A method and system for variable tracking in a program

Abstract

The present disclosure provides a variable tracking method and system in a program. The method provided by the present disclosure comprises: acquiring a target variable located in target code, the target code comprising a plurality of variables; determining an associated variable set based on the target code, the associated variable set comprising at least one associated variable related to the target variable in the target code; and outputting the associated variable set. The present disclosure tracks the associated variables related to the target variable in the target code by analyzing the target variable in the target code, so that the developer can pay attention to the variables related to the target variable when coding in the IDE, and has a clearer understanding of the influence range of the key variable.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method and system for tracking variables in a program. Background Technology

[0002] Most mainstream Integrated Development Environments (IDEs) offer static code analysis plugins to achieve some simple functions. For example, when the mouse hovers over a variable in the program code, it highlights all occurrences of that variable in the program. However, this approach only displays the locations where the variable appears and cannot analyze and display other related variables that affect that variable; furthermore, this approach can only analyze variables within a single function and cannot effectively analyze inter-function calls.

[0003] Therefore, it is necessary to develop a system that can analyze and display variables related to data flow, so that developers can notice related variables when coding in an IDE, thereby gaining a clearer understanding of the impact of key variables and improving code robustness. Summary of the Invention

[0004] The primary objective of this disclosure is to provide a method and system for tracking variables in a program, capable of analyzing and displaying variables related to data flow, thereby enabling developers to have a clearer understanding of the impact of key variables when coding in an IDE.

[0005] This disclosure provides a variable tracking method in a program, comprising: obtaining a target variable located in target code, the target code including multiple variables; determining a set of associated variables based on the target code, the set of associated variables including at least one associated variable in the target code related to the target variable; and outputting the set of associated variables.

[0006] In some embodiments, the target variable includes at least one of input parameters, member variables, static variables, and return values; and the associated variable includes at least one of input parameters, local variables, member variables, and static variables.

[0007] In some embodiments, the variable tracking method in the program further includes: outputting the target variable.

[0008] In some embodiments, the output may be presented in a visual manner; and the visual presentation may include at least one of language list display and highlighting.

[0009] In some embodiments, determining the set of related variables includes: treating each executed statement in the target code as a target analysis statement; determining variable transit relationships in the target analysis statements; based on the variable transit relationships, determining the related variables affecting the target variable from the plurality of variables; and merging the related variables in each executed statement to obtain the set of related variables.

[0010] In some embodiments, before determining the variable passing relationship in the target analysis statement, the method further includes: arranging all the execution statements contained in the target code into a target analysis queue; and sequentially obtaining an execution statement from the head of the target analysis queue as the target analysis statement.

[0011] In some embodiments, determining the variable passing relationship in the target analysis statement includes: determining the statement type of the target analysis statement, the statement type including at least one of a return statement, an assignment statement, and a function call statement; and determining the variable passing relationship corresponding to the target analysis statement based on the statement type.

[0012] In some embodiments, determining the variable transit relationship corresponding to the target analysis statement includes: when the statement type is a function call statement, obtaining the target analysis result of the called function in the target analysis statement, wherein the target analysis result includes related variables in the called function that are related to the target variable; and determining the variable transit relationship of the target analysis statement based on the target analysis result.

[0013] In some embodiments, when the statement type is a function call statement, obtaining the target analysis result of the called function in the target analysis statement includes: determining that the called function is a sink function, and using all tainted variables in the sink function as the associated variables related to the target variable in the target analysis result.

[0014] In some embodiments, the target analysis statement includes an input state and an output state; and determining the related variable affecting the target variable from the plurality of variables includes: determining a first related variable in the target analysis statement related to the target variable in the input state, determining a second related variable in the target analysis statement related to the target variable in the output state based on the variable transitivity and the first related variable, and using the second related variable as the related variable in the target analysis statement related to the target variable.

[0015] In some embodiments, determining the first variable related to the target variable in the target analysis statement under the input state includes: obtaining the execution statement adjacent to the target analysis statement in the target code; and using the second associated variable in the adjacent execution statement as the first associated variable related to the target variable in the target analysis statement.

[0016] In some embodiments, the adjacent execution statements include at least one of an adjacent upper-level execution statement and an adjacent lower-level execution statement; and the step of using the second associated variable in the adjacent execution statement as the first associated variable related to the target variable in the target analysis statement includes: performing attribute analysis on the target variable to determine the variable type of the target variable; when the target variable is an input parameter, determining that the second associated variable of the adjacent upper-level execution statement is used as the first associated variable related to the target variable in the target analysis statement; and when the target variable is at least one of a return value, a static variable, and a member variable, determining that the second associated variable of the adjacent lower-level execution statement is used as the first associated variable related to the target variable in the target analysis statement.

[0017] In some embodiments, determining the associated variables affecting the target variable from the plurality of variables further includes: determining a first transitive relationship between the first associated variables in the target analysis statement in the input state; and determining a second transitive relationship between the second associated variables in the target analysis statement in the output state based on the variable transitive relationship and the first transitive relationship.

[0018] In some embodiments, after determining the related variables affecting the target variable from the plurality of variables, the method further includes: determining that the target analysis statement has a historical second related variable; comparing the current second related variable obtained by the target analysis statement in this round with the historical second related variable; and determining that the current second related variable is different from the historical second related variable, and using the current second related variable as the related variable of the target analysis statement in this round.

[0019] In some embodiments, after determining that the current second associated variable is different from the historical second associated variable, the method further includes: obtaining the execution statement in the target code that is adjacent to the target analysis statement as the associated execution statement; and adding the target analysis statement and the associated execution statement to the tail of the target analysis queue.

[0020] In some embodiments, the variable tracking method in the program further includes: storing the set of related variables as the target analysis result of the target variable in the target code.

[0021] In some embodiments, after obtaining the target variable located in the target code, the method further includes: identifying code blocks contained in the target code, each code block corresponding to a function; creating a call relationship network between the code blocks, the call relationship network reflecting the call relationship between the code blocks; arranging all code blocks located in the call relationship network into a code block analysis queue, the code block analysis queue including a first queue and a second queue, each element in the code block analysis queue corresponding to a code block; and sequentially taking a code block from the head of the code block analysis queue to determine the set of associated variables related to the target variable in the code block.

[0022] In some embodiments, the method for configuring the code block analysis queue includes: taking all code blocks in the call relationship network as first code blocks and arranging the first code blocks into a first queue; and / or extracting code blocks related to the sink function in the call relationship network as second code blocks and arranging the second code blocks into a second queue.

[0023] In some embodiments, determining the set of associated variables related to the target variable in the code block includes: using the code block at the head of the code block analysis queue as the target code for variable tracking to obtain the set of associated variables related to the target variable in the code block; and using the set of associated variables as the current target analysis result of the code block in this round.

[0024] In some embodiments, after determining the set of associated variables related to the target variable in the code block, the method further includes: updating the target analysis result of the target code, including: determining that the code block has historical target analysis results; comparing the current target analysis result of the code block with the historical target analysis results; and determining that the current target analysis result of the code block is different from the historical target analysis results, and using the current target analysis result of the code block as the target analysis result of the code block in this round.

[0025] In some embodiments, after updating the target analysis results of the target code, the method further includes: searching for related code blocks that have a call relationship with the code block from the call relationship network;

[0026] Add the code block and the related code block to the tail of the code block analysis queue.

[0027] This disclosure also provides a variable tracking system in a program, comprising: at least one storage medium including at least one instruction set for implementing and analyzing a variable tracking method in the program; and at least one processor communicatively connected to the at least one storage medium, wherein, when the system is running, the at least one processor reads the at least one instruction set and executes the variable tracking method in the program according to the instructions of the at least one instruction set.

[0028] As can be seen from the above technical solutions, the variable tracking method and the system for executing this method provided in this disclosure analyze the target variable in the target code to track related variables in the target code. This makes it easier for developers to notice variables related to the target variable when coding in an IDE, to have a clearer understanding of the impact of key variables, and to improve the robustness of the code.

[0029] Other functionalities of the variable tracking methods and systems provided in this disclosure will be partially listed in the following description. The figures and examples described below will be readily apparent to those skilled in the art. The inventive aspects of the variable tracking methods and systems provided in this disclosure can be fully understood through practice or use of the methods, apparatus, and combinations described in the detailed examples below. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 A schematic diagram of the terminal structure of the hardware operating environment involved in the embodiments of this disclosure is shown;

[0032] Figure 2 A server schematic diagram of a variable tracking method in a program according to some embodiments of the present disclosure is shown;

[0033] Figure 3 A flowchart of a variable tracking method in a program according to some embodiments of the present disclosure is shown;

[0034] Figure 4 A flowchart illustrating one embodiment of a variable tracking method in a program according to some embodiments of the present disclosure is shown.

[0035] Figure 5A schematic diagram of function code provided according to some embodiments of the present disclosure is shown;

[0036] Figure 6 A schematic diagram of a visual display interface provided according to some embodiments of the present disclosure is shown;

[0037] Figure 7 A schematic diagram of a visual display interface provided according to some embodiments of the present disclosure is shown;

[0038] Figure 8 A flowchart illustrating one embodiment of a variable tracking method in a program according to some embodiments of the present disclosure is shown.

[0039] Figure 9 A schematic diagram of function code provided according to some embodiments of the present disclosure is shown;

[0040] Figure 10 A control flow graph of a function provided according to some embodiments of the present disclosure is shown;

[0041] Figure 11 A schematic diagram of a visual display interface provided according to some embodiments of the present disclosure is shown;

[0042] Figure 12 A schematic diagram of a visual display interface provided according to some embodiments of the present disclosure is shown;

[0043] Figure 13 The diagram illustrates code provided according to some embodiments of this disclosure;

[0044] Figure 14 A schematic diagram of a visual display interface provided according to some embodiments of the present disclosure is shown;

[0045] Figure 15 The diagram illustrates code provided according to some embodiments of this disclosure;

[0046] Figure 16 A schematic diagram of the input parameter analysis operation flow provided according to some embodiments of the present disclosure is shown;

[0047] Figure 17 This diagram illustrates the operation flow of module A involved in the input parameter analysis process provided according to some embodiments of the present disclosure;

[0048] Figure 18 This diagram illustrates the operation flow of module B involved in the input parameter analysis process provided according to some embodiments of the present disclosure;

[0049] Figure 19This diagram illustrates the operation flow of module C involved in the input parameter analysis process provided according to some embodiments of the present disclosure;

[0050] Figure 20 A schematic diagram of the member variable / static variable analysis operation flow provided according to some embodiments of this disclosure is shown;

[0051] Figure 21 This diagram illustrates the operation flow of module D involved in the member variable / static variable analysis process provided according to some embodiments of this disclosure;

[0052] Figure 22 This diagram illustrates the operation flow of module E involved in the member variable / static variable analysis process provided according to some embodiments of this disclosure;

[0053] Figure 23 This diagram illustrates the operation flow of module F involved in the member variable / static variable analysis process provided according to some embodiments of this disclosure;

[0054] Figure 24 A schematic diagram of a sink analysis operation flow provided according to some embodiments of the present disclosure is shown;

[0055] Figure 25 A schematic diagram of the return value analysis operation flow provided according to some embodiments of the present disclosure is shown; and

[0056] Figure 26 A schematic diagram of the inter-function analysis operation flow provided according to some embodiments of the present disclosure is shown. Detailed Implementation

[0057] The following description provides specific application scenarios and requirements for this disclosure, intended to enable those skilled in the art to make and use the content of this disclosure. Various partial modifications to the disclosed embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments and applications without departing from the spirit and scope of this disclosure. Therefore, this disclosure is not limited to the embodiments shown, but rather to the widest scope consistent with the claims.

[0058] The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not restrictive. For example, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” as used herein may also include the plural forms. When used in this disclosure, the terms “comprising,” “including,” and / or “containing” mean that the associated integers, steps, operations, elements, and / or components are present, but do not exclude the presence of one or more other features, integers, steps, operations, elements, components, and / or groups, or that other features, integers, steps, operations, elements, components, and / or groups may be added to the system / method.

[0059] In view of the following description, these and other features of this disclosure, as well as the operation and function of the related elements of the structure, and the economy of assembly and manufacture of the components, can be significantly improved. All of these form part of this disclosure with reference to the accompanying drawings. However, it should be clearly understood that the drawings are for illustrative and descriptive purposes only and are not intended to limit the scope of this disclosure. It should also be understood that the drawings are not drawn to scale.

[0060] The flowcharts used in this disclosure illustrate operations implemented according to some embodiments of this disclosure. It should be clearly understood that the operations in the flowcharts may not be implemented sequentially. Instead, the operations may be implemented in reverse order or simultaneously. Furthermore, one or more additional operations may be added to the flowcharts. One or more operations may be removed from the flowcharts.

[0061] For ease of description, the terms that will appear in the following descriptions will be explained as follows.

[0062] Input parameters: The values ​​of the input parameters are required by the called function.

[0063] Member variables: These belong to an object and are also called object variables. Member variables exist when the object is created and disappear when the object is destroyed.

[0064] Static variables: Variables modified by the `static` keyword are called static variables. Static variables belong to the class and are also known as class variables. Static variables are loaded when the class is loaded and disappear when the class is deleted.

[0065] Local variables: Local variables are defined only within a local scope, such as within a function or statement, and are only valid within their respective scope.

[0066] Return value: The value returned to the main program or the calling function after the subroutine or function has finished executing. It's important to note that the function name is both a representation of the function and a variable. Since function name variables are typically used to return the result of a function's processing to the calling function (i.e., recursive calls), they are generally referred to as return values.

[0067] Stain analysis: can be abstracted into a triple.<sources,sinks,sanitizers> Taint analysis takes the form of a taint source, which represents the direct introduction of untrusted or confidential data into the system; a sink, which represents the direct generation of security-sensitive operations (violation of data integrity) or the leakage of private data to the outside world (violation of data confidentiality); and a sanitizer, which represents the process of preventing data propagation from harming the information security of the software system through data encryption or removal of harmful operations. Taint analysis analyzes whether data introduced by a taint source in a program can propagate directly to a taint sink without sanitizer treatment. If not, the system's information flow is secure; otherwise, the system has security issues such as privacy data leakage or dangerous data operations.

[0068] Sink functions: These represent functions that directly perform security-sensitive operations or leak private data to the outside world. Sink functions can be specified manually or by the server. When one or more functions are specified as sink functions in advance, the system can recognize the specified sink functions.

[0069] A control flow graph (CFG) is an abstract representation of a process or program. It's an abstract data structure used in compilers, maintained internally, and represents all paths traversed during program execution. It uses a graph to represent the possible flow of execution for all basic blocks within a process, and can also reflect the real-time execution process of a program.

[0070] A queue is a linear list with restricted operations, allowing insertions only at one end and deletions at the other. Inserting an element into a queue is called enqueueing; deleting an element is called dequeueing. Its operation characteristic is First In First Out (FIFO), and only elements can enter from the rear of the queue and exit from the front.

[0071] An assignment statement is a formula that connects a variable and an expression using an assignment operator; it is also called an "assignment expression." An assignment statement assigns the value of an expression to a variable. An assignment statement includes: a left operand (lvalue): placed on the left side of the assignment operator; and a right operand (rvalue): placed on the right side of the assignment operator.

[0072] Figure 1 A schematic diagram of a system 100 for variable tracking in a program according to some embodiments of the present disclosure is shown. System 100 may include a client 110, an integrated development platform 120, an integrated development platform server 130, and a database 140.

[0073] The integrated development platform 120, also known as an integrated development environment (IDE), is an application that provides a program development environment, typically including tools such as a code editor, compiler, debugger, and graphical user interface. Developers can write program code (i.e., program development) on the integrated development platform 120 through client 110. The integrated development platform server 130 (hereinafter referred to as server 130) can be a computing device on the integrated development platform 120 specifically used to handle variable tracking in the program. In this application, multiple developers 110A, 110B, and 110C (collectively referred to as client 110) can perform program development on the integrated development platform 120.

[0074] Server 130 may store data or instructions for executing the variable tracking method in the program described herein, and may execute or be used to execute said data and / or instructions. Server 130 may include hardware devices with data processing capabilities and the necessary programs required to drive the hardware devices. Of course, server 130 may also be merely a hardware device with data processing capabilities, or merely a program running on the hardware device. In some embodiments, server 130 may also be a plug-in deployed on client 110.

[0075] Database 140 may store data and / or instructions. In some embodiments, database 140 may store data and / or instructions executed by server 130 or used to execute variable tracking methods in the program described in this disclosure. Client 110 and server 130 may have access to database 140, and client 110 and server 130 may access data or instructions stored in database 140 via a network. In some embodiments, database 140 may be directly connected to client 110 and server 130. In some embodiments, database 110 may be part of server 130. In some embodiments, database 140 may include mass storage, removable storage, volatile read-write memory, read-only memory (ROM), or similar content, or any combination thereof. Exemplary mass storage may include non-transitory storage media such as disks, optical discs, and solid-state drives. Exemplary removable storage may include flash drives, floppy disks, optical discs, memory cards, zip disks, magnetic tapes, etc. Typical volatile read-write memory may include random access memory (RAM). Example RAMs may include dynamic RAM (DRAM), dual date rate synchronous dynamic RAM (DDRSDRAM), static RAM (SRAM), thyristor RAM (T-RAM), and zero-capacitance RAM (Z-RAM), etc. Exemplary ROMs may include mask ROM (MROM), programmable ROM (PROM), virtual programmable ROM (PEROM), electronically programmable ROM (EEPROM), optical disc (CD-ROM), and digital multifunction disk ROM, etc.

[0076] It should be understood that Figure 1 The number of clients 110 and servers 130 shown is merely illustrative. Depending on implementation needs, there can be any number of clients 110 and servers 130.

[0077] It should be noted that the variable tracking method in the program can be executed entirely on the client 110, entirely on the server 130, or partially on the client 110 and partially on the server 130.

[0078] For ease of description, the following descriptions of this disclosure will use the variable tracking method in the program executed on server 130 as an example to describe the technical solutions involved in this disclosure.

[0079] Figure 2This is a schematic diagram of the structure of a computing device 200 provided according to some embodiments of the present disclosure. The computing device 200 can be a general-purpose computer or a special-purpose computer. For example, the computing device 200 can be a server, a personal computer, a portable computer (such as a laptop computer, tablet computer, etc.), or other electronic devices with computing capabilities. Of course, the computing device can be... Figure 1 The server 130 can also be a terminal device used by multiple developers 110A, 110B, 110C (client 110) to develop programs on the integrated development platform.

[0080] like Figure 2 As shown, the computing device 200 may include a COM port 250, which can be connected to or from a network to facilitate data communication. The computing device 200 may also include a processor 220, such as a central processing unit (CPU), in the form of one or more processors for executing program instructions. The computing device 200 may also include an internal communication bus 210 and various forms of program storage media and data storage media, such as a disk 270 (non-transitory memory) and read-only memory (ROM) 230 or random access memory (RAM) 240, etc., for storing various data files to be processed and / or transmitted. The storage media may be local to the computing device 200 or shared by the computing device 200 (e.g., Figure 1 The computing device 200 may also include program instructions stored in ROM 230, RAM 240, and / or other types of non-transitory storage media to be executed by processor 220. The computing device 200 may also include I / O components 260 to support data communication with other computing devices in the distributed computing system 100. The computing device 200 may also receive programming and data via network communication.

[0081] For illustrative purposes only, only one processor 220 is described in the computing device 200. However, those skilled in the art will understand that the computing device 200 in this application may also include multiple processors. Therefore, the methods / steps / operations performed by one processor as described in this application may also be performed jointly or separately by multiple processors. For example, in this application, the processor of the computing device 200 may simultaneously execute step A and step B. It should be understood that step A and step B may also be performed jointly by two different processors. For example, a first processor executes step A, a second processor executes step B, or a first processor and a second processor jointly execute steps A and B.

[0082] Figure 3A method flowchart 300 of a variable tracking method in a program provided according to some embodiments of the present disclosure is shown;

[0083] The following will combine Figure 3 This disclosure describes the technical solution. The subject implementing the technical solution may be... Figure 1 The client 110, integrated development platform 120, and server 130 are selected from the above. Specifically, the client 110, integrated development platform 120, and / or server 130 may have the following characteristics: Figure 2 The aforementioned structure, namely, the client 110, the integrated development platform 120, and / or the server 130, can be a device for variable tracking in a program, comprising: at least one storage medium and at least one processor. The at least one storage medium includes at least one instruction set for variable tracking in the program. The at least one processor is communicatively connected to the at least one storage medium. When the system is running, the at least one processor can read the at least one instruction set and execute instructions according to the at least one instruction set. Figure 3 The method 300. For illustrative purposes only, this application will describe the method 300 as being performed by server 130. The method may include:

[0084] S310, Obtain the target variables located in the target code, wherein the target code includes multiple variables.

[0085] The target code can be program code entered by the developer during program development on the client 110, or program code that already exists on the client 110 and can be manipulated by the developer. The developer can select or specify program code that needs variable tracking as the target code as needed. In this case, the server 130 can obtain the program code that the developer has selected or specified as the target code. Therefore, the target code in this disclosure can be a single program statement, a reusable group of statements with a specific function (i.e., a function), or code composed of multiple functions (i.e., code containing function calls).

[0086] At least one processor of server 130 can access target variables in the target code. For example, the target variable may be pre-selected by the program according to certain rules, or it may be specified by the developer through mouse clicks on the target code display interface.

[0087] In program code (i.e., target code), there may be multiple types of variables, such as input parameters, member variables, local variables, static variables, and return values. Local variables are those that can only be used within the body of the corresponding function in which they are defined. When the function execution ends, the memory space of the local variables defined within the function body is released. The target variables described in this disclosure include at least one of input parameters, member variables, static variables, and return values. That is, the variable tracking method of this disclosure can track variables in input parameters, member variables, static variables, or return values ​​to find related variables in the target code that are associated with at least one of these types of variables. Of course, the target variables may also include local variables.

[0088] S320, Based on the target code, determine a set of related variables, the set of related variables including at least one related variable in the target code that is related to the target variable.

[0089] After obtaining the target code, the server 130 can automatically identify the target variables contained in the target code. When the server 130 identifies that the target code contains at least one of input parameters, member variables, static variables and return values, it will perform variable tracking on the input parameters, member variables, static variables or return values ​​respectively, and determine the related variables in the target code that are related to the input parameters, the related variables in the target code that are related to the member variables, the related variables in the target code that are related to the static variables, and the related variables in the target code that are related to the return values.

[0090] After obtaining the target code, server 130 can also perform variable tracking based on the target variable specified by the developer in client 110. For example, the developer can specify a certain variable in the target code as the target variable through client 110. After obtaining the target variable, server 130 will perform variable tracking on the target variable to determine the related variables in the target code.

[0091] If two or more variables in a program code have a direct or indirect transitive relationship (transmission includes active and passive transmission), then all variables in this propagation chain can be considered as related variables. For example, consider the execution statement "a = b + 1". This is an assignment statement containing two variables: variable a and variable b. The transitive relationship between the variables in this statement is: a <- b, meaning variable b actively transmits taints to variable a, while variable a passively receives the taints transmitted by variable b. In this case, we can say that variable b actively transmits taints to variable a, or that variable a passively transmits taints to variable b. It should be understood that the above example does not limit the scope of application of the transitive relationships between variables in this disclosure.

[0092] In this disclosure, the related variable is any other variable included in the propagation chain of the target variable besides the target variable. The related variable may include at least one of the following: input parameters, local variables, member variables, and static variables.

[0093] Typically, the number of related variables in the target code is not limited to one. For ease of description, a set of related variables is used to represent the related variables in the target code; that is, the set of related variables is the collection of related variables in the target code. Generally, the set of related variables includes at least one related variable. It should be understood that if there are no related variables in the target code, the set of related variables can be interpreted as an empty set, or as if no set of related variables exists.

[0094] In the technical solution provided in this disclosure, when server 130 performs variable tracing on the target code, it needs to traverse the executed statements of the target code, determine the related variables of each executed statement that are related to the target variable, and merge the corresponding related variables in each executed statement to obtain the set of related variables of the target variable in the target code. Specifically, as follows Figure 4 As shown, step S320 may include:

[0095] S321, arrange all the execution statements contained in the target code into a target analysis queue.

[0096] S322, sequentially obtain an execution statement from the head of the target analysis queue as the target analysis statement.

[0097] The execution process of the target code can be reflected in the form of a control flow graph.

[0098] The target analysis queue stores the execution statements contained in the target code to be analyzed. Each element in the target analysis queue corresponds to one execution statement. It should be understood that the order of the execution statements in the target analysis queue can be arranged according to the order of the execution statements in the control flow graph corresponding to the target code, or it can be arranged differently.

[0099] This disclosure traverses the execution statements in the target code in the form of a queue, takes each execution statement in the target code as a target analysis statement, and then performs variable tracking on each target analysis statement.

[0100] Specifically, for each target analysis statement, server 130 can perform variable tracking according to the following steps:

[0101] S323, Determine the variable passing relationships in the target analysis statement.

[0102] In this disclosure, each target analysis statement corresponds to an input state (in) and an output state (out). The state before execution (before execution) of the target analysis statement is the input state, and the state after execution is the output state. The variable transitivity in the target analysis statement can reflect the influence (or transitivity) between the variables covered by the target analysis statement during execution, or it can be the variable covered (or pointed to) by the target analysis statement. The determination of variable transitivity can be based on the statement type of the target analysis statement. The statement types of target analysis statements include at least one of return statements, assignment statements, and function call statements.

[0103] When the target analysis statement is a return statement, the variable passing relationship in the target analysis statement is the variable that the target analysis statement points to, that is, the variable returned by the target analysis statement.

[0104] When the target analysis statement is an assignment statement or a function call statement, the variable passing relationship in the target analysis statement is the passing relationship between the variables covered by the target analysis statement.

[0105] For function call statements, if the called function already has a corresponding target analysis result, this result can be directly obtained. Then, the variable passing relationship of the target analysis statement is determined based on the target analysis result of the called function. The target analysis result includes related variables in the called function that are relevant to the target variable. If the called function does not have a corresponding target analysis result, variable tracking of the called function is required to identify the related variables in the called function that are relevant to the target variable. These related variables are then used as the target analysis result of the called function. Finally, the variable passing relationship of the target analysis statement is determined based on the target analysis result of the called function.

[0106] System 100 stores the target analysis results of the function so that when the function is called in the future, the variable passing relationship of the target analysis statement calling the function can be determined directly based on the target analysis results, thereby greatly improving the efficiency of variable tracking.

[0107] In some embodiments, if the called function is a sink function, then all input parameters of the sink function are treated as tainted variables, and all tainted variables are treated as the correlation variables related to the target variable in the target analysis results.

[0108] For example, such as Figure 5The code shown contains three functions, named sink, sinkTest0, and sinkTest1. Figure 5 In the code, the numbers on the left indicate the line number corresponding to each line of code. As mentioned earlier, since the sink function is one or more pre-specified functions, therefore... Figure 5 The three functions named "sink", "sinkTest0", and "sinkTest1" can all be designated as the sink function. It should be understood that there is no necessary connection between the function name and the sink function.

[0109] In this disclosure, if a function named "sink" is designated as a sink function, then all its input parameters (input parameters x, y, and z) will be treated as tainted variables and included as correlation variables related to the target variable in the target analysis results of that function. The other two unspecified functions (named sinkTest0 and sinkTest1, respectively) are not sink functions.

[0110] It's important to note that for the `sink` function, all tainted variables are associated variables with respect to the target variable, regardless of whether the target variable is an input parameter, return value, member variable, or static variable. All tainted variables in the `sink` function will be treated as associated variables related to the target variable in the execution statement that calls the `sink` function.

[0111] For assignment statements, there are two cases: (a) assignment statements without nested function calls; and (b) assignment statements with nested function calls. For (a) assignment statements without nested function calls, the variable passing relationship is determined based on the passing relationship between the left and right operands. For (b) assignment statements with nested function calls, the target analysis result of the called function is first determined using the same method as for function calls, and this result is then merged into the right operand of the assignment statement. Finally, the variable passing relationship is determined based on the passing relationship between the left and right operands.

[0112] S324, Based on the variable transitivity, determine the associated variable that affects the target variable from the plurality of variables.

[0113] For ease of understanding and distinction, the related variables of the target variable in the input state of the target analysis statement are called the first related variables; the related variables of the target variable in the output state of the target analysis statement are called the second related variables. The second related variables will be used as the related variables of the target variable in the target analysis statement. It should be understood that, in general, the first and second related variables of the target analysis statement are not the same. Furthermore, the first and second related variables can be singular or plural.

[0114] The first and second related variables of each target analysis statement are connected through the variable transitivity of that statement. That is, given any two of the first, second, and transitivity variables of the target analysis statement, the specific details of a third party can be determined. For example, given the first and transitivity variables of the target analysis statement, the second related variable can be determined. Given the second and transitivity variables of the target analysis statement, the first related variable can be determined. Given the first and second related variables of the target analysis statement, the transitivity can be determined.

[0115] Specifically, such as Figure 8 As shown, step S324 may include:

[0116] S324-a, determine the first associated variable related to the target variable in the target analysis statement under the input state. Specifically, the determination of the first associated variable of the target analysis statement can be combined with the position of the target analysis statement in the target code, that is, it can be combined with the analysis of the execution statements adjacent to the target analysis statement in the target code. In some embodiments, the target code can be transformed into a control flow graph, which clearly shows all paths that the target code will traverse during program execution. Based on the control flow graph, the execution statements adjacent to the target analysis statement can be determined. Adjacent execution statements include at least one of adjacent upper-level execution statements and adjacent lower-level execution statements.

[0117] by Figure 9 Taking the function shown as an example, Figure 9 The function shown is named "functionForExample", and its corresponding control flow graph is as follows: Figure 10 As shown, Figure 10The control flow graph shows the execution order of the statements contained in the function. If the target analysis statement is "x = y + 1", then the upper-level execution statement adjacent to "x = y + 1" is "z = x + 1", and the lower-level execution statements adjacent to "x = y + 1" are "z = z + 10" and "z = z - 10". If the target analysis statement is "z = x + 1", then there is no upper-level execution statement adjacent to "z = x + 1", and the lower-level execution statement adjacent to "z = x + 1" is "x = y + 1". Similarly, if the target analysis statement is "return z", then the upper-level execution statements adjacent to "return z" are "z = z + 10" and "z = z - 10", but there is no lower-level execution statement adjacent to "return z".

[0118] In some embodiments, the execution statements adjacent to the target analysis statement in the target code can be obtained, and the second associated variable in the adjacent execution statements can be used as the first associated variable related to the target variable in the target analysis statement. Specifically, depending on the variable type of the target variable, the second associated variable of the upper-level execution statement adjacent to the target analysis statement can be selected as the first associated variable related to the target variable in the target analysis statement; alternatively, the second associated variable of the lower-level execution statement adjacent to the target analysis statement can be selected as the first associated variable related to the target variable in the target analysis statement.

[0119] Specifically, attribute analysis is performed on the target variable to determine its variable type. As mentioned earlier, the target variable includes at least one of the following: input parameters, member variables, static variables, and return values.

[0120] When the target variable is an input parameter, the second related variable of the adjacent upper-level executed statement is determined as the first related variable in the target analysis statement that is related to the target variable. Figure 9Taking the function shown as an example, when the target variable is an input parameter and the execution statement "x = y + 1" is used as the target analysis statement, the second associated variable of the execution statement "z = x + 1" is determined to be the first associated variable of the target analysis statement. When the target variable is an input parameter and the execution statement "return z" is used as the target analysis statement, since the upper-level execution statements adjacent to the execution statement "return z" include the execution statements "z = z + 10" and "z = z - 10", the second associated variable of the execution statements "z = z + 10" and "z = z - 10" is combined and used as the first associated variable of the target analysis statement. Similarly, the second associated variable of the execution statement "x = y + 1" can be used as the first associated variable of the execution statement "z = z + 10" or "z = z - 10".

[0121] In some embodiments, when the target analysis statement has no adjacent execution statements, the first associated variable of the target analysis statement can be initialized to zero. For example, Figure 9 The function shown has input parameters including variables x and y. When the target variable is specified as variable x, and the execution statement "z = x + 1" is used as the target analysis statement, since the target analysis statement "z = x + 1" has no adjacent upper-level execution statement, the first associated variable of the target analysis statement can be initialized to zero.

[0122] It should be understood that it is not necessary to determine the specific details of the third party only after identifying any two of the first related variable, the second related variable, and the variable transitivity in the target analysis statement.

[0123] When the target variable is at least one of a return value, a static variable, or a member variable, the second associated variable of the adjacent next-level execution statement is determined as the first associated variable related to the target variable in the target analysis statement. Similarly, Figure 9Taking the function shown as an example, when the target variable is the return value z, and the execution statement "x = y + 1" is used as the target analysis statement, since the next-level execution statements adjacent to "x = y + 1" include the execution statements "z = z + 10" and "z = z - 10", the second associated variable of the execution statement "z = z + 10" and the second associated variable of the execution statement "z = z - 10" are merged and used as the first associated variable of the target analysis statement. When the target variable is the return value z, and the execution statement "return z" is used as the target analysis statement, since there is no next-level execution statement adjacent to "return z", the first associated variable of the target analysis statement can be initialized to zero. Similarly, the second associated variable of the execution statement "return z" can be used as the first associated variable of the execution statement "z = z + 10" or "z = z - 10".

[0124] When the target variable is a static variable and / or a member variable, the first associated variable in the target analysis statement is determined according to the method for handling target variables as return values. This will not be elaborated upon here.

[0125] In the above method for determining the first associated variable of the target analysis statement based on the variable type of the target variable, when the target variable is an input parameter, the first associated variable is passed along the sequential direction of the control flow graph; while when the target variable is at least one of a return value, a static variable, or a member variable, the first associated variable is passed along the reverse direction of the control flow graph.

[0126] S324-b, Based on the variable transitivity and the first associated variable, determine the second associated variable related to the target variable in the target analysis statement in the output state.

[0127] by Figure 9 Taking the function shown as an example, when the target variable is specified as the return value z, and the execution statement "return z" is used as the target analysis statement, since the target analysis statement "return z" has no adjacent next-level execution statement, the first associated variable of the target analysis statement "return z" is initialized to zero, meaning that the target analysis statement "return z" has no corresponding first associated variable. Since the target analysis statement "return z" is a return value statement, as mentioned earlier, the variable passing relationship of the target analysis statement "return z" is the variable z that the target analysis statement points to. Therefore, based on the first associated variable and variable passing relationship of the target analysis statement "return z", the second associated variable of the target analysis statement "return z" can be determined to be: variable z.

[0128] When the target variable remains unchanged, and the execution statement "z = z + 10" is used as the target analysis statement, since the next-level execution statement adjacent to "z = z + 10" is the execution statement "return", the second associated variable of the execution statement "return z" is taken as the first associated variable of the target analysis statement "z = z + 10". The target analysis statement "z = z + 10" is an assignment statement, and its corresponding variable transitivity is: z < -z, meaning variable z passes taint to variable z. Therefore, based on the first associated variable and variable transitivity of the target analysis statement "z = z + 10", the second associated variable of the target analysis statement "z = z + 10" can be determined to be variable z.

[0129] With the target variable unchanged, when the execution statement "z = z - 10" is used as the target analysis statement, similarly, the second related variable of the execution statement "return z" is used as the first related variable of the target analysis statement "z = z - 10". The target analysis statement "z = z + 10" is an assignment statement, and its corresponding variable transitivity is: z < -z. Based on the first related variable and variable transitivity of the target analysis statement "z = z - 10", the second related variable of the target analysis statement "z = z - 10" can be determined to be the variable z.

[0130] When the target variable remains unchanged, and the execution statement "x = y + 1" is used as the target analysis statement, the next-level execution statements adjacent to "x = y + 1" include the execution statements "z = z + 10" and "z = z - 10". Therefore, the second related variable of the execution statements "z = z + 10" and "z = z - 10" needs to be merged to form the first related variable of the target analysis statement. According to the previous analysis, the second related variable of the execution statement "z = z + 10" is variable z; the second related variable of the execution statement "z = z - 10" is also variable z. Therefore, the first related variable of the target analysis statement "x = y + 1" obtained by merging the second related variables of the execution statements "z = z + 10" and "z = z - 10" is variable z. The target analysis statement "x = y + 1" is an assignment statement, and its corresponding variable transitive relationship is: x < -y. Since there is no transitive relationship between the first associated variable and the variables involved in the variable transitivity of the target execution statement "x = y + 1", it can be determined that the second associated variable of the target analysis statement "x = y + 1" is empty, that is, there is no associated variable in the target analysis statement "x = y + 1" that has a transitive relationship with the target variable.

[0131] With the target variable unchanged, when the execution statement "z = x + 1" is used as the target analysis statement, since the next-level execution statement adjacent to "z = x + 1" is "x = y + 1", and the second associated variable of the execution statement "x = y + 1" is empty, the first associated variable of the target analysis statement "z = x + 1" is also empty. The target analysis statement "z = x + 1" is an assignment statement, and its corresponding variable transitivity is: z < -x. Based on the first associated variable and variable transitivity of the target analysis statement "z = x + 1", the second associated variable of the target analysis statement "z = x + 1" can be determined to be the variable x.

[0132] After confirming the second associated variable corresponding to the target analysis statement, S324-c, the second associated variable is used as the associated variable related to the target variable in the target analysis statement. Therefore, for the execution statement "return z", the associated variable related to the target variable z (return value z) is: variable z. For the execution statement "z = z + 10", the associated variable related to the target variable z (return value z) is: variable z. For the execution statement "z = z - 10", the associated variable related to the target variable z (return value z) is: variable z. For the execution statement "x = y + 1", there is no associated variable related to the target variable z (return value z). For the execution statement "z = x + 1", the associated variable related to the target variable z (return value z) is: variable x.

[0133] It should be understood that the number of variables corresponding to the first associated variable and / or the second associated variable is not limited to one, and the number of variables corresponding to the first associated variable and / or the second associated variable is a natural number.

[0134] S325, merge the associated variables in each executed statement to obtain the associated variable set.

[0135] The set of related variables of the target variable contained in all executed statements of the target code can be called the set of related variables of the target code. For Figure 9 The function shown, based on the above analysis, combines the related variables in each executed statement to obtain a set of related variables associated with the target variable (return value z). This set of related variables includes: variable z and variable x.

[0136] In some embodiments, the set of related variables can also be a collection of related variables associated with the target variable contained in each executed statement, which can be referred to as the set of related variables for the target analysis statement. It should be understood that the set of related variables for the target code and the set of related variables for the target analysis statement can coexist without conflict. When executing the variable tracing method in the program, the server 130 can merge the related variables associated with the target variable contained in each executed statement as the set of related variables for each executed statement, and further merge the sets of related variables for each executed statement to obtain the set of related variables for the target code. Alternatively, when executing the variable tracing method in the program, the server 130 can directly merge the related variables associated with the target variable contained in all executed statements of the target code to obtain the set of related variables for the target code.

[0137] It should be noted that, Figure 9 The function shown is only one type of object code described in this disclosure and does not limit the scope of the object code described in this disclosure. In other examples, the object code may also contain member variables and / or static variables. Therefore, both the target variable and the associated variables may include member variables and / or static variables, and correspondingly, the set of associated variables of the target variable may also include member variables and / or static variables. For example, as Figure 13 The code shown defines a class named SourceClass, which contains two functions: objectPropertiesTest3 and objectPropertiesTest5. If... Figure 13 Using the entire code shown as the target code, and specifying the target variable as a static variable (property1), following the variable tracing method described above, we can determine that in line 147 of the target code, the execution statement "property1 = y0" contains the variable transitive relation property1 <- y0. Therefore, the associated variable related to the target variable (property1) in the execution statement "property1 = y0" is variable y0, which is also an input parameter of the function objectPropertiesTest3. Furthermore, in line 149 of the target code, the execution statement "y = property1" contains the variable transitive relation y <- property1. Therefore, the associated variable related to the target variable (property1) in the execution statement "y = property1" is variable y. Based on the above analysis, by merging the associated variables in each execution statement, we can obtain the set of associated variables related to the target variable (property1) in the target code. This set of associated variables includes variables y0 and y.

[0138] It should be understood that Figure 13The code shown can also specify other variables as target variables for variable tracking. For example, the target variable can be at least one of the member variable property0, member variable property2, input parameter x0, input parameter y0, and input parameter z0. These will not be elaborated upon here.

[0139] In some embodiments, the set of associated variables can be stored as the target analysis result of the target variable in the target code. This allows the variable passing relationship of the target analysis statement calling the target code to be determined directly based on the target analysis result when the target code is called in the future, thereby greatly improving the efficiency of variable tracking.

[0140] It should be understood that the results of target analysis can be adjusted according to the scope of the target code. When the target code is a single function, the target analysis results include the related variables of that function that are relevant to the target variable. When the target code contains multiple functions, the summation of the target analysis results for each function yields the related variables of the entire target code that are relevant to the target variable.

[0141] In this disclosure, to determine whether variables contained in the target code are related to the target variable, it is necessary to observe all variables. When a function is executed, variables may be assigned values. After the function ends, some objects are destroyed (the corresponding variables are no longer alive), while others continue to exist due to the JVM's memory mechanism (their corresponding variables are still alive). Therefore, in some embodiments, to facilitate recording whether variables contained in the target code are related to the target variable, an array of length n can be defined, where each element in the array represents a variable; and "1" is defined to indicate that the variable is related to the target variable and is still alive, while "0" is defined to indicate that the variable is not related to the target variable or is not alive.

[0142] For example, with Figure 9 Taking the function shown as an example, the variables contained in this function are: variable x, variable y, and variable z. Define an array array of length 3, where array[0] represents x, array[1] represents y, and array[2] represents z. When the target variable is z, for the execution statement "return z", since the target variable y is the return value of the function, according to the control flow graph, the first associated variable of the execution statement "return z" is empty, that is, the state of the first associated variable of the execution statement "return z" is [0,0,0]; according to the variable passing relationship of the execution statement "return z", the state of the second associated variable of the execution statement is [0,0,1].

[0143] Since the target variable z is the input parameter of the function, according to the control flow graph, the second associated variable of the executed statement "return z" is the first associated variable of the executed statements "z = z + 1" or "z = z - 10". For the executed statement "z = z + 1", the state of its first associated variable is [0, 0, 1]; according to the variable transitivity of the executed statement "z = z - 10", the state of its second associated variable is [0, 0, 1]. For the executed statement "z = z - 10", the state of its first associated variable is [0, 0, 1]; according to the variable transitivity of the executed statement "z = z - 10", the state of its second associated variable is [0, 0, 1].

[0144] Accordingly, according to Figure 10 As shown in the control flow graph, the first associated variable of the executed statement "x = y + 1" is the second associated variable after the combined execution statements "z = z + 1" and "z = z - 10". That is, the state of the first associated variable of the executed statement "x = y + 1" is [0, 0, 1]. According to the variable transit relationship of the executed statement "x = y + 1" (there is only a transit relationship between variables x and y in the executed statement "x = y + 1", and there is no transit relationship with variable z), the state of the second associated variable of the executed statement is [0, 0, 1].

[0145] Similarly, according to Figure 10 As shown in the control flow graph, the first associated variable of the executed statement "z = x + 1" is the second associated variable of the executed statement "x = y + 1". For the executed statement "z = x + 1", the state of its first associated variable is [0,0,1]; according to the variable transit relationship of the executed statement "z = x + 1", the state of the second associated variable of this executed statement is [1,0,0].

[0146] In some embodiments, step S324 further includes:

[0147] Determine a first transitive relationship between the first associated variables in the target analysis statement in the input state; and based on the variable transitive relationship and the first transitive relationship, determine a second transitive relationship between the second associated variables in the target analysis statement in the output state.

[0148] For a given target analysis statement, when the number of variables corresponding to the first and / or second associated variables of the target analysis statement is not less than two, and there is a transitive relationship between the variables, the transitive relationships between the first and second associated variables can be recorded. In this disclosure, the first transitive relationship represents the transitive relationship between the first associated variables contained in the target analysis statement in the input state; the second transitive relationship represents the transitive relationship between the second associated variables contained in the target analysis statement in the output state. For example, if a target analysis statement has a first variable transitive relationship in the input state: p0 <- v, that is, variable v transitively transmits a taint to variable p0; if the target analysis statement has a variable transitive relationship: v <- p1, then the second variable transitive relationship of the target analysis statement is: v <- p1 and p0 <- p1.

[0149] In this disclosure, the transitive relationship between variables can also be referred to as the taint transitive relationship between variables. In some embodiments, the taint transitive relationship needs to be updated according to the specific content of the target analysis statement.

[0150] For example, when the target variable is the input parameter z, for a certain target analysis statement, there is a first transitive relation in the input state: z <-y, and there is an assignment relation in the target analysis statement: y = x0 op x1 (op represents the operator). At this time, it is necessary to clear the original taint propagation relation of variable y in the first transitive relation, and pass the transitive relation of x0, x1 and input parameter z to variable y. After the analysis is completed, the second transitive relation of the target analysis statement in the output state is: z <-x0, x1.

[0151] For example, when the target variable is at least one of a return value, a member variable, and a static variable, for ease of description, at least one of the return value, member variable, or static variable will be represented by the variable z. For a given target analysis statement, in the input state, there exists a first transitive relation: z <- y, and in this target analysis statement, there exists a variable transitive relation: y <- x0, x1. At this point, the transitive relation between x0, x1, and variable z needs to be passed to variable y. After analysis, in the output state, the second transitive relation of this target analysis statement is: z <- x0, x1, and y <- x0, x1.

[0152] Therefore, when updating the taint transitivity of a target analysis statement (i.e., determining the second transitivity of the target analysis statement), it is necessary to determine whether the variable transitivity of the target analysis statement should be retained based on the attributes of the target variable. When the target variable is an input parameter, failure to delete the variable transitivity of the target analysis statement will lead to false positives. Therefore, it is necessary to delete the variable transitivity existing in the target analysis statement itself. When the target variable is at least one of a return value, a member variable, and a static variable, since the first transitivity of the target analysis statement is obtained by merging the second transitivity of the next-level execution statement adjacent to the target analysis statement, even if the variable transitivity existing in the target analysis statement itself is not deleted from the second transitivity of the target analysis statement, it will not cause false positives during the analysis process.

[0153] In some embodiments, at least one of the first transitive relation, variable transitive relation, and second transitive relation related to the target variable in the target analysis statement can be stored as the target analysis result of the target analysis statement. Alternatively, the target analysis results corresponding to each execution statement in the target code can be merged and stored as the target analysis result related to the target variable in the target code. This allows the variable transitive relation of the target analysis statement calling the target code to be directly determined based on the target analysis result of the target code when the target code is called in the future, thereby greatly improving the efficiency of variable tracing.

[0154] It should be understood that the results of target analysis can be adjusted according to the scope of the target code. When the target code is a single function, the target analysis results include the related variables of that function that are relevant to the target variable. When the target code contains multiple functions, the summation of the target analysis results for each function yields the related variables of the entire target code that are relevant to the target variable.

[0155] In some embodiments, after step S324, the method further includes:

[0156] Determine that the target analysis statement has a historical second associated variable; compare the current second associated variable obtained by the target analysis statement in this round with the historical second associated variable.

[0157] As mentioned earlier, during variable tracing in a program, an executed statement is sequentially retrieved from the head of the target analysis queue as the target analysis statement. Variable tracing is then performed to determine the second related variables in that target analysis statement that are associated with the target variable. In this disclosure, after the target analysis statement is analyzed, the second related variables corresponding to this round of analysis are obtained. At this point, it can be determined whether the target analysis statement needs iterative analysis based on the second related variables obtained in this round of analysis and those obtained using the same method previously. For ease of distinction, the second related variables obtained by the target analysis statement in this round are referred to as the current second related variables; the second related variables obtained by the target analysis statement before this round are referred to as historical second related variables.

[0158] When the current second associated variable of the target analysis statement is different from the historical second associated variable, the current second associated variable is used as the associated variable of the target analysis statement in this round; then the execution statement adjacent to the target analysis statement in the target code is obtained as the associated execution statement, and the target analysis statement and the associated execution statement are added to the tail of the target analysis queue.

[0159] The fact that the current second associated variable of the target analysis statement differs from the historical second associated variable indicates that the target analysis statement requires iterative analysis. Since the first and second associated variables of this target analysis statement influence the second associated variables of the execution statements adjacent to it, this disclosure, in addition to adding the target analysis statement to the tail of the target analysis queue, also requires adding the execution statements adjacent to it (i.e., associated execution statements) to the tail of the target analysis queue.

[0160] When the current second associated variable of the target analysis statement is the same as the historical second associated variable, the current second associated variable or the historical second associated variable can be used as the associated variable of the target analysis statement in this round.

[0161] In some embodiments, when the target code contains multiple code blocks (functions), there are call and called relationships between these functions. In this case, a call relationship network that can cover these functions can be created based on the call and called relationships between the functions. Furthermore, each code block can be considered an independent whole, and variable tracking can be performed on each code block to obtain the set of associated variables related to the target variable in each code block (i.e., the target analysis result). This process can also be called in-function analysis. Specifically, it includes: identifying the code blocks contained in the target code, each code block corresponding to a function; creating a call relationship network between the code blocks, the call relationship network reflecting the call relationships between the code blocks; arranging all the code blocks located in the call relationship network into a code block analysis queue, the code block analysis queue including a first queue and a second queue, each element in the code block analysis queue corresponding to a code block; and sequentially taking one code block from the head of the code block analysis queue and determining the set of associated variables related to the target variable in the code block.

[0162] In this disclosure, the difference between the target analysis queue and the code block analysis queue lies in the different types of elements. Each element in the target analysis queue corresponds to an execution statement, while each element in the code block analysis queue corresponds to a code block. The configuration method for the code block analysis queue includes: taking all code blocks in the call relationship network as first code blocks and arranging the first code blocks into a first queue; extracting the code blocks related to the sink function in the call relationship network as second code blocks and arranging the second code blocks into a second queue.

[0163] It is important to note that the first queue contains all code blocks in the call relationship network, while the second queue contains only code blocks in the call relationship network related to the sink function.

[0164] In this disclosure, determining the set of related variables in the code block that are associated with the target variable includes: using the code block at the head of the code block analysis queue as the target code for variable tracking to obtain the set of related variables in the code block that are associated with the target variable; and using the set of related variables as the current target analysis result of the code block in this round. In this disclosure, the method for determining the set of related variables in the code block that are associated with the target variable is as follows: using the code block as the target code for variable tracking. Specifically, each executed statement in the code block is used as a target analysis statement to obtain a second related variable in the target analysis statement that is associated with the target variable. Then, the second related variables of each executed statement are merged to obtain the set of related variables in the code block that are associated with the target variable, which is the target analysis result of the code block.

[0165] To facilitate differentiation, the target analysis result obtained by the code block in this round is called the current target analysis result; the target analysis result obtained by the target analysis statement in previous rounds is called the historical target analysis result.

[0166] If the code block is a called function in the call relationship network, then when other code blocks in the target code that call this code block perform variable tracing, they can directly determine the second associated variable in the execution statement containing this code block based on the associated variable set (target analysis result) of this code block, without needing to perform variable tracing on this code block again. This enables variable tracing between functions and also improves analysis efficiency.

[0167] In some embodiments, after the analysis within the function is completed, the method further includes: updating the target analysis result of the target code. That is, comparing the target analysis result of the code block in the current round with the target analysis result of the code block in the previous round. Specifically, this includes: determining that the code block has historical target analysis results; comparing the current target analysis result of the code block with the historical target analysis results; and determining that the current target analysis result of the code block is different from the historical target analysis result, and using the current target analysis result of the code block as the target analysis result of the code block in the current round.

[0168] Once the code block analysis is complete, the target analysis result for this round of analysis is obtained. At this point, it can be determined whether the code block needs iterative analysis based on the target analysis result obtained in this round of analysis and the target analysis result obtained using the same method previously.

[0169] When the target analysis result of the code block in the current round is determined to be different from the target analysis result of the code block in the previous round, it indicates that the code block needs to undergo iterative analysis. The target analysis result of the target code is updated to the target analysis result of the code block in the current round. Related code blocks with call relationships to the code block are then searched from the call relationship network; the code block and the related code blocks are added to the tail of the code block analysis queue.

[0170] Because the target analysis result of this code block will affect the target analysis result of the code blocks that call this code block, in this disclosure, in addition to adding this code block to the tail of the code block analysis queue, it is also necessary to add all code blocks (related code blocks) that call this code block to the tail of the code block analysis queue.

[0171] S330, Output the set of related variables.

[0172] In some embodiments, after step S330, the method further includes:

[0173] S340, output the target variable.

[0174] The output method includes visual display. Specifically, the visual display includes at least one of language list display and highlighting.

[0175] Visualization can be achieved by directly highlighting the target variable and / or the related variables contained in the set of associated variables in the target code on the client's display interface. Of course, besides highlighting, other marking methods include borders, underlines, shadows, bolding, or a combination of two or more marking types. Any display method that distinguishes the target variable and / or the related variables contained in the set of associated variables from other content in the target code falls within the scope of this disclosure, and will not be listed here individually.

[0176] In some embodiments, based on Figure 5 The code shown contains two functions, sinkTest0 and sinkTest, both of which call the sink function. For example... Figure 6 As shown, Figure 5 The set of associated variables that pass taints to the sink function in the displayed code includes: input parameter x, input parameter y, input parameter z, local variable x, local variable y, and local variable z. In the client 110's display interface, input parameter x, input parameter y, input parameter z, local variable x, local variable y, and local variable z are marked with borders.

[0177] In some embodiments, such as Figure 11 As shown, based on Figure 10 The function shown, when the target variable is the return value z, determines, through variable tracking using the technical solution of this disclosure, that the set of associated variables for the return value z includes: local variable z and input parameter x. In the display interface of client 110, the variable z, local variable z, and input parameter x are marked with borders. Furthermore, since the target variable is the return value z, the variable z is highlighted in the display interface of client 110.

[0178] Visualization can also be achieved by displaying the target variable and / or the related variables in the set of associated variables in the target code using a list of textual language. For example, the line number, variable type, or variable name of the target variable and the related variables in the set of associated variables can be displayed. In some embodiments, when using a list of textual language, the variable name and line number of the local variable can be written; if there are static variables, member variables, or input parameters, the corresponding variable types can also be written.

[0179] In some embodiments, such as Figure 7 As shown, based on Figure 5The code shown can also be displayed as a list of textual languages. Figure 5 The code passes the taint-related variable to the sink function.

[0180] In some embodiments, such as Figure 9 As shown, based on Figure 6 The function shown, when the target variable is the return value z, displays the associated variables and statements related to the return value z in a list format. Here, args indicates that the variable type is an input parameter.

[0181] In some embodiments, when displayed as a list of textual language, the transitive relationships between the related variables in the related variable set can also be shown. For example... Figure 14 As shown, based on Figure 13 The code shown Figure 14 The document lists all static variables and member variables in the code that have passed taints, as well as the transitive relationships between these variables.

[0182] Therefore, by analyzing the target variable in the target code to track the related variables in the target code, and visually displaying the target variable and the related variables in the set of related variables, the transitive relationship of the target variable in the target code can be clearly shown. This makes it easier for developers to notice variables related to the target variable when coding in the IDE, thus improving the robustness of the code.

[0183] In the technical solution provided in this disclosure, the target variable can be specified by the developer through the client 110. For example, the developer can point the mouse at a variable. If the pointed-to variable is one of the following: input parameter, member variable, static variable, or return value, the processor 130 will use the pointed-to variable as the target variable, perform variable tracking, determine the set of related variables associated with the target variable, and then visualize the target variable and / or the related variables contained in the set of related variables associated with the target variable. Of course, the target variable can also be specified by the developer in other ways, which will not be elaborated here.

[0184] In some embodiments, the method further includes: S350, storing the set of related variables as the target analysis result of the target variable in the target code.

[0185] As mentioned earlier, when function calls exist in the target code, if the called function has corresponding target analysis results, the variable transit relationships of the target analysis statements can be directly determined based on the target analysis results of the called function, which can greatly improve variable tracking efficiency. In this disclosure, the set of associated variables is stored as the target analysis results of the target variables in the target code. It should be understood that the target analysis results may contain not only the set of associated variables, but also the transit relationships between the variables in the set of associated variables.

[0186] The variable tracing method described in this disclosure can track various types of variables in the target code and identify related variables. The variable tracing process will be demonstrated below for cases where the target variable is an input parameter, member variable, static variable, or return value; cases where the target code contains a sink function; and cases where the target code contains function calls or recursion. It should be understood that the analysis process involved in the variable tracing method of this disclosure satisfies the loop fixed point theorem.

[0187] Input parameter analysis: When the target variable is an input parameter, after running a function, determine which member variables / input parameters / static variables will pass taints to the input parameter. For example... Figure 15 In the code shown, the function named "paramsTest" has two input parameters: input parameter v0 and input parameter v1. The function named "paramsTest" calls functions named "getStr" and "setStr". According to the variable tracking method described in this disclosure, it can be determined that in the function named "paramsTest", when the target variable is input parameter v0, the associated variable related to the target variable (i.e., input parameter v0) is input parameter v1 (located in line 115). When the target variable is input parameter v1, the associated variable related to the target variable (i.e., input parameter v1) does not exist.

[0188] In addition, such as Figure 16-19 As shown, this disclosure also provides a flowchart corresponding to the input parameter analysis. Modules A, B, and C correspond to three preset processing methods before input parameter analysis. Actively tainted variables represent variables in the target code that have passed taints to other variables; actively tainted variables include: actively tainted input parameters, actively tainted member variables, and actively tainted static variables. Passively tainted variables represent variables in the target code that have had taints passed to them by other variables; passively tainted variables include: passively tainted input parameters, passively tainted member variables, and passively tainted static variables.

[0189] Member variable / static variable analysis: When the target variable is a member variable or a static variable, during the execution of a function, values ​​may be assigned to static variables or member variables of an object. After the function ends, some objects will be destroyed, while others will continue to exist due to the JVM's memory mechanism. It is necessary to determine which input parameters / member variables / static variables will pass taints to the member variables / static variables of objects that are not destroyed after the function ends. For example... Figure 20-23 As shown, this disclosure provides a flowchart corresponding to the analysis of member variables / static variables. Modules D, E, and F correspond to three preset processing methods before the analysis of member variables.

[0190] Sink Analysis: If a function is a sink function, then the taints on its input parameters will be output as results. During the execution of a function, it's necessary to determine which taints on its input parameters or external member variables / static variables will ultimately be passed as parameters to any sink function. For example... Figure 24 As shown, this disclosure provides a flowchart corresponding to sink analysis.

[0191] Return value analysis: When the target variable is a return value, after running a function, it's necessary to determine which input parameters or external static / member variables' taints will be passed to the return value. For example... Figure 25 As shown, this disclosure provides a flowchart corresponding to the return value analysis.

[0192] Inter-function analysis: When function calls or recursion exist in the target code, the following methods are used: Figure 26 The flowchart shown illustrates variable tracking.

[0193] In summary, after reading this detailed disclosure, those skilled in the art will understand that the foregoing detailed disclosure is presented by way of example only and is not restrictive. Although not explicitly stated herein, those skilled in the art will understand that this disclosure is intended to encompass various reasonable changes, improvements, and modifications to the embodiments. These changes, improvements, and modifications are intended to be made by this disclosure and are within the spirit and scope of the exemplary embodiments of this disclosure.

[0194] Furthermore, certain terms used in this disclosure have been used to describe embodiments of this disclosure. For example, "an embodiment," "an embodiment," and / or "some embodiments" mean that a particular feature, structure, or characteristic described in connection with that embodiment may be included in at least one embodiment of this disclosure. Therefore, it is to be emphasized and understood that two or more references to "an embodiment" or "an embodiment" or "alternative embodiment" in various parts of this disclosure do not necessarily refer to the same embodiment. Moreover, specific features, structures, or characteristics may be suitably combined in one or more embodiments of this disclosure.

[0195] It should be understood that in the foregoing description of the embodiments of this disclosure, various features are sometimes combined in a single embodiment, drawing, or description for the purpose of simplifying the disclosure and to aid in understanding a feature. Alternatively, various features may be distributed across multiple embodiments of this disclosure. However, this does not mean that the combination of these features is necessary, and those skilled in the art may extract some features as separate embodiments when reading this disclosure. That is, the embodiments in this disclosure can also be understood as an integration of multiple sub-embodiments. It is also possible for each sub-embodiment to contain fewer features than all of the features of a single foregoing disclosed embodiment.

Claims

1. A method for tracking variables in a program, comprising: Obtain the target variable located in the target code, wherein the target code includes multiple variables, and the target variable includes at least one of input parameters, member variables, static variables, and return values; Based on the target code, a set of associated variables is determined, the set of associated variables including at least one associated variable in the target code that is related to the target variable; as well as Output the set of related variables; The determination of the set of related variables includes: Each execution statement in the target code is taken as a target analysis statement, and the target analysis statement includes input state and output state; Determine the statement type of the target analysis statement, wherein the statement type includes at least one of return statement, assignment statement and function call statement; Based on the statement type, the variable transit relationship between the variables covered by the target analysis statement is determined. The variable transit relationship is used to characterize the influence relationship between the variables covered by the target analysis statement during execution. When the target analysis statement is a function call statement, it is determined whether the called function in the target analysis statement has a corresponding target analysis result. If the called function has a corresponding target analysis result, the target analysis result of the called function is obtained. If the called function does not have a corresponding target analysis result, variable tracking is first performed on the called function to determine the related variables in the called function that are related to the target variable, and the related variables in the called function that are related to the target variable are used as the target analysis result of the called function. The variable transit relationship of the target analysis statement is determined based on the target analysis result of the called function. In the input state, a first associated variable related to the target variable in the target analysis statement is determined, wherein attribute analysis is performed on the target variable to determine its variable type; when the target variable is an input parameter, the second associated variable of the upper-level execution statement adjacent to the target analysis statement is taken as the first associated variable related to the target variable in the target analysis statement; when the target variable is at least one of a return value, a static variable, and a member variable, the second associated variable of the lower-level execution statement adjacent to the target analysis statement is taken as the first associated variable related to the target variable in the target analysis statement. Based on the variable transit relationship and the first associated variable, a second associated variable related to the target variable in the target analysis statement in the output state is determined, and the second associated variable is used as the associated variable related to the target variable in the target analysis statement; The associated variables in each executed statement are merged to obtain the associated variable set.

2. The method as described in claim 1, wherein, The associated variables include at least one of the following: input parameters, local variables, member variables, and static variables.

3. The method as described in claim 1, wherein, Also includes: Output the target variable.

4. The method as described in claim 1 or 3, wherein, The output method includes visualization. The visualization includes at least one of language list display and highlighting.

5. The method of claim 1, wherein, The step of treating each executable statement in the target code as a target analysis statement includes: Arrange all executable statements contained in the target code into a target analysis queue; and One execution statement is sequentially retrieved from the head of the target analysis queue as the target analysis statement.

6. The method of claim 1, wherein, When the called function is a sink function, all tainted variables in the sink function are used as the correlation variables related to the target variable in the target analysis result of the called function.

7. The method of claim 1, wherein, The step of determining the second associated variable related to the target variable in the target analysis statement in the output state based on the variable transitivity and the first associated variable further includes: Determine the first transitive relationship between the first associated variables in the target analysis statement under the input state; and Based on the variable transitivity and the first transitivity, a second transitivity is determined between the second associated variables in the target analysis statement in the output state.

8. The method of claim 7, wherein, The step of determining the second transitive relationship between the second associated variables in the target analysis statement in the output state based on the variable transitive relationship and the first transitive relationship includes: Based on the variable type of the target variable, determine whether the second transitive relationship includes the variable transitive relationship in the target analysis statement; When the target variable is an input parameter, it is determined that the second transitive relationship does not include the variable transitive relationship in the target analysis statement; and When the target variable is at least one of a return value, a member variable, and a static variable, the second transitive relationship is determined to include the variable transitive relationship in the target analysis statement.

9. The method of claim 5, wherein, The step of using the second associated variable as an associated variable related to the target variable in the target analysis statement further includes: It was determined that the target analysis statement contained a historical second associated variable; The current second correlation variable obtained in this round of the target analysis statement is compared with the historical second correlation variable; and If the current second association variable is determined to be different from the historical second association variable, the current second association variable is used as the association variable of the target analysis statement in this round.

10. The method of claim 9, wherein, After determining that the current second association variable is different from the historical second association variable, the method further includes: Obtain the execution statements in the target code that are adjacent to the target analysis statement as associated execution statements; and The target analysis statement and the associated execution statement are added to the tail of the target analysis queue.

11. The method of claim 1, wherein, Also includes: The set of related variables is stored as the target variable in the target code as the target analysis result.

12. The method of claim 11, wherein, After obtaining the target variable located in the target code, the process also includes: Identify the code blocks contained in the target code, with each code block corresponding to a function; Create a call relationship network between the code blocks, the call relationship network reflecting the call relationships between the code blocks; All code blocks located in the call relationship network are arranged into a code block analysis queue, the code block analysis queue including a first queue and a second queue, and each element in the code block analysis queue corresponds to a code block; and One code block is taken from the head of the code block analysis queue in sequence, and the set of associated variables related to the target variable in the code block is determined.

13. The method of claim 12, wherein, The step of storing the set of related variables as the target variable in the target code is the target analysis result, including: Determine the number n of variables contained in the target code; Define an array of length n, where each element of the array corresponds to a variable in the target code; Based on the set of associated variables, the values ​​of each element in the array are determined, wherein the first value in the array indicates that the corresponding variable is related to the target variable and is alive, and the second value in the array indicates that the corresponding variable is not related to the target variable or is not alive; and The array is used as the target variable in the target code as the target analysis result.

14. The method of claim 12, wherein, The configuration method for the code block analysis queue includes: All code blocks in the call relationship network are taken as first code blocks, and the first code blocks are arranged into a first queue; and / or Extract the code block related to the sink function from the call relationship network as the second code block, and arrange the second code block into a second queue.

15. The method of claim 12, wherein, The step of determining the set of related variables in the code block that are associated with the target variable includes: The code block at the head of the code block analysis queue is used as the target code for variable tracking to obtain the set of associated variables related to the target variable in the code block; and The set of related variables is used as the current target analysis result of the code block in this round.

16. The method of claim 15, wherein, Also includes: Update the target analysis results of the target code, including: It was determined that the code block contained historical target analysis results; The current target analysis result of the code block is compared with the historical target analysis result; and If the current target analysis result of the code block is determined to be different from the historical target analysis result, the current target analysis result of the code block shall be taken as the target analysis result of the code block in this round.

17. The method of claim 16, wherein, Following the update of the target analysis results for the target code, the following is also included: Search the call relationship network for related code blocks that have a call relationship with the code block; Add the code block and the related code block to the tail of the code block analysis queue.

18. A variable tracking system in a program, comprising: At least one storage medium, including at least one instruction set, for implementation analysis of variable tracking methods in a program; as well as At least one processor is communicatively connected to the at least one storage medium. When the system is running, the at least one processor reads the at least one instruction set and executes the method of any one of claims 1-17 according to the instructions of the at least one instruction set.

Images