A vulnerability detection method, device, storage medium and electronic equipment

Abstract

The specification discloses a vulnerability detection method, device, storage medium and electronic equipment. First, a function call link to be verified detected from a target application program by a preset vulnerability detection tool and an interface corresponding to the function call link to be verified are determined as a target interface, and the function call link is used to represent a function call path formed by a function passing processed data as a parameter to other functions. Second, a target URL accessible by the target application program based on the target interface is determined. Then, a label corresponding to the target URL is queried, and the label is used to indicate whether sensitive data will be called when the target application program accesses the target URL. Then, the function call link to be verified is verified according to the label corresponding to the target URL, and a verification result is obtained. Finally, the target application program is subjected to vulnerability detection according to the verification result. The method can reduce the false positive rate of vulnerability detection on the source code.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method, apparatus, storage medium, and electronic device for vulnerability detection. Background Technology

[0002] With the continuous development of technology, many new internet information technologies are emerging, and various application systems have been developed to facilitate operation for different users. During the operation of these application systems, vulnerabilities frequently arise. These vulnerabilities stem from flaws in the specific implementation of hardware, software, protocols, or system security policies. Attackers can exploit these vulnerabilities to access or damage the system. Therefore, before an application system is put into use, vulnerability detection technology is typically used to detect its vulnerabilities in order to improve system security and protect user privacy.

[0003] Currently, white-box vulnerability detection techniques are typically used to analyze the static source code of applications to discover security vulnerabilities. However, because white-box vulnerability detection techniques cannot obtain actual business data from online operations, they often result in a high false positive rate when detecting vulnerabilities in the source code.

[0004] Therefore, how to reduce the false positive rate of vulnerability detection in source code is an urgent problem to be solved. Summary of the Invention

[0005] This specification provides a method, apparatus, storage medium, and electronic device for vulnerability detection, in order to reduce the false positive rate of vulnerability detection in source code.

[0006] The following technical solution is adopted in this specification:

[0007] This specification provides a method for vulnerability detection, including:

[0008] Identify the function call chain to be verified detected from the target application by a preset vulnerability detection tool, and the interface corresponding to the function call chain to be verified, as the target interface. The function call chain is used to represent the function call path formed by a function passing processed data as a parameter to other functions.

[0009] Determine the URL that the target application can access based on the target interface, and use it as the target URL;

[0010] The tags corresponding to the target URL are retrieved. The tags corresponding to the target URL are used to indicate whether sensitive data will be retrieved when the target application accesses the target URL.

[0011] Based on the tags corresponding to the target URL, the function call chain to be verified is verified to obtain the verification result;

[0012] Based on the verification results, vulnerability detection is performed on the target application.

[0013] Optionally, the target URL is determined as the URL that the target application can access based on the target interface, specifically including:

[0014] Obtain the pre-determined URLs that each application can access based on its respective interface;

[0015] Based on the URLs that each application can access through its own interface, the URL that the target application can access through the target interface is determined and used as the target URL.

[0016] Optionally, based on the URLs accessible by each application through its respective interface, the URL accessible by the target application through the target interface is determined as the target URL, specifically including:

[0017] Obtain the storage address in the database of the source code corresponding to the target application identified by the vulnerability detection tool, and use it as the target address;

[0018] Based on the preset first correspondence and the target address, the deployment device information corresponding to the target application is determined as the target device information. The first correspondence is used to represent the correspondence between the storage address of the source code of each application in the database and the deployment device information of each application.

[0019] Based on the predetermined second correspondence and the target device information, the URL that the target application can access based on the target interface is determined as the target URL. The second correspondence is used to represent the access relationship between each interface and each URL set in the application running on the deployment device.

[0020] Optionally, the tags corresponding to the target URL are retrieved, specifically including:

[0021] Based on the pre-determined correspondence between each URL and each tag, the tag corresponding to the target URL is retrieved. The correspondence between each URL and each tag is determined by obtaining the data retrieval results after the application accesses the URL through a preset traffic scanning tool.

[0022] Optionally, based on the predetermined correspondence between URLs and tags, the tags corresponding to the target URL are queried, specifically including:

[0023] The third correspondence is obtained by acquiring the domain names, URLs and tags that each application can access as determined by the traffic scanning tool. The fourth correspondence is obtained by acquiring the relationship between the deployment device information corresponding to each application and the domain names that each application can access.

[0024] Based on the third and fourth correspondences, determine the URLs that the applications running on each deployed device can access and the tags corresponding to each URL;

[0025] Based on the target device information, the URLs accessible by the applications running on each deployed device, and the tags corresponding to each URL, determine the URLs accessible by the target applications running on the deployed device and the tags corresponding to each URL, and query the tags corresponding to the target URL based on the target URL, the URLs accessible by the target applications running on the deployed device, and the tags corresponding to each URL.

[0026] Optionally, based on the target URL, the URLs accessible by the target application running on the deployment device, and the tags corresponding to each URL, the tags corresponding to the target URL are queried, specifically including:

[0027] Based on the syntax format of the URL, the URLs corresponding to each application are processed to obtain the URL paths corresponding to each application, and the correspondence between each URL path and each tag is determined based on the correspondence between each URL and each tag.

[0028] The URL path corresponding to the target URL is determined by a preset aspect ratio procedure;

[0029] Based on the URL path corresponding to the target URL, the URL paths corresponding to each URL accessible by the target application running on the deployment device, and the tags corresponding to each URL path, the tags corresponding to the target URL are retrieved.

[0030] Optionally, the URL path corresponding to the target URL is determined through a preset aspect ratio procedure, specifically including:

[0031] In response to a vulnerability detection request, obtain the aspect program used to process application routing information and the cut-off point of the aspect program in the noise reduction program;

[0032] Based on the cut point, the sectioning procedure is injected into the noise reduction procedure;

[0033] The noise reduction process is used to obtain the application routing information registered by the target application.

[0034] The aspect-oriented programming process determines the syntax format of the application routing information registered by the target application, and parses the application routing information registered by the target application according to the parsing method corresponding to the syntax format to determine the URL path corresponding to the target URL.

[0035] Optionally, determine the URLs that each application can access based on its respective interface, specifically including:

[0036] In response to a vulnerability detection request, obtain the aspect program used to process application routing information and the cut-off point of the aspect program in the noise reduction program;

[0037] Based on the cut point, the sectioning procedure is injected into the noise reduction procedure;

[0038] The noise reduction process obtains the application routing information registered by each application.

[0039] The aspect-oriented programming process determines the syntax format of the application routing information registered by each application, and parses the application routing information registered by each application according to the parsing method corresponding to the syntax format, thereby determining the URLs that each application can access based on its respective interface.

[0040] Optionally, the function call chain to be verified is verified based on the tags corresponding to the target URL to obtain the verification result, specifically including:

[0041] If the tag corresponding to the target URL is determined to be an abnormal tag, then the function call chain is found to have a vulnerability, and the vulnerability in the function call chain is fixed.

[0042] This specification provides a vulnerability detection device, comprising:

[0043] The acquisition module is used to determine the function call chain to be verified detected from the target application by a preset vulnerability detection tool, and the interface corresponding to the function call chain to be verified as the target interface. The function call chain is used to represent the function call path formed by a function passing the processed data as a parameter to other functions.

[0044] The determining module is used to determine the URL that the target application can access based on the target interface, and use it as the target URL;

[0045] The query module is used to query the tags corresponding to the target URL. The tags corresponding to the target URL are used to indicate whether sensitive data will be retrieved when the target application accesses the target URL.

[0046] The verification module is used to verify the function call chain to be verified based on the tags corresponding to the target URL, and obtain the verification result;

[0047] The detection module is used to perform vulnerability detection on the target application based on the verification results.

[0048] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned vulnerability detection method.

[0049] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned method for vulnerability detection.

[0050] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0051] The vulnerability detection method provided in this specification first identifies the function call chain to be verified detected from the target application using a preset vulnerability detection tool, along with the corresponding interface, as the target interface. The function call chain represents the function call path formed when a function passes processed data as a parameter to another function. Second, the URLs accessible by the target application based on the target interface are identified as the target URLs. Then, the tags corresponding to the target URLs are retrieved. These tags indicate whether sensitive data will be retrieved when the target application accesses the target URL. Next, the function call chain to be verified is validated based on the tags corresponding to the target URLs, yielding the verification results. Finally, vulnerability detection is performed on the target application based on the verification results.

[0052] As can be seen from the above method, this approach can determine the URLs accessible by the target application based on the target interface, which are then used as the target URLs. Next, the tags corresponding to the target URLs are retrieved. Then, based on the tags corresponding to the target URLs, the function call chain to be verified is validated, and the verification results are obtained. Finally, based on the verification results, vulnerability detection is performed on the target application. This reduces the false positive rate of vulnerability detection on source code. Attached Figure Description

[0053] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and their descriptions, serving to explain this specification and do not constitute an undue limitation thereof.

[0054] In the picture:

[0055] Figure 1 A flowchart illustrating a vulnerability detection method provided in an embodiment of this specification;

[0056] Figure 2 This is a schematic diagram of a vulnerability detection process provided in an embodiment of this specification;

[0057] Figure 3 A schematic diagram of the structure of a vulnerability detection device provided in the embodiments of this specification;

[0058] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this specification. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0060] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0061] In this specification, a security aspect refers to a method that uses aspect-oriented programming (AOP) to dynamically add or modify aspect programs that implement security-related business logic within the runtime logic of a business application without modifying the application itself. This decouples the program implementing the security aspect from the business application, thereby avoiding development iteration problems caused by high coupling.

[0062] The aspect program mentioned here refers to an enhancement program that implements security aspect functionality based on business logic. By using aspect-oriented programming, aspect programs can be injected into corresponding pointcuts in the business application. These aspect programs are triggered and executed during the execution of the business application to achieve the required security aspect functionality.

[0063] When a business application executes its business logic, it typically does so through function calls. Therefore, any function within the business application can be used as a pointcut for an aspect, as mentioned above, and the aspect can be injected into the corresponding pointcut. This ensures that when the business application reaches a pointcut—that is, when it calls the function corresponding to that pointcut—the injected aspect is executed.

[0064] Typically, the code responsible for injecting aspects into pointcuts is highly reusable. Therefore, the program implementing this process is usually abstracted into a service module, namely the aspect daemon. The aspect daemon can obtain the aspects to be injected and the pointcuts in the business application from a third party that provides secure aspect services, and inject the corresponding aspects at the pointcuts in the business application after the application container starts.

[0065] A business application can be a business application that provides business services on the servers of a business platform. These business services can be services provided by the business platform's servers to users, such as query services and payment services. Business services can also be services provided by one server of the business platform to other servers, such as settlement services.

[0066] Of course, as described above, to decouple the security aspect service program from the business application, this specification employs aspect-oriented programming (AOP) to allow the security aspect service program and the business application to intertwine during business execution, while remaining parallel and independently maintainable. Therefore, unlike the business application provider, the third party providing the security aspect service can manage the content related to the security aspect service through a management platform, such as configuring security aspect service management policies, iterating aspect program versions, configuring aspect program injection rules, etc. Of course, the provider of the security aspect service can be either a third party or a business application provider.

[0067] When managing the content related to security aspect services, the management platform can record various configuration information through configuration files, such as the configuration of various policies and the injection rules for aspect programs. This allows the aspect base to inject aspect programs according to the configuration files, or the management platform to implement security aspect services according to the configuration files.

[0068] In practical applications, service providers typically set up data centers containing several physical machines or servers, providing the physical resources required by business applications. Of course, a business application may not require all the physical resources of a single physical machine; therefore, virtualization technology is often used to run multiple virtual hosts on a single physical machine. Each virtual host is independent, sharing a portion of the physical resources of the physical machine. Application containers can then be injected into these virtual hosts, and business applications can run through these containers. Application containers typically contain the physical resources allocated to them, such as CPU and memory, as well as the runtime environment provided to them, such as the operating system (OS) or other runtime environment data (e.g., container serial number, assigned IP address, application name, tenant, environment variables, etc.). Business applications can be injected into these application containers to execute their business logic.

[0069] In scenarios where secure aspect-based business operations are performed, the server of the business provider or a third party providing secure aspect services can provide a management platform. The management platform can manage the content involved in secure aspect services and inject the aspect base into the application container. The aspect program is then injected into the business application in the business application container through the aspect base, thereby providing secure aspect service support for the application container of the business provider.

[0070] Therefore, the aspect base can be pre-injected into the application container of the service provider. Typically, when the application container starts, the operating system provided to the application container is invoked, and the pre-injected aspect base runs. The aspect base obtains the aspect and the pointcut of the business application from the management platform and injects the aspect at the pointcut of the business application within the application container. Alternatively, the aspect base can also obtain the aspect and the pointcut of the business application from the management platform during the execution of the business application and inject the aspect at the pointcut of the business application within the application container.

[0071] Of course, how the faceting base obtains the information required for injecting the faceting program from the management platform can be configured as needed. For example, it can actively pull the required information from the management platform according to the configuration file, or the management platform can actively send the required information to the faceting base.

[0072] After injecting an aspect into a pointcut of a business application, the business application can trigger the aspect during execution to achieve the corresponding security aspect business function.

[0073] In this specification, the security aspect business function implemented by the aspect program refers to: parsing application routing information and determining the URL path corresponding to the application routing information.

[0074] Figure 1 This is a flowchart illustrating a vulnerability detection method described in this specification, which specifically includes the following steps:

[0075] S100: Determine the function call chain to be verified detected from the target application by a preset vulnerability detection tool, and the interface corresponding to the function call chain to be verified, as the target interface. The function call chain is used to represent the function call path formed by a function passing processed data as a parameter to other functions.

[0076] In the embodiments of this specification, the execution subject of the vulnerability detection method can refer to electronic devices such as servers or desktop computers. For ease of description, the vulnerability detection method provided in this specification will be described below using only a server as the execution subject.

[0077] In the embodiments described in this specification, the server can determine the function call chain to be verified detected from the target application by a preset vulnerability detection tool, and the interface corresponding to the function call chain to be verified, as the target interface. The vulnerability detection tool mentioned here can refer to a white-box vulnerability detection tool, such as Jtest, Jcontract, CodeWizard, etc.

[0078] The function call chain mentioned here refers to the function call path formed when a function passes processed data as an argument to other functions. Specifically, during the vulnerability detection process, taint analysis technology is used to mark sensitive data (usually from external input to the program) as tainted data. Then, by tracing the flow of sensitive data, it can be determined whether it will affect certain critical program operations. Specific rules are used to track and analyze the propagation process of sensitive data in the source code to determine the function call chain. The interface corresponding to the function call chain mentioned here can refer to the fully qualified class name and method name of the interface that calls sensitive data in the source code of the target application.

[0079] S102: Determine the URL that the target application can access based on the target interface, and use it as the target URL.

[0080] In practical applications, the target interface identified by vulnerability detection tools cannot be associated with the URLs accessible by each application based on its respective interface, as determined by aspect-oriented programming. This makes it impossible to determine the URLs accessible by the target interface. Therefore, the server can associate the data identified by the vulnerability detection tool and the data identified by the aspect-oriented programming based on the common data types found between them, thus obtaining the URLs accessible by the target interface.

[0081] In the embodiments described in this specification, the server can determine the URL that the target application can access based on the target interface, and use it as the target URL.

[0082] Furthermore, the server can obtain pre-determined Uniform Resource Locators (URLs) accessible to each application based on its respective interface. The URL format is: protocol: / / username:password@subdomain.domain.top-level-domain:port / directory / filename.fileex?parameter=value#flag. Here, the port / directory / filename.fileex part of the URL format can be called the URL path. The parameter=value#flag in the URL format can be called the URL parameter. The interfaces of each application mentioned here can refer to the fully qualified class names and method names corresponding to the interfaces that call data in the source code of each application. The URL mentioned here can refer to the representation method used to specify the location of information on the World Wide Web service program, commonly known as a website address.

[0083] In the embodiments described in this specification, the server can use aspect-oriented programming to determine the URLs that each application can access based on its respective interface.

[0084] Specifically, in response to a vulnerability detection request, the server can obtain the aspect used to process application routing information and the pointcut of that aspect in the noise reduction process. The application routing information mentioned here can refer to an aggregation service that exposes internal cluster services to the outside world through an externally accessible URL. This externally accessible URL can consist of information such as the domain name, protocol, path of the application routing rule, and corresponding backend service.

[0085] Secondly, the server can inject aspect ratios into the noise reduction program based on the cutoff point.

[0086] Then, the server can obtain the application routing information registered by each application through the noise reduction program.

[0087] Finally, the server can use aspect-oriented programming to determine the syntax format of the application routing information registered by each application, and parse the application routing information registered by each application according to the parsing method corresponding to the syntax format, so as to determine the URLs that each application can access based on its own interface.

[0088] The server can first determine the syntax format of the application routing information, such as the special symbols contained in the application routing information, and then parse the application routing information registered by each application according to the parsing method corresponding to the special symbols, and determine the URLs that each application can access based on its own interface.

[0089] For example, if the server determines that the application routing information contains the special character "{}", it can use RESTful variable parsing to parse the application routing information registered by each application and determine the URLs accessible by each application based on its respective interface. As another example, if the server determines that the application routing information contains the special character "*", it can use regular expression wildcard parsing to parse the application routing information registered by each application and determine the URLs accessible by each application based on its respective interface. And as yet another example, if the server determines that the application routing information only contains the special character " / ", it can use static variable parsing to parse the application routing information registered by each application and determine the URLs accessible by each application based on its respective interface.

[0090] Of course, the server can also use RESTful variable parsing methods, regular expression wildcard parsing methods, and static variable parsing methods to parse the application routing information registered by each application, and obtain the URL path in the URL that each application can access based on its own interface.

[0091] It should be noted that this manual does not limit the methods for parsing application routing information.

[0092] Then, the server can determine the target URL that the target application can access based on the target interface, according to the URLs that each application can access based on its own interface.

[0093] Specifically, the server can obtain the storage address in the database of the source code corresponding to the target application identified by the vulnerability detection tool, and use it as the target address.

[0094] Secondly, the server can determine the deployment device information corresponding to the target application based on the preset first correspondence and the target address, and use this as the target device information. The first correspondence mentioned here represents the mapping between the storage address of the source code for each application in the database and the deployment device information for each application. The storage address of the source code for each application in the database and the deployment device information for each application in the first correspondence are obtained from the application management platform.

[0095] The deployment equipment mentioned here can refer to a deployment unit. A deployment unit is a self-contained set capable of completing all business operations. This set contains all the services required by all businesses, as well as the data allocated to this unit. Several units are deployed in all data centers across the entire site. The number of units in each data center is variable. Each unit deploys all the applications required by the system, and the data is a portion of the full data after being divided according to a certain dimension. In other words, deployment equipment can be understood as the data center where the computing resources used by the application reside. Deployment equipment information refers to the identification number of the deployment equipment.

[0096] For example, the server can construct a triple S (target address, function call chain, target interface) based on the target address, function call chain, and target interface. Furthermore, the server can construct a triple A (the storage address of the source code for each application in the database, the deployment device for each application, and the domain name for each application) based on the storage address of the source code for each application in the database, the deployment device for each application, and the domain name for each application, all determined from the application management platform.

[0097] As can be seen, both triples S and A contain the storage addresses of the source code in the database. The server can match the target address with the storage addresses of the source code corresponding to each application in the database to determine the deployment device information corresponding to the target application, which is then used as the target device information. Based on the target device information, a quadruple S1 (target address, function call chain, target interface, target device information) is constructed.

[0098] Then, the server can determine the URL that the target application can access based on the target interface, using the pre-determined second correspondence and the target device information, as the target URL. The second correspondence mentioned here represents the access relationship between each interface set in the application running on the deployment device and each URL. The deployment device corresponding to each application, the interface corresponding to each application, and the URL that each application can access based on its respective interface in the second correspondence are obtained from the aspect-oriented programming.

[0099] For example, the server can construct a tuple T(deployment device information for each application, (URLs accessible by each application based on its respective interface, and interfaces corresponding to each application)) based on the URLs accessible by each application based on its respective interface, the corresponding interfaces of each application, and the deployment devices of each application. Here, there is a one-to-one correspondence between the URLs accessible by each application based on its respective interface and the corresponding interfaces of each application.

[0100] As can be seen, both the quadruple S1 and the binary tuple T contain information about the deployment device and the interface. The server can match the deployment device information in quadruple S1 with the deployment device information in binary tuple T, and match the interface information in quadruple S1 with the interface information in binary tuple T to determine the URL that the target application can access based on the target interface, which is then used as the target URL. Based on the target URL, the server constructs quadruple S2 (target address, function call chain, target device information, (target URL, target interface)).

[0101] S104: Query the tag corresponding to the target URL. The tag corresponding to the target URL is used to indicate whether sensitive data will be retrieved when the target application accesses the target URL.

[0102] In practical applications, white-box vulnerability detection technology can only analyze the static source code of an application and cannot obtain the actual business data of online operation. This results in a high false positive rate for vulnerability detection based on the source code. Therefore, the server can correlate the data identified by the vulnerability detection tool and the data identified by the traffic scanning tool based on the common data types found between them, thus obtaining the tags corresponding to the target URL.

[0103] In the embodiments described in this specification, the server can query the tags corresponding to the target URL. These tags indicate whether sensitive data will be retrieved when the target application accesses the target URL. For example, tags indicating whether the URL is a publicly accessible URL. Another example is tags indicating whether the URL contains externally available URLs.

[0104] Furthermore, the server can query the tag corresponding to the target URL based on the pre-determined correspondence between each URL and each tag. The correspondence between each URL and each tag is determined by the data retrieval results obtained by the application after accessing the URL through a preset traffic scanning tool.

[0105] Specifically, the server can obtain the domain names accessible to each application, the mapping between each URL and each tag as determined by the traffic scanning tool, as the third mapping relationship; and obtain the pre-determined relationship between the deployment device information corresponding to each application and the domain names accessible to each application, as the fourth mapping relationship. The deployment device information corresponding to each application and the domain names accessible to each application in the fourth mapping relationship mentioned here are obtained from the application management platform.

[0106] For example, the server can construct a triple F (domain name of each application, URL, and tag) based on the correspondence between the domain name of each application, the URL, and the tag of each URL, as determined by the traffic scanning tool.

[0107] The server can construct a triple A (the storage address of the source code of each application in the database, the deployment device of each application, and the domain name of each application) based on the storage address of the source code of each application in the database, the deployment device of each application, and the domain name of each application, which are determined from the application management platform.

[0108] Secondly, the server can determine the URLs that the applications running on each deployed device can access, as well as the tags corresponding to each URL, based on the third and fourth correspondences.

[0109] As can be seen, both triple F and triple A contain domain names. The server can match the domain names in triple F with the domain names in triple A to determine the URLs accessible by the applications running on each deployed device and the corresponding tags for each URL. Based on the URLs accessible by the applications running on each deployed device and the corresponding tags for each URL, the server constructs a quadruple A1 (domain name corresponding to each application, URLs, tags corresponding to each URL, and deployment device corresponding to each application).

[0110] Finally, the server can determine the URLs accessible by the target application running on the deployment device and the corresponding tags of each URL based on the target device information, the URLs accessible by the application running on each deployment device, and the tags corresponding to each URL. Based on the target URL, the URLs accessible by the target application running on the deployment device, and the tags corresponding to each URL, the server can query the tags corresponding to the target URL.

[0111] As can be seen, both quadruplets A1 and S2 contain the deployment device and the URL. The server can match the deployment device information in quadruplets A1 with the deployment device in quadruplets S2 to determine the URLs accessible by the target application running on the deployment device and the tags corresponding to each URL. Then, it matches each URL in quadruplets A1 with the target URL in quadruplets S2 to retrieve the tags corresponding to the target URL. Based on the tags corresponding to the target URL, it constructs quadruplets S3 (target address, function call chain, target device information, (target interface, target URL, tags corresponding to the target URL)).

[0112] In practical applications, an application interface may access multiple URLs, meaning a single URL path can correspond to multiple URLs. Based on this, the server can process the URLs identified by traffic scanning tools to obtain URL paths, and then use aspect-oriented programming to process application routing information to obtain the URL paths corresponding to that application routing information. Finally, these URL paths are matched with the URL paths in the application routing information for each application to determine which URLs the application interface has accessed.

[0113] In the embodiments of this specification, the server can process the URLs corresponding to each application according to the syntax format of the URL to obtain the URL paths corresponding to each application, and determine the correspondence between each URL path and each tag according to the correspondence between each URL and each tag.

[0114] Specifically, the server can truncate the URL according to a general URL format, obtaining the URL domain, URL path, and URL parameters. These URL parameters include settings that can be personalized to the website based on user preferences. For example, URL parameters consisting of a username and password can be used to verify user identity. Furthermore, URL parameters containing externally accessible URLs can be used to access those URLs.

[0115] Secondly, the server can determine the URL path corresponding to the target URL through a pre-defined aspect ratio.

[0116] Then, the server can query the tags corresponding to the target URL based on the URL path corresponding to the target URL, the URL paths corresponding to each URL accessible by the target application running on the deployed device, and the tags corresponding to each URL path.

[0117] Specifically, in response to a vulnerability detection request, the server can obtain the aspect used to process application routing information and the pointcut of that aspect in the noise reduction program. Secondly, the server can inject the aspect into the noise reduction program based on the pointcut. Then, the server can obtain the application routing information registered by the target application through the noise reduction program. Finally, the server can use the aspect to determine the syntax format of the application routing information registered by the target application, and parse the application routing information according to the parsing method corresponding to the syntax format to determine the URL path corresponding to the target URL.

[0118] The server can construct a tuple T1 (deployment device corresponding to each application, URL path corresponding to the URL that each application can access based on its own interface, and interface corresponding to each application) based on the URL path corresponding to the target URL.

[0119] The server can then match the URL path corresponding to the target URL with the URL paths corresponding to each application to retrieve the tags corresponding to the target URL. Specifically, as follows... Figure 2 As shown.

[0120] Figure 2 This is a schematic diagram of a vulnerability detection process provided in an embodiment of this specification.

[0121] exist Figure 2 In the database, the triple A (the storage address of the source code of each application in the database, the deployment device of each application, and the domain name of each application) and the triple S (target address, function call chain, target interface) both contain the storage address of the source code in the database. Therefore, the server can construct the quadruple S1 (target address, function call chain, target interface, target device information).

[0122] Secondly, both the quadruple S1 and the binary T1 (deployment device corresponding to each application, URL path corresponding to the URL that each application can access based on its own interface, and interface corresponding to each application) contain deployment devices and interfaces. Therefore, the server can construct the quadruple T2 (target address, function call chain, target device information, target interface, and URL path corresponding to the target URL)).

[0123] Then, the server can process each URL in the triple F (domain name corresponding to each application, each URL, and tag corresponding to each URL) to obtain the triple F1 (domain name corresponding to each application, each URL path, and tag corresponding to each URL path). Both triple F1 and triple A contain domain names, therefore, the server can construct the quadruple F2 (the storage address of the source code corresponding to each application in the database, the domain name corresponding to each application, the deployment device corresponding to each application, each URL path, and tag corresponding to each URL path).

[0124] Finally, both quadruplets F2 and T2 contain the deployment device and the URL path. Therefore, the server can construct quadruplet F3(target address, function call chain, target device information, (target interface, URL path corresponding to the target URL, and the tag of the URL path corresponding to the target URL)).

[0125] In the embodiments of this specification, the server includes a data connector, which is used to determine the association between various data sets in order to construct sets such as triples and quadruples.

[0126] S106: Verify the function call chain to be verified based on the tag corresponding to the target URL, and obtain the verification result.

[0127] In practical applications, white-box vulnerability detection techniques are typically used to analyze the static source code of an application to discover security vulnerabilities. However, because white-box vulnerability detection techniques cannot obtain actual business data from online operations, they often result in a high false positive rate when detecting vulnerabilities in the source code.

[0128] For example, a white-box vulnerability detection tool might detect that an operation on sensitive resources has been performed at the underlying level, indicating an privilege escalation vulnerability. However, if the user actually performs a resource query operation on public data within a controlled request, this could lead to a false positive for the privilege escalation vulnerability.

[0129] For example, a white-box vulnerability detection tool might detect that the underlying system initiated a request, indicating an SSRF vulnerability. However, if the user-controlled request only transmits concatenated URL parameters and does not access an internal website through an externally controlled URL, this could lead to a false positive for an SSRF vulnerability.

[0130] In the embodiments of this specification, the server can verify the function call chain to be verified based on the tags corresponding to the target URL, and obtain the verification result.

[0131] Specifically, the server verifies the function call chain to be verified based on the vulnerability type corresponding to the function call chain to be verified and the tag corresponding to the target URL, and determines whether the function call chain has vulnerabilities.

[0132] In practical applications, function call chains transmit a large amount of traffic data, resulting in a large number of tags associated with them. Based on this, the server can determine whether vulnerabilities exist in the function call chain by analyzing the tags corresponding to each target URL transmitted within it.

[0133] In the embodiments of this specification, if the tag corresponding to the target URL is determined to be an abnormal tag, a vulnerability is identified in the function call chain, and the vulnerability in the function call chain is repaired. The abnormal tag mentioned here can refer to a target URL that does not meet the security criteria for data propagation. For example, if the vulnerability type is an escalation vulnerability, the normal tag is a non-public URL. As another example, if the vulnerability type is an SSRF vulnerability, the normal tag is a URL that contains externally accessible information.

[0134] If it is determined that all tags corresponding to the target URL are normal tags, then the function call chain is confirmed to be free of vulnerabilities. Normal tags, as mentioned here, can refer to target URLs that meet security criteria for data propagation. For example, if the vulnerability type is an escalation vulnerability, a normal tag would be a publicly accessible URL. As another example, if the vulnerability type is an SSRF vulnerability, a normal tag would be a URL that does not contain externally accessible elements.

[0135] In other words, if there is even one abnormal tag among the tags corresponding to each target URL transmitted in the function call chain, the function call chain is considered to have a vulnerability.

[0136] S108: Based on the verification results, perform vulnerability detection on the target application.

[0137] In the embodiments described in this specification, the server can perform vulnerability detection on the target application based on the verification results. That is, if the server determines that there is no vulnerability in the function call chain, it marks the function call chain detected by the vulnerability detection tool as a false positive, thereby reducing the false positive rate of vulnerability detection on the source code.

[0138] In practical applications, as online services operate, servers need to correlate newly added business data. Based on this, servers can retrieve various types of data according to a set time period to update the database.

[0139] In the embodiments of this specification, the server can, according to a set time period, obtain the storage address in the database of the source code corresponding to the target application identified by the vulnerability detection tool, the function call chain to be verified detected from the target application, and the interface corresponding to the function call chain to be verified. It can also obtain the URLs accessible by each application based on its respective interface, as determined by the aspect-oriented programming, and the deployment device corresponding to each application. Furthermore, it can obtain the storage address in the database of the source code corresponding to each application, the deployment device corresponding to each application, and the domain name corresponding to each application, as determined from the application management platform. Finally, it can obtain the correspondence between the domain name, URL, and tag corresponding to each application, as determined by the traffic scanning tool. All of this data is stored in the database for database updates.

[0140] As can be seen from the above method, this method determines the target application's accessible URL based on the URLs accessible by each application through its own interface. Then, based on the pre-determined correspondence between URLs and tags, the tags corresponding to the target URL are retrieved. Next, the function call chain to be verified is validated according to the tags corresponding to the target URL, yielding the verification results. Finally, based on the verification results, vulnerability detection is performed on the target application. This reduces the false positive rate of vulnerability detection in source code.

[0141] The above is a vulnerability detection method provided by the embodiments of this specification. Based on the same idea, this specification also provides corresponding devices, storage media and electronic devices.

[0142] Figure 3 This is a schematic diagram of a vulnerability detection device provided in an embodiment of this specification. The device includes:

[0143] The acquisition module 300 is used to determine the function call chain to be verified detected from the target application by a preset vulnerability detection tool, and the interface corresponding to the function call chain to be verified, as the target interface. The function call chain is used to represent the function call path formed by a function passing the processed data as a parameter to other functions.

[0144] The determining module 302 is used to determine the URL that the target application can access based on the target interface, and use it as the target URL;

[0145] The query module 304 is used to query the tags corresponding to the target URL. The tags corresponding to the target URL are used to indicate whether sensitive data will be retrieved when the target application accesses the target URL.

[0146] The verification module 306 is used to verify the function call chain to be verified based on the tags corresponding to the target URL, and obtain the verification result;

[0147] The detection module 308 is used to perform vulnerability detection on the target application based on the verification results.

[0148] Optionally, the determining module 302 is specifically used to obtain the URLs that each application can access based on its respective interface, and determine the URL that the target application can access based on the target interface, based on the URLs that each application can access based on its respective interface, as the target URL.

[0149] Optionally, the determining module 302 is specifically used to: obtain the storage address in the database of the source code corresponding to the target application determined by the vulnerability detection tool, as the target address; determine the deployment device information corresponding to the target application according to a preset first correspondence relationship and the target address, as the target device information; the first correspondence relationship is used to represent the correspondence between the storage address in the database of the source code corresponding to each application and the deployment device information corresponding to each application; and determine the URL that the target application can access based on the target interface according to a preset second correspondence relationship and the target device information, as the target URL; the second correspondence relationship is used to represent the access relationship between each interface set in the application running on the deployment device and each URL.

[0150] Optionally, the query module 304 is specifically used to query the tag corresponding to the target URL based on the pre-determined correspondence between each URL and each tag. The correspondence between each URL and each tag is determined by obtaining the data retrieval results after the application accesses the URL through a preset traffic scanning tool.

[0151] Optionally, the query module 304 is specifically used to: obtain the correspondence between the domain names, URLs and tags that each application can access as determined by the traffic scanning tool, as a third correspondence; obtain the relationship between the pre-determined deployment device information corresponding to each application and the domain names that each application can access, as a fourth correspondence; determine the URLs that the applications running on each deployment device can access and the tags corresponding to each URL based on the third and fourth correspondences; determine the URLs that the target application running on the deployment device can access and the tags corresponding to each URL based on the target device information, the URLs that the applications running on each deployment device can access and the tags corresponding to each URL; and query the tags corresponding to the target URL based on the target URL, the URLs that the target application running on the deployment device can access and the tags corresponding to each URL.

[0152] Optionally, the query module 304 is specifically configured to: process the URLs corresponding to each application according to the syntax format of the URL to obtain the URL paths corresponding to each application; determine the correspondence between each URL path and each tag according to the correspondence between each URL and each tag; determine the URL path corresponding to the target URL through a preset aspect ratio program; and query the tags corresponding to the target URL based on the URL path corresponding to the target URL, the URL paths corresponding to each URL accessible by the target application running on the deployment device, and the tags corresponding to each URL path.

[0153] Optionally, the query module 304 is specifically configured to, in response to a vulnerability detection request, obtain an aspect program for processing application routing information and the pointcut of the aspect program in the noise reduction program, inject the aspect program into the noise reduction program according to the pointcut, obtain the application routing information registered by the target application through the noise reduction program, determine the syntax format of the application routing information registered by the target application through the aspect program, and parse the application routing information registered by the target application according to the parsing method corresponding to the syntax format to determine the URL path corresponding to the target URL.

[0154] Optionally, the query module 304 is specifically configured to, in response to a vulnerability detection request, obtain the aspect program used to process application routing information and the pointcut of the aspect program in the noise reduction program, inject the aspect program into the noise reduction program according to the pointcut, obtain the application routing information registered by each application through the noise reduction program, determine the syntax format of the application routing information registered by each application through the aspect program, and parse the application routing information registered by each application according to the parsing method corresponding to the syntax format to determine the URLs that each application can access based on its respective interface.

[0155] Optionally, the verification module 306 is specifically used to determine that the function call chain has a vulnerability if it is determined that the tag corresponding to the target URL is an abnormal tag, and to fix the vulnerability in the function call chain.

[0156] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can be used to perform the above-described actions. Figure 1 The methods provided for vulnerability detection.

[0157] The embodiments in this specification also provide Figure 4 The diagram shows the structure of the electronic device. Figure 4 At the hardware level, this electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then executes it to achieve the above. Figure 1 The methods provided for vulnerability detection.

[0158] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software. In other words, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0159] It should be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and regulations of the locality and with authorization from the owner of the relevant device.

[0160] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0161] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0162] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0163] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0164] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0166] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0168] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0169] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0170] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0171] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0172] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0173] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0174] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0175] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A vulnerability detection method, comprising: Identify the function call chain to be verified detected from the target application by a preset vulnerability detection tool, and the interface corresponding to the function call chain to be verified, as the target interface. The function call chain is used to represent the function call path formed by a function passing processed data as a parameter to other functions. Determine the URL that the target application can access based on the target interface, and use it as the target URL; The tags corresponding to the target URL are retrieved. The tags corresponding to the target URL are used to indicate whether sensitive data will be retrieved when the target application accesses the target URL. Based on the tags corresponding to the target URL, the function call chain to be verified is verified to obtain the verification result; Based on the verification results, vulnerability detection is performed on the target application.

2. The method as described in claim 1, wherein determining the URL accessible by the target application based on the target interface as the target URL, specifically includes: Obtain the pre-determined URLs that each application can access based on its respective interface; Based on the URLs that each application can access through its own interface, the URL that the target application can access through the target interface is determined and used as the target URL.

3. The method as described in claim 2, wherein determining the target URL as the target URL based on the URLs accessible by each application through its respective interface, specifically includes: Obtain the storage address in the database of the source code corresponding to the target application identified by the vulnerability detection tool, and use it as the target address; Based on the preset first correspondence and the target address, the deployment device information corresponding to the target application is determined as the target device information. The first correspondence is used to represent the correspondence between the storage address of the source code of each application in the database and the deployment device information of each application. Based on the predetermined second correspondence and the target device information, the URL that the target application can access based on the target interface is determined as the target URL. The second correspondence is used to represent the access relationship between each interface and each URL set in the application running on the deployment device.

4. The method as described in claim 3, specifically including: retrieving the tag corresponding to the target URL, includes: Based on the pre-determined correspondence between each URL and each tag, the tag corresponding to the target URL is retrieved. The correspondence between each URL and each tag is determined by obtaining the data retrieval results after the application accesses the URL through a preset traffic scanning tool.

5. The method as described in claim 4, wherein the tag corresponding to the target URL is queried based on the predetermined correspondence between each URL and each tag, specifically includes: The third correspondence is obtained by acquiring the domain names, URLs and tags that each application can access as determined by the traffic scanning tool. The fourth correspondence is obtained by acquiring the relationship between the deployment device information corresponding to each application and the domain names that each application can access. Based on the third and fourth correspondences, determine the URLs that the applications running on each deployed device can access and the tags corresponding to each URL; Based on the target device information, the URLs accessible by the applications running on each deployed device, and the tags corresponding to each URL, determine the URLs accessible by the target applications running on the deployed device and the tags corresponding to each URL, and query the tags corresponding to the target URL based on the target URL, the URLs accessible by the target applications running on the deployed device, and the tags corresponding to each URL.

6. The method as described in claim 5, wherein querying the tags corresponding to the target URL based on the target URL, the URLs accessible by the target application running on the deployment device, and the tags corresponding to each URL, specifically includes: Based on the syntax format of the URL, the URLs corresponding to each application are processed to obtain the URL paths corresponding to each application, and the correspondence between each URL path and each tag is determined based on the correspondence between each URL and each tag. The URL path corresponding to the target URL is determined by a preset aspect ratio procedure; Based on the URL path corresponding to the target URL, the URL paths corresponding to each URL accessible by the target application running on the deployment device, and the tags corresponding to each URL path, the tags corresponding to the target URL are retrieved.

7. The method as described in claim 6, wherein determining the URL path corresponding to the target URL through a preset aspect ratio procedure, specifically includes: In response to a vulnerability detection request, obtain the aspect used to process application routing information and the pointcut of the aspect in the business application; Based on the cut-off point, the aspect program is injected into the business application; The application routing information registered by the target application is obtained through the business application. The aspect-oriented programming process determines the syntax format of the application routing information registered by the target application, and parses the application routing information registered by the target application according to the parsing method corresponding to the syntax format to determine the URL path corresponding to the target URL.

8. The method as described in claim 2, wherein determining the URLs that each application can access based on its respective interface specifically includes: In response to a vulnerability detection request, obtain the aspect used to process application routing information and the pointcut of the aspect in the business application; Based on the cut-off point, the aspect program is injected into the business application; The application routing information registered by each application is obtained through the business application. The aspect-oriented programming process determines the syntax format of the application routing information registered by each application, and parses the application routing information registered by each application according to the parsing method corresponding to the syntax format, thereby determining the URLs that each application can access based on its respective interface.

9. The method as described in claim 1, wherein the function call chain to be verified is verified based on the tag corresponding to the target URL to obtain a verification result, specifically includes: If the tag corresponding to the target URL is determined to be an abnormal tag, then the function call chain is found to have a vulnerability, and the vulnerability in the function call chain is fixed.

10. A vulnerability detection apparatus, comprising: The acquisition module is used to determine the function call chain to be verified detected from the target application by a preset vulnerability detection tool, and the interface corresponding to the function call chain to be verified as the target interface. The function call chain is used to represent the function call path formed by a function passing the processed data as a parameter to other functions. The determining module is used to determine the URL that the target application can access based on the target interface, and use it as the target URL; The query module is used to query the tags corresponding to the target URL. The tags corresponding to the target URL are used to indicate whether sensitive data will be retrieved when the target application accesses the target URL. The verification module is used to verify the function call chain to be verified based on the tags corresponding to the target URL, and obtain the verification result; The detection module is used to perform vulnerability detection on the target application based on the verification results.

11. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1-9.

12. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1-9.

Images