Database security hardening methods, devices, storage media, and electronic devices

Abstract

This invention discloses a method, apparatus, storage medium, and electronic device for database security hardening. The method includes: inputting a first source code file into a UT (Ultimate Test) automatic generation module to generate a UT file; inputting the first source code file into a program exception detection module to generate a target abstract syntax tree (AST), and converting the AST into a second source code file. This invention solves the technical problem of relying on manual labor for database process security hardening.

Description

Technical Field

[0001] This invention relates to the field of computers, and more specifically, to a method, apparatus, storage medium, and electronic device for security hardening of a database. Background Technology

[0002] As a core component of financial business systems, databases have extremely stringent quality requirements. Achieving this requires significant effort in ensuring code security. In the daily coding process of database products, boundary conditions in logical flows are often insufficiently handled, or exception paths are overlooked. For financial-grade system software, similar issues must be identified and addressed proactively. Existing solutions rely entirely on the experience of coders or involve complex unit testing. A static analysis-based approach could be considered to automatically add security fixes. Current techniques for hardening program flow security suffer from the following problems: Unit testing checks and verifies the smallest testable unit of software, falling under the scope of database flow security hardening; however, current technologies do not combine unit testing with program anomaly detection for database flow security hardening; most techniques merely throw alerts for matched program anomalies without processing them, or require manual repair, which is time-consuming and labor-intensive. Many anomalies can be fixed with certain fixed operations, such as checking for null pointers in the program. Summary of the Invention

[0003] This invention provides a database security hardening method, apparatus, storage medium, and electronic device to at least solve the technical problem that database process security hardening relies on human intervention.

[0004] According to one aspect of the present invention, a database security hardening method is provided, comprising: inputting a first source code file into a UT automatic generation module to generate a UT file; inputting the first source code file into a program exception detection module to generate a target abstract syntax tree, and converting the target abstract syntax tree into a second source code file.

[0005] According to another aspect of the present invention, a database security hardening device is provided, comprising: a first generation module for inputting a first source code file into a UT automatic generation module to generate a UT file; and a second generation module for inputting the first source code file into a program exception detection module to generate a target abstract syntax tree and converting the target abstract syntax tree into a second source code file.

[0006] As an optional example, the first generation module includes: a first generation unit, used to input the first source code file into the test case generation module to generate the test case portion of the UT file; and a second generation unit, used to input the first source code file into the definition generation module to generate the definition portion of the UT file.

[0007] As an optional example, the first generation unit includes: a tracking subunit, used to track all possible execution paths in the first source code file and output an intermediate file, wherein the intermediate file includes all possible execution results obtained in the first source code file; and a conversion subunit, used to read the intermediate file and convert each execution result into a corresponding UT test case according to the generation rules to obtain the test case part.

[0008] As an optional example, the second generation unit includes: a first parsing subunit, used to parse the first source code file, generate a JSON file, and save the compilation command line data of the first source code file to the JSON file; a second parsing subunit, used to parse the first source code file, and save the detailed information of all variables and functions in the first source code file to a YAML file; a third parsing subunit, used to parse the JSON file and the YAML file to obtain all undefined variables and functions in the first source code file; and a generation subunit, used to generate the header file information of the definition section based on the source code path in the YAML file, and to supplement all undefined variables and functions in the definition section.

[0009] As an optional example, the second generation module includes: a third generation unit, used to create ClangTool based on the first source code file and use ClangTool to generate a first abstract syntax tree; a first processing unit, used to access the first abstract syntax tree from top to bottom using ClangTool to obtain the types of all syntax tree nodes of the first abstract syntax tree; a second processing unit, used to call the corresponding TraverseXXX method to traverse each node according to the type of each node of all the syntax tree nodes; a third processing unit, used to call the VisitXXX method corresponding to each node of all the syntax tree nodes to perform a rewrite operation on each node; a fourth processing unit, used to recursively execute to obtain the target abstract syntax tree; and a conversion unit, used to convert the target abstract syntax tree into the second source code file.

[0010] As an optional example, the third generation unit includes: a first processing subunit for performing syntactic analysis on the first source file to obtain a sequence of lexical units; a second processing subunit for generating word units for each lexical unit; and a third processing subunit for parsing the word units to generate the first abstract syntax tree.

[0011] As an optional example, the second generation module further includes: an acquisition unit, used to acquire the variable type of each node after traversing each node by calling the corresponding TraverseXXX method according to the type of each node of all the above syntax tree nodes; a fifth processing unit, used to add a pointer null check statement after the statement corresponding to the above target node when the variable type of the target node is a pointer type; and a sixth processing unit, used to perform an initialization operation on the above target node when the variable type of the above target node is a null pointer.

[0012] According to another aspect of the present invention, a storage medium is also provided, wherein a computer program is stored in the storage medium, and the computer program is executed by a processor to perform the above-described database security hardening method.

[0013] According to another aspect of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to execute the above-described database security hardening method through the computer program.

[0014] In this embodiment of the invention, a method is adopted in which a first source code file is input into a UT automatic generation module to generate a UT file; the first source code file is input into a program exception detection module to generate a target abstract syntax tree; and the target abstract syntax tree is converted into a second source code file. In the above method, the combination of automatic UT file generation and automatic program exception detection and repair makes the database process security hardening effect better, thereby achieving the purpose of automated program exception detection and repair, and thus solving the technical problem that database process security hardening relies on human labor. Attached Figure Description

[0015] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0016] Figure 1 This is a flowchart of an optional database security hardening method according to an embodiment of the present invention;

[0017] Figure 2This is a structural diagram of an optional database security hardening method according to an embodiment of the present invention;

[0018] Figure 3 This is a flowchart of the use case portion generation process for an optional database security hardening method according to an embodiment of the present invention.

[0019] Figure 4 This is a flowchart illustrating the generation of the definition portion of a UT file for an optional database security hardening method according to an embodiment of the present invention.

[0020] Figure 5 This is an abstract syntax tree flowchart based on static analysis of an optional database security hardening method according to an embodiment of the present invention;

[0021] Figure 6 This is an operation flowchart of an optional database security hardening method according to an embodiment of the present invention in a pointer null detection scenario;

[0022] Figure 7 This is a schematic diagram of an optional database security hardening device according to an embodiment of the present invention;

[0023] Figure 8 This is a schematic diagram of an optional electronic device according to an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] According to a first aspect of the present invention, a database security hardening method is provided, optionally, as follows: Figure 1 As shown, the above method includes:

[0027] S102, Input the first source code file into the UT automatic generation module to generate the UT file;

[0028] S104: Input the first source code file into the program exception detection module, generate the target abstract syntax tree, and convert the target abstract syntax tree into the second source code file.

[0029] Optionally, in this embodiment, as Figure 2 The architecture diagram shown is as follows: Source 1: The first source code file. This invention parses the first source code file in the database process to generate the corresponding abstract syntax tree, based on a static analysis detection method; UT automatic generation module: Contains two modules, namely the test case generation module and the definition generation module; Test case generation module: Mainly implements the assembly of the command line clang-cc1 to load the checker plugin, generates intermediate files based on the syntax-sensitive and path-sensitive Clang static analyzer, and then automatically generates the test case part according to the corresponding generation rules in the test suite; Definition generation module: After the first source code file is parsed by ASTMatcher, it saves the detailed information of all variables and functions used in the first source code file to a YAML file, and supplements all undefined variables and functions in the first source code file in the definition part of the UT file; Program exception detection module: Based on the Clang source to source principle, it realizes the detection of program exception scenarios and performs corresponding repair actions on the matched exception scenarios; UT file: UT test cases generated by the UT automatic generation module; Source 2: The second source code file after the abstract syntax tree parsed from the first source code file is converted into a newly generated abstract syntax tree after matching and repairing program exception scenarios.

[0030] Optionally, in this embodiment, the combination of automatic UT file generation and automatic program anomaly detection and repair enhances the security hardening effect of the database process, thereby achieving the goal of automated program anomaly detection and repair, and solving the technical problem of relying on human intervention for database process security hardening.

[0031] As an optional example, the first source file is input into the UT automatic generation module, and the generated UT file includes:

[0032] Input the first source code file into the test case generation module to generate the test case section of the UT file;

[0033] Input the first source code file into the definition generation module to generate the definition part of the UT file.

[0034] Optionally, in this embodiment, the automatic generation of UT files includes: 1. Test suite selection: The test framework can be JUnit, Unittest, gtest, TestNG, etc., and is compatible with all the test suites in the above test frameworks. Users can select a test suite to use. 2. Boiler code writing: To use unit testing and mock functions, the corresponding header file is included in each UT file; almost every UT file contains FIXTURE, STEUP, and TEARDOWN. 3. Framework code generation: Each UT file contains two parts, namely, a definition part and a test case part. The UT file definition part relies on Clang's AST (Abstract Syntax Tree) function, while the test case part relies on Clang's path-sensitive static analysis function.

[0035] As an optional example, the first source code file is input into the test case generation module, and the test case portion of the generated UT file includes:

[0036] Trace all possible execution paths in the first source code file and output intermediate files, which include all possible execution results obtained from the first source code file;

[0037] Read the intermediate file and convert each execution result into a corresponding unit test case according to the generation rules to obtain the test case part.

[0038] Optionally, in this embodiment, as Figure 3 As shown, Unittest.lua calls libUt.so, a special plugin library developed based on the Clang static analysis framework, to analyze the first source code file, tracing all possible execution paths in the program and outputting the obtained information to an intermediate file, result.lua. Unittest.lua can be seen as assembling the command line clang-cc1, loading the checker plugin, and using the syntax-sensitive and path-sensitive Clang static analyzer. The compilation options required by clang-cc1 are provided by the compile_command.json file. The intermediate file result.lua contains the possible execution result cases for each function. ut4u.lua then reads the intermediate file result.lua and, according to the generation rules in the test suite (which include, but are not limited to, automatically generating stub functions based on values ​​and branch conditions), converts the cases into corresponding UT test cases. The strategy is to generate a UT test case for each case and append it after TEARDOWN in the boilerplate. Using the intermediate file result.lua allows for changes to the UT test suite without repeating the previous process; only the generation rules in ut4u.lua need to be modified.

[0039] As an optional example, the first source file is input into the definition generation module, and the definition portion of the generated UT file includes:

[0040] The first source code file is parsed to generate a JSON file, and the compilation command line data of the first source code file is saved to the JSON file;

[0041] The first source code file is parsed, and the detailed information of all variables and functions in the first source code file is saved to a yaml file;

[0042] Parse the JSON and YAML files to obtain all undefined variables and functions in the first source code file;

[0043] Generate header file information for the definition section based on the source code path in the YAML file, and supplement all undefined variables and functions in the definition section.

[0044] Optionally, in this embodiment, as Figure 4 As shown, the first source code file is parsed using `bear` (a third-party Python script used to generate compilation command-line data) and a JSON file is generated to store the corresponding compilation command-line data. `frame` (an executable program based on Clang's `ASTMatcher`, used to parse source code files) is then used to parse the first source code file, saving detailed information about all variables and functions used in the first source code file to a YAML file. The Linux file analysis tool `nm` is then used to analyze the generated JSON file and static dependencies to identify all undefined variables and functions in the source code. Finally, `yaml_parser` parses the source code path saved in the YAML file, generating the `#include` information for the unit definition section. Undefined variables and functions from the first source code file are added to the definition section of the unit file. For undefined functions, the added information does not need to be identical to that in the source code; for example, for functions with no return value, the function body can be empty, and for functions with an integer return type, the function body can simply contain `return 0`.

[0045] As an optional example, the first source code file is input into the program exception detection module to generate the target abstract syntax tree, and the target abstract syntax tree is converted into a second source code file, including:

[0046] ClangTool is created based on the first source code file, and the first abstract syntax tree is generated using ClangTool.

[0047] Use ClangTool to access the first abstract syntax tree from top to bottom to get the type of all syntax tree nodes in the first abstract syntax tree;

[0048] Based on the type of each node in the syntax tree, call the corresponding TraverseXXX method to traverse each node;

[0049] Call the VisitXXX methods corresponding to each node in the syntax tree to rewrite each node;

[0050] Recursively execute the process to obtain the target abstract syntax tree;

[0051] Convert the target abstract syntax tree into a second source file.

[0052] Optionally, in this embodiment, as Figure 5 As shown, the process of the abstract syntax tree based on static analysis is described in detail: First, the first source code file is passed as an input parameter to ClangTool, which is created based on libTooling. Then, the first abstract syntax tree generated by ClangASTMatcher from the first source code file is sent to the ASTConsumer class. The ASTConsumer class provides an entry point for accessing the abstract syntax tree from top to bottom. Since the first abstract syntax tree contains the abstract base class interface Stmt of various programming language syntax components, it can also be considered that ASTConsumer is similar to providing an entry point for accessing this container containing various types of Stmt. A class inheriting from `ASTConsumer` is implemented, and the `HandleTopLevelDecl` method is overridden to traverse the first abstract syntax tree (AST) from top to bottom. This process generates AST nodes of various types. Each node is then parsed, and the corresponding `TraverseXXX` methods are called to iterate through each node based on its type. The traversed nodes are those requiring security hardening. During node traversal, the corresponding `VisitXXX` methods are called. These `VisitXXX` methods are overridden from those in the `RecursiveASTVisitor` class and primarily perform security hardening on matched exception scenarios. Subsequent statements then call the corresponding `TraverseDecl`, `TraverseStmt`, and other methods recursively until a new target AST is generated. Finally, the target AST is converted into a second source file.

[0053] As an optional example, creating ClangTool from the first source file and using ClangTool to generate the first abstract syntax tree includes:

[0054] Perform syntactic analysis on the first source file to obtain a sequence of lexical elements;

[0055] Generate word units for each morpheme;

[0056] Parse word units to generate the first abstract syntax tree.

[0057] Optionally, in this embodiment, source-to-source code conversion is based on Clang. First, the source program byte stream is read in through Clang lexical analysis, forming a meaningful sequence of lexical units (Lexeme). For each Lexeme, the lexical analyzer generates a token as output, producing a related symbol table. The syntax analysis phase parses the token and generates a first abstract syntax tree. This phase does not check the rationality of the program's syntactic context; it only determines its correctness from a syntactic perspective. That is, the abstract syntax tree is a static model of the program. Based on prior error code patterns (such as the use of null pointers), the source code is automatically scanned to detect potential problems in the program and fix them to achieve security hardening.

[0058] As an optional example, after traversing each node by calling the corresponding TraverseXXX method based on the type of each node in all syntax tree nodes, the above method also includes:

[0059] Get the variable type of each node;

[0060] If the variable type of the target node is a pointer type, add a pointer null check statement after the statement corresponding to the target node;

[0061] If the variable type of the target node is a null pointer, perform an initialization operation on the target node.

[0062] Optionally, in this embodiment, as Figure 6As shown, the specific operations in the pointer null detection scenario are as follows: Using the libTooling approach, a ClangTool is created to parse the input parameters (the first source code file). ASTConsumer is used to read the first abstract syntax tree parsed by Clang and the RecursiveASTVisitor class is called for error matching and source code rewriting. The RecursiveASTVisitor class in Clang rewrites the first source code file, mainly by leveraging its ability to traverse specific nodes to detect errors in the first source code file, execute corresponding actions, and add rewritten content. The VisitStmt method in the RecursiveASTVisitor class is overridden. In VisitStmt, the variable type is obtained using the gettype method, and then the isAnyPointerType method is used to determine if it is a pointer type variable. The condition is getParamDecl(xx)->gettype()->isAnyPointerType(). If it is a pointer type, the InsertText function in the Rewriter class is called to add a pointer null check statement after the corresponding statement. If the pointer is null, an initialization operation for null pointers can be added during the rewrite.

[0063] Optionally, the present invention relates to a database security hardening method, which has the following main advantages:

[0064] 1. In the database process, a combination of unit testing and program exception detection is adopted to ensure the process's security and reliability. The abstract syntax tree generated from parsing the first source code file is used for two purposes: one is used to automatically generate unit test files, and the other is used to match abnormal scenarios in the program. The combination of unit testing and program exception detection makes the database process security hardening effect better.

[0065] 2. Automatically match abnormal scenarios and execute corresponding actions. Based on the source code conversion solution of Clang source to source technology, the system realizes automated program anomaly detection and repair by identifying specific abnormal scenarios and executing corresponding actions during the matching stage.

[0066] 3. A static analysis-based approach is adopted, using Clang tools to automate the generation of unit test cases and the detection and repair of program anomalies. This not only automates time-consuming and labor-intensive tasks, saving effort, but also detects and automatically repairs potential security risks in database processes, such as boundary condition handling in logical flows, the use of null pointers, and stack overflows, achieving a security hardening effect.

[0067] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0068] According to another aspect of the embodiments of this application, a database security hardening device is also provided, such as... Figure 7 As shown, it includes:

[0069] The first generation module 702 is used to input the first source code file into the UT automatic generation module to generate a UT file;

[0070] The second generation module 704 is used to input the first source code file into the program exception detection module, generate the target abstract syntax tree, and convert the target abstract syntax tree into the second source code file.

[0071] Optionally, in this embodiment, as Figure 2 The architecture diagram shown is as follows: Source 1: The first source code file. This invention parses the first source code file in the database process to generate the corresponding abstract syntax tree, based on a static analysis detection method; UT automatic generation module: Contains two modules, namely the test case generation module and the definition generation module; Test case generation module: Mainly implements the assembly of the command line clang-cc1 to load the checker plugin, generates intermediate files based on the syntax-sensitive and path-sensitive Clang static analyzer, and then automatically generates the test case part according to the corresponding generation rules in the test suite; Definition generation module: After the first source code file is parsed by ASTMatcher, it saves the detailed information of all variables and functions used in the first source code file to a YAML file, and supplements all undefined variables and functions in the first source code file in the definition part of the UT file; Program exception detection module: Based on the Clang source to source principle, it realizes the detection of program exception scenarios and performs corresponding repair actions on the matched exception scenarios; UT file: UT test cases generated by the UT automatic generation module; Source 2: The second source code file after the abstract syntax tree parsed from the first source code file is converted into a newly generated abstract syntax tree after matching and repairing program exception scenarios.

[0072] Optionally, in this embodiment, the combination of automatic UT file generation and automatic program anomaly detection and repair enhances the security hardening effect of the database process, thereby achieving the goal of automated program anomaly detection and repair, and solving the technical problem of relying on human intervention for database process security hardening.

[0073] As an optional example, the first generation module includes:

[0074] The first generation unit is used to input the first source code file into the test case generation module to generate the test case part of the UT file;

[0075] The second generation unit is used to input the first source code file into the definition generation module to generate the definition part of the UT file.

[0076] Optionally, in this embodiment, the automatic generation of UT files includes: 1. Test suite selection: The test framework can be JUnit, Unittest, gtest, TestNG, etc., and is compatible with all the test suites in the above test frameworks. Users can select a test suite to use. 2. Boiler code writing: To use unit testing and mock functions, the corresponding header file is included in each UT file; almost every UT file contains FIXTURE, STEUP, and TEARDOWN. 3. Framework code generation: Each UT file contains two parts, namely, a definition part and a test case part. The UT file definition part relies on Clang's AST (Abstract Syntax Tree) function, while the test case part relies on Clang's path-sensitive static analysis function.

[0077] As an optional example, the first generating unit includes:

[0078] The tracing subunit is used to trace all possible execution paths in the first source code file and output intermediate files, which include all possible execution results obtained from the first source code file.

[0079] The transformation subunit is used to read intermediate files and convert each execution result into a corresponding unit test case according to the generation rules, thus obtaining the test case part.

[0080] Optionally, in this embodiment, as Figure 3As shown, Unittest.lua calls libUt.so, a special plugin library developed based on the Clang static analysis framework, to analyze the first source code file, tracing all possible execution paths in the program and outputting the obtained information to an intermediate file, result.lua. Unittest.lua can be seen as assembling the command line clang-cc1, loading the checker plugin, and using the syntax-sensitive and path-sensitive Clang static analyzer. The compilation options required by clang-cc1 are provided by the compile_command.json file. The intermediate file result.lua contains the possible execution result cases for each function. ut4u.lua then reads the intermediate file result.lua and, according to the generation rules in the test suite (which include, but are not limited to, automatically generating stub functions based on values ​​and branch conditions), converts the cases into corresponding UT test cases. The strategy is to generate a UT test case for each case and append it after TEARDOWN in the boilerplate. Using the intermediate file result.lua allows for changes to the UT test suite without repeating the previous process; only the generation rules in ut4u.lua need to be modified.

[0081] As an optional example, the second generation unit includes:

[0082] The first parsing subunit is used to parse the first source code file, generate a JSON file, and save the compilation command line data of the first source code file to the JSON file;

[0083] The second parsing subunit is used to parse the first source code file and save the detailed information of all variables and functions in the first source code file to a yaml file;

[0084] The third parsing subunit is used to parse JSON and YAML files to obtain all undefined variables and functions in the first source code file;

[0085] The generation subunit is used to generate header file information for the definition section based on the source code path in the YAML file, and to supplement all undefined variables and functions in the definition section.

[0086] Optionally, in this embodiment, as Figure 4As shown, the first source code file is parsed using `bear` (a third-party Python script used to generate compilation command-line data) and a JSON file is generated to store the corresponding compilation command-line data. `frame` (an executable program based on Clang's `ASTMatcher`, used to parse source code files) is then used to parse the first source code file, saving detailed information about all variables and functions used in the first source code file to a YAML file. The Linux file analysis tool `nm` is then used to analyze the generated JSON file and static dependencies to identify all undefined variables and functions in the source code. Finally, `yaml_parser` parses the source code path saved in the YAML file, generating the `#include` information for the unit definition section. Undefined variables and functions from the first source code file are added to the definition section of the unit file. For undefined functions, the added information does not need to be identical to that in the source code; for example, for functions with no return value, the function body can be empty, and for functions with an integer return type, the function body can simply contain `return 0`.

[0087] As an optional example, the second generation module includes:

[0088] The third generation unit is used to create ClangTool based on the first source code file and use ClangTool to generate the first abstract syntax tree;

[0089] The first processing unit is used to access the first abstract syntax tree from top to bottom using ClangTool to obtain the types of all syntax tree nodes of the first abstract syntax tree.

[0090] The second processing unit is used to call the corresponding TraverseXXX methods to traverse each node according to the type of each node in all syntax tree nodes.

[0091] The third processing unit is used to call the VisitXXX methods corresponding to each node of all syntax tree nodes to perform rewriting operations on each node.

[0092] The fourth processing unit is used for recursive execution to obtain the target abstract syntax tree;

[0093] The transformation unit is used to convert the target abstract syntax tree into a second source file.

[0094] Optionally, in this embodiment, as Figure 5As shown, the process of the abstract syntax tree based on static analysis is described in detail: First, the first source code file is passed as an input parameter to ClangTool, which is created based on libTooling. Then, the first abstract syntax tree generated by ClangASTMatcher from the first source code file is sent to the ASTConsumer class. The ASTConsumer class provides an entry point for accessing the abstract syntax tree from top to bottom. Since the first abstract syntax tree contains the abstract base class interface Stmt of various programming language syntax components, it can also be considered that ASTConsumer is similar to providing an entry point for accessing this container containing various types of Stmt. A class inheriting from `ASTConsumer` is implemented, and the `HandleTopLevelDecl` method is overridden to traverse the first abstract syntax tree (AST) from top to bottom. This process generates AST nodes of various types. Each node is then parsed, and the corresponding `TraverseXXX` methods are called to iterate through each node based on its type. The traversed nodes are those requiring security hardening. During node traversal, the corresponding `VisitXXX` methods are called. These `VisitXXX` methods are overridden from those in the `RecursiveASTVisitor` class and primarily perform security hardening on matched exception scenarios. Subsequent statements then call the corresponding `TraverseDecl`, `TraverseStmt`, and other methods recursively until a new target AST is generated. Finally, the target AST is converted into a second source file.

[0095] As an optional example, the third generation unit includes:

[0096] The first processing subunit is used to perform syntactic analysis on the first source code file to obtain a sequence of lexical elements.

[0097] The second processing subunit is used to generate word units for each morpheme;

[0098] The third processing subunit is used to parse word units and generate the first abstract syntax tree.

[0099] Optionally, in this embodiment, source-to-source code conversion is based on Clang. First, the source program byte stream is read in through Clang lexical analysis, forming a meaningful sequence of lexical units (Lexeme). For each Lexeme, the lexical analyzer generates a token as output, producing a related symbol table. The syntax analysis phase parses the token and generates a first abstract syntax tree. This phase does not check the rationality of the program's syntactic context; it only determines its correctness from a syntactic perspective. That is, the abstract syntax tree is a static model of the program. Based on prior error code patterns (such as the use of null pointers), the source code is automatically scanned to detect potential problems in the program and fix them to achieve security hardening.

[0100] As an optional example, the second generation module also includes:

[0101] The get unit is used to obtain the variable type of each node after traversing each node by calling the corresponding TraverseXXX method according to the type of each node in all syntax tree nodes;

[0102] The fifth processing unit is used to add a pointer null check statement after the statement corresponding to the target node when the variable type of the target node is pointer type;

[0103] The sixth processing unit is used to perform initialization operations on the target node when the variable type of the target node is a null pointer.

[0104] Optionally, in this embodiment, as Figure 6As shown, the specific operations in the pointer null detection scenario are as follows: Using the libTooling approach, a ClangTool is created to parse the input parameters (the first source code file). ASTConsumer is used to read the first abstract syntax tree parsed by Clang and the RecursiveASTVisitor class is called for error matching and source code rewriting. The RecursiveASTVisitor class in Clang rewrites the first source code file, mainly by leveraging its ability to traverse specific nodes to detect errors in the first source code file, execute corresponding actions, and add rewritten content. The VisitStmt method in the RecursiveASTVisitor class is overridden. In VisitStmt, the variable type is obtained using the gettype method, and then the isAnyPointerType method is used to determine if it is a pointer type variable. The condition is getParamDecl(xx)->gettype()->isAnyPointerType(). If it is a pointer type, the InsertText function in the Rewriter class is called to add a pointer null check statement after the corresponding statement. If the pointer is null, an initialization operation for null pointers can be added during the rewrite.

[0105] For other examples of this embodiment, please refer to the examples above, which will not be repeated here.

[0106] Figure 8 This is a schematic diagram of an optional electronic device according to an embodiment of this application, such as... Figure 8 As shown, it includes a processor 802, a communication interface 804, a memory 806, and a communication bus 808. The processor 802, communication interface 804, and memory 806 communicate with each other via the communication bus 808.

[0107] Memory 806 is used to store computer programs;

[0108] When processor 802 executes a computer program stored in memory 806, it performs the following steps:

[0109] Input the first source code file into the UT automatic generation module to generate the UT file;

[0110] The first source code file is input into the program exception detection module to generate the target abstract syntax tree, and the target abstract syntax tree is converted into the second source code file.

[0111] Optionally, in this embodiment, the communication bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 The symbol is represented by a single thick line, but this does not indicate that there is only one bus or one type of bus. The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0112] The memory may include RAM, or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0113] As an example, the memory 806 described above may include, but is not limited to, the first generation module 602 and the second generation module 604 from the database security hardening device. Furthermore, it may include, but is not limited to, other module units from the database security hardening device, which will not be elaborated upon in this example.

[0114] The processors mentioned above can be general-purpose processors, including but not limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; they can also be DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0115] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0116] Those skilled in the art will understand that Figure 8 The structure shown is for illustrative purposes only. The device that implements the above database security hardening method can be a terminal device, such as a smartphone (e.g., Android phone, iOS phone), tablet computer, PDA, mobile Internet Devices (MID), PAD, etc. Figure 8 This does not limit the structure of the aforementioned electronic devices. For example, the electronic device may also include components that are more... Figure 8 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 8 The different configurations shown.

[0117] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, ROM, RAM, disk or optical disk, etc.

[0118] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is executed by a processor to perform the steps in the above-described database security hardening method.

[0119] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0120] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0121] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0122] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0123] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0124] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0125] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0126] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for security hardening of a database, characterized in that, include: Input the first source code file into the unit test automatic generation module to generate unit test files; The first source code file is input into the program exception detection module to generate a target abstract syntax tree, and the target abstract syntax tree is converted into a second source code file; The step of inputting the first source code file into the unit test automatic generation module to generate unit test files includes: The first source code file is input into the test case generation module to generate the test case portion of the unit test file; The first source code file is input into the definition generation module to generate the definition part of the unit test file; The step of inputting the first source code file into the program exception detection module to generate a target abstract syntax tree and converting the target abstract syntax tree into a second source code file includes: Create a ClangTool based on the first source code file, and use the ClangTool to generate a first abstract syntax tree; Using the ClangTool, access the first abstract syntax tree from top to bottom to obtain the types of all syntax tree nodes of the first abstract syntax tree; Based on the type of each node in all the syntax tree nodes, call the corresponding traversal method to traverse each node; Call the access method corresponding to each node of all the syntax tree nodes, and rewrite each node; Recursively execute the process to obtain the target abstract syntax tree; The target abstract syntax tree is converted into the second source code file.

2. The method according to claim 1, characterized in that, The step of inputting the first source code file into the test case generation module to generate the test case portion of the unit test file includes: Track all possible execution paths in the first source code file and output an intermediate file, wherein the intermediate file includes all possible execution results obtained from the first source code file; The intermediate file is read, and each execution result is converted into a corresponding unit test case according to the generation rules to obtain the test case part.

3. The method according to claim 2, characterized in that, The step of inputting the first source code file into the definition generation module to generate the definition portion of the unit test file includes: The first source code file is parsed to generate a JSON file, and the compilation command line data of the first source code file is saved to the JSON file; The first source code file is parsed, and the detailed information of all variables and functions in the first source code file is saved to a yaml file; The JSON file and the YAML file are parsed to obtain all undefined variables and functions in the first source code file; The header file information for the definition section is generated based on the source code path in the YAML file, and all undefined variables and functions are added to the definition section.

4. The method according to claim 1, characterized in that, The step of creating ClangTool based on the first source code file and using ClangTool to generate the first abstract syntax tree includes: Perform syntactic analysis on the first source code file to obtain a sequence of lexical elements; Generate word units for each morpheme; The word units are parsed to generate the first abstract syntax tree.

5. The method according to claim 1, characterized in that, After traversing each node according to its type by calling the corresponding traversal method, the method further includes: Get the variable type of each node; If the variable type of the target node is a pointer type, add a pointer null check statement after the statement corresponding to the target node; If the variable type of the target node is a null pointer, the target node is initialized.

6. A database security hardening device, characterized in that, include: The first generation module is used to input a first source code file into the unit test automatic generation module to generate a unit test file; wherein, inputting the first source code file into the unit test automatic generation module to generate the unit test file includes: inputting the first source code file into the test case generation module to generate the test case portion of the unit test file; and inputting the first source code file into the definition generation module to generate the definition portion of the unit test file; The second generation module is used to input the first source code file into the program exception detection module, generate a target abstract syntax tree, and convert the target abstract syntax tree into a second source code file. The step of inputting the first source code file into the program exception detection module, generating the target abstract syntax tree, and converting the target abstract syntax tree into a second source code file includes: creating a ClangTool based on the first source code file, and using the ClangTool to generate a first abstract syntax tree; using the ClangTool to access the first abstract syntax tree from top to bottom to obtain the types of all syntax tree nodes; calling the corresponding traversal method to traverse each node according to the type of each node; calling the access method corresponding to each node to perform a rewrite operation on each node; recursively executing to obtain the target abstract syntax tree; and converting the target abstract syntax tree into the second source code file.

7. A computer-readable storage medium storing a computer program, characterized in that, The computer program is executed by the processor to perform the method described in any one of claims 1 to 5.

8. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method described in any one of claims 1 to 5 through the computer program.

Images