Data permission detection method, device and equipment and readable storage medium

Abstract

The application discloses a data authority detection method and device, equipment and a readable storage medium. Wherein, the target database script file of the source code is obtained, the target database script file is analyzed, it is determined whether the target operation statement corresponding to the target operation exists in the target database script file, if it exists, the target operation statement is extracted, the target content statement associated with the target operation statement is obtained, if the target content statement includes the table creation statement, it is determined whether the target content statement includes the assignment statement, if the target content statement does not include the assignment statement, it is determined that the target database script file corresponding to the target content statement does not give the read-write authority to the user, so as to reduce the manual participation to realize the accurate finding of the read-write authority not given, and the automation finding maximally improves the detection efficiency, avoids the serious program error caused by the detection omission after the product is put into operation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data detection, and in particular to a data permission detection method, device and equipment and a readable storage medium. BACKGROUND

[0002] Oracle database has a more secure feature in the development design process, based on which, after creating a database table, sequence and other files in the Oracle database, the created files need to be given read and write permissions to users, otherwise the created files are unusable to users. Moreover, whether the files in the Oracle database are given permissions is difficult to detect by a compiler, and it is also difficult to find whether the files are given read and write permissions through testing, and when the files without permissions are put online, it will cause serious online problems.

[0003] Therefore, after creating a database table, sequence and other files in the Oracle database, the files need to be given read and write permissions to corresponding users. SUMMARY

[0004] Based on the above research, the present application provides a data permission detection method, device, equipment and readable storage medium, which can realize detection of read and write permissions of database files, has high detection efficiency, high accuracy and low cost.

[0005] In a first aspect, the present application embodiment provides a data permission detection method, which comprises:

[0006] obtaining a target database script file;

[0007] performing statement analysis on the target database script file to determine whether the target database script file has a target operation statement corresponding to a target operation;

[0008] if yes, performing statement extraction on the target operation statement to obtain a target content statement associated with the target operation statement;

[0009]

[0009] if the target content statement includes a table creation statement, determining whether the target content statement includes an assignment statement;

[0010] if the target content statement does not include the assignment statement, determining that the target content statement does not give read and write permissions to users.

[0011] In a possible implementation manner of the present application, the target database script file is obtained, comprising:

[0012] obtaining a database script file of a source code;

[0013] performing database syntax analysis on each database script file to determine a database script file with successful analysis as the target database script file.

[0014] In a possible implementation of the present application, the database script file of the source code is obtained, including:

[0015] Obtaining the source code file in the source code repository;

[0016] Determining the suffix identifier of each source code file;

[0017] Matching the suffix identifier of each source code file with the preset database suffix identifier, and determining that the source code file with the matched suffix identifier and database suffix identifier is the database script file.

[0018] In a possible implementation of the present application, the target database script file is subjected to statement analysis to determine whether the target database script file has a target operation statement corresponding to a target operation, including:

[0019] Determining an abstract syntax tree of the target database script file; the abstract syntax tree includes a plurality of nodes, and each node corresponds to an operation statement;

[0020] Detecting whether the operation statement corresponding to each node in the abstract syntax tree is an operation statement corresponding to a new, modification and / or deletion operation;

[0021] If the operation statement corresponding to at least one node is an operation statement corresponding to a new, modification and / or deletion operation, it is determined that the target database script file has a target operation statement corresponding to a target operation, and the target operation includes at least one of a new operation, a modification operation and a deletion operation. In a possible implementation of the present application, the target operation statement is subjected to statement extraction to obtain a target content statement associated with the target operation statement, including:

[0022] The target operation statement is subjected to statement extraction to obtain an initial content statement associated with the target operation statement;

[0023] Determining that the initial content statement with a statement content as an execution content corresponding to the target operation is the target content statement.

[0024] In a possible implementation of the present application, the target content statement includes a table creation statement, and before it is determined whether the target content statement includes an assignment statement, including:

[0025] Performing character conversion on the target content statement to obtain a converted target content statement;

[0026] Detecting the table creation statement of the converted target content statement based on a preset table creation detection function.

[0027] In a possible implementation manner of the present application, after it is determined that the target database script file corresponding to the target content sentence does not grant the read-write permission to the user, the method comprises the following steps of:

[0028] sending the permission granting prompt information according to the target database script file which does not grant the read-write permission to the user;

[0029] performing the permission granting on the target database script file which does not grant the read-write permission to the user in response to the permission granting request sent based on the prompt information. In the second aspect, the embodiments of the present application provide a data permission detection device, which comprises:

[0030] a obtaining module configured to obtain a target database script file in source code;

[0031] an analyzing module configured to perform sentence analysis on the target database script file, and determine whether the target database script file has a target operation sentence corresponding to a target operation; if yes, perform sentence extraction on the target operation sentence to obtain a target content sentence associated with the target operation sentence;

[0032] a determining module configured to, if the target content sentence comprises a table creation statement, determine whether the target content sentence comprises an assignment statement; if the target content sentence does not comprise the assignment statement, the target database script file corresponding to the target content sentence does not grant the read-write permission to the user.

[0033] In the third aspect, the embodiments of the present application further provide a data permission detection device, which comprises:

[0034] one or more processors;

[0035] a memory; and

[0036] one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the processor to implement the above-mentioned data permission detection method.

[0037] In the fourth aspect, the embodiments of the present application further provide a computer readable storage medium, which stores a computer program, and the computer program is loaded by a processor to execute the steps in the above-mentioned data permission detection method.

[0038] The data permission detection method, device and equipment and readable storage medium provided by the embodiment of the present application can analyze the target database script file after obtaining the target database script file of the source code, determine whether the target database script file has a target operation statement corresponding to a target operation, if yes, extract the target operation statement to obtain a target content statement associated with the target operation statement, if the target content statement includes a table creation statement, determine whether the target content statement includes an assignment statement, if the target content statement does not include the assignment statement, determine that the target database script file does not give the user read-write permission. In this way, the read-write permission is detected based on the analysis of the target database script file and the detection of the table creation statement and the assignment statement, which is efficient, accurate and low in cost. BRIEF DESCRIPTION OF DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0040] Figure 1 is a flow diagram of the data permission detection method provided by the embodiment of the present application;

[0041] Figure 2 is a block diagram of the data permission detection device provided by the embodiment of the present application;

[0042] Figure 3 is a structural diagram of the data permission detection equipment provided by the embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0044] In the description of the present application, it should be understood that the terms "first", "second" are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0045] As the background, the Oracle database has a more secure feature in the development design process, based on which, after a database table, a sequence and the like are created in the Oracle database, the created files need to be given read-write permissions to the user, otherwise the created files are unusable to the user. And whether the files in the Oracle database are given read-write permissions is difficult to detect by the compiler, and it is also difficult to find out whether the files are given read-write permissions through testing, and when the product without read-write permissions is put online, it will cause serious online problems.

[0046] And when migrating data, when the data in other databases does not need to be given read-write permissions to the user, in this case, if the data in other databases is migrated to the Oracle database, the migrated data in the Oracle database will be unusable. At present, for the detection of read-write permissions, the code is usually detected by manual review, which often consumes a lot of manpower and time, and once the detection is missed, the product will cause incalculable consequences when put online.

[0047] Based on this, the embodiment of the present application provides a data permission detection method, device, equipment and readable storage medium, after obtaining the target database script file of the source code, the target database script file is analyzed, it is determined whether the target operation statement corresponding to the target operation exists in the target database script file, if it exists, the target operation statement is extracted, the target content statement associated with the target operation statement is obtained, if the target content statement includes a table creation statement, it is determined whether the target content statement includes an assignment statement, if the target content statement does not include the assignment statement, it is determined that the target database script file corresponding to the target content statement does not give the user read-write permissions, in this way, through the statement analysis of the target database script file, based on the detection of the table creation statement and the assignment statement, the detection of the data read-write permissions is realized, the labor cost is reduced, and the detection accuracy is improved, avoiding the incalculable consequences caused by the detection omission.

[0048] First, some terms involved in the embodiment of the present application will be explained.

[0049] Abstract syntax tree:

[0050] AST stands for Abstract Syntax Tree, which is translated as abstract syntax tree. The abstract syntax tree is essentially a tree structure object (variable, function, expression, etc.), any object can be converted into an abstract syntax tree form, the key to generating an AST is lexical analysis and syntax analysis, which represents the syntax structure of the programming language in the form of a tree, each node on the tree represents a structure in the source code.

[0051] The data permission detection method, apparatus, device, and readable storage medium provided in the embodiments of the present invention will be described below.

[0052] The data permission detection method provided in this embodiment of the invention can be executed by an electronic device with executable instructions. The electronic device can be a terminal device such as a mobile phone, tablet computer, or laptop computer; it can also be an independent physical server; it can be a server cluster or distributed system composed of multiple physical servers; or it can be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms, but it is not limited to these.

[0053] In this invention, in a specific implementation of the aforementioned executable instruction electronic device, the electronic device first obtains the source code file and performs database syntax parsing based on the database script file. It then determines that the successfully parsed database script file is the target database script file. Next, it performs statement analysis on the target database script file to determine if the target database script file contains a target operation statement corresponding to the target operation. If it does, it extracts the target operation statement to obtain the target content statement associated with the target operation statement. If the target content statement includes a table creation statement, it determines whether the target content statement includes an assignment statement. If the target content statement does not include an assignment statement, it determines that the target database script file corresponding to the target content statement has not been granted read / write permissions to the user. Finally, it grants read / write permissions to the target database script file to obtain a target database script file with read / write permissions.

[0054] It should be noted that the above system scenario is merely an example. The electronic devices and scenarios described in this invention are intended to more clearly illustrate the technical solutions of this invention and do not constitute a limitation on the technical solutions provided by this invention. As those skilled in the art will know, with the evolution of systems and the emergence of new business scenarios, the technical solutions provided by this invention are equally applicable to similar technical problems.

[0055] like Figure 1 As shown, Figure 1 This is a flowchart illustrating a data permission detection method provided in an embodiment of the present invention. Figure 1 As shown, it should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0056] The data permission detection method provided in this embodiment of the invention includes steps S101 to S105:

[0057] S101. Obtain the target database script file.

[0058] The database is a computer software system for storing and managing data according to a data structure, wherein the target database script file refers to a project code file executed by the database. The present application is based on the security design of an Oracle database. After creating files such as database tables and sequences in the Oracle database, the created files need to be assigned read and write permissions to users, otherwise the created files are unusable to users. The purpose of the embodiment of the present application is to detect files in the Oracle database that are not assigned read and write permissions to users, and to perform value assignment processing on the files.

[0059] The target database script file refers to a script file of the Oracle database. The embodiment can configure a corresponding storage path for the script file of the Oracle database. The script files created in the Oracle database are stored in the storage path. When a target database script file needs to be obtained, the target database script file can be obtained from the specified file path.

[0060] S102, performing statement analysis on the target database script file to determine whether the target database script file contains a target operation statement corresponding to a target operation.

[0061] The target operation refers to a new creation, modification and / or deletion operation in the Oracle database. That is, the target operation includes three operations of the Oracle database, the first is a new creation operation, the second is a modification operation, and the third is a deletion operation. The target operation corresponds to a corresponding target operation statement. For example, the new creation operation can correspond to a new table statement and a new field statement, etc. The modification operation can correspond to a table structure modification statement, a field prediction change statement and / or a field name change statement, etc. The deletion operation can correspond to a field deletion statement and a foreign key deletion statement, etc. Determining whether the target database script file contains a target operation statement corresponding to a target operation is to determine whether the target database script file contains a target operation statement corresponding to a new creation, modification and / or deletion operation of the Oracle database.

[0062] The purpose of the embodiment of the present application is to detect the file in the Oracle database which is not assigned to the user with read-write permission, when the Oracle database performs a new operation, which may be adding a new table or sequence in the Oracle database, in order to avoid that the new table or sequence generated in the new operation is not assigned with corresponding read-write permission, it is necessary to detect the permission of the Oracle database script file under the new operation. When the Oracle database performs a modification operation, which may be modifying the data in the table or sequence in the Oracle database, the modification operation may have an impact on the permission assignment statement, such as wrong modification, wrong change, etc., considering the consequences caused by not assigning permission and the difficulty of detecting permission after online, it is necessary to detect the permission of the Oracle database script file under the modification operation. When the Oracle database performs a deletion operation, the deletion operation may be deleting the field in the table in the Oracle database, or it may be emptying the table in the database to retain the table structure in order to input new data, in this process, if the person performing the deletion operation is not familiar with the rules of the Oracle database, the permission detection statement may be deleted by mistake, if the data in the table is emptied, the permission detection statement may also be correspondingly removed, therefore, it is also necessary to detect the permission of the Oracle database script file under the modification operation.

[0063] In order to achieve the purpose of determining whether the target operation statement corresponding to the new, modification and / or deletion operation of the Oracle database exists in the target database, it is necessary to analyze the statement of the target database script file, and analyze whether the target operation statement corresponding to the new, modification and / or deletion operation of the Oracle database exists in the code of the target database script file.

[0064] In the embodiment, the target operation statement corresponding to the target operation represents the syntax structure of the target operation, therefore, the statement analysis can be extracting the syntax structure of the target database script file, matching the syntax structure of the target database script file with the syntax structure of the new operation, based on the matching result, determining whether the syntax structure of the new operation exists, matching the syntax structure of the target database script file with the syntax structure of the modification operation, based on the matching result, determining whether the syntax structure of the modification operation exists, matching the syntax structure of the target database script file with the syntax structure of the deletion operation, based on the matching result, determining whether the syntax structure of the deletion operation exists.

[0065] If the syntax structure of the target database script file does not match the syntax structure of all the foregoing operations (new, modification, and deletion), that is, the target database script file does not include the syntax structure of the target operation, it is determined that the target database script file does not include the target operation statement corresponding to the target operation. If the target database script file includes at least one syntax structure matching the syntax structure of any one of the foregoing operations (new, modification, and deletion), it is determined that the target database script file includes the target operation statement corresponding to the target operation.

[0066] S103. If yes, the target operation statement is subjected to statement extraction to obtain a target content statement associated with the target operation statement.

[0067] The target content statement can be a content statement of an operation performed by the target operation statement. For example, when the target operation statement is an operation statement corresponding to a new operation, the target content statement can be a content statement of a new object and related information of the object corresponding to the new operation, such as a newly created table and table information (including permissions, table name, etc.). When the target operation statement is an operation statement corresponding to a modification operation, the target content statement can be a content statement of a modified object and related information of the object corresponding to the modification operation, such as a modified table and modification information (including permissions, table name, field statement, field name, etc.). When the target operation statement is an operation statement corresponding to a deletion operation, the target content statement can be a content statement of a deleted object and related information of the object corresponding to the deletion operation, such as deletion information (including field statement, foreign key statement, etc.).

[0068] In the embodiment of the application, the target operation statement is subjected to statement extraction to obtain a target content statement associated with the target operation statement. The target content statement can be a content statement of a new object and related information of the object corresponding to the new operation, a content statement of a modified object and related information of the object corresponding to the modification operation, or a content statement of a deleted object and related information of the object corresponding to the deletion operation.

[0069] S104. If the target content statement includes a table creation statement, it is determined whether the target content statement includes an assignment statement.

[0070] The target content sentence is obtained by sentence extraction from a target operation sentence, and the target operation sentence contains a new creation, modification and / or deletion operation, that is, the target content sentence can be a content sentence under a new creation syntax structure, can be a content sentence under a modification syntax structure, and can also be a content sentence under a deletion syntax structure. Considering that the non-assignment permission often occurs in the new creation scenario, the application mainly detects the data permission when creating a table and a sequence. Based on this, the embodiment of the application can first analyze the target content sentence to determine whether the target content sentence contains a table creation statement. If the target content sentence contains the table creation statement, it indicates that the table, sequence and other files are newly created in the Oracle database, so that the permission of the newly created file is further detected.

[0071] In the embodiment of the application, whether the target content sentence contains the table creation statement can be directly found in the target content sentence. For example, it can be found whether the target content sentence contains "create table" and / or "create sequence". If the target content sentence includes "create table" and / or "create sequence", it is determined that the new creation operation is performed in the target database script file, it is determined that the target content sentence contains the table creation statement, at this time, the assignment analysis of the target content sentence containing the table creation statement is required, and it is determined whether the target content sentence includes an assignment statement. If the target content sentence does not include "create table" and / or "create sequence", it is determined that the target content sentence does not contain the table creation statement, it is marked that the target database file does not perform the table creation operation, and the next target database script file is acquired.

[0072] S105, if the target content sentence does not include the assignment statement, it is determined that the target database script file corresponding to the target content sentence does not assign the read-write permission to the user.

[0073] S106, if the target content sentence does not include the assignment statement, it is determined that the target database script file corresponding to the target content sentence assigns the read-write permission to the user.

[0074] According to the target content sentence containing the table creation statement, it is determined whether the target content sentence includes the assignment statement.

[0075] In the embodiment of the present application, the assignment statement can be "grant", the "grant" statement is searched in the target content statement, if the target content statement not containing the "grant" statement is found, it indicates that the target content statement does not contain the assignment statement, and the target database script file corresponding to the target content statement does not grant the read and write permissions to the user, if the target content statement searched includes the "grant" statement, the target content statement includes the assignment statement. Alternatively, the assignment function statement judgment can be performed on the target content, the assignment function statement refers to the "not contain" statement, if the judgment shows that the target content statement does not have the assignment statement, it indicates that the target content statement does not contain the assignment statement, that is, the target database script file corresponding to the content statement does not grant the read and write permissions to the user; if the judgment shows that the target content has the assignment statement, it indicates that the target content statement has the assignment statement, that is, the target database script file corresponding to the content statement grants the read and write permissions to the user.

[0076] It can be understood that when there are multiple target database script files, after the data permission detection of the current target database script file is performed, the next target database script file can be executed.

[0077] Considering that deletion and modification can also affect the data read and write permissions, it can be understood that when the target operation statement is a modification operation statement, after the target operation statement is extracted to obtain the target content statement associated with the target operation statement, it can be detected whether the target content statement includes the modification statement (such as "update"), if the modification statement is included, it is determined whether the target content statement includes the assignment statement (such as "grant"), it can be detected whether the target content statement includes the deletion statement (such as "delete"), and it is determined whether the target content statement includes the assignment statement.

[0078] It can also be understood that the target operation statement can also represent an operation statement capable of simultaneously implementing the new creation, modification, and deletion operations, for example, the "data definition language" operation statement can simultaneously implement the new creation, modification, and deletion operations.

[0079] In the embodiment, the target database script file is analyzed to determine the target operation statement corresponding to the target operation, the target content statement is extracted from the target operation statement, and the assignment statement matching is performed on the target content statement containing the table creation statement, if the assignment statement is not contained, it is determined that the target database script file does not grant the read and write permissions to the user, the embodiment maximizes the detection efficiency and accuracy.

[0080] In another embodiment of the present application, in order to improve efficiency, the step of determining whether the target database script file contains the target operation statement corresponding to the target operation can comprise:

[0081] determining an abstract syntax tree of the target database script file, wherein the abstract syntax tree comprises a plurality of nodes, and each node corresponds to an operation statement;

[0082] detecting whether the operation statement corresponding to each node in the abstract syntax tree is an operation statement corresponding to a new, modification and / or deletion operation;

[0083] if the operation statement corresponding to at least one node is an operation statement corresponding to a new, modification and / or deletion operation, it is determined that the target database script file contains the target operation statement corresponding to the target operation, wherein the target operation comprises at least one of a new operation, a modification operation and a deletion operation.

[0084] The method for extracting the syntax structure of the target database script file can be to parse the target database script file into an abstract syntax tree by using a "PLSQL" syntax, wherein if the parsing succeeds, it indicates that the target database script file is a script file of an Oracle database, and each node on the abstract syntax tree represents each syntax structure of the target database script file.

[0085] Therefore, by detecting whether the operation statement corresponding to each node in the abstract syntax tree is an operation statement corresponding to a new, modification and / or deletion operation, and by judging whether each node information contains node information corresponding to a new, modification and / or deletion operation, it can be determined whether the target database script file contains node information corresponding to a new, modification and / or deletion operation, and it can be determined whether the target database script file contains the target operation statement corresponding to the target operation. If the operation statement corresponding to at least one node is an operation statement corresponding to a new, modification and / or deletion operation, it is determined that the target database script file contains the target operation statement corresponding to the target operation, wherein the target operation comprises at least one of a new operation, a modification operation and a deletion operation.

[0086] The method for putting the database script file into the database based on the path can cause path errors, so that other script files exist under the path, and thus when the target database script file is obtained, other script files can be obtained, which increases the workload of the script file and reduces the efficiency. In order to improve efficiency, the step of obtaining the target database script file can comprise:

[0087] obtaining a database script file of a source code;

[0088] The database script files are parsed by using a database syntax, and the database script files successfully parsed are determined as target database script files.

[0089] In the embodiment of the present application, the source code management warehouse is deployed in the electronic device which can execute instructions, and the source code management warehouse is used to store and manage all codes in the electronic device, wherein the all codes can include project codes based on the database and other non-database operation codes, and the source code includes all codes in the electronic device, that is, the source code can include project codes based on the database and other non-database operation codes, that is, the source code includes database script files and other non-database script files.

[0090] In order to detect the files which are not assigned with read and write permissions to users in the Oracle database, the source code needs to be obtained from the source code management warehouse, the database script files are obtained from the source code, and then the target database script files, that is, the script files of the Oracle database, are determined from the database script files.

[0091] In the embodiment of the present application, the step of obtaining the database script files in the source code can include:

[0092] Obtaining the source code files in the source code warehouse;

[0093] Determining the suffix identifiers of the source code files;

[0094] Matching the suffix identifiers of the source code files with preset database suffix identifiers, and determining that the source code files with matched suffix identifiers and database suffix identifiers are the database script files.

[0095] The source code files in the source code warehouse can be obtained based on the “git clone” instruction.

[0096] Since the names of the database script files all have the suffix identifier “.sql”, after the source code files in the source code warehouse are obtained, the names of the source code files are analyzed to obtain the suffix identifiers of the source code files.

[0097] Then, the suffix identifiers of the source code files are matched with the preset database suffix identifier “.sql”, and the source code files with matched suffix identifiers and “.sql” are determined as the database script files.

[0098] In the optional embodiment, in order to improve the matching efficiency of the suffix identifiers of the database script files, the lowercase characters are easier to match, and therefore, the step of obtaining the target database script files of the source code in the embodiment of the present application can further include:

[0099] The suffix identifier of each source code file is determined, the file name of the source code file is converted into lower case characters, the suffix identifier of each source code file is matched with a preset database suffix identifier, if the suffix identifier of the source code file is ".sql", the suffix identifier of the source code file is matched successfully with the preset database suffix identifier, and it is determined that the source code file with the suffix identifier ".sql" is a database script file.

[0100] Since the database script file contains a script file of a non-Oracle database, after obtaining the database script file, database syntax analysis is further performed on each database script file, and it is determined that a database script file successfully parsed is a target database script file.

[0101] The PLSQL syntax can be used to perform database syntax analysis on each database script file, the database script file conforming to the "PLSQL" syntax belongs to the script file of the Oracle database, the "PLSQL" syntax is used to analyze the target script file, the target script file is successfully parsed into an abstract syntax tree (AST), and it is indicated that the target database script file belongs to the script file of the Oracle database, and the database script file that is not successfully parsed indicates that the target database script file does not belong to the script file of the Oracle database.

[0102] In the embodiment of the application, the abstract syntax tree of the target database script file is determined, and it is detected whether each node corresponding to an operation statement in the abstract syntax tree is a node corresponding to a new creation, modification and / or deletion operation. The node corresponding to the operation statement of the new creation, modification and / or deletion operation can be a DDLCommand node, at least one node in the abstract syntax tree is determined to be a DDLCommand node, it is determined that the node corresponding to the target operation statement exists on the abstract syntax tree, it is determined that the target database script file exists, the target operation statement corresponding to the target operation exists, and the target operation includes at least one of the new creation operation, the modification operation and the deletion operation.

[0103] In some embodiments of the application, the target operation statement is subjected to statement extraction to obtain a target content statement associated with the target operation statement, which can further include:

[0104] The target operation statement is subjected to statement extraction to obtain an initial content statement associated with the target operation statement.

[0105] The initial content statement with the statement content as the execution content corresponding to the target operation is determined to be the target content statement.

[0106] The initial content statement refers to other content statements in the target database script file based on the target operation statement, that is, all content statements associated with the target operation extracted. However, the other content statements in the target database script file include execution content statements and non-execution content statements. The execution content statement refers to a statement for performing an operation, that is, a statement including the target operation, for example, for the new operation, the initial content statement associated with the operation statement includes the execution content statements of "create table" and / or "create sequence". The non-execution content statement refers to, for example, an empty statement and the like, which will not be compiled and will not generate binary machine instructions.

[0107] Since the purpose of the embodiment of the present application is to detect the file in the Oracle database which is not assigned to the user with read and write permissions, and to perform assignment processing on the file, the purpose of obtaining the initial content statement is to confirm the table creation statement in the initial content statement, therefore, it is necessary to determine the initial content statement, and determine that the statement content is the execution content statement.

[0108] In the optional implementation, when the target operation statement is a syntax structure corresponding to a node on the abstract syntax tree, the initial content statement with execution content under the node in the abstract syntax tree can be directly extracted based on the image attribute operation, therefore, the statement extraction on the target operation statement can be the image attribute operation on the node, that is, the target content statement of the target operation can be confirmed.

[0109] In the embodiment of the present application, the statement extraction is performed on the target operation statement, and the corresponding operation statement of other operation information associated with the target operation statement is the initial content statement, wherein if the statement content of the initial content statement is the execution content corresponding to the target operation, it is determined that the initial content statement is the target content statement, and if the statement content of the initial content statement is not the execution content corresponding to the target operation, it is determined that the statement content of the other initial content statement.

[0110] In some embodiments of the present application, considering the improvement of the detection efficiency of the lowercase character, when the target content statement includes the table creation statement, before determining whether the target content statement includes the assignment statement, the method further includes:

[0111] Converting the characters of the target content statement to obtain a converted target content statement;

[0112] Performing table creation statement detection on the converted target content statement based on a preset table creation detection function.

[0113] The character conversion refers to lowercase character conversion, and the target content sentence is converted into lowercase characters, so that the target can be detected more quickly in subsequent detection.

[0114] In the embodiment of the application, the target content is subjected to lowercase character conversion to obtain a target content sentence converted into lowercase characters. Assuming that the preset table building detection function is "contain", the "contain" judgment is performed on the converted target content sentence. If the judgment shows that the target content contains the table building function content, it indicates that the target content contains the table building statements "create table" and / or "create sequence". If the judgment shows that the target content does not contain the table building function content, it indicates that the target content does not contain the table building statements "create table" and / or "create sequence". Then, the table building detection function judgment is performed on other target content.

[0115] In some embodiments of the application, after it is determined that the target database script file corresponding to the target content sentence does not grant the user read-write permission, the method can further include:

[0116] providing permission granting prompt information according to the target database script file that does not grant the user read-write permission;

[0117] performing permission granting on the target database script file that does not grant the user read-write permission in response to a permission granting request sent based on the prompt information.

[0118] The electronic device for processing data permission detection can provide a display interface to the user according to the target database script file that does not grant the user read-write permission, and the display interface is provided with a permission granting button. The electronic device for processing data permission detection sends prompt information to the display interface end according to the target database script file that does not grant the user read-write permission, and presents the prompt information to the user. The user presses the permission granting button on the display interface according to the prompt information, and the display interface end sends a permission granting instruction based on the prompt information to the electronic device for processing data permission detection. Alternatively, the first electronic device for processing data permission detection sends prompt information to the second electronic device according to the target database script file that does not grant the user read-write permission. The user receives the prompt information on the second electronic device, and sends a permission granting instruction to the first electronic device according to the prompt information.

[0119] According to the determination that the target content sentence does not include an assignment statement, it is determined that the target database script file corresponding to the target content sentence does not grant the user read-write permission. The target database script file that does not grant the user read-write permission can be obtained. In the embodiment of the application, a method for assigning a value to the target data script file that does not grant the user read-write permission is provided.

[0120] In an embodiment of the present application, a permission granting statement is executed on the target database script file, for example, the target database script file is U1, the electronic device is instructed to execute the permission granting instruction "grant connect to U1" on U1, and the electronic device executes the permission granting on the target database script file to which no read-write permission is granted to the user, and obtains the target database script file U1 to which the read-write permission is granted.

[0121] In another embodiment of the present application, a prompt information is sent to the terminal for the target database script file, prompting that the target database script file does not grant the read-write permission to the user, and waiting for the administrator to handle the next operation.

[0122] In the application scenario of the data permission detection provided by the embodiment of the present application, the sql file is parsed into an abstract syntax tree to make the sql file comply with the PLSQL syntax, and it is determined that the sql file is an Oracle database operation file. Further, it is determined whether the target operation statement corresponding to each node of the abstract syntax tree contains a database new creation, modification and / or deletion operation statement. If the target content statement associated with the node containing the database new creation, modification and / or deletion operation statement contains a table creation statement, it is determined whether the target content statement includes an assignment statement. Further, the assignment statement judgment is performed on the target content statement containing the table creation statement. If the target content statement contains the table creation statement and does not contain the assignment statement, it is indicated that the target database script file corresponding to the DDLCommand node associated with the target content statement does not grant the read-write permission to the user. Therefore, in the embodiment of the present application, the target operation statement judgment, the table creation statement judgment and / or the assignment statement judgment are performed to accurately find the target database script file to which no read-write permission is granted to the user, the accuracy of the finding is high, and the possibility of false finding and missing finding is minimized, and more time and labor cost are saved compared with the manual finding.

[0123] Based on the same inventive concept, please refer to Figure 2 , Figure 2 is a block diagram of the data permission detection device provided by the embodiment of the present application. The embodiment of the present application also provides a data permission detection device 40 applied to the electronic device of the executable instruction, as shown in Figure 2 The data permission detection device 40 includes an acquisition module 401, an analysis module 402 and a determination module 403.

[0124] The acquisition module 401 is configured to acquire the target database script file in the source code.

[0125] The analysis module 402 is configured to perform statement analysis on the target database script file, determine whether the target database script file contains a target operation statement corresponding to a target operation, perform statement extraction on the target operation statement if the target database script file contains the target operation statement, and obtain a target content statement associated with the target operation statement.

[0126] The determination module 403 is configured to determine whether the target content statement contains an assignment statement if the target content statement contains a table creation statement, and determine that the target database script file does not grant read and write permissions to a user if the target content statement does not contain the assignment statement.

[0127] In some embodiments of the present application, the acquisition module 401 is configured to:

[0128] acquire a database script file of source code;

[0129] perform database syntax analysis on each database script file, and determine a database script file for which the database syntax analysis is successful as a target database script file.

[0130] In some embodiments of the present application, the acquisition module 401 is configured to:

[0131] acquire a source code file in a source code repository;

[0132] determine a suffix identifier of each source code file;

[0133] match the suffix identifier of each source code file with a preset database suffix identifier, and determine a source code file for which the suffix identifier matches the database suffix identifier as a database script file.

[0134] In some embodiments of the present application, the analysis module 402 is configured to:

[0135] determine an abstract syntax tree of the target database script file, wherein the abstract syntax tree contains a plurality of nodes, and each node corresponds to an operation statement;

[0136] detect whether the operation statement corresponding to each node in the abstract syntax tree is an operation statement corresponding to a new creation operation, a modification operation, and / or a deletion operation;

[0137] determine that the target database script file contains a target operation statement corresponding to a target operation if at least one node corresponds to an operation statement corresponding to a new creation operation, a modification operation, and / or a deletion operation, wherein the target operation includes at least one of a new creation operation, a modification operation, and a deletion operation. In some embodiments of the present application, the analysis module 402 is configured to:

[0138] perform statement extraction on the target operation statement, and obtain an initial content statement associated with the target operation statement;

[0139] The initial content sentence corresponding to the execution content of the target operation is determined as the target content sentence.

[0140] In some embodiments of the present application, the determining module 403 is configured to:

[0141] character conversion is performed on the target content sentence to obtain a converted target content sentence.

[0142] The converted target content sentence is detected based on a preset table building detection function.

[0143] In some embodiments of the present application, the data permission detection apparatus 40 is further configured to:

[0144] After determining that the target database script file corresponding to the target content sentence does not grant the user read-write permission, the target database script file that does not grant the user read-write permission is obtained.

[0145] The target database script file is executed to grant read-write permission, and the target database script file with read-write permission is obtained.

[0146] It should be noted that in the present application, the related content of the obtaining module 401, the analysis module 402 and the determining module 403 corresponds to the above one by one. Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the data permission detection apparatus and its corresponding modules described above can be referred to as Figure 1 The description of the data permission detection module method in any embodiment corresponds, and the specific description is not repeated here.

[0147] In addition, the embodiments of the present application also provide a data permission detection device, which can be a terminal or a server, as shown in Figure 3 The structure of the data permission detection device is shown in the figure, and specifically:

[0148] The data permission detection device can include a processor 10 with one or more processing cores, a power supply 20 with one or more computer readable storage media, a memory 30 and an input unit 50, etc. Those skilled in the art can understand that Figure 3 The structure of the data permission detection device shown in the figure does not constitute a limitation on the data permission detection device, and can include more or fewer components than the figure, or combine certain components, or different component arrangements. Among them:

[0149] The processor 10 is the control center of the data authority detection device, connects each part of the data authority detection device by various interfaces and lines, executes various functions of the data authority detection device and processes data by running or executing software programs and / or modules stored in the memory 30 and calling data stored in the memory 30, thereby overall monitoring the data authority detection device. Optionally, the processor 10 can include one or more processing cores; preferably, the processor 10 can integrate an application processor and a modem processor, wherein the application processor mainly processes operating systems, user interfaces and application programs, etc., and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 10.

[0150] The memory 30 can be used to store software programs and modules, and the processor 10 executes various functions and data processing by running the software programs and modules stored in the memory 30. The memory 30 can mainly include a program storage area and a data storage area, wherein the program storage area can store operating systems, application programs required by at least one function, etc.; and the data storage area can store data created according to the use of the data authority detection device, etc. In addition, the memory 30 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device. Accordingly, the memory 30 can also include a memory controller to provide access of the processor 10 to the memory 30.

[0151] The data authority detection device further includes a power supply 20 for supplying power to each component, and preferably the power supply 20 can be logically connected to the processor 10 through a power management system, thereby realizing functions such as management of charging, discharging and power consumption management through the power management system. The power supply 20 can also include one or more than one direct current or alternating current power supply, a recharging system, a power failure detection circuit, a power converter or inverter, a power state indicator, etc. Any component.

[0152] The data authority detection device can also include an input unit 50, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0153] Although not shown, the data authority detection device can also include a display unit, etc., which will not be described here. Specifically, in the present embodiment, the processor 10 in the data authority detection device will load the executable file corresponding to the process of one or more than one application program into the memory 30 according to the following instructions, and run the application program stored in the memory 30 by the processor 10, thereby realizing various functions, such as:

[0154] obtaining a target database script file of source code;

[0155] performing statement analysis on the target database script file to determine whether the target database script file has a target operation statement corresponding to the target operation;

[0156] If yes, performing statement extraction on the target operation statement to obtain a target content statement associated with the target operation statement;

[0157] If the target content statement includes a table creation statement, determining whether the target content statement includes an assignment statement;

[0158] If the target content statement does not include an assignment statement, determining that the target database script file corresponding to the target content statement does not grant read and write permissions to the user.

[0159] To this end, the application provides a computer readable storage medium, which can include a Read Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, etc. A computer program is stored on the storage medium, and the computer program is loaded by a processor to execute the steps in any of the data permission detection methods provided by the application. For example, the computer program loaded by the processor can execute the following steps:

[0160] obtaining a target database script file of source code;

[0161] performing statement analysis on the target database script file to determine whether the target database script file has a target operation statement corresponding to the target operation;

[0162] If yes, performing statement extraction on the target operation statement to obtain a target content statement associated with the target operation statement;

[0163] If the target content statement includes a table creation statement, determining whether the target content statement includes an assignment statement;

[0164] If the target content statement does not include an assignment statement, determining that the target database script file corresponding to the target content statement does not grant read and write permissions to the user.

[0165] The specific implementation of each operation can be referred to the foregoing embodiments, which will not be described here.

[0166] In the foregoing embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the foregoing detailed description of other embodiments, which will not be described here.

[0167] In practice, the above-mentioned units or structures can be realized as independent entities, or be combined as the same or several entities, and can execute the steps in the method provided by the embodiments of the present application due to the instructions stored in the readable storage medium, thus the beneficial effects that can be achieved by the method provided by the embodiments of the present application can be achieved. For details, refer to the foregoing embodiments, which will not be repeated here.

[0168] The above describes in detail the data permission detection method, device, equipment and readable storage medium provided by the embodiments of the present application. The principles and implementation manners of the present application are described by applying specific examples. The above embodiment description is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, the specific implementation manners and application ranges will be changed according to the idea of the present application. In summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A data authority detection method, characterized in that, The method comprises: obtaining a target database script file; performing statement analysis on the target database script file to determine whether the target database script file has a target operation corresponding to a target operation statement; if so, performing statement extraction on the target operation statement to obtain a target content statement associated with the target operation statement; if the target content statement includes a table creation statement, determining whether the target content statement includes an assignment statement; if the target content statement does not include an assignment statement, determining that the target content statement corresponding to the target database script file does not grant read and write permissions to a user.

2. The method of claim 1, wherein, The method comprises: obtaining a target database script file; performing database syntax analysis on each of the database script files to determine a database script file that is successfully parsed as a target database script file.

3. The method of claim 2, wherein, The method comprises: obtaining a source code repository; determining the suffix identifier of each of the source code files; matching the suffix identifier of each of the source code files with a preset database suffix identifier to determine that a source code file with a matching suffix identifier and the database suffix identifier is a database script file.

4. The method of claim 1, wherein, The method comprises: determining an abstract syntax tree of the target database script file; the abstract syntax tree comprises a plurality of nodes, and each node corresponds to an operation statement; detecting whether the operation statement corresponding to each node in the abstract syntax tree is an operation statement corresponding to a new creation, modification, and / or deletion operation; if at least one node corresponds to an operation statement corresponding to a new creation, modification, and / or deletion operation, it is determined that the target database script file has a target operation corresponding to a target operation statement, and the target operation includes at least one of a new creation operation, a modification operation, and a deletion operation.

5. The method of claim 4, wherein, The method comprises: performing statement extraction on the target operation statement to obtain an initial content statement associated with the target operation statement; determining that an initial content statement with statement content corresponding to the execution content of the target operation is a target content statement.

6. The method of claim 1, wherein, Before the method comprises: performing character conversion on the target content statement to obtain a converted target content statement; detecting a table creation statement based on a preset table creation detection function.

7. The method according to any one of claims 1 to 6, characterized in that, After the method comprises: providing a permission granting prompt based on the target database script file that does not grant read and write permissions to a user; performing permission granting on the target database script file that does not grant read and write permissions to a user in response to a permission granting request sent based on the prompt.

8. A data authority detection apparatus, characterized by comprising: The device comprises: An acquisition module is configured to acquire a target database script file in source code; An analysis module is configured to perform statement analysis on the target database script file to determine whether the target database script file includes a target operation statement corresponding to a target operation; if so, the target operation statement is extracted to obtain a target content statement associated with the target operation statement; A determination module is configured to determine whether the target content statement includes an assignment statement if the target content statement includes a table creation statement; if not, the target database script file corresponding to the target content statement does not grant read and write permissions to a user.

9. A data permission detection device, characterized in that the device comprises: one or more processors; a memory; and one or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the processor to implement the data permission detection method of any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in the data permission detection method of any one of claims 1 to 7.

Images