Methods, devices, electronic equipment, and storage media for detecting cross-site scripting vulnerabilities in source code.

Abstract

This invention relates to a method, apparatus, electronic device, and storage medium for detecting cross-site scripting (XSS) vulnerabilities in source code. The method includes: adjusting the source code format through anti-code polymorphism to extract source code content; constructing a static detection and analysis tool based on the extracted source code content using preset construction rules and preset variable transformation methods; using dynamic testing technology to inject attack vectors through the preset tool to monitor page status and obtain page status monitoring information; and detecting XSS vulnerabilities in the source code based on the static detection and analysis tool and the page status monitoring information. Thus, static vulnerability detection is achieved through the construction of feature expressions and data flow analysis, while dynamic simulation and discovery of source code injection points are achieved through the construction of attack vectors. This combination of static and dynamic approaches improves the accuracy of XSS vulnerability detection, accurately locating and outputting source code vulnerability points.

Description

Technical Field

[0001] This invention relates to the field of computers, and in particular to a method, apparatus, electronic device, and storage medium for detecting cross-site scripting vulnerabilities in source code. Background Technology

[0002] With the continuous upgrading of internet technology, cybersecurity remains a focal point of development, with cyberattacks being particularly prominent. According to the 2021 TOP 10 vulnerability rankings released by OWASP (Open Web Application Security Project), injection attacks still rank among the top three, and Cross-Site Scripting (XSS) vulnerabilities, which fall under the category of injection attacks, are also within the top 10. Therefore, XSS vulnerabilities remain one of the most dangerous vulnerabilities on the internet today. XSS attacks involve attackers injecting malicious scripts into various elements of a webpage, such as HTML tag attributes and events. When a user browses the page, the embedded malicious content is executed, achieving the goal of maliciously attacking the user. The harms of XSS attacks include stealing user cookie information, impersonating users to perform illegal operations, conducting phishing attacks, injecting drive-by downloads into websites, and even achieving remote control, seriously threatening user privacy and financial security. Summary of the Invention

[0003] In view of this, in order to solve the above-mentioned technical problems or some of the technical problems, the embodiments of the present invention provide a method, apparatus, electronic device and storage medium for detecting cross-site scripting vulnerabilities in source code.

[0004] In a first aspect, embodiments of the present invention provide a method for detecting cross-site scripting vulnerabilities in source code, including:

[0005] Source code content can be extracted by adjusting the source code format through discode transformation operations;

[0006] Based on the extracted source code content, a static detection and analysis tool is constructed using preset construction rules to build feature expressions and preset variable transformation methods.

[0007] Dynamic testing technology is used to inject attack vectors through preset tools to monitor page status and obtain page status monitoring information;

[0008] Cross-site scripting vulnerabilities were detected in the source code based on the static detection and analysis tool and the page status monitoring information.

[0009] In one possible implementation, the method further includes:

[0010] Based on preset construction rules, the extracted source code content is used to construct feature expressions using static analysis technology. The construction rules include metacharacter construction rules, control frequency character construction rules, and content character construction rules. Combined with source code data flow analysis, sensitive content in the source code is detected and identified, and static vulnerability points in the source code are discovered. The source code data flow analysis includes generating variable matrices, input point matrices, and label matrices.

[0011] In one possible implementation, the method further includes:

[0012] An attack vector is constructed to perform dynamic verification testing of the input point. The attack vector is constructed by combining various base element tags under the control of operation symbols.

[0013] In one possible implementation, the method further includes:

[0014] S1: Use characteristic expressions to obtain all declared variables in the script and store them in key-value pairs;

[0015] S2: Detect the location information of all declared variables in S1 within the script, and convert the corresponding variables in the script into their corresponding values ​​based on the location information;

[0016] S3: Perform type identification and length calculation on all variable values ​​in S2, and store the variable values, variable value categories, and lengths in DataFrame format to construct a variable matrix.

[0017] In one possible implementation, the method further includes:

[0018] Define a sensitive built-in function and use the characteristic expression of malicious content to detect the security of the parameter content. If malicious content is found, output the corresponding sensitive built-in function and its parameters.

[0019] Using feature expressions, the URL construction syntax is used to locate the URL concatenation operation in the script, and to locate the variable storing the corresponding string to detect whether the variable value contains malicious content;

[0020] For statements that have completed the S2 variable value replacement, if the statement is an assignment statement and the assignment operation under the DOM function ends on both sides of the equal sign, then the id, class, name, or tagname used by the assigned party is extracted, and the extracted information is passed to the analysis content used in dynamic testing to verify the payload injection effect.

[0021] In one possible implementation, the method further includes:

[0022] If the variable value is content extracted from webpage tags by a DOM function, then the complete function is directly stored as the variable value.

[0023] In one possible implementation, the method further includes:

[0024] Load the page and inject attack vectors into input elements; monitor DOM function states and page states.

[0025] The expected execution result of the attack vector is set as a pop-up operation, and the page status is queried in real time to verify whether the attack vector is executed successfully.

[0026] For elements obtained from script analysis, extract the outerHTML attribute and check whether the elements obtained from script analysis contain part of the attack vector content;

[0027] Based on the detection results of verifying whether the attack vector was executed successfully and whether the elements obtained in the script analysis contain part of the attack vector, it is determined whether the input element is a cross-site scripting vulnerability in the source code.

[0028] Secondly, embodiments of the present invention provide a cross-site scripting vulnerability detection device, comprising:

[0029] The extraction module is used to extract source code content by adjusting the source code format through discode transformation operations;

[0030] The building module is used to construct feature expressions and static detection and analysis tools based on the extracted source code content using preset building rules and preset variable transformation methods;

[0031] The monitoring module is used to monitor the page status by injecting attack vectors through preset tools using dynamic testing technology, and to obtain page status monitoring information.

[0032] The detection module is used to detect cross-site scripting vulnerabilities in the source code based on the static detection and analysis tool and the page status monitoring information.

[0033] In one possible implementation, the construction module is further configured to construct feature expressions from the extracted source code content using static analysis techniques based on preset construction rules, wherein the construction rules include metacharacter construction rules, control frequency character construction rules, and content character construction rules; and to detect and identify sensitive content in the source code by combining source code data flow analysis, thereby mining static vulnerability points in the source code, wherein the source code data flow analysis includes generating a variable matrix, an input point matrix, and a label matrix.

[0034] In one possible implementation, the construction module is further configured to construct an attack vector for dynamic verification testing of input points, wherein the attack vector is constructed by combining various base element tags under the control of operation symbols.

[0035] In one possible implementation, the construction module is further configured to: S1: obtain all declared variables within the script using a feature expression and store them in key-value pairs; S2: detect the position information of all declared variables in S1 within the script, and convert the corresponding variables within the script into their corresponding variable values ​​based on the position information; S3: perform type discrimination and length calculation on all variable values ​​in S2, and store the variable values, variable value categories, and lengths in DataFrame format to construct a variable matrix.

[0036] In one possible implementation, the construction module is further configured to set sensitive built-in functions, use characteristic expressions of malicious content to detect the security of parameter content, and output the corresponding sensitive built-in functions and their parameters if malicious content is found; using characteristic expressions, locate the URL concatenation operation in the script based on URL construction syntax, locate the variable storing the corresponding string, and detect whether the variable value contains malicious content; for the statement after completing the S2 variable value replacement, if the statement is an assignment statement and the assignment operation under the DOM function ends on both sides of the equal sign, extract the id, class, name, or tagname used by the assigned party, and pass the extracted information to the analysis content used in dynamic testing to verify the payload injection effect.

[0037] In one possible implementation, the building module is further configured to store the complete function as the variable value if the variable value is content extracted from web page tags by a DOM function.

[0038] In one possible implementation, the detection module is further configured to load the page, inject an attack vector into the input element, monitor the DOM function state and the page state; set the expected execution result of the attack vector as a pop-up operation, and query the page state in real time to verify whether the attack vector was executed successfully; for elements obtained in script analysis, extract the outerHTML attribute and verify whether the elements obtained in script analysis contain part of the attack vector content; based on the detection results of verifying whether the attack vector was executed successfully and whether the elements obtained in script analysis contain part of the attack vector content, determine whether the input element is a cross-site scripting vulnerability.

[0039] Thirdly, embodiments of the present invention provide an electronic device, including: a processor and a memory, wherein the processor is configured to execute a source code cross-site scripting vulnerability detection program stored in the memory, so as to implement the source code cross-site scripting vulnerability detection method described in the first aspect above.

[0040] Fourthly, embodiments of the present invention provide a storage medium, comprising: the storage medium storing one or more programs, the one or more programs being executable by one or more processors to implement the source code cross-site scripting vulnerability detection method described in the first aspect above.

[0041] The cross-site scripting (XSS) vulnerability detection scheme provided in this invention extracts source code content by adjusting the source code format through anti-code polymorphism operations. Based on the extracted source code content, a static detection and analysis tool is constructed using preset construction rules and preset variable transformation methods. Dynamic testing technology is used to inject attack vectors through preset tools to monitor page status and obtain page status monitoring information. XSS vulnerabilities are detected based on the static detection and analysis tool and the page status monitoring information. This scheme achieves static vulnerability detection by constructing feature expressions and data flow analysis, and dynamically simulates and discovers source code injection points by constructing attack vectors. The combination of static and dynamic approaches improves the accuracy of XSS vulnerability detection, accurately locating and outputting source code vulnerability points. Attached Figure Description

[0042] Figure 1 A flowchart illustrating a method for detecting cross-site scripting vulnerabilities in source code, provided in an embodiment of the present invention;

[0043] Figure 2 A flowchart illustrating another method for detecting cross-site scripting vulnerabilities in source code provided by an embodiment of the present invention;

[0044] Figure 3 A variable transformation flowchart provided for an embodiment of the present invention;

[0045] Figure 4 This invention provides an attack vector succession tree diagram.

[0046] Figure 5 This is a schematic diagram of a feature expression application module provided in an embodiment of the present invention;

[0047] Figure 6 This is a schematic diagram of a cross-site scripting vulnerability detection device provided in an embodiment of the present invention;

[0048] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] To facilitate understanding of the embodiments of the present invention, further explanations and descriptions will be provided below with reference to the accompanying drawings and specific embodiments. These embodiments do not constitute a limitation on the embodiments of the present invention.

[0051] Figure 1 This is a flowchart illustrating a method for detecting cross-site scripting vulnerabilities in source code, as provided in an embodiment of the present invention. Figure 1 As shown, the method specifically includes:

[0052] S11. Adjust the source code format through discode transformation to extract the source code content.

[0053] This invention provides a method for detecting cross-site scripting vulnerabilities by combining static analysis and dynamic testing. It improves the ability to analyze the data flow of injection points by setting variable transformation principles, realizes static analysis vulnerability detection by constructing attack vector feature expressions, and improves the accuracy of vulnerability detection by combining static and dynamic methods. Furthermore, it improves the vulnerability identification type for the three types of cross-site scripting vulnerabilities.

[0054] Specifically, in combination Figure 2 This invention can obtain webpage source code using the automated testing tool Selenium, and adjust the source code based on a set of characteristic expressions for processing deformed and obfuscated content, combined with Python string operations. Preprocessing operations include: ① unifying the uppercase and lowercase format of encoding to eliminate content obfuscation caused by letter case; ② decoding special encoded content, involving Unicode encoding, URL encoding, and special character decoding, while retaining entity encoding; ③ removing closed and complete comments from the source code; ④ replacing consecutive spaces with single spaces, and removing tabs at the beginning of each line of code during extraction and analysis; ⑤ removing special characters such as '\' within tags; and ⑥ removing nested content within nested tags.

[0055] Furthermore, the adjusted source code is stored in three categories: scripts, HTML content, and webpage input elements. Specifically, the page's JavaScript scripts are stored; input tags and textarea tags are stored as page input elements in the input point matrix; sensitive tags, such as ["a","img","form","body","iframe","link","table","div","object","svg"], etc., have their detailed content stored in the tag matrix according to attributes, events, and styles. The formats of the input point matrix and tag matrix are shown in Table 1.

[0056]

[0057] Table 1

[0058] S12. Based on the extracted source code content, a static detection and analysis tool is constructed using preset construction rules to build feature expressions and preset variable transformation methods.

[0059] Feature expressions are constructed as detection and content analysis tools. The construction principles are as follows:

[0060] Define 1 metacharacter to represent various characters to be recognized, specifically {\d for digits, \w for letters, \s for spaces, ^ for the beginning of a line, $ for the end of a line, [] for sets, and () for subexpressions}.

[0061] Definition 2 controls the number of occurrences of a character, limiting the number of times a character appears. Specifically, {+ appears more than or equal to 1 time, ? appears 0 or 1 time, * appears more than or equal to 0 times, {m,n} appears from m to n times, {m,} appears more than or equal to m times, and {m} appears m times.}

[0062] Definition 3: Content characters are the key features of the content to be identified. They generally appear in the form of characters or words, such as matching the src attribute of a script tag.

[0063] First, define an identifier for each tag on the webpage to be analyzed. This identifier is constructed by concatenating the id, class, and name attributes of the tag, in the form of {id-class-name}.

[0064] Preferredly, in this embodiment of the invention, matrices are used to store multiple types of information, and the definitions of the several types of matrices used are given. The set of values ​​for all column dimensions containing "whether" is {true, false}.

[0065] The input point matrix is ​​used to store detailed information about web page input elements. The column dimensions are {tag name, input element identifier, output point identifier, and whether it is a vulnerability point}.

[0066] The tag matrix stores the tags to be analyzed on the webpage, with columns including {tag name, id-class-name, tag attributes, tag events, tag styles, and whether it contains malicious content}.

[0067] First, source code distortion features are given. Distortion features refer to a type of obfuscation technique used to modify source code. Their purpose is to distort attack vectors to enhance attack capabilities and to provide a reference for format adjustments during source code processing. Specifically:

[0068] 1) Case obfuscation: Since HTML does not distinguish between uppercase and lowercase letters, case obfuscation is used to bypass the detection mechanism.

[0069] 2) Character encoding, including Unicode encoding, URL encoding, and Base64 encoding, to implement character replacement in the encoding process.

[0070] 3) Whitespace character replacement. The content of the tag can be replaced with whitespace characters in certain cases: space %20, tab %09, newline %0a, and carriage return %0d.

[0071] 4) Replace the bracket by replacing the parentheses () in the functions of the JavaScript code with 'or'.

[0072] 5) Adjust the content of the pop-up function by transforming the function to avoid vulnerability detection methods that use functions as keywords, such as converting alert(1) into top['ale'+'rt'](1) in a concatenation bypass method.

[0073] 6) Tag nesting: Embedding the same type of tag within another tag, such as... <scri <script>pt>。

[0074] 7)添加特殊符号，紊乱检测机制的匹配逻辑，逃过关键字的检索；如斜杠 / 。

[0075] 进一步的，指定6类基元素为攻击向量payload的基本内容，依据基元素之间的关系设定接继关系，并在符合接继关系下组合基元素构建payload：元素的接继关系如图4的攻击向量接继关系树型图所示。

[0076] 其中，6类基元素：{敏感标签ET、敏感属性EA、敏感事件EE、网页伪协议操作ED、敏感脚本ES、闭合字符EC}；攻击向量的构建是通过编写HTML文件，内容为所有易受攻击的敏感标签。使用selenium加载html文件，向标签内添加敏感属性与事件，添加完成后使用selenium及时获取不含变形特征的标签内容作为攻击向量。再结合字符串函数向攻击向量内添加变形特征，提供攻击向量的攻击能力。

[0077] 构建一组恶性内容特征表达式，旨在发掘恶性脚本的内容；特征表达式语法格式为：{元字符+次数字符}……{元字符+次数字符}{内容字符}……{元字符+次数字符}；特征表达式构建完成后将会是本专利所提方法内重要的辅助工具，其使用范围如图5所示。而在恶性内容特征表达式构建中内容字符，是待识别内容的关键特征，一般以字符或字词的形式出现，因此构建基础与payload具有一致性，取用其中{敏感属性EA、敏感事件EE}作为定位元素，{网页伪协议操作ED、敏感脚本ES、闭合字符EC}作为本专利特征表达式语法中的内容字符。

[0078] S13、采用动态测试技术通过预设工具注入攻击向量监测页面状态，得到页面状态监测信息。

[0079] S14、基于所述静态检测分析工具和所述页面状态监测信息检测源码跨站脚本漏洞。

[0080] 结合静态分析技术与动态测试技术实现源码跨站脚本漏洞检测，具体的，静态分析技术包括两方面内容：特征表达式检测HTML标签、静态网页脚本安全性。

[0081] 其中，HTML标签的分析，即为对于标签矩阵内所有属性、事件、CSS样式内容使用特征表达式进行恶性检测，若一个标签中{属性、事件、样式}有一者存在恶性内容，则此标签的即为漏洞点，将输出其标识以及outerHTML属性，作为漏洞点发掘的结果并可以使用标识定位。

[0082] 对于脚本使用设计的一种"变量转换”方法完成分析。结合图3此方法的内容具体为：

[0083] S1：采用特征表达式获取脚本内所有声明变量，变量的值以<脚本内位置，值>的键值对形式存储。其中特殊情况，变量值为DOM函数从网页标签中提取的某项内容，即使用document.getElementById或QuerySelector此类函数提取标签属性或事件，则直接将完整的函数作为变量值进行存储。

[0084] S2：探测脚本内S1中所有变量的位置，依据其每个值所在的位置为界定，将该段脚本内的此变量转换为其值；替换位置包括赋值操作与作为函数的参数。

[0085] S3：对S2内所有的变量值进行类型判别和长度计算，将变量值、变量值类别、长度以DataFrame格式存储构建变量矩阵。

[0086] 在S2完成后，设定以下几类sink内容并开展分析：

[0087] ①其中设定敏感内置函数如["eval","expression","escape","setTimeout"]是源码内的威胁点sink，则使用恶性内容特征表达式检测其参数内容安全性，此时参数内容已经被S2替换为值；检测后若存在恶性内容则将输出此函数及其参数。

[0088] ②采用特征表达式，基于URL构建语法：{协议: / / 路径？参数&参数}定位脚本中的拼接URL操作并定位存储此字符串的变量，使用恶性内容特征表达式检测其值内是否含有恶意内容，特别是URL的参数部分。

[0089] ③对于完成S2变量值替换后的语句，若语句为赋值语句并且等号两侧结尾为DOM函数下的赋值操作，如document.getElementById(‘A)＝docuemt.getElement.getElementById(‘B’)，则抽取被赋值一方使用的id或class或name或tagname，将其传递至动态测试中用作为payload注入效果检验的分析内容。

[0090] 动态测试通过预设工具加载页面，向输入元素注入攻击向量payload，并监测DOM状态以及页面状态，预设工具可以是自动化工具selenium。设定payload预期执行结果为弹窗操作，因此selenium将监测alert对象的值来实时查询页面状态，已检验攻击向量是否执行成功；同时对于脚本分析中获取的元素，提取其outerHTML属性，查验其中是否存在payload的部分内容。根据以上两者的检测结果，决定输入元素是否为源码跨站脚本漏洞点。

[0091] 由于静态分析与动态分析所针对的是不同的攻击角度所开展的漏洞攻击分析，因此两种方法中所检测出的恶性点——即源码内恶性内容存在位置与网站注入点将皆作为源码漏洞输出。并且由于恶性内容点为标签属性，注入点为页面输入元素，因此两种间冲突的可能极低，遂无需制定用于处理输出内容冲突时的核定规则。

[0092] 本发明给出的一种源码跨站脚本漏洞检测方法，能够定位并输出源码漏洞点，其中设定的变量转换方法相较于构建数据流图并遍历的获取数据流方法，可以更快进行输入元素的数据流获取；基于源码恶性内容分析所设定的特征表达式可视为黑名单技术的简化，并且对比之下在分析效率方面有较大提升，提高静态分析检测能力，降低静态分析的误报率；采用动态测试与静态分析两者结合的方式，更好的针对不同的攻击角度实现了漏洞检测，提高漏洞点检测准确率；详细描述攻击向量构建逻辑更好的生成了有效的攻击向量。因此结合静态分析与动态测试更有效的实现了漏洞检测，使得源码有了一定的安全防护。

[0093] 图6示出了本发明实施例的一种源码跨站脚本漏洞检测装置的结构示意图。如图6所示，该装置包括：

[0094] 提取模块601，用于通过反代码变形操作调整源码格式以提取源码内容。详细说明参见上述方法实施例对应的相关描述，此处不再赘述。

[0095] 构建模块602，用于基于提取到的源码内容采用预设构建规则构建特征表达式以及预设的变量转换方法构建静态检测分析工具。详细说明参见上述方法实施例对应的相关描述，此处不再赘述。

[0096] 监测模块603，用于采用动态测试技术通过预设工具注入攻击向量监测页面状态，得到页面状态监测信息。详细说明参见上述方法实施例对应的相关描述，此处不再赘述。

[0097] 检测模块604，用于基于所述静态检测分析工具和所述页面状态监测信息检测源码跨站脚本漏洞。详细说明参见上述方法实施例对应的相关描述，此处不再赘述。

[0098] 本发明实施例提供的源码跨站脚本漏洞检测装置，用于执行上述实施例提供的无源码跨站脚本漏洞检测方法，其实现方式与原理相同，详细内容参见上述方法实施例的相关描述，不再赘述。

[0099] 图7示出了本发明实施例的一种电子设备，如图7所示，该电子设备可以包括处理器901和存储器902，其中处理器901和存储器902可以通过总线或者其他方式连接，图7中以通过总线连接为例。

[0100] 处理器901可以为中央处理器(Central Processing Unit，CPU)。处理器901还可以为其他通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field-Programmable Gate Array，FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等芯片，或者上述各类芯片的组合。

[0101] 存储器902作为一种非暂态计算机可读存储介质，可用于存储非暂态软件程序、非暂态计算机可执行程序以及模块，如本发明实施例中所提供方法所对应的程序指令 / 模块。处理器901通过运行存储在存储器902中的非暂态软件程序、指令以及模块，从而执行处理器的各种功能应用以及数据处理，即实现上述方法实施例中的方法。

[0102] 存储器902可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储处理器901所创建的数据等。此外，存储器902可以包括高速随机存取存储器，还可以包括非暂态存储器，例如至少一个磁盘存储器件、闪存器件、或其他非暂态固态存储器件。在一些实施例中，存储器902可选包括相对于处理器901远程设置的存储器，这些远程存储器可以通过网络连接至处理器901。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。

[0103] 一个或者多个模块存储在存储器902中，当被处理器901执行时，执行上述方法实施例中的方法。

[0104] 上述电子设备具体细节可以对应参阅上述方法实施例中对应的相关描述和效果进行理解，此处不再赘述。

[0105] 本领域技术人员可以理解，实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)、随机存储记忆体(Random Access Memory，RAM)、快闪存储器(Flash Memory)、硬盘(Hard Disk Drive，缩写：HDD)或固态硬盘(Solid-StateDrive，SSD)等；存储介质还可以包括上述种类的存储器的组合。

[0106] 虽然结合附图描述了本发明的实施例，但是本领域技术人员可以在不脱离本发明的精神和范围的情况下作出各种修改和变型，这样的修改和变型均落入由所附权利要求所限定的范围之内。< / script>

Claims

1. A method for detecting cross-site scripting vulnerabilities in source code, characterized in that, include: Source code content can be extracted by adjusting the source code format through discode transformation operations; Based on the extracted source code content, a static detection and analysis tool is constructed using preset construction rules to build feature expressions and preset variable transformation methods. Dynamic testing technology is used to inject attack vectors through preset tools to monitor page status and obtain page status monitoring information; Based on the static detection and analysis tool and the page status monitoring information, cross-site scripting vulnerabilities were detected in the source code. The static detection and analysis tool, constructed based on the extracted source code content, uses preset construction rules to build feature expressions and preset variable transformation methods to build static detection and analysis tools, including: Based on preset construction rules, the extracted source code content is used to construct feature expressions using static analysis technology. The construction rules include metacharacter construction rules, control number character construction rules, and content character construction rules. By combining source code data flow analysis to detect and identify sensitive content in the source code and to uncover static vulnerabilities in the source code, the source code data flow analysis includes generating a variable matrix, an input point matrix, and a label matrix. The generated variable matrix includes: S1: Use characteristic expressions to obtain all declared variables in the script and store them in key-value pairs; S2: Detect the location information of all declared variables in S1 within the script, and convert the corresponding variables in the script into their corresponding values ​​based on the location information; S3: Perform type identification and length calculation on all variable values ​​in S2, and store the variable values, variable value categories, and lengths in DataFrame format to construct a variable matrix; Define a sensitive built-in function and use the characteristic expression of malicious content to detect the security of the parameter content. If malicious content is found, output the corresponding sensitive built-in function and its parameters. Using feature expressions, the URL construction syntax is used to locate the URL concatenation operation in the script, and to locate the variable storing the corresponding string to detect whether the variable value contains malicious content; For statements that have completed the S2 variable value replacement, if the statement is an assignment statement and the assignment operation under the DOM function ends on both sides of the equal sign, then the id, class, name, or tagname used by the assigned party is extracted, and the extracted information is passed to the analysis content used in dynamic testing to verify the payload injection effect. S1: This involves using a feature expression to obtain all declared variables within the script and storing them as key-value pairs, and also includes: If the variable value is content extracted from webpage tags by a DOM function, then the complete function is directly stored as the variable value.

2. The method according to claim 1, characterized in that, The method further includes: An attack vector is constructed to perform dynamic verification testing of the input point. The attack vector is constructed by combining various base element tags under the control of operation symbols.

3. The method according to claim 1 or 2, characterized in that, The method employs dynamic testing technology to inject attack vectors using preset tools to monitor page status and obtain page status monitoring information, including: Load the page and inject attack vectors into input elements; monitor DOM function states and page states. The expected execution result of the attack vector is set as a pop-up operation, and the page status is queried in real time to verify whether the attack vector is executed successfully. For elements obtained from script analysis, extract the outerHTML attribute and check whether the elements obtained from script analysis contain part of the attack vector content; Based on the detection results of verifying whether the attack vector was executed successfully and whether the elements obtained in the script analysis contain part of the attack vector, it is determined whether the input element is a cross-site scripting vulnerability in the source code.

4. A cross-site scripting vulnerability detection device, characterized in that, include: The extraction module is used to extract source code content by adjusting the source code format through discode transformation operations; The building module is used to construct feature expressions and static detection and analysis tools based on the extracted source code content using preset building rules and preset variable transformation methods; The monitoring module is used to monitor the page status by injecting attack vectors through preset tools using dynamic testing technology, and to obtain page status monitoring information. The detection module is used to detect cross-site scripting vulnerabilities in the source code based on the static detection and analysis tool and the page status monitoring information. The construction module is also used to construct feature expressions from the extracted source code content using static analysis techniques based on preset construction rules. The construction rules include metacharacter construction rules, control number character construction rules, and content character construction rules. It also combines source code data flow analysis to detect and identify sensitive content in the source code and to discover static vulnerabilities in the source code. The source code data flow analysis includes generating a variable matrix, an input point matrix, and a label matrix. The construction module is further configured to: S1: obtain all declared variables in the script using feature expressions and store them in key-value pairs; S2: detect the position information of all declared variables in S1 in the script, and convert the corresponding variables in the script into corresponding variable values ​​based on the position information; S3: perform type discrimination and length calculation on all variable values ​​in S2, and store the variable values, variable value categories, and lengths in DataFrame format to construct a variable matrix; The detection module is also used to set sensitive built-in functions, use the feature expressions of malicious content to detect the security of parameter content, and output the corresponding sensitive built-in functions and their parameters if malicious content is found. Using feature expressions, the module locates the URL concatenation operation in the script based on the URL construction syntax, locates the variable storing the corresponding string, and detects whether the variable value contains malicious content. For the statement after completing the S2 variable value replacement, if the statement is an assignment statement and the assignment operation under the DOM function ends on both sides of the equal sign, the module extracts the id, class, name, or tagname used by the assigned party and passes the extracted information to the analysis content used in dynamic testing to verify the payload injection effect.

5. The apparatus according to claim 4, characterized in that, The construction module is also used to construct attack vectors for dynamic verification testing of input points, wherein the attack vectors are constructed by combining various base element tags under the control of operation symbols.

6. The apparatus according to claim 4, characterized in that, The monitoring module is also used to load the page, inject attack vectors into the input elements, monitor the DOM function state and page state; set the expected execution result of the attack vector as a pop-up operation, query the page state in real time to verify whether the attack vector was executed successfully; for elements obtained in the script analysis, extract the outerHTML attribute to verify whether the elements obtained in the script analysis contain part of the attack vector content.

7. The apparatus according to claim 4, characterized in that, The detection module is also used to determine whether the input element is a cross-site scripting vulnerability based on the detection results of whether the attack vector was successfully executed and whether the elements obtained in the script analysis contain part of the attack vector.

8. An electronic device, characterized in that, include: A processor and a memory, wherein the processor is configured to execute a source code cross-site scripting vulnerability detection program stored in the memory to implement the source code cross-site scripting vulnerability detection method according to any one of claims 1 to 3.

9. A storage medium, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the source code cross-site scripting vulnerability detection method according to any one of claims 1 to 3.

Images