure 4 This is a schematic diagram of an offline scanning disclosed in this application;

[0051] Figure 5 A real-time scanning schematic diagram disclosed in this application;

[0052] Figure 6 This is a flow chart of a specific code detection method disclosed in this application;

[0053] Figure 7 A schematic diagram of the code detection device structure provided in this application;

[0054] Figure 8 This is a structural diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0055] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0056] Currently, in existing open source scanning services, automatic scanning can only be achieved with the help of a third-party scheduled task startup; the task trigger configuration is relatively complex, the trigger conditions are relatively simple, and it is not easy for users to use; it can only scan the project code alone, and there is no code file filtering function; it does not support scheduled automatic build jobs; it does not support the email push function of scanning results; it can only specify a single node for scanning, and the scanning is very time-consuming; the test report after the scan is relatively simple, and the scanning rules do not support customization; the scanning programming language is single and limited, resulting in complex installation and configuration during user use, and it is necessary to combine multiple third-party components to achieve a single effect. If the project development code involves multiple programming languages, it may be necessary to deploy multiple scanning tools when using open source scanning tools, and work at the same time to achieve the desired effect. This greatly reduces work efficiency and affects user use. Differences in scanning rules between multiple scanning tools may also bring security risks to project codes. To this end, this application provides a code detection method that can save manpower and time costs and improve development efficiency and security.

[0057] The embodiment of the present invention discloses a code detection method, see Figure 1 As shown, the method is applied to an intelligent code scanning platform and includes:

[0058] Step S11: determining code data to be scanned, and creating a scanning job based on the code data to be scanned.

[0059] In this embodiment, the code data to be scanned is determined, and a scanning job is created based on the code data to be scanned. The administrator or ordinary user (i.e., developer) logs in to the visual Web (Internet general term) UI (User Interface) page, and then logs in to the intelligent code scanning platform, determines the code to be scanned on the intelligent code scanning platform to obtain the data to be scanned, and then determines the corresponding scanning job based on the data to be scanned, and can create real-time scanning and / or offline scanning jobs. It is understandable that the administrator can see all code issues, and the developer can only see issues with the part of the code that he is responsible for.

[0060] Step S12: Send the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result.

[0061] In this embodiment, after creating a scan job based on the code data to be scanned, the scan job and the preset code scanning rule group are sent to the cluster node, so that the cluster node can scan the scan job based on the preset code scanning rule group and obtain a scan result. It is understood that when the scan job and the preset code scanning rule group are sent to the cluster node for scanning, distributed job scanning is supported, and a scan job can be distributed to multiple cluster nodes for simultaneous scanning.

[0062] Step S13: If the scanning result is a scanning failure, the failed scanning code data is displayed so as to modify the failed scanning code data to obtain modified data.

[0063] In this embodiment, the cluster node scans the scanning job based on the preset code scanning rule group, and after obtaining the scanning result, if the scanning result is a scan failure, the failed scan code data is displayed so that the failed scan code data can be modified to obtain the modified data. It is understandable that if the scan fails, the failed scan code data is displayed, and the failure reason of the failed scan code data is displayed at the same time, and the responsible developer corresponding to the problem code is displayed. It supports sharing the problem with the designated responsible developer. The responsible developer can view the problem details, determine the rules violated by the code, the risks involved, and the solution suggestions, etc., so as to complete the modification of the code problem on the page and obtain the modified data.

[0064] Step S14: If the scanning result of the modified data is a successful scan, the modified data is submitted to the code library.

[0065] In this embodiment, the code data that failed the scan is displayed so that the code data that failed the scan can be modified. After obtaining the modified data, if the scan result of the modified data is a successful scan, the modified data is submitted to the code library. It is understood that after the modification of the code data that failed the scan is completed, the platform immediately scans the modification module. If the problem is fixed, the modified code data is synchronously submitted to the code library.

[0066] like Figure 2As shown, this solution includes a visual web UI page (intelligent code scanning platform), a scanner, a rule manager, a search engine, and a storage device. Log in to the visual web UI page (intelligent code scanning platform) via an administrator or a regular user to create real-time and offline scanning jobs, supporting operations such as viewing, starting, stopping, modifying, and deleting them. Scanning tasks can be configured for real-time, offline, project, monitoring events, programming language, scanning rules, quality thresholds, and issue whitelists. Results can be visualized, and issues can be automatically assigned, modified, added to whitelists, and marked. The scanner runs on a platform-specified client, pulls code to perform scanning tasks, and pushes the results to the code scanning server. The rule manager configures and manages scanning rule specifications for different programming languages, allowing for the addition, activation, suspension, and deletion of automatic configurations. It also manages quality thresholds and rules. The search engine retrieves tasks, issues, rules, code, users, and more, improving search efficiency when there are too many issues in a scanning task. The search engine primarily provides fast retrieval of various conditions within the intelligent code scanning platform, providing a page display interface. It supports fast retrieval of jobs, scan results, vulnerabilities, bugs, rules, and rule groups within the intelligent code scanning platform. The storage device serves as the metadata storage location of the intelligent code scanning platform. It stores information such as jobs, scanning tasks, scanning rules, rule tags, and scanning results created by the intelligent code scanning platform. This information is provided to the intelligent scanning platform page, and is provided to users for analysis of scanning results. It also stores status information during the operation of the job. With the rapid development of business and the policy support obtained from the research and application of innovative technologies, information security has always been a top priority in work. In order to reduce the sharing faced by application systems, reduce possible vulnerabilities and bugs in project coding, and improve the security capabilities of the application system itself, intelligent code scanning can help the team automatically scan, quickly discover, accurately locate, provide repair suggestions, and directly repair during the project development process, saving a lot of manpower and time costs, improving development efficiency and code security, and greatly reducing security risks in the project. This solution actively scans and discovers vulnerabilities, bugs, coding standards and other issues in the code, and provides prompts and repair suggestions for the scanned issues, so that the code is more in line with the coding standards of each programming language, improving the security and robustness of the code.

[0067] It is understood that this application can create scanning rules, organize scanning rules, set standards to score and evaluate scanning results, and set job trigger conditions and problem whitelists for real-time scanning. Custom job trigger conditions are supported, such as submission to the code library, auditor review, merging, and submission of Python code. The platform supports distributed job scanning, meaning a job can be split up into multiple nodes for simultaneous scanning. The intelligent code scanning platform manages the allocation strategy and result aggregation. It monitors job progress, status, and other information. It queries the scan result issue list, including vulnerabilities, bugs, and coding standard violations, categorizing them by severity and filtering them based on conditions. It clicks on an issue to view it, make a note about it, modify its status, and display the developer of the code responsible for the issue. It also supports sharing issues with designated personnel. It can label issues as misjudged, resolved, unresolved, confirmed, not fixed, or not a problem. It also allows users to view detailed information about the issue, including the rule violated, risks involved, and suggested solutions. It supports simultaneous repair of similar issues. Code issue modifications can be made on the page, with the platform immediately scanning the modified module. If the issue is fixed, the modified code is submitted to the code repository. Offline code scanning jobs can also be scheduled for automatic builds. Scan results are emailed to designated personnel, with the platform immediately scanning the modified module. If the issue is fixed, the modified code is submitted to the code repository.

[0068] It can be seen that the present application provides a code detection method, including: determining the code data to be scanned, and creating a scanning job based on the code data to be scanned; sending the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node can scan the scanning job based on the preset code scanning rule group and obtain the scanning result; if the scanning result is a scanning failure, then displaying the code data that failed to scan, so as to modify the code data that failed to scan and obtain the modified data; if the scanning result of the modified data is a scanning success, then submitting the modified data to the code library. It can be seen that the present application supports operations such as adding, deleting, modifying, and checking jobs by creating a scanning job, sending the scanning job and the preset code scanning rule group to the cluster node, and realizing scanning of all codes through a scanning tool and different scanning rules. By displaying the code data that failed to scan when the scan fails, the code modification is completed, saving manpower and time costs, and improving development efficiency and security.

[0069] See also Figure 3 As shown, the embodiment of the present invention discloses a code detection method. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0070] Step S21: determining code data to be scanned, and creating a real-time scanning job and / or an offline scanning job based on the code data to be scanned.

[0071] In this embodiment, the code data to be scanned is determined, and a real-time scanning job and / or an offline scanning job is created based on the code data to be scanned. For example, in the process of developing a large project, branch iterative development is usually selected, that is, the developer will submit part of the code in a branch of the above-mentioned large project to the intelligent code scanning platform. At this time, a real-time scanning job is created based on the part of the code just submitted by the developer. When the development of a small project enters the end, that is, when the project development is basically completed, an offline scanning job will be generated based on all the completed codes of the above-mentioned small project. It should be pointed out that the intelligent code scanning platform can create real-time scanning jobs and offline scanning jobs at the same time, or create real-time scanning jobs or offline scanning jobs separately, and supports operations such as viewing, starting, stopping, modifying, and deleting jobs.

[0072] Step S22: Determine whether the cluster node corresponding to the scanning operation is used for the first time.

[0073] In this embodiment, it is determined whether the cluster node corresponding to the scanning job is being used for the first time. It is understandable that a job may not be divided into multiple cluster nodes for simultaneous scanning. During scanning, a scanning service needs to be deployed on the cluster node, and a connection needs to be established between the cluster node and the intelligent code scanning platform. Therefore, it is necessary to first determine whether the cluster node corresponding to the scanning job is being used for the first time. If the cluster node is being used for the first time, it indicates that the cluster node has not established a connection with the intelligent code scanning platform and has not deployed a scanning service. If the cluster node is not being used for the first time, it indicates that the cluster node can be used directly without the need to re-establish a connection and deploy operations.

[0074] Step S23: If the cluster node is used for the first time, the cluster node is added, and after the cluster node is connected using the user and password of the cluster node, a scanner and corresponding services are deployed on the cluster node.

[0075] In this embodiment, if the cluster node is being used for the first time, the cluster node is added. After the user and password of the cluster node are used to connect to the cluster node, the scanner and corresponding services are deployed on the cluster node. Specifically, the intelligent code scanning platform supports adding cluster nodes on a page. The node can be a Linux system or a Windows system node. The user and password of the cluster node to be added are used to automatically connect the cluster node to the intelligent code scanning platform. After the intelligent code scanning platform adds the new node, it will immediately deploy the scanner service on the new node. If the cluster node is not being used for the first time, the cluster node is directly determined.

[0076] Furthermore, the created job can be assigned to the newly added cluster node for execution, or the code can be manually scanned using a scanner in conjunction with an IDE (Integrated Development Environment) on that node, and the scan results pushed to the intelligent code scanning platform. For example, before submitting part of the code from a branch of the aforementioned large project to the intelligent code scanning platform, a developer would manually scan the code locally using a scanner in conjunction with an IDE. If the scan passes, the code would be submitted to the intelligent code scanning platform.

[0077] Step S24: Send the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result.

[0078] In this embodiment, the scanning job and the preset code scanning rule group are sent to the cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result.

[0079] In a specific real-time manner, if the scanning job is the offline scanning job, the first target code information after merging all branches in the current project corresponding to the offline scanning job is pulled from the code library, and the first target code information, the offline scanning job and the preset code scanning rule group are sent to the cluster node. Figure 4As shown, when performing offline scanning, the intelligent code scanning platform actively triggers the generation of an offline scanning job, and assigns a running node (i.e., a cluster node) to the offline cache job, pulls the latest code file after merging all branches in the current project corresponding to the offline scanning job from the code library, i.e., the first target code information, inputs the first target code information into the detection library C, and scans the code in the detection library C through the scanner deployed on the cluster node to obtain the corresponding scanning result. The scanning result will be displayed on the platform page, and the name is a combination of the code branch name and the scanning task ID, such as master-110. The success or failure of the scan is determined based on the quality threshold (i.e., the preset scanning result scoring rule). At this time, a static code scanning report will be generated, which can be provided for online and offline download. It should be pointed out that the intelligent code scanning platform scans the corresponding code files according to the target programming language set by the platform. If the programming language is unknown, all code files in the code library are scanned by default. The name of the detection library C remains unchanged. Each time the task is executed, the latest merged code is pulled based on the code library. Quality Threshold: The code scanning page has default values, which can also be manually configured. If any of these conditions are met, the scan fails. For example, if the code BUG (defect) count is greater than 0 and the number of vulnerabilities is greater than 0, then when scanning the code that triggered the task, if the code BUG count is greater than 0 and / or the number of vulnerabilities is greater than 0, the code does not meet the requirements and the scan task is considered a failure. Otherwise, the scan succeeds. Offline code scanning jobs can also be scheduled for automatic builds; scan results are emailed to designated personnel.

[0080] In another specific real-time method, if the scanning job is the real-time scanning job, the current branch code information that meets the preset trigger condition is pulled from the code library; the difference code information between the first target code information and the current branch code information is obtained to obtain the second target code information; the second target code information, the real-time scanning job and the preset code scanning rule group are sent to the cluster node. Figure 5As shown, developers first manually scan the code to be uploaded in their local workspace, using a scanner to scan the code files for the current changes. The results are then pushed to the code platform. Only after any scan issues are corrected can the code be submitted to the code repository. When code is submitted to the code repository, Stream Events are automatically triggered based on pre-set trigger conditions. When the intelligent code scanning platform detects changes in the code repository data, it allocates cluster nodes for the code data to be scanned. It then pulls the latest code into the latest repository B (the code files involved in the triggering task for this branch of the code repository). It then compares the latest repository B with the baseline repository A to identify the differences, resulting in a test repository C. The scanner then scans the code files in test repository C to obtain scan results. Based on the quality threshold (i.e., the pre-set scan result scoring rules), the scan is determined to be successful or unsuccessful. If the scan succeeds, a +1 or +2 action is automatically triggered. If the scan fails, a -1 or -2 action is automatically triggered, and the developer is redirected or logged into the intelligent code scanning platform, allowing them to resolve any issues revealed by the scan. The modified code is then automatically scanned and, if compliant, pushed to the code repository with a +1 or +2 score, awaiting merging. It should be pointed out that the code data in the latest library B is the code data just submitted by the developer; Baseline Library A: Each time a task is triggered, the latest merged code will be pulled, including the code of all branches of the project. Multi-branch projects can switch branches locally at will. The intelligent code scanning platform automatically detects and compares the newly added files and files with different MD5 value changes in the latest library B and the baseline library A. It filters out the target files that need to be detected according to the pre-set target programming language. For example, only the programming languages ​​​​such as Python, Java, HTML, JS, PHP, etc. are scanned. New and modified files are detected and imported into the detection library C. The content in the detection library C is changing, and a unique detection library C will be generated each time the task is triggered. It provides the ability to set quality threshold standards to score and evaluate the scan results. Real-time scanning can set job trigger conditions and problem whitelists.

[0081] For example, in real-time scanning, a job monitors the code base in real time. When a developer submits code (trigger conditions are met), the job is actively triggered to execute and assigned to the scanner node for scanning. The scan results will provide feedback on this submission, such as +1, +2, -1, and -2. The job also monitors the code base in real time and is continuously executed in real time. For offline scanning, the job execution is manually triggered and stops after the job is completed. The job does not monitor the conditions and does not execute automatically. The platform specifies the programming language for the job, filters out code files that meet the conditions, and assigns them for scanning. Code files that do not meet the conditions will not be scanned. Batch modification and marking of similar problems are supported. Such problem marks can be added to the whitelist. The next time the problem is scanned, the problems in the whitelist will not be exposed.

[0082] Step S25: If the scanning result is a scanning failure, the failed scanning code data is displayed so as to modify the failed scanning code data to obtain modified data.

[0083] In this embodiment, if the scan result is a scan failure, the failed scan code data is displayed so that the failed scan code data can be modified to obtain the modified data. If the scan fails, the developer will jump to the code scanning platform from the code library or log in to view the specific error information and make modifications on the code scanning platform.

[0084] Step S26: If the scanning result of the modified data is a successful scan, the modified data is submitted to the code library.

[0085] For the specific content of the above step S26, reference may be made to the corresponding content disclosed in the above embodiments, which will not be repeated here.

[0086] It can be seen that the embodiment of the present application determines the code data to be scanned, and creates a real-time scanning job and / or an offline scanning job based on the code data to be scanned; determines whether the cluster node corresponding to the scanning job is used for the first time; if the cluster node is used for the first time, adds the cluster node, and after completing the connection with the cluster node using the user and password of the cluster node, deploys the scanner and the corresponding service on the cluster node; sends the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node can scan the scanning job based on the preset code scanning rule group and obtain the scanning result; if the scanning result is a scanning failure, the code data that failed to pass the scanning is displayed, so that the code data that failed to pass the scanning is modified to obtain the modified data; if the scanning result of the modified data is a scanning success, the modified data is submitted to the code library, saving manpower and time costs, and improving development efficiency and security.

[0087] See also Figure 6 As shown, the embodiment of the present invention discloses a code detection method. Compared with the previous embodiment, this embodiment further illustrates and optimizes the technical solution.

[0088] Step S31: determining code data to be scanned, and creating a scanning job based on the code data to be scanned.

[0089] Step S32: Acquire target information of the cluster node, and divide the scanning job based on the target information to obtain a divided scanning job.

[0090] In this embodiment, target information of the cluster nodes is obtained, and the scanning job is divided based on the target information to obtain a divided scanning job. The target information includes the number of cluster nodes and the performance of the cluster nodes. It is understood that scanners are distributed services, and a job can be configured with one or more scanners to execute the job simultaneously. When issuing a job task, the intelligent code scanning platform will allocate the items to be scanned in the job to different cluster nodes according to the number of scanners and the performance of the nodes where the scanners are located. In other words, based on the performance resources of the scanner nodes, the job is divided into multiple copies of different task volumes and sent together with the scanning rules to each scanner for scanning. The scanning results are aggregated to the intelligent code scanning platform. When the intelligent code scanning platform issues a task to the scanner, it also sends the rule group along with the job to each scanner. The scanner scans the code according to the rule group. Scanning rules support customization, custom tags, and custom rule groups. The rules that evaluate the entire project are combined into quality thresholds to evaluate and score the scan results.

[0091] Step S33: Setting a rule manager, setting rules in the rule manager using a preset rule setting method, and setting corresponding tag information for the rules.

[0092] In this embodiment, a rule manager is set up, and rules are set in the rule manager through a preset rule setting method, and corresponding label information is set for the rules. The preset rule setting method includes creation, import, export, activation and deactivation, and the rules include the preset code scanning rules, preset scanning result scoring rules and preset retrieval rules. It can be understood that the rule manager manages the creation, import, export, activation, deactivation and formation of rule groups of scanning rules in the intelligent code platform. Scanning rules are grouped according to programming language. Different programming languages ​​correspond to different scanning rules and cannot be mixed. Label information can be added to the scanning rules. Problem types include: vulnerabilities, bugs, and violations of coding standards; severity includes: blocking, serious, major, minor, and prompts; and some customized labels can also be used to indicate the mark after the rule is violated in the code. The rule manager filters out a set of specific rules to form a quality threshold, which is used to score and evaluate the scanning results to evaluate the quality of the code. The quality threshold is mainly a rule for determining the quality of the project, that is, the preset scanning result scoring rule.

[0093] Step S34: Based on the programming language of the intelligent code scanning platform, the rules corresponding to the programming language are acquired to obtain the preset code scanning rules.

[0094] In this embodiment, based on the programming language of the intelligent code scanning platform, the rules corresponding to the programming language are obtained to obtain the preset code scanning rules. The intelligent code scanning platform scans the corresponding code files according to the target programming language set by the platform. If the programming language is unknown, all code files in the code library are scanned by default.

[0095] Step S35: Setting a problem list based on the tag information to display the non-compliance reasons, problem levels, and problem handling status corresponding to the scan results.

[0096] In this embodiment, a problem list is set based on the tag information to display the non-compliance reason, problem level, and problem handling status corresponding to the scan result. It is understandable that when a problem exists in some code data, the corresponding tag information is filled in the problem list for subsequent search.

[0097] Step S36: Sending the divided scanning jobs and the preset code scanning rule group to the corresponding cluster node, so that the scanning jobs are scanned by the scanner on the cluster node based on the preset code scanning rule group and a scanning result is obtained.

[0098] Step S37: If the scanning result is a scanning failure, the failed scanning code data is displayed so as to modify the failed scanning code data to obtain modified data.

[0099] In this embodiment, if the scanning result is a scan failure, the failed scan code data is displayed so that the failed scan code data can be modified to obtain the modified data. Specifically, if the scanning result is a scan failure, the failed scan code data is displayed; the non-compliance reason of the failed scan code data is obtained from the problem list to obtain the current non-compliance reason; the failed scan code data corresponding to all the current non-compliance reasons in the problem list are modified in batches to obtain the modified data; it is determined whether the non-compliance reason is a violation of the coding specification; if it is and the failed scan code data meets the current preset writing rules, the problem processing status of the failed scan code data is changed to a misjudgment; all the failed scan code data with the problem processing status as a misjudgment are marked, and the problem processing status corresponding to the misjudgment is added to the whitelist. It can be understood that batch modification and marking of similar problems are supported, and such problems (such as data that violates the coding specification) can be marked and added to the whitelist, so that the problems in the whitelist will not be exposed the next time the problem is scanned.

[0100] Step S38: If the scanning result of the modified data is a successful scan, the modified data is submitted to the code library.

[0101] For the specific contents of the above steps S31, S36, and S38, reference may be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0102] It can be seen that the embodiment of the present application determines the code data to be scanned and creates a scanning job based on the code data to be scanned; obtains the target information of the cluster node, divides the scanning job based on the target information to obtain a divided scanning job; sets a rule manager, sets rules in the rule manager through a preset rule setting method, and sets corresponding label information for the rules; based on the programming language of the intelligent code scanning platform, obtains the rules corresponding to the programming language to obtain the preset code scanning rules; sets a problem list based on the label information to display the non-compliance reasons, problem levels, and problem processing status corresponding to the scanning results; sends the divided scanning job and the preset code scanning rule group to the corresponding cluster node, so that the scanning job is scanned by the scanner on the cluster node and based on the preset code scanning rule group, and obtains a scanning result; if the scanning result is a scanning failure, the failed scanning code data is displayed, so that the failed scanning code data is modified to obtain the modified data; if the scanning result of the modified data is a scanning success, the modified data is submitted to the code library, saving manpower and time costs and improving development efficiency and security.

[0103] See also Figure 7 As shown, the embodiment of the present application also discloses a code detection device, which is applied to the intelligent code scanning platform, including:

[0104] A job creation module 11 is configured to determine code data to be scanned and create a scanning job based on the code data to be scanned;

[0105] The scanning module 12 is configured to send the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result;

[0106] A code modification module 13 is configured to display failed scan code data if the scan result is a scan failure, so as to modify the failed scan code data to obtain modified data;

[0107] The code submission module 14 is configured to submit the modified data to a code library if the scan result of the modified data is a successful scan.

[0108] It can be seen that the present application includes: determining the code data to be scanned, and creating a scanning job based on the code data to be scanned; sending the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node can scan the scanning job based on the preset code scanning rule group and obtain the scanning result; if the scanning result is a scanning failure, then displaying the code data that failed to scan, so as to modify the code data that failed to scan and obtain the modified data; if the scanning result of the modified data is a scanning success, then submitting the modified data to the code library. It can be seen that the present application supports operations such as adding, deleting, modifying, and checking jobs by creating a scanning job, sending the scanning job and the preset code scanning rule group to the cluster node, and realizing scanning of all codes through a scanning tool and different scanning rules. By displaying the code data that failed to scan when the scan fails, the code modification is completed, saving manpower and time costs, and improving development efficiency and security.

[0109] In some specific embodiments, the job creation module 11 specifically includes:

[0110] a code data to be scanned determining unit, configured to determine the code data to be scanned;

[0111] A job creating unit is used to create a real-time scanning job and / or an offline scanning job based on the code data to be scanned.

[0112] In some specific embodiments, the scanning module 12 specifically includes:

[0113] A rule manager setting unit, used for setting a rule manager;

[0114] A rule setting unit, configured to set rules in the rule manager using a preset rule setting method;

[0115] A tag information setting unit, configured to set corresponding tag information for the rule; the preset rule setting method includes creating, importing, exporting, enabling, and disabling, and the rule includes the preset code scanning rule, the preset scanning result scoring rule, and the preset retrieval rule;

[0116] A rule acquisition unit, configured to acquire the rule corresponding to the programming language of the intelligent code scanning platform based on the programming language of the programming language, so as to obtain the preset code scanning rule;

[0117] a problem list setting unit, configured to set a problem list based on the tag information so as to display the non-compliance reason, problem level, and problem handling status corresponding to the scanning result;

[0118] A cluster node use determination unit, configured to determine whether the cluster node corresponding to the scanning operation is used for the first time;

[0119] a cluster node adding unit, configured to add the cluster node if the cluster node is used for the first time;

[0120] A service deployment unit, configured to deploy a scanner and corresponding services on the cluster node after completing a connection with the cluster node using the user and password of the cluster node;

[0121] a cluster node determining unit, configured to directly determine the cluster node if the cluster node is not used for the first time;

[0122] a first target code information determining unit configured to, if the scanning job is the offline scanning job, pull from the code repository the first target code information obtained by merging all branches in the current project corresponding to the offline scanning job;

[0123] a first information sending unit, configured to send the first target code information, the offline scanning job, and the preset code scanning rule group to the cluster node;

[0124] a current branch code information acquiring unit, configured to, if the scanning operation is the real-time scanning operation, pull the current branch code information that meets a preset trigger condition from the code library;

[0125] a second target code information determining unit, configured to obtain difference code information between the first target code information and the current branch code information to obtain second target code information;

[0126] a second information sending unit, configured to send the second target code information, the real-time scanning job, and the preset code scanning rule group to the cluster node;

[0127] A target information acquisition unit, configured to acquire target information of the cluster nodes; the target information includes the number of cluster nodes and cluster node performance;

[0128] a scanning job division unit, configured to divide the scanning job based on the target information to obtain divided scanning jobs;

[0129] The third information sending unit is used to send the divided scanning job and the preset code scanning rule group to the corresponding cluster node, so that the scanning job is scanned by the scanner on the cluster node based on the preset code scanning rule group and a scanning result is obtained.

[0130] In some specific embodiments, the code modification module 13 specifically includes:

[0131] a failed scan code data display unit, configured to display failed scan code data if the scan result is a scan failure;

[0132] a current non-compliance reason determining unit, configured to obtain the non-compliance reason of the failed scan code data from the problem list to obtain a current non-compliance reason;

[0133] a code data modification unit, configured to modify in batches the failed scan code data corresponding to all the current non-compliance reasons in the problem list to obtain the modified data;

[0134] A non-compliance reason determination unit, configured to determine whether the non-compliance reason is a violation of coding standards;

[0135] a misjudgment determination unit, configured to change the problem processing status of the failed scan code data to a misjudgment if the failed scan code data satisfies a current preset writing rule;

[0136] The misjudgment data processing unit is used to mark all the failed scan code data whose problem processing status is misjudgment, and add the problem processing status corresponding to the misjudgment to the whitelist.

[0137] In some specific embodiments, the code submission module 14 specifically includes:

[0138] A code submitting unit is configured to submit the modified data to a code library if the scan result of the modified data is a successful scan.

[0139] Furthermore, an embodiment of the present application also provides an electronic device. Figure 8 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0140] Figure 8 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the code detection method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0141] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0142] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0143] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of implementing the code detection method executed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program capable of implementing other specific tasks.

[0144] Furthermore, an embodiment of the present application also discloses a storage medium, in which a computer program is stored. When the computer program is loaded and executed by a processor, the steps of the code detection method disclosed in any of the aforementioned embodiments are implemented.

[0145] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0146] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0147] The above is a detailed introduction to a code detection method, apparatus, device and storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A code detection method, characterized in that: Applied to intelligent code scanning platforms, including: Determining code data to be scanned, and creating a scanning job based on the code data to be scanned; Sending the scanning job and the preset code scanning rule group to the cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result; If the scanning result is a scanning failure, displaying the failed scanning code data so as to modify the failed scanning code data to obtain modified data; If the scanning result of the modified data is successful, submitting the modified data to the code library; Before sending the scanning job and the preset code scanning rule group to the cluster node, the method further includes: Determining whether the cluster node corresponding to the scanning operation is used for the first time; If the cluster node is used for the first time, add the cluster node, and after connecting to the cluster node using the user and password of the cluster node, deploy a scanner and corresponding services on the cluster node; If the cluster node is not used for the first time, directly determine the cluster node; Before sending the scanning job and the preset code scanning rule group to the cluster node, the method further includes: Setting a rule manager, in which rules are set in a preset rule setting method, and corresponding tag information is set for the rules; the preset rule setting method includes creating, importing, exporting, enabling, and disabling, and the rules include the preset code scanning rules, the preset scanning result scoring rules, and the preset search rules; Based on the programming language of the intelligent code scanning platform, acquiring the rules corresponding to the programming language to obtain the preset code scanning rules; A problem list is set based on the tag information to display the non-compliance reasons, problem levels, and problem handling status corresponding to the scan results.

2. The code detection method according to claim 1, wherein: The step of creating a scanning job based on the code data to be scanned includes: A real-time scanning job and / or an offline scanning job is created based on the code data to be scanned.

3. The code detection method according to claim 2, characterized in that: The sending of the scanning operation and the preset code scanning rule group to the cluster node includes: If the scanning job is the offline scanning job, pulling first target code information after merging all branches in the current project corresponding to the offline scanning job from the code library; Sending the first target code information, the offline scanning job, and the preset code scanning rule group to the cluster node; Or, if the scanning job is the real-time scanning job, then the current branch code information that meets the preset triggering condition is pulled from the code library; Obtaining difference code information between the first target code information and the current branch code information to obtain second target code information; wherein the first target code information is code information after merging all branches in the current project corresponding to the offline scanning job, pulled from the code library; The second target code information, the real-time scanning job, and the preset code scanning rule group are sent to the cluster node.

4. The code detection method according to claim 1, wherein: The sending of the scanning job and the preset code scanning rule group to the cluster node so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result includes: Obtaining target information of the cluster nodes; the target information includes the number of cluster nodes and cluster node performance; dividing the scanning job based on the target information to obtain divided scanning jobs; The divided scanning jobs and the preset code scanning rule group are sent to the corresponding cluster nodes, so that the scanning jobs are scanned by the scanner on the cluster nodes based on the preset code scanning rule group, and a scanning result is obtained.

5. The code detection method according to claim 1, wherein: If the scanning result is a scanning failure, displaying the failed scanning code data so as to modify the failed scanning code data to obtain modified data, including: If the scanning result is a scanning failure, displaying the failed scanning code data; Obtain the non-compliance reason for the failed scan code data from the problem list to obtain a current non-compliance reason; Modifying the failed scan code data corresponding to all the current non-compliance reasons in the problem list in batches to obtain the modified data; Determine whether the non-compliance reason is a violation of coding standards; If so, and the unscanned code data satisfies the current preset writing rule, changing the problem processing status of the unscanned code data to a misjudgment; Mark all the failed scan code data whose problem handling status is misjudgment, and add the problem handling status corresponding to the misjudgment to the whitelist.

6. A code detection device, characterized in that: Applied to intelligent code scanning platforms, including: A job creation module, configured to determine code data to be scanned and create a scanning job based on the code data to be scanned; A scanning module, configured to send the scanning job and a preset code scanning rule group to a cluster node, so that the cluster node scans the scanning job based on the preset code scanning rule group and obtains a scanning result; a code modification module, configured to display failed scan code data if the scan result is a scan failure, so as to modify the failed scan code data to obtain modified data; A code submission module, configured to submit the modified data to a code repository if the scan result of the modified data is a successful scan; Before sending the scanning job and the preset code scanning rule group to the cluster node, the scanning module further includes: A rule manager setting unit, used for setting a rule manager; A rule setting unit, configured to set rules in the rule manager using a preset rule setting method; A tag information setting unit, configured to set corresponding tag information for the rule; the preset rule setting method includes creating, importing, exporting, enabling, and disabling, and the rule includes the preset code scanning rule, the preset scanning result scoring rule, and the preset retrieval rule; A rule acquisition unit, configured to acquire the rule corresponding to the programming language of the intelligent code scanning platform based on the programming language of the programming language, so as to obtain the preset code scanning rule; a problem list setting unit, configured to set a problem list based on the tag information so as to display the non-compliance reason, problem level, and problem handling status corresponding to the scanning result; A cluster node use determination unit, configured to determine whether the cluster node corresponding to the scanning operation is used for the first time; a cluster node adding unit, configured to add the cluster node if the cluster node is used for the first time; A service deployment unit, configured to deploy a scanner and corresponding services on the cluster node after completing a connection with the cluster node using the user and password of the cluster node; The cluster node determining unit is configured to directly determine the cluster node if the cluster node is not used for the first time.

7. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the steps of the code detection method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the code detection method according to any one of claims 1 to 5 is implemented.

Images