A vulnerability fixing method and device

Abstract

The application discloses a vulnerability repairing method and device, and relates to the technical field of network security. The method can enable a developer to understand the generation principle of a vulnerability from the code level, and to perform online repairing on the vulnerability, thereby improving the repairing efficiency of the vulnerability. The method comprises the following steps: in response to a vulnerability viewing request sent by a client and carrying a vulnerability type and a language type, selecting a first vulnerability list from a preset vulnerability list library, and feeding back the first vulnerability list to the client; in response to an online repairing request sent by the client, running a vulnerability code, repairing a vulnerability corresponding to the vulnerability type, feeding back a vulnerability code running page to the client; in response to a vulnerability prompting request sent by the client, feeding back the vulnerability code running page to the client according to a vulnerability principle, and displaying the vulnerability corresponding to the vulnerability type and the position of the vulnerability in the vulnerability code in the vulnerability code running page.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a vulnerability repair method and apparatus. Background Technology

[0002] Currently available vulnerability learning ranges are all built based on web vulnerability points. These vulnerability ranges focus on introducing the concept, principle, and testing methods of vulnerabilities.

[0003] These testing ranges focus on teaching learners how to find vulnerabilities in websites, learn security testing methods, and master testing tools. However, for some Java or Python backend developers, understanding and mastering the principles and remediation methods of vulnerabilities from the code level of mainstream web development frameworks such as Spring Boot, Django, and PHP is not feasible, and online vulnerability remediation verification is not supported. For R&D personnel, existing vulnerability remediation methods cannot determine the cause of the vulnerability, thus failing to prevent its occurrence at the source of the code. Summary of the Invention

[0004] This invention provides a vulnerability repair method and apparatus that enables developers to understand the underlying principles of vulnerabilities at the code level and to perform online repairs, thereby improving the efficiency of vulnerability repair.

[0005] This invention provides a vulnerability remediation method applied to a server, comprising:

[0006] In response to a vulnerability viewing request sent by a client, which carries the vulnerability type and language type, a first vulnerability list matching the vulnerability type and language type is selected from a preset vulnerability list library, and the first vulnerability list is fed back to the client; the first vulnerability list includes at least the vulnerability type, the language type, and a target range description, and the target range description includes the vulnerability principle and the vulnerability code;

[0007] In response to the online repair request sent by the client based on the first vulnerability list, the vulnerability code is run to repair the vulnerability corresponding to the vulnerability type, and the vulnerability code running page is returned to the client;

[0008] In response to the vulnerability alert request sent by the client based on the vulnerability code execution page, and based on the vulnerability principle, the vulnerability code execution page is fed back to the client, and the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code are displayed on the vulnerability code execution page.

[0009] Preferably, after sending the vulnerable code execution page back to the client, the method further includes:

[0010] In response to the online verification request sent by the client based on the vulnerable code execution page, the vulnerable code is executed;

[0011] The plugin corresponding to the vulnerability type and the language type is called from the vulnerability list library, and the verification code included in the plugin is run.

[0012] When the verification code matches the result of the vulnerability code, the vulnerability is determined to be fixed, and an online verification page including a "fix complete" indication is sent to the client.

[0013] Preferably, after running the verification code included in the plugin, the method further includes:

[0014] If the execution results of the verification code and the vulnerability code are inconsistent, it is determined that the vulnerability repair is unsuccessful, and the client is fed back an online verification execution page including the "repair unsuccessful" indication;

[0015] In response to the client's request for a repair tutorial sent based on the online verification running page, and based on the target range description including repair suggestions and the vulnerability principle, a vulnerability code running page is sent back to the client, and the vulnerability, the repair code for the vulnerability, and the repair result corresponding to the repair code are displayed on the vulnerability code running page.

[0016] Preferably, before selecting the first vulnerability list that matches the vulnerability type and the language type from the preset vulnerability list library, the method further includes:

[0017] In response to the newly created vulnerability range sent by the client, the vulnerability range is isolated and stored according to the range type and language type, and the range name, range type, language type and range description of the vulnerability range are added to the vulnerability list library;

[0018] The vulnerability list includes a vulnerability title, a vulnerability type, a language type, a target range description, and an operation; the target range name and the vulnerability title have the same content, and the target range type and the vulnerability type have the same content.

[0019] This invention provides a vulnerability remediation method applied to the client, comprising:

[0020] A vulnerability viewing request is sent to the server. The vulnerability remediation request carries the vulnerability type and language type. The vulnerability remediation request is used to make the server return a first vulnerability list. The first vulnerability list is stored in a vulnerability list database. The first vulnerability list is matched with the vulnerability type and the language type. The first vulnerability list includes at least the vulnerability type, the language type and the target range description. The target range description includes the vulnerability principle and the vulnerability code.

[0021] Based on the target range description included in the first vulnerability list, an online repair request is sent to the server. The online repair request is used to enable the server to run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and provide feedback on the vulnerability code execution page.

[0022] Based on the vulnerability alert request included in the vulnerability code execution page, a vulnerability alert request is sent to the server. The vulnerability alert request is used to enable the server to run the vulnerability code according to the vulnerability principle and return the vulnerability code execution page. The vulnerability code execution page displays the location of the vulnerability corresponding to the vulnerability type in the vulnerability code.

[0023] Preferably, after sending the online repair request to the server, the method further includes:

[0024] Receive the vulnerable code execution page from the server;

[0025] Based on the online verification request included in the vulnerability code execution page, an online verification request is sent to the server. The online verification request is used to enable the server to run the vulnerability code and verification code, and to provide feedback on the online verification execution page. The verification code is stored in the vulnerability list library and corresponds to the vulnerability type and the language type.

[0026] Receive the online verification running page fed back by the server;

[0027] If the online verification page includes a "Repair Complete" indication, it confirms that the verification code and the vulnerability code have the same execution result, and the vulnerability repair is complete.

[0028] Preferably, after receiving the online verification running page from the server, the method further includes:

[0029] If the online verification page includes "Repair unsuccessful" and "Repair prompt" indicators, it is confirmed that the verification code and the vulnerability code have inconsistent execution results, and the vulnerability repair is unsuccessful.

[0030] A repair tutorial request is sent to the server. The repair tutorial request is used to make the server respond with a repair prompt running page. The repair prompt running page includes the vulnerability, the location of the vulnerability in the vulnerability principle, the repair suggestions for the vulnerability, and the repair results corresponding to the repair suggestions.

[0031] This invention provides a vulnerability patching device, comprising:

[0032] The first response unit is used to respond to a vulnerability viewing request sent by the client, which carries the vulnerability type and language type, select a first vulnerability list that matches the vulnerability type and language type from a preset vulnerability list library, and return the first vulnerability list to the client; the first vulnerability list includes at least the vulnerability type, the language type, and a target range description, and the target range description includes the vulnerability principle and the vulnerability code;

[0033] The second response unit is used to respond to the online repair request sent by the client according to the first vulnerability list, run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and return the vulnerability code running page to the client;

[0034] The third response unit is used to respond to the vulnerability prompt request sent by the client based on the vulnerability code execution page, and to provide the vulnerability code execution page back to the client according to the vulnerability principle, and to display the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code on the vulnerability code execution page.

[0035] This invention provides a vulnerability patching device, comprising:

[0036] The first sending unit is used to send a vulnerability viewing request to the server. The vulnerability remediation request carries a vulnerability type and a language type. The vulnerability remediation request is used to cause the server to return a first vulnerability list. The first vulnerability list is stored in a vulnerability list database. The first vulnerability list is matched with the vulnerability type and the language type. The first vulnerability list includes at least the vulnerability type, the language type, and a target range description. The target range description includes the vulnerability principle and the vulnerability code.

[0037] The second sending unit is configured to send an online repair request to the server based on the target range description included in the first vulnerability list. The online repair request is used to enable the server to run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and provide feedback on the vulnerability code running page.

[0038] The third sending unit is used to send a vulnerability notification request to the server according to the vulnerability notification request included in the vulnerability code execution page. The vulnerability notification request is used to enable the server to run the vulnerability code according to the vulnerability principle and to return the vulnerability code execution page. The vulnerability code execution page displays the location of the vulnerability corresponding to the vulnerability type in the vulnerability code.

[0039] This invention provides an electronic device, which includes a processor and a memory; the memory stores computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the electronic device performs the aforementioned vulnerability remediation method.

[0040] This invention provides a computer-readable storage medium including computer instructions that, when executed on a computer device, cause the computer device to perform the aforementioned vulnerability remediation method.

[0041] This invention provides a vulnerability remediation method and apparatus, comprising: responding to a vulnerability viewing request sent by a client carrying a vulnerability type and a language type, selecting a first vulnerability list matching the vulnerability type and the language type from a preset vulnerability list library, and feeding back the first vulnerability list to the client; the first vulnerability list includes at least the vulnerability type, the language type, and a target range description, the target range description including the vulnerability principle and the vulnerability code; responding to an online remediation request sent by the client based on the first vulnerability list, running the vulnerability code to remediate the vulnerability corresponding to the vulnerability type, and feeding back a vulnerability code execution page to the client; responding to a vulnerability notification request sent by the client based on the vulnerability code execution page, feeding back a vulnerability code execution page to the client based on the vulnerability principle, and displaying the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code on the vulnerability code execution page. Compared to existing technologies that fix discovered vulnerabilities but cannot teach users how to fix them at the code level, this method provides vulnerability fixation methods and constructs different vulnerability lists based on different languages ​​and vulnerabilities. Based on the constructed vulnerability lists, users can understand the cause of the vulnerability at the code level, determine the location of the vulnerability, and realize online vulnerability fixation, thereby improving the efficiency of vulnerability fixation. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is one of the structural schematic diagrams of the vulnerability repair device provided in the embodiments of the present invention;

[0044] Figure 2 This is a schematic diagram of the system architecture applicable to embodiments of the present invention;

[0045] Figure 3 This is a schematic diagram of the server-side vulnerability repair method provided in an embodiment of the present invention;

[0046] Figure 4 A schematic diagram of the client-side vulnerability repair method provided in this embodiment of the invention.

[0047] Figure 5 This is a schematic diagram of the server structure of a vulnerability repair device provided in an embodiment of the present invention;

[0048] Figure 6 This is a schematic diagram of a client structure for a vulnerability repair device provided in an embodiment of the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of embodiments of this disclosure, unless otherwise stated, "a plurality of" means two or more. Furthermore, the use of "based on" or "according to" implies openness and inclusiveness, because processes, steps, calculations, or other actions "based on" or "according to" one or more of the stated conditions or values ​​may in practice be based on additional conditions or beyond the stated values.

[0051] To address the limitations of existing vulnerability remediation methods, which fail to teach users how to fix vulnerabilities at the code level and lack support for online remediation and vulnerability location identification, this invention provides a vulnerability remediation method and apparatus. This method teaches users to perform online vulnerability remediation at the code level and alerts them to the vulnerability's location, thereby improving remediation efficiency.

[0052] Figure 1 An exemplary schematic diagram of one of the vulnerability repair devices provided in an embodiment of the present invention is shown, such as... Figure 1 As shown, the vulnerability repair device may include: a processor 11, a memory 12, a communication interface 13, and a bus 14. The processor 11, the memory 12, and the communication interface 13 can be connected via the communication bus 14.

[0053] Processor 11 is the control center of the vulnerability remediation device. It can be a single processor 11 or a collective term for multiple processing elements. For example, processor 11 can be a general-purpose central processing unit (CPU) or other general-purpose processors 11. Among them, the general-purpose processor 11 can be a microprocessor 11 or any conventional processor 11.

[0054] As one embodiment, processor 11 may include one or more CPUs, for example, Figure 1 CPU0 and CPU1 are shown.

[0055] The memory 12 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0056] In one possible implementation, the memory 12 can exist independently of the processor 11. The memory 12 can be connected to the processor 11 via a bus 14 and is used to store instructions or program code. When the processor 11 calls and executes the instructions or program code stored in the memory 12, it can implement the threat tree construction method provided in the following embodiments of the present invention.

[0057] In another possible implementation, the memory 12 can also be integrated with the processor 11.

[0058] Communication interface 13 is used for the threat tree construction device to connect with other devices via a communication network, which may be Ethernet, radio access network (RAN), wireless local area network (WLAN), etc. Communication interface 13 may include a receiving unit for receiving data and a sending unit for sending data.

[0059] Bus 14 can be an Industry Standard Architecture (ISA) bus 14, a Peripheral Component Interconnect (PCI) bus 14, or an Extended Industry Standard Architecture (EISA) bus 14, etc. This bus 14 can be divided into an address bus 14, a data bus 14, a control bus 14, etc. For ease of representation, Figure 1 The bus 14 is represented by a single thick line, but this does not mean that there is only one bus 14 or only one type of bus 14.

[0060] It should be pointed out that, Figure 1 The structure shown does not constitute a limitation on the vulnerability remediation device, except Figure 1 In addition to the components shown, the vulnerability repair device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0061] The vulnerability remediation method provided in this embodiment of the invention uses a vulnerability remediation device as its execution entity. This device can be a terminal device, the CPU within the terminal device, a control module for vulnerability remediation within the terminal device, or a client for vulnerability remediation within the terminal device. This embodiment of the invention uses the execution of the vulnerability remediation method on a terminal device as an example to illustrate the vulnerability remediation provided by this invention.

[0062] Figure 2 An exemplary system architecture diagram applicable to embodiments of the present invention is shown, such as... Figure 2 As shown, the system includes a server 20 and clients (30a, 30b). The server 20 and the clients (30a, 30b) can exchange information via wireless or wired communication.

[0063] For example, server 20 can access the network via cellular mobile communication technology to communicate with display devices (30a, 30b), such as 5th generation mobile network (5G) technology.

[0064] This invention does not limit the number of servers and other devices mentioned above. Figure 1 This description uses only one server as an example.

[0065] Server 101 is used to respond to vulnerability viewing requests sent by clients, carrying vulnerability types and language types. It selects a first vulnerability list from a preset vulnerability list library that matches the vulnerability type and language type, and sends the first vulnerability list back to the client. The first vulnerability list includes at least the vulnerability type, the language type, and a target range description, where the target range description includes the vulnerability principle and vulnerability code. In response to online repair requests sent by clients based on the first vulnerability list, it runs the vulnerability code to repair the vulnerability corresponding to the vulnerability type and sends a vulnerability code execution page back to the client. In response to vulnerability alert requests sent by clients based on the vulnerability code execution page, it sends a vulnerability code execution page back to the client based on the vulnerability principle, and displays the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code on the vulnerability code execution page.

[0066] A client (30a, 30b) is a device that can provide voice and / or data connectivity to a user, including handheld terminal devices with wireless connectivity, vehicle-mounted terminal devices, etc.

[0067] For example, terminal devices can be: mobile phones, tablets, laptops, handheld computers, mobile internet devices (MID), wearable devices, virtual reality (VR) devices, augmented reality (AR) devices, wireless terminal devices in industrial control, wireless terminal devices in autonomous driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.

[0068] Furthermore, based on the above system architecture, this embodiment of the invention provides a schematic diagram of the server-side repair method in a vulnerability repair method, see [link to relevant documentation]. Figure 3 As shown, the main steps include:

[0069] Step 101: In response to a vulnerability viewing request sent by the client, which carries the vulnerability type and language type, select a first vulnerability list that matches the vulnerability type and language type from a preset vulnerability list library, and send the first vulnerability list back to the client; the first vulnerability list includes at least the vulnerability type, the language type, and a target range description, and the target range description includes the vulnerability principle and the vulnerability code;

[0070] Step 102: In response to the online repair request sent by the client based on the first vulnerability list, run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and send the vulnerability code running page back to the client;

[0071] Step 103: In response to the vulnerability alert request sent by the client based on the vulnerability code execution page, based on the vulnerability principle, the vulnerability code execution page is fed back to the client, and the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code are displayed on the vulnerability code execution page.

[0072] Specifically, before executing step 101, the server stores the vulnerability range and establishes a vulnerability list database.

[0073] For example, on the new vulnerability range page provided by the client, the user sequentially enters the range name, range type, language, and range description, and selects the "Submit" command from the "Submit" and "Cancel" options displayed on the new vulnerability range page. Through this method, the user completes the creation of a vulnerability range via the client's new vulnerability range page. Simultaneously, the server receives the new vulnerability range request sent by the client and, based on the range name, range type, language, and range description information carried in the request, uses Docker container isolation technology to isolate and store each received vulnerability range.

[0074] In practical applications, users can name newly created vulnerability ranges according to the naming rules of existing vulnerability ranges. The choice of range name is related to user habits, and no restrictions are placed on its selection. Since there are many types of vulnerabilities in existing technologies, the range types are named using existing vulnerability types. Users can select the vulnerability types included in the newly created range from multiple vulnerability types via a drop-down menu. Furthermore, the language options include Java, Python, and PHP, so users can choose any one of these languages ​​from the drop-down menu to work with the selected vulnerability types.

[0075] Furthermore, since the target type in the newly created vulnerability range page may include multiple options, and the language type may also include three options, when the server uses Docker container isolation technology to isolate and store each vulnerability range, one vulnerability range will correspond to three language types. Therefore, the vulnerability types included in one vulnerability range will also form separate containers in the three different environments of Java, PHP, and Python, providing vulnerability environment services to the outside world.

[0076] In this embodiment of the invention, the server utilizes Docker container isolation technology to isolate each vulnerability range, storing them sequentially in designated locations. The storage information of each vulnerability range, along with its included information, is stored in a vulnerability list database. It should be noted that the vulnerability list database records the storage location information and included information for each vulnerability range. For example, the header of the vulnerability list database includes vulnerability title, vulnerability type, language type, range description, and storage address. In practical applications, the information carried in the client's request to create a new vulnerability range sent to the server includes: range name, range type, language type, and range description. The vulnerability list database header includes information such as vulnerability title, vulnerability type, language type, target range description, storage address, runtime status, and operation. Therefore, when storing information from vulnerability targets into the vulnerability list database, the target range type information needs to be written under the vulnerability type in the database; the target range name needs to be written under the vulnerability title; and the language type needs to be written under the language type. Because the information from the vulnerability targets does not include storage address, runtime status, and operation information, the server will write these details into the vulnerability list database based on the actual situation. Based on this, it can be determined that the target range name and the vulnerability title in the vulnerability list database are consistent, and the target range type and the vulnerability type in the vulnerability list database are consistent.

[0077] In this embodiment of the invention, the vulnerability types mainly include any one of the following: SQL injection, cross-site scripting (XSS), cross-site request forgery (CRSF), command execution, file upload, arbitrary file download, brute force attack, privilege escalation, information disclosure, account enumeration, XML external entity injection (XXE), server-side request forgery (SSRF), SMS-related vulnerabilities, etc.

[0078] In practical applications, users can create vulnerability testing environments through the client, and can also start, stop, restart, modify, and delete vulnerability testing environments stored in the vulnerability list database. For example, once a vulnerability testing environment is enabled, users can view information related to the vulnerabilities corresponding to that environment, such as vulnerability descriptions, vulnerability principles, vulnerability consequences, testing methods, and vulnerability remediation strategies. It should be noted that when viewing a vulnerability testing environment, users can only view all information for a single vulnerability testing environment, not all information for multiple vulnerability testing environments simultaneously; when modifying a vulnerability testing environment, users can only maintain and update the information included in already created vulnerability testing environments; and when deleting a vulnerability testing environment, users can only delete vulnerability testing environments that have already been created.

[0079] In step 101, the user sends a vulnerability viewing request carrying the vulnerability type and language type to the server through the client. Because the server stores the vulnerability types included in each vulnerability range and the corresponding language types in isolation, the server needs to select the first vulnerability list that matches the vulnerability type and language type from the vulnerability list library based on the vulnerability type and language type, and then feed back the found first vulnerability list to the client so that the user can make a selection based on the content displayed in the first vulnerability list on the client.

[0080] It should be noted that the first vulnerability list mentioned here is a vulnerability list selected from the vulnerability list library that corresponds to the vulnerability viewing request sent by the client. In this embodiment of the invention, in order to avoid confusion between this vulnerability list and other vulnerability lists included in the vulnerability list library, the vulnerability list corresponding to the vulnerability viewing request sent by the client is referred to as the first vulnerability list.

[0081] Furthermore, the first vulnerability list provided in this embodiment of the invention includes a vulnerability type, a language type, and a target range description in its header. In this embodiment of the invention, the target range description includes detailed information about the vulnerability, such as the target range type, vulnerability description, vulnerability principle, testing method, remediation suggestions, language type, and vulnerability code.

[0082] In practical applications, after the server sends the first vulnerability list to the client, the client displays the first vulnerability list. Simultaneously, the first vulnerability list also provides control keys or other operation instructions for triggering a request. In this embodiment of the invention, the specific form of the control keys or other operation instructions provided to the user by the first vulnerability list for triggering a request is not limited.

[0083] In step 102, the client displays a first vulnerability list, which includes operation information and has four options: Enable, Stop, Delete, and Restart. In this embodiment of the invention, Enable, Stop, Delete, and Restart are control keys provided by the first vulnerability list to the user for triggering requests. That is, after the user selects any one of the four options and clicks it, a request corresponding to that option will be sent to the server.

[0084] For example, when a user clicks the control key, the server sends a vulnerability description page to the client. This page includes not only the vulnerability details but also the control key provided to the user to trigger the request. The vulnerability details include: vulnerability title, vulnerability type, vulnerability description, vulnerability principle, vulnerability impact, testing method, remediation suggestions, language type, and vulnerability code.

[0085] In this embodiment of the invention, the control key provided to the user by the target range description running page for triggering the request is an online repair request. After the user triggers the online repair request, the server selects the vulnerability code to run from the target range description according to the received online repair request, and completes the repair of the vulnerability by running the vulnerability code. The vulnerability here corresponds to the vulnerability type carried in the viewing request.

[0086] It should be noted that because the vulnerability types included in a vulnerability range can combine with the three language types of Java, PHP, and Python to form different vulnerability environments, the vulnerability code called through the above-mentioned target range description not only matches the vulnerability type, but also necessarily matches one of the three language types.

[0087] In practical applications, when the server runs the vulnerable code and fixes the vulnerability corresponding to the vulnerability type, it will also send a page showing the execution of the vulnerable code to the client.

[0088] In step 103, when the client displays the vulnerability code execution page fed back by the server, the vulnerability code execution page not only displays the execution status of the vulnerability code, but also displays the control keys provided to the user for triggering requests.

[0089] In this embodiment of the invention, the control keys provided to the user by the vulnerable code execution page for triggering requests include online verification requests and vulnerability notification requests.

[0090] When a user clicks the vulnerability notification request control button, the client sends a vulnerability notification request to the server. After receiving the vulnerability notification request, the server calls the vulnerability principle and vulnerability code through the target range description, runs the vulnerability code, and displays the location of the vulnerability on the vulnerability code according to the vulnerability principle. The vulnerability here corresponds to the vulnerability type carried in the viewing request.

[0091] In practical applications, when the server runs the vulnerable code, it will also display the location of the vulnerability on the vulnerability code execution page according to the vulnerability principle; correspondingly, the server will also send the vulnerability code execution page back to the client and display the location of the vulnerability on the vulnerability code execution page.

[0092] The vulnerability remediation method provided in this invention, compared to existing technologies that address discovered vulnerabilities but fail to teach users how to remediate them at the code level, not only provides a vulnerability remediation method but also constructs different vulnerability lists based on different languages ​​and vulnerability structures. These constructed vulnerability lists enable users to understand the underlying principles of vulnerabilities at the code level, pinpoint their locations, and achieve online remediation, thereby improving the efficiency of vulnerability remediation.

[0093] For example, when a user clicks the online verification request control button, the client sends an online verification request to the server. After receiving the online verification request, the server calls the vulnerable code and the verification code that matches the vulnerable code according to the target range description. The server runs the vulnerable code and the verification code at the same time. If the running results of the verification code and the vulnerable code are consistent, it can be determined that the vulnerability has been fixed. If the running results of the verification code and the vulnerable code are inconsistent, it can be determined that the vulnerability has not been fixed.

[0094] In this embodiment, the information included in the verification code is also stored in the vulnerability list library. The verification code includes at least the vulnerability type and language type that are consistent with the vulnerability type and language type included in the first vulnerability list. In order to manage the verification code in a unified manner, the verification code can be referred to as a plugin and stored in a set location.

[0095] Specifically, if the server-side execution results of the verification code and the vulnerability code are consistent, the vulnerability is considered to be fixed. At the same time, the client not only displays the online verification execution page for the verification code and the vulnerability code, but also displays a fix completion control button on the online verification execution page. This fix completion control button is used to trigger the end request to the user.

[0096] If the server-side execution results of the verification code and the vulnerability code are inconsistent, it is determined that the vulnerability fix was unsuccessful. At the same time, the client not only displays the online verification and execution pages for the verification code and the vulnerability code, but also displays a fix reminder control button on the online verification and execution page. This fix reminder control button is used to provide the user with a request to trigger the fix tutorial.

[0097] It should be noted that in practical applications, for a single vulnerability, the target range description may provide multiple remediation tutorials. Therefore, users can also select one of the multiple remediation prompt control keys displayed on the online verification run page to send a remediation tutorial request to the server.

[0098] Furthermore, when a user selects to click on the repair reminder on the online verification run page, the client sends a repair tutorial request to the server. After receiving the repair tutorial request, the server calls the vulnerability principle, vulnerability code, and repair suggestions through the target range description, and sends the vulnerability code run page back to the client. At the same time, the vulnerability code run page displays the vulnerability, the corresponding repair code, and the repair result corresponding to the repair code.

[0099] It should be noted that in practical applications, since the target range description may provide multiple remediation tutorials, if a user is dissatisfied with the vulnerability remediation feedback obtained from the vulnerability code run page (which includes remediation code) provided by the server, the user can return to the previous level and select another remediation prompt control button from the multiple remediation prompt control buttons displayed on the online verification run page. The specific method for returning to the previous level is not limited here.

[0100] Based on the same inventive concept, this invention also provides a schematic flowchart of a vulnerability remediation method on the client side. Figure 4 As shown, the main steps include:

[0101] Step 201: Send a vulnerability viewing request to the server. The vulnerability remediation request carries the vulnerability type and language type. The vulnerability remediation request is used to make the server return a first vulnerability list. The first vulnerability list is stored in a vulnerability list database. The first vulnerability list matches the vulnerability type and the language type. The first vulnerability list includes at least the vulnerability type, the language type, and the target range description. The target range description includes the vulnerability principle and the vulnerability code.

[0102] Step 202: Based on the target range description included in the first vulnerability list, send an online repair request to the server. The online repair request is used to enable the server to run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and provide feedback on the vulnerability code execution page.

[0103] Step 203: Based on the vulnerability alert request included in the vulnerability code execution page, send a vulnerability alert request to the server. The vulnerability alert request is used to enable the server to run the vulnerability code according to the vulnerability principle and return the vulnerability code execution page. The vulnerability code execution page displays the location of the vulnerability corresponding to the vulnerability type in the vulnerability code.

[0104] In the above embodiments, the process of establishing the vulnerability range and storing the information of the vulnerability range in the vulnerability list library has been described, and will not be repeated here.

[0105] In step 201, the server has stored the newly created vulnerability range and established a vulnerability list library. When a user wants to fix a vulnerability, they need to send a vulnerability viewing request to the server. The user sends the vulnerability viewing request, carrying the vulnerability type and language type, to the server through the client. After the vulnerability viewing request is sent to the server, the server will return a first vulnerability list to the client. The first vulnerability list is stored in the vulnerability list, and the vulnerability type and language type included in the first vulnerability list match the vulnerability type and language type carried in the vulnerability query request.

[0106] Furthermore, the header of the first vulnerability list includes vulnerability type, language type, and target range description. In this embodiment of the invention, the target range description includes detailed information about the vulnerability, such as target range type, vulnerability description, vulnerability principle, testing method, remediation suggestions, language type, and vulnerability code.

[0107] Furthermore, while the client displays the first list of vulnerabilities reported by the server, it also displays control keys provided to the user to trigger requests. These control keys correspond to four options: enable, stop, delete, and restart. That is, the user can send a request to the server using any of these control keys.

[0108] In this embodiment of the invention, when the user clicks the control key, the server will send a target range description page to the client. The target range description page includes not only details about the target range, such as the target range title, target range type, vulnerability description, vulnerability principle, vulnerability hazard, testing method, remediation suggestions, language type, and vulnerability code, but also a control key provided to the user to trigger the request.

[0109] In step 202, the control key provided to the user by the target range description running page for triggering the request is the online repair request. When the user triggers the online repair request, the online repair request is sent to the server. The server calls the vulnerability code from the target range description and completes the repair of the vulnerability by running the vulnerability code. The vulnerability here corresponds to the vulnerability type carried in the viewing request.

[0110] It should be noted that when the server runs the vulnerable code and fixes the vulnerability corresponding to the vulnerability type, it will also send a page showing the execution of the vulnerable code to the client.

[0111] In practical applications, when the client displays the vulnerability code execution page fed back by the server, the vulnerability code execution page not only displays the execution status of the vulnerability code, but also displays two control buttons: online verification and vulnerability prompt. That is, the user can choose to send a request to the server through either of the above control buttons.

[0112] In step 203, when the user clicks the vulnerability notification request control button, the client sends a vulnerability notification request to the server. Upon receiving the request, the server invokes the vulnerability principle and vulnerable code based on the target environment description. While controlling the execution of the vulnerable code, the server also displays the location of the vulnerability on the vulnerable code according to the vulnerability principle. Correspondingly, the server also sends a vulnerability code execution page back to the client, displaying the vulnerability's location on that page. It should be noted that the vulnerability here corresponds to the vulnerability type carried in the viewing request.

[0113] For example, users can also choose to click the online verification request control button. That is, the user sends an online verification request to the server through the client. After receiving the online verification request, the server calls the vulnerability code and the verification code that matches the vulnerability code according to the target range description. The vulnerability code and the verification code are run at the same time. If the running results of the verification code and the vulnerability code are consistent, it can be determined that the vulnerability is fixed. If the running results of the verification code and the vulnerability code are inconsistent, it can be determined that the vulnerability is not fixed.

[0114] In this embodiment, the information included in the verification code is also stored in the vulnerability list library. The verification code includes at least the vulnerability type and language type consistent with those included in the first vulnerability list. For unified management of the verification code, it can be referred to as a plugin and stored in a designated location. Specifically, if the server-side execution results of the verification code and the vulnerability code are consistent, the client will not only display the online verification execution page for both the verification code and the vulnerability code, but will also display a "Repair Complete" control button on the online verification execution page. This "Repair Complete" control button is used to trigger an end request to the user.

[0115] If the results of the verification code and the vulnerability code running on the server are inconsistent, the client will not only display the online verification and running pages for the verification code and the vulnerability code, but also display a repair reminder control button. This repair reminder control button is used to provide the user with a request to trigger the repair tutorial.

[0116] It should be noted that in practical applications, for a single vulnerability, the target range description may provide multiple remediation tutorials. Therefore, users can also select one of the multiple remediation prompt control keys displayed on the online verification run page to send a remediation tutorial request to the server.

[0117] Furthermore, when a user selects to click on the repair reminder on the online verification run page, the client sends a repair tutorial request to the server. After receiving the repair tutorial request, the server calls the vulnerability principle, vulnerability code, and repair suggestions through the target range description, and sends the vulnerability code run page back to the client. At the same time, the vulnerability code run page displays the vulnerability, the corresponding repair code, and the repair result corresponding to the repair code.

[0118] It should be noted that in practical applications, since the target range description may provide multiple remediation tutorials, if a user is dissatisfied with the vulnerability remediation feedback obtained from the vulnerability code run page (which includes remediation code) provided by the server, the user can return to the previous level and select another remediation prompt control button from the multiple remediation prompt control buttons displayed on the online verification run page. The specific method for returning to the previous level is not limited here.

[0119] Based on the same inventive concept, this invention provides a schematic diagram of the server-side structure of a vulnerability repair device. Since the principle by which this device solves the technical problem is similar to that of the server-side vulnerability repair method, the implementation of this device can refer to the implementation of the method, and repeated details will not be repeated.

[0120] See Figure 5 The device includes a first response unit 301, a second response unit 302, and a third response unit 303.

[0121] The first response unit 301 is used to respond to a vulnerability viewing request sent by the client, which carries the vulnerability type and language type, select a first vulnerability list that matches the vulnerability type and language type from a preset vulnerability list library, and feed back the first vulnerability list to the client; the first vulnerability list includes at least the vulnerability type, the language type and the target range description, and the target range description includes the vulnerability principle and the vulnerability code;

[0122] The second response unit 302 is used to respond to the online repair request sent by the client according to the first vulnerability list, run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and send the vulnerability code running page back to the client;

[0123] The third response unit 303 is used to respond to the vulnerability prompt request sent by the client based on the vulnerability code execution page, and to provide the vulnerability code execution page to the client based on the vulnerability principle, and to display the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code on the vulnerability code execution page.

[0124] Preferably, the second response unit 302 is further configured to:

[0125] In response to the online verification request sent by the client based on the vulnerable code execution page, the vulnerable code is executed;

[0126] The plugin corresponding to the vulnerability type and the language type is called from the vulnerability list library, and the verification code included in the plugin is run.

[0127] When the verification code matches the result of the vulnerability code, the vulnerability is determined to be fixed, and an online verification page including a "fix complete" indication is sent to the client.

[0128] Preferably, the second response unit 302 is further configured to:

[0129] If the execution results of the verification code and the vulnerability code are inconsistent, it is determined that the vulnerability repair is unsuccessful, and the client is fed back an online verification execution page including the "repair unsuccessful" indication;

[0130] In response to the client's request for a repair tutorial sent based on the online verification running page, and based on the target range description including repair suggestions and the vulnerability principle, a vulnerability code running page is sent back to the client, and the vulnerability, the repair code for the vulnerability, and the repair result corresponding to the repair code are displayed on the vulnerability code running page.

[0131] Preferably, the first response unit 301 is further configured to:

[0132] A first target range is established, including the target range name, target range type, language type, and target range description. The first target range is stored in the vulnerability list library and added to the vulnerability list.

[0133] The vulnerability list database isolates and stores the first target range stored in the vulnerability list database according to the target range type and the language type;

[0134] The vulnerability list includes a vulnerability title, a vulnerability type, a language type, a target range description, and an operation; the target range name and the vulnerability title have the same content, and the target range type and the vulnerability type have the same content.

[0135] Based on the same inventive concept, this invention provides a schematic diagram of the client structure of a vulnerability repair device. Since the principle by which this device solves the technical problem is similar to the vulnerability repair method on the client side, the implementation of this device can refer to the implementation of the method, and the repeated parts will not be described again.

[0136] See Figure 6 The device includes: a first transmitting unit 401, a second transmitting unit 402 and a third transmitting unit 403.

[0137] The first sending unit 401 is used to send a vulnerability viewing request to the server. The vulnerability remediation request carries a vulnerability type and a language type. The vulnerability remediation request is used to make the server return a first vulnerability list. The first vulnerability list is stored in a vulnerability list database. The first vulnerability list is matched with the vulnerability type and the language type. The first vulnerability list includes at least the vulnerability type, the language type, and a target range description. The target range description includes the vulnerability principle and the vulnerability code.

[0138] The second sending unit 402 is used to send an online repair request to the server according to the target range description included in the first vulnerability list. The online repair request is used to enable the server to run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and provide feedback on the vulnerability code running page.

[0139] The third sending unit 403 is used to send a vulnerability notification request to the server according to the vulnerability notification request included in the vulnerability code execution page. The vulnerability notification request is used to enable the server to run the vulnerability code according to the vulnerability principle and to return the vulnerability code execution page. The vulnerability code execution page displays the location of the vulnerability corresponding to the vulnerability type in the vulnerability code.

[0140] Preferably, the second transmitting unit 402 is further configured to:

[0141] Receive the vulnerable code execution page from the server;

[0142] Based on the online verification request included in the vulnerability code execution page, an online verification request is sent to the server. The online verification request is used to enable the server to run the vulnerability code and verification code, and to provide feedback on the online verification execution page. The verification code is stored in the vulnerability list library and corresponds to the vulnerability type and the language type.

[0143] Receive the online verification running page fed back by the server;

[0144] If the online verification page includes a "Repair Complete" indication, it confirms that the verification code and the vulnerability code have the same execution result, and the vulnerability repair is complete.

[0145] Preferably, the second transmitting unit 402 is further configured to:

[0146] If the online verification page includes "Repair unsuccessful" and "Repair prompt" indicators, it is confirmed that the verification code and the vulnerability code have inconsistent execution results, and the vulnerability repair is unsuccessful.

[0147] A repair tutorial request is sent to the server. The repair tutorial request is used to make the server respond with a repair prompt running page. The repair prompt running page includes the vulnerability, the location of the vulnerability in the vulnerability principle, the repair suggestions for the vulnerability, and the repair results corresponding to the repair suggestions.

[0148] It should be understood that the units included in the above-described vulnerability repair device are merely a logical division based on the functions implemented by the device. In practical applications, the units can be superimposed or split. Furthermore, the functions implemented by the vulnerability repair device provided in this embodiment correspond one-to-one with the vulnerability repair methods provided in the above embodiments. The more detailed processing flow implemented by the device has been described in detail in the first embodiment of the method described above, and will not be described in detail here.

[0149] Another embodiment of the present invention provides an electronic device, which includes a processor and a memory; the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the electronic device executes each step of the vulnerability repair method in the method flow shown in the above method embodiment.

[0150] Another embodiment of the present invention provides a computer-readable storage medium storing computer instructions that, when executed on a computer device, cause the computer device to perform each step of the vulnerability repair method in the method flow shown in the above method embodiment.

[0151] Another embodiment of the present invention provides a chip system applied to a vulnerability patching device. The chip system includes one or more interface circuits and one or more processors 11. The interface circuits and processors 11 are interconnected via lines. The interface circuits are used to receive signals from a memory 12 of the vulnerability patching device and send the signals to the processors 11, the signals including computer instructions stored in the memory 12. When the processors 11 execute the computer instructions, the vulnerability patching device performs the method flow shown in the above method embodiment, including the various steps performed by the vulnerability patching device.

[0152] In another embodiment of the present invention, a computer program product is also provided, the computer program product including instructions, which, when run on a vulnerability repair device, cause the vulnerability repair device to execute the method flow shown in the above method embodiment, and the various steps executed by the vulnerability repair device.

[0153] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer instructions. When these computer instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0154] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions within the technical scope disclosed in the present invention should be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A vulnerability remediation method, characterized in that, Applied to the server side, including: In response to a vulnerability viewing request sent by a client, which carries the vulnerability type and language type, a first vulnerability list matching the vulnerability type and language type is selected from a preset vulnerability list library, and the first vulnerability list is fed back to the client; the first vulnerability list includes at least the vulnerability type, the language type, and a target range description, and the target range description includes the vulnerability principle and the vulnerability code; In response to the online repair request sent by the client based on the first vulnerability list, the vulnerability code is run to repair the vulnerability corresponding to the vulnerability type, and the vulnerability code running page is returned to the client; In response to the vulnerability alert request sent by the client based on the vulnerability code execution page, and based on the vulnerability principle, the vulnerability code execution page is fed back to the client, and the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code are displayed on the vulnerability code execution page.

2. The vulnerability remediation method as described in claim 1, characterized in that, After sending the vulnerable code execution page back to the client, the process also includes: In response to the online verification request sent by the client based on the vulnerable code execution page, the vulnerable code is executed; The plugin corresponding to the vulnerability type and the language type is called from the vulnerability list library, and the verification code included in the plugin is run. When the verification code matches the result of the vulnerability code, the vulnerability is determined to be fixed, and an online verification page including a fix completion indication is sent to the client.

3. The vulnerability remediation method as described in claim 2, characterized in that, After running the verification code included in the plugin, the process also includes: If the execution results of the verification code and the vulnerability code are inconsistent, it is determined that the vulnerability repair is unsuccessful, and an online verification execution page including an indication that the repair was unsuccessful is sent back to the client; In response to the client's request for a repair tutorial sent based on the online verification running page, and based on the target range description including repair suggestions and the vulnerability principle, a vulnerability code running page is sent back to the client, and the vulnerability, the repair code for the vulnerability, and the repair result corresponding to the repair code are displayed on the vulnerability code running page.

4. The vulnerability remediation method as described in claim 1, characterized in that, Before selecting the first vulnerability list that matches the vulnerability type and the language type from the preset vulnerability list library, the method further includes: In response to the newly created vulnerability range sent by the client, the vulnerability range is isolated and stored according to the range type and language type, and the range name, range type, language type and range description of the vulnerability range are added to the vulnerability list library; The vulnerability list includes a vulnerability title, a vulnerability type, a language type, a target range description, and an operation; the target range name and the vulnerability title have the same content, and the target range type and the vulnerability type have the same content.

5. A vulnerability remediation method, characterized in that, Applied to the client side, including: A vulnerability viewing request is sent to the server. The vulnerability remediation request carries the vulnerability type and language type. The vulnerability remediation request is used to make the server return a first vulnerability list. The first vulnerability list is stored in a vulnerability list database. The first vulnerability list is matched with the vulnerability type and the language type. The first vulnerability list includes at least the vulnerability type, the language type and the target range description. The target range description includes the vulnerability principle and the vulnerability code. Based on the target range description included in the first vulnerability list, an online repair request is sent to the server. The online repair request is used to enable the server to run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and provide feedback on the vulnerability code execution page. Based on the vulnerability alert request included in the vulnerability code execution page, a vulnerability alert request is sent to the server. The vulnerability alert request is used to enable the server to run the vulnerability code according to the vulnerability principle and return the vulnerability code execution page. The vulnerability code execution page displays the location of the vulnerability corresponding to the vulnerability type in the vulnerability code.

6. The vulnerability remediation method as described in claim 5, characterized in that, After sending the online repair request to the server, the process also includes: Receive the vulnerable code execution page from the server; Based on the online verification request included in the vulnerability code execution page, an online verification request is sent to the server. The online verification request is used to enable the server to run the vulnerability code and verification code, and to provide feedback on the online verification execution page. The verification code is stored in the vulnerability list library and corresponds to the vulnerability type and the language type. Receive the online verification running page fed back by the server; If the online verification page includes a repair completion indication, it confirms that the verification code and the vulnerability code have the same execution result, and the vulnerability repair is complete.

7. The vulnerability remediation method as described in claim 6, characterized in that, After receiving the online verification running page from the server, the process further includes: If the online verification page includes a repair failure message and a repair prompt, it is confirmed that the verification code and the vulnerability code have inconsistent execution results, and the vulnerability repair is unsuccessful. A repair tutorial request is sent to the server. The repair tutorial request is used to make the server respond with a repair prompt running page. The repair prompt running page includes the vulnerability, the location of the vulnerability in the vulnerability principle, the repair suggestions for the vulnerability, and the repair results corresponding to the repair suggestions.

8. A vulnerability repair device, characterized in that, include: The first response unit is used to respond to a vulnerability viewing request sent by the client, which carries the vulnerability type and language type, select a first vulnerability list that matches the vulnerability type and language type from a preset vulnerability list library, and return the first vulnerability list to the client; the first vulnerability list includes at least the vulnerability type, the language type, and a target range description, and the target range description includes the vulnerability principle and the vulnerability code; The second response unit is used to respond to the online repair request sent by the client according to the first vulnerability list, run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and return the vulnerability code running page to the client; The third response unit is used to respond to the vulnerability prompt request sent by the client based on the vulnerability code execution page, and to provide the vulnerability code execution page back to the client according to the vulnerability principle, and to display the vulnerability corresponding to the vulnerability type and the location of the vulnerability in the vulnerability code on the vulnerability code execution page.

9. A vulnerability repair device, characterized in that, include: The first sending unit is used to send a vulnerability viewing request to the server. The vulnerability remediation request carries a vulnerability type and a language type. The vulnerability remediation request is used to cause the server to return a first vulnerability list. The first vulnerability list is stored in a vulnerability list database. The first vulnerability list is matched with the vulnerability type and the language type. The first vulnerability list includes at least the vulnerability type, the language type, and a target range description. The target range description includes the vulnerability principle and the vulnerability code. The second sending unit is configured to send an online repair request to the server based on the target range description included in the first vulnerability list. The online repair request is used to cause the server to run the vulnerability code, repair the vulnerability corresponding to the vulnerability type, and provide feedback on the vulnerability code execution page. The third sending unit is used to send a vulnerability notification request to the server according to the vulnerability notification request included in the vulnerability code execution page. The vulnerability notification request is used to enable the server to run the vulnerability code according to the vulnerability principle and to return the vulnerability code execution page. The vulnerability code execution page displays the location of the vulnerability corresponding to the vulnerability type in the vulnerability code.

10. An electronic device, characterized in that, The electronic device includes a processor and a memory; the memory is used to store computer program code, the computer program code including computer instructions; when the processor executes the computer instructions, the electronic device performs the vulnerability repair method as described in any one of claims 1 to 4.

Images