Code dependency analysis method and computing device

Abstract

The application provides a code dependency analysis method and a computing device. In an embodiment, the method comprises: obtaining target code and prohibition information corresponding to the target code, the target code comprising a plurality of function sets; each function set in the plurality of function sets comprising at least one function, and the prohibition information indicating prohibited dependency relationships of the plurality of function sets; determining dependency information corresponding to the target code, the dependency information indicating dependency relationships between the plurality of function sets; and determining a target result based on the prohibition information and the dependency information, the target result indicating whether the prohibited dependency relationships exist in the dependency information of the target code. Thus, the technical solution provided by the embodiment of the application can determine the dependency between the function sets in the code, and analyze whether there is an undue prohibited dependency relationship in the code based on the dependency between the function sets, thereby intercepting the occurrence of architecture corruption and improving the security of code development.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software development, and particularly relates to a code dependency analysis method and a computing device. BACKGROUND

[0002] At present, in the software architecture design stage, software levels or modules are often divided according to software layered architecture or other module design best practices, and interfaces are carefully designed between the levels and modules to achieve the design goal of high cohesion and low coupling, and reduce software complexity. However, with the development process, architecture corruption may occur at any time, resulting in level or module dependencies that violate design principles. SonarQube uses a dependency structure matrix (DSM) to simply show the dependencies between different components, and the navigation level between these components can be the most basic class level, package or file level.

[0003] However, although DSM can intuitively show the dependencies of other components of a component, it cannot directly view the dependencies between more components, and it is difficult to analyze unnecessary module dependencies. In the code development and submission stage, it is expected to analyze the problem of unnecessary module dependencies, discover the occurrence of architecture corruption, and improve the security of code development. SUMMARY

[0004] Embodiments of the present application provide a code dependency analysis method and a computing device, which can determine the dependencies between function sets in the code, and analyze whether there is an unnecessary prohibited dependency relationship in the code based on the dependencies between the function sets, thereby intercepting the occurrence of architecture corruption and improving the security of code development.

[0005] In a first aspect, embodiments of the present application provide a code dependency analysis method, including: obtaining target code and prohibited information corresponding to the target code, the target code including a plurality of function sets; each function set in the plurality of function sets including at least one function, and the prohibited information indicating prohibited dependency relationships of the plurality of function sets; determining dependency information corresponding to the target code, the dependency information indicating dependency relationships between the plurality of function sets; and based on the prohibited information and the dependency information, determining a target result, the target result indicating whether there is a prohibited dependency relationship in the dependency information of the target code.

[0006] In this scheme, the dependencies between function sets in the code can be determined, and whether there is an unnecessary prohibited dependency relationship in the code can be analyzed based on the dependencies between the function sets, thereby intercepting the occurrence of architecture corruption and improving the security of code development.

[0007] In a possible implementation, the prohibition dependency relationship indicates that the first configuration item prohibits dependency on the second configuration item; the first configuration item is used to match at least one function set in the plurality of function sets; and the second configuration item is used to match at least one function set in the plurality of function sets.

[0008] In a possible implementation, the target result is determined based on the prohibition information and the dependency information, including: determining at least one function set matched by the first configuration item from the plurality of function sets; determining at least one function set matched by the second configuration item from the plurality of function sets; and determining, based on the dependency information, whether each function set matched by the first configuration item depends on the function set matched by the second configuration item, to obtain the target result.

[0009] In a possible implementation, the determination of whether each function set matched by the first configuration item depends on the function set matched by the second configuration item based on the dependency information to obtain the target result includes:

[0010] When each function set matched by the first configuration item does not depend on the function set matched by the second configuration item, it is determined that the prohibition dependency relationship does not exist in the dependency information of the target code; and when any function set matched by the first configuration item depends on the function set matched by the second configuration item, it is determined that the prohibition dependency relationship exists in the dependency information of the target code.

[0011] In this scheme, whether there is a dependency relationship between each starting function set and each ending function set in the prohibition dependency relationship is analyzed, thereby improving the accuracy of analyzing whether there is a prohibition dependency relationship in the code based on the dependency between the function sets.

[0012] In a possible implementation, the target code is a multi-layer architecture; the function set matched by the first configuration item indicates a function set of a first layer in the multi-layer architecture; the function set matched by the second configuration item indicates a function set of a second layer in the multi-layer architecture; and the function sets between the first layer and the second layer are prohibited from dependency.

[0013] In this scheme, by analyzing the unnecessary dependency relationship between the function sets of the layers, the occurrence of architecture corruption is intercepted, and the security of code development is improved.

[0014] In a possible implementation, when the prohibition dependency relationship exists in the dependency information of the target code, the target result further indicates a dependency path between the function sets with the prohibition dependency relationship existing in the target code.

[0015] In a possible implementation, the target result includes code in each function set on the dependency path with the prohibition dependency relationship.

[0016] In a possible implementation, the target result includes a program return value, the program return value indicating whether the detection of the target code passes, the program return value indicating that the detection of the target code passes when there is no prohibited dependency relationship in the dependency information of the target code, and the program return value indicating that the detection of the target code fails when there is a prohibited dependency relationship in the dependency information of the target code.

[0017] In a possible implementation, the dependency information is a directed graph, and a node in the directed graph is any one of the plurality of function sets; determining the dependency information corresponding to the target code includes determining, based on the target code, a function set that each function set in the plurality of function sets depends on; and taking each function set in the plurality of function sets as a node, connecting each function set in the plurality of function sets and the function set that each function set depends on by a directed line, to construct the directed graph.

[0018] In a second aspect, an embodiment of the present application provides a code dependency analysis apparatus, the code dependency analysis apparatus including a plurality of modules, each module being configured to perform each step in the code dependency analysis method provided in the first aspect of the present application, and the division of the modules is not limited herein. For the specific functions performed by each module of the code dependency analysis apparatus and the beneficial effects achieved, reference can be made to the functions of each step of the code dependency analysis method provided in the first aspect of the present application, which will not be repeated here.

[0019] For example, the code dependency analysis apparatus includes:

[0020] The obtaining module is configured to obtain the target code and the target code corresponding prohibited information, the target code including a plurality of function sets, each function set in the plurality of function sets including at least one function, and the prohibited information indicating prohibited dependency relationships among the plurality of function sets;

[0021] The dependency analysis module is configured to determine the dependency information corresponding to the target code, the dependency information indicating dependency relationships among the plurality of function sets.

[0022] The result determination module is configured to determine the target result based on the prohibited information and the dependency information, the target result indicating whether there is a prohibited dependency relationship in the dependency information of the target code.

[0023] In this scheme, the dependency among the function sets in the code can be determined, and whether there is an unnecessary prohibited dependency relationship in the code can be analyzed based on the dependency among the function sets, so that the occurrence of architecture corruption can be intercepted, and the security of code development can be improved.

[0024] In a possible implementation, the prohibited dependency relationship indicates that a first configuration item prohibits a second configuration item; the first configuration item is used to match at least one function set in the plurality of function sets; and the second configuration item is used to match at least one function set in the plurality of function sets.

[0025] In a possible implementation, the result determining module comprises: a matching unit and a judging unit; wherein,

[0026] The matching unit is configured to determine at least one function set matched by the first configuration item from the plurality of function sets, and determine at least one function set matched by the second configuration item from the plurality of function sets.

[0027] The judging unit is configured to determine, based on the dependency information, whether each function set matched by the first configuration item depends on the function set matched by the second configuration item, to obtain the target result.

[0028] In a possible implementation, the judging unit is configured to determine that there is no forbidden dependency relationship in the dependency information of the target code when none of the function sets matched by the first configuration item depends on the function set matched by the second configuration item, and determine that there is a forbidden dependency relationship in the dependency information of the target code when any of the function sets matched by the first configuration item depends on the function set matched by the second configuration item.

[0029] In this scheme, whether there is a dependency relationship between each starting function set and each ending function set in the forbidden dependency relationship is analyzed, thereby improving the accuracy of analyzing whether there is a forbidden dependency relationship in the code based on the dependency between the function sets.

[0030] In a possible implementation, the target code is a multi-layer architecture; the function set matched by the first configuration item indicates a function set of a first layer in the multi-layer, the function set matched by the second configuration item indicates a function set of a second layer in the multi-layer, and the function sets between the first layer and the second layer are forbidden to depend.

[0031] In this scheme, by analyzing the unnecessary dependency relationship between the function sets of the layers, the occurrence of architecture corruption is intercepted, and the security of code development is improved.

[0032] In a possible implementation, when there is a forbidden dependency relationship in the dependency information of the target code, the target result further indicates a dependency path between the function sets with the forbidden dependency relationship in the target code.

[0033] In a possible implementation, the target result comprises code with the forbidden dependency relationship in each function set on the dependency path.

[0034] In a possible implementation, the target result comprises a program return value, the program return value indicates whether the detection of the target code passes, the program return value indicates that the detection of the target code passes when there is no forbidden dependency relationship in the dependency information of the target code, and the program return value indicates that the detection of the target code fails when there is a forbidden dependency relationship in the dependency information of the target code.

[0035] In a possible implementation, the dependency information is a directed graph, and a node in the directed graph is any one of the plurality of function sets; the dependency analysis module is configured to determine, based on the target code, a function set that each of the plurality of function sets depends on; and the directed graph is constructed by taking each of the plurality of function sets as a node and connecting each of the plurality of function sets and the function set that it depends on by a directed line.

[0036] In a third aspect, an embodiment of the present application provides a code dependency analysis apparatus, including: at least one memory configured to store a program; and at least one processor configured to execute the program stored in the memory, and when the program stored in the memory is executed, the processor is configured to execute the method provided in the first aspect.

[0037] In a fourth aspect, an embodiment of the present application provides a code dependency analysis apparatus, and the apparatus runs computer program instructions to execute the method provided in the first aspect. For example, the apparatus can be a chip or a processor.

[0038] In one example, the apparatus can include a processor, which can be coupled with a memory, read instructions in the memory and execute the method provided in the first aspect according to the instructions. The memory can be integrated in the chip or the processor, or can be independent of the chip or the processor.

[0039] In a fifth aspect, an embodiment of the present application provides a computing device, including a memory and a processor, and the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0040] In a sixth aspect, an embodiment of the present application provides a computer storage medium, and the computer storage medium stores instructions, and when the instructions run on a computer, the computer executes the method provided in the first aspect.

[0041] In a seventh aspect, an embodiment of the present application provides a computer program product including instructions, and when the instructions run on a computer, the computer executes the method provided in the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 FIG. 1 is a system architecture diagram of a code analysis system provided by an embodiment of the present application;

[0043] Figure 2 FIG. 2 is a structural schematic diagram of a server provided by an embodiment of the present application;

[0044] Figure 3 FIG. 3 is a flowchart of a code dependency analysis method provided by an embodiment of the present application;

[0045] Figure 4 is a structural schematic diagram of a directed graph provided by an embodiment of the present application.

[0046] Figure 5 is a schematic diagram of prohibited dependency analysis provided by an embodiment of the present application Figure 1 .

[0047] Figure 6 is a structural schematic diagram of a code dependency analysis tool provided by an embodiment of the present application.

[0048] Figure 7 is a schematic diagram of prohibited dependency analysis provided by an embodiment of the present application Figure 2 .

[0049] Figure 8 is a structural schematic diagram of a code dependency analysis apparatus provided by an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below with reference to the drawings.

[0051] In the description of the embodiments of the present application, the words “exemplary”, “for example”, or “for instance” are used to mean serving as an example, instance or illustration. Any embodiment or design solution described as “exemplary”, “for example” or “for instance” in the embodiments of the present application should not be interpreted as being more advantageous or superior than other embodiments or design solutions. In fact, the words “exemplary”, “for example” or “for instance” are used to present related concepts in a specific manner.

[0052] In the description of the embodiments of the present application, the term “and / or” merely describes an association relationship of associated objects, and can represent three relationships, for example, A and / or B can represent three cases of existence of A alone, existence of B alone and existence of A and B simultaneously. In addition, unless otherwise specified, the term “multiple” means two or more. For example, multiple systems mean two or more systems, and multiple terminals mean two or more terminals.

[0053] In addition, the terms “first” and “second” are used only for descriptive purposes, and should not be construed as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined with “first” and “second” can explicitly or implicitly include one or more features. The terms “include”, “contain”, “have” and their variants mean “include but are not limited to”, unless otherwise specifically emphasized.

[0054] The following explains some of the terms used in this embodiment. It should be noted that these explanations are for the convenience of those skilled in the art and do not constitute a limitation on the scope of protection required by the present application.

[0055] Go language (also known as Golang): a compiled programming language developed by Google in 2009. Compared with most languages, golang has the characteristics of simple writing concurrency or network interaction, rich data types, fast compilation, etc., and is more suitable for high-performance and high-concurrency scenarios. Currently, Go language has been widely used in artificial intelligence, cloud computing development, container virtualization, big data development, data analysis and scientific computing, operation and maintenance development, crawler development, game development, etc.

[0056] Go language package (Package): Go language uses packages to organize source code, and a package is a collection of multiple Go source codes, which is a high-level code reuse scheme. Go language provides many built-in packages such as fmt, os, io, etc.

[0057] Go module: go module is a go dependency management library provided by go official, which is officially recommended for use in version 1.13.

[0058] Directed acyclic graph (DAG): In mathematics, especially in graph theory and computer science, a directed acyclic graph refers to a loop-free directed graph.

[0059] High cohesion and low coupling: a concept in software engineering, which is a standard for judging the quality of software design, mainly used for object-oriented design of programs, mainly looking at whether the cohesion of the class is high and the coupling degree is low. The purpose is to greatly enhance the reusability and portability of program modules. Generally, the higher the cohesion of each module in the program structure, the lower the coupling degree between modules.

[0060] DSM (Dependency Structure Matrix): represents the dependency relationship between class groups (Java package, C# namespace). Each row of the matrix represents a dependent package, and each column represents a package that needs to depend on other packages.

[0061] Continuous integration (CI): a set of automated processes for software developers, a method for developers. In software engineering, CI refers to the practice of merging all developer work copies into the trunk multiple times a day; CI emphasizes that after a developer submits new code, it is immediately built and tested. According to the test results, it can be determined whether the new code and the original code can be correctly integrated together.

[0062] Dependence Inversion Principle (DIP): When designing code structure, high-level modules should not depend on low-level modules, both should depend on their abstractions. Abstractions should not depend on details, details should depend on abstractions. Through dependence inversion, the coupling between classes can be reduced, the stability of the system can be improved, the readability and maintainability of the code can be improved, and the risk caused by modifying the program can be reduced.

[0063] SonarQube: an open source platform for code quality management, used to manage the quality of source code.

[0064] Architecture decay: a phenomenon refers to the gradual decline in the quality of software architecture over time due to various reasons. As the software system evolves, a series of problems may occur in the architecture, such as tight coupling, low cohesion, excessive complexity, etc. These problems will lead to decreased development efficiency, decreased system performance, poor maintainability, and other problems, making software development and maintenance difficult.

[0065] Currently, in the software architecture design phase, software layers or modules are often divided according to software layered architecture or other module design best practices. Interfaces between these layers and modules are carefully designed to achieve the design goal of high cohesion and low coupling, and to reduce software complexity. However, as the development process progresses, architecture decay may occur at any time, resulting in dependencies between layers or modules that violate design principles. SonarQube uses a dependency structure matrix (DSM) to visually display the dependencies between different components. The navigation level between these components can be the most basic class level, package or file level.

[0066] However, in the CI system, developers need to configure access control. The things that need to be done in access control are: first, compilation; second, static code checking; DSM can visually display the dependencies between components, but it cannot visually display the dependencies between more components, making it difficult to use as access control to restrict unnecessary module dependencies. However, during the code development and submission phase, it is desirable to analyze the problem of unnecessary module dependencies and use it as a combination of access control to intercept the occurrence of architecture decay.

[0067] Based on this, the code dependency analysis method is proposed in the embodiments of the present application.

[0068] The method obtains all dependencies of the code to be analyzed, analyzes whether the prohibited dependencies exist according to all dependencies of the code to be analyzed for the user-configured prohibited dependencies, and obtains an analysis result. The analysis result can be integrated with a CI system to block the code to be analyzed with problems, so as to block the code containing the prohibited dependencies, thereby blocking the occurrence of architecture corruption and improving the security of code development. Here, only the method is briefly described, and the detailed content of the method is described below.

[0069] Next, a code analysis system to which the code dependency analysis method provided by the embodiments of the present application can be applied is introduced. Figure 1 An architecture example diagram of a code analysis system provided by the embodiments of the present application is shown. The code dependency analysis method provided by the embodiments of the present application can be applied to a system architecture diagram as shown in Figure 1 As shown in Figure 1 The code analysis system includes a terminal 101 and a server 102. The terminal 101 communicates with the server 102 through a network. The network can be a wired network or a wireless network. For example, the wired network can be a cable network, a fiber network, a digital data network (DDN), etc., and the wireless network can be a telecommunications network, an internal network, the Internet, a local area network (LAN), a wide area network (WAN), etc., or any combination thereof. It can be understood that the network can use any known network communication protocol to realize communication between different client layers and gateways. The network communication protocol can be various wired or wireless communication protocols.

[0070] The terminal 101 can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices. The exemplary embodiments of the terminal 101 involved in the present solution include, but are not limited to, electronic devices running iOS, android, Windows, HarmonyOS, or other operating systems. The type of electronic device is not specifically limited in the embodiments of the present application.

[0071] The server 102 can be implemented by an independent device or a device cluster composed of multiple devices. In one example, the server 102 involved in the present solution can be used to provide cloud services, which can be a server or a super terminal that can establish a communication connection with other devices and provide computing and / or storage functions for other devices. The server 102 involved in the present solution can be a hardware server or run in a virtualization software. For example, the server 102 involved in the present solution can be a virtual machine running on a hardware server.

[0072] In some possible implementations, the server 102 can be a single-node server, such as a rack server, or a computing node in a multi-node server, which can be a blade server, a high-density server, or a whole-cabinet server. As shown in FIG. 1, the server 102 can include a power supply 121 and a motherboard 110. The power supply 121 is electrically connected to the motherboard 110, and is configured to supply power to devices connected to the motherboard 110. Figure 2 As shown, the server 102 can include a power supply 121 and a motherboard 110. The power supply 121 is electrically connected to the motherboard 110, and is configured to supply power to devices connected to the motherboard 110.

[0073] Exemplarily, the devices connected to the server 102 include a processor 111, a memory 112, a programmable logic device (PLD) 113, a baseboard management controller (BMC) 114, a PCIE slot 115, a network card 122, a hard disk 123, and a fan 124.

[0074] The processor 111 can be a central processing unit (CPU), and can also be another general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or another programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, or the like. The general-purpose processor can be a microprocessor, or the processor can also be any conventional processor.

[0075] The memory 112 can be disposed in a memory bank and inserted into a memory slot to be connected to the motherboard 110. The memory 112 can be a random access memory (RAM). By way of example and not limitation, many forms of RAM are available. Exemplarily, the memory 112 includes at least two types of memories, for example, the memory can be a random access memory (RAM) or a read only memory (ROM). For example, the RAM can include a dynamic random access memory (DRAM), or a storage class memory (SCM), and the like.

[0076] The programmable logic device 113 can be a complex programmable logic device (CPLD) or a field programmable gate array (FPGA).

[0077] The PCIE slot 115 is adapted to expand at least one of a GPU card, a network card, a video capture card, an HBA (Host Bus Adapter) card, a RAID (redundant arrays of independent disks) card, and an SSD (solid state disk or solid state drive).

[0078] The hard disk 123 can be a mechanical hard disk (HDD) or a solid state disk (SSD). It should be understood that the hard disk 123 is merely an example of a non-volatile memory and does not constitute a specific limitation. In actual applications, the non-volatile memory can be selected according to actual conditions.

[0079] It should be noted that, Figure 2 The server 102 is merely an example and does not constitute a specific limitation. In actual applications, more or fewer devices can be included. Figure 2 More or fewer devices can be included.

[0080] In the embodiments of the present application, the terminal 101 is configured to send the code to be analyzed to the server 102, and the server 102 is configured to obtain all dependency relationships of the code to be analyzed. The terminal 101 is configured to send the prohibited dependency relationship to the server 102. The server 102 is configured to analyze whether the prohibited dependency relationship exists according to all dependency relationships of the code to be analyzed, and obtain an analysis result. The analysis result can be integrated with a CI system to intercept the code to be analyzed with problems, so as to intercept the code containing the prohibited dependency, thereby preventing the occurrence of architecture corruption and improving the security of code development.

[0081] Next, a code dependency analysis method provided by the embodiments of the present application will be described in detail in combination with the code analysis system provided above.

[0082] Figure 3 FIG. 1 is a flowchart of a code dependency analysis method provided by the embodiments of the present application. The embodiments can be applied to a code analysis system. As shown in FIG. 1, the code dependency analysis method provided by the embodiments of the present application includes the following steps. Figure 3As shown, the code dependency analysis method provided in the embodiments of the present application at least includes the following steps:

[0083] Step 301, the terminal 101 sends target code to the server 102, the target code includes a plurality of function sets, and each function set in the plurality of function sets includes at least one function.

[0084] In the embodiments of the present application, the target code can be written in any language, including C, JAVA, Python, and other programming languages.

[0085] The function set is a collection of several functions. In an example, the function set can be in the form of a package, and the package is composed of a plurality of files, and the plurality of files are used to describe several functions, for example, one file describes one function, and for another example, a plurality of files describe one function. In an example, the package can be a folder, and the folder contains a plurality of files. In another example, the package can include sub-packages, and each sub-package is a sub-folder containing several files. Therefore, the package can be a folder, or a folder with multiple levels of sub-folders.

[0086] Step 302, the terminal 101 sends the target code corresponding to the server 102 to the server 102, and the prohibition information indicates the prohibited dependency relationship of the plurality of function sets.

[0087] It should be noted that the prohibited dependency relationship is used to indicate that several function sets cannot depend on another several function sets, for example, it can include several prohibited dependency configuration items, for each prohibited dependency configuration item, the prohibited dependency configuration item is used to describe that a first configuration item is prohibited to depend on a second configuration item; the first configuration item is used to match at least one function set in the plurality of function sets, and the second configuration item is used to match at least one function set in the plurality of function sets; the function set matched by the first configuration item is different from the function set matched by the second configuration item, and the function set matched by the first configuration item is prohibited to depend on the function set matched by the second configuration item. Wherein, the first configuration item matches at least one function set, when the first configuration item matches a plurality of function sets, the first configuration item can indicate a folder with multiple levels of sub-folders, and each sub-set folder is a function set matched by the first configuration item; the second configuration item matches at least one function set, when the second configuration item matches a plurality of function sets, the second configuration item can indicate a folder with multiple levels of sub-folders, and each sub-set folder is a function set matched by the second configuration item.

[0088] In some possible implementations, the target code has an n (greater than or equal to 2) layer architecture, with each layer having several sets of functions. The sets of functions in different layers have specific dependencies, which indicate that a set of functions in one layer depends on other sets of functions in the same layer. Other dependencies are prohibited. Correspondingly, the set of functions matched by the first configuration item can be the set of functions in the first layer, and the set of functions matched by the second configuration item can be the set of functions in the second layer. There is a prohibited dependency between the first and second layers. In some possible implementations, the target code may include a database layer, a persistence layer, a business layer, and a presentation layer. The presentation layer depends on the business layer, the business layer depends on the persistence layer, and the persistence layer depends on the database layer. Other dependencies are prohibited. For example, the set of functions matched by the first configuration item indicates the set of functions in the data layer, and the set of functions matched by the second configuration item indicates the set of functions in the persistence layer. The data layer is prohibited from depending on the persistence layer.

[0089] It should be noted that the embodiments of this application do not specifically limit the order in which the terminal 101 sends the target code and the corresponding prohibition information to the server 103. For example, the terminal 101 may send the target code to the server 103 first, and then send the prohibition information corresponding to the target code; for example, the terminal 101 may send the target code and the corresponding prohibition information to the server 103 simultaneously.

[0090] Step 303: Server 102 determines the dependency information corresponding to the target code. The dependency information indicates the dependency relationship between multiple function sets.

[0091] In some possible implementations, dependency information may consist of multiple nodes and directed edges connecting them. Each node represents a set of functions, and the direction of the arrow on the directed edge indicates the dependency relationship. For each node, the starting point of the directed edge is that node, and the ending point is the node that the node depends on. The arrow on the directed edge points to the node that the node depends on. In practical applications, dependency information can be represented as a directed graph. Figure 4 This is a schematic diagram of a directed graph provided in an embodiment of this application. For example... Figure 4 As shown, package 1 depends on packages 21, 22, and 23; package 21 depends on packages 31 and 32; package 31 depends on packages 41, 42, and 43; and package 22 depends on package 22. It should be noted that each directed edge in the directed graph of this embodiment points from one vertex to another, and a closed loop is not formed along the directions of these vertices. Specifically, the nodes in the directed graph are not connected end-to-end; therefore, the directed graph can also be called a DAG (Directed Acyclic Graph).

[0092] In the embodiments of the present application, a plurality of nodes connected by directed edges can form a plurality of dependency paths. The dependency path is composed of a plurality of function sets and a plurality of sequentially connected directed edges between the function sets. For each function set on the dependency path, the function set directly dependent on is the function set connected by the directed edge of the function set, and the function set indirectly dependent on is the function set not directly connected to the function set in the direction of the directed edge of the function set on the dependency path. In some possible implementation manners, the plurality of dependency paths can be represented by a directed graph. For example, as shown in FIG. 2, there are a plurality of dependency paths, and for the dependency path: package 1→21→package 31→package 41, for the package 1 on the dependency path, the package directly dependent on is the package 21, and the packages indirectly dependent on are the package 31 and the package 41. Figure 4

[0093] It should be noted that the server 102 can analyze the target code to mine the direct dependency between the function sets, mine the indirect dependency between the function sets based on the direct dependency between the function sets, and obtain a plurality of dependency paths. In the specific implementation, the server 102 can obtain the other function sets dependent on each function set in the target code by analyzing the target code, and construct a directed graph based on the other function sets dependent on each function set in the target code. Here, the directed graph includes a plurality of dependency paths. The process of constructing the directed graph is as follows: each function set in the plurality of function sets is taken as a node, and each function set in the plurality of function sets and the function set dependent on are connected by a directed line, and the arrow of the directed line points to the function set dependent on.

[0094] In step 304, the server 102 determines a target result based on the prohibition information and the dependency information, where the target result indicates whether there is a prohibited dependency relationship in the dependency information of the target code.

[0095] In some possible implementation manners, the server 102 determines at least one function set matched with the first configuration item from the plurality of function sets, determines at least one function set matched with the second configuration item from the plurality of function sets, and determines the target result based on the dependency information, whether each function set matched with the first configuration item depends on the function set matched with the second configuration item.

[0096] The first configuration item is a summary of one or more function sets. In an example, the first configuration item can be an identifier of a single function set, or can be the same part in the identifiers of a plurality of function sets. For example, the target code is an n-layer architecture, each layer has an identifier, and the identifier of each function set in the layer includes the identifier of the layer in which the function set is located. In this case, the first configuration item can be the identifier of the layer. The second configuration item is similar and will not be described herein.

[0097] ​The implementation manner of the server 102 judging whether each function set matched by the first configuration item depends on the function set matched by the second configuration item to obtain the target result is as follows: when each function set matched by the first configuration item does not depend on the function set matched by the second configuration item, the server 102 determines that there is no prohibited dependency relationship in the dependency information of the target code; when any function set matched by the first configuration item depends on the function set matched by the second configuration item, the server 102 determines that there is a prohibited dependency relationship in the dependency information of the target code.

[0098] In a specific implementation, as shown in Figure 5 , the server 102 determines at least one function set matched by the first configuration item from the plurality of function sets, determines at least one function set matched by the second configuration item from the plurality of function sets, and performs full combination on the at least one function set matched by the first configuration item and the at least one function set matched by the second configuration item to obtain at least one combination, and for each combination, judges whether the function set matched by the first configuration item in the combination depends on the function set matched by the second configuration item based on the dependency information.

[0099] When the dependency information is a directed acyclic graph, the manner in which the server 102 judges whether the function set matched by the first configuration item in the combination depends on the function set matched by the second configuration item can be as follows: determining a target node corresponding to the function set matched by the first configuration item in the DAG graph, checking whether each dependency path with the target node as a starting point and a leaf node (a node with an out-degree of 0 in the DAG graph) as an ending point in the DAG graph includes the function set matched by the second configuration item, if not, determining that the function set matched by the first configuration item does not depend on the function set matched by the second configuration item, and if yes, determining that there is a dependency relationship from the function set matched by the first configuration item to the function set matched by the second configuration item.

[0100] For example, as shown in Figure 4 , it is assumed that the function set matched by the first configuration item is package 21, and the function set matched by the second configuration item is package 41, the dependency paths of package 21 are two, which are: package 21→package 31→package 41, and package 21→package 32, and package 21→package 31→package 41 includes package 41, so there is a dependency path from package 41 to package 31 to package 21, and package 21 depends on package 41.

[0101] It should be noted that when there is a prohibited dependency relationship in the dependency relationship of the target code, the target result also indicates the dependency paths between the function sets of the prohibited dependency relationship existing in the target code. The dependency paths can be multiple, and each dependency path can be a code path between one function set in the prohibited dependency relationship and another function set that cannot be depended on.

[0102] Specifically, the target result includes description information of a dependency path between a set of functions in which the forbidden dependency exists in the target code; exemplary, the description information of the dependency path can include a case that the forbidden dependency exists in each set of functions on the dependency path, for example, the description information can include an identifier of the set of functions, a line number of the code in which the forbidden dependency exists in the set of functions, and a path to the location of the code in which the forbidden dependency exists in the set of functions. In a scenario where the set of functions is a folder, the description information of the dependency path indicates any file in each set of functions on the dependency path. It should be noted that when the dependency information is represented as a directed graph, the dependency path in the target result is a path between a node representing a starting set of functions in which the forbidden dependency exists, for example, a set of functions matched by the first configuration item, and a node representing an ending set of functions in which the forbidden dependency exists, for example, a set of functions matched by the second configuration item, in the DAG graph.

[0103] It should be noted that the set of functions in which the forbidden dependency exists can be the set of functions matched by the first configuration item and the set of functions matched by the second configuration item; correspondingly, the code in which the forbidden dependency exists is code dependent in a process from the set of functions matched by the first configuration item to the set of functions matched by the second configuration item. When there is a dependency path between the set of functions matched by the first configuration item and the set of functions matched by the second configuration item, the dependency path can be one or more; for each dependency path, the dependency path can be a path between any set of functions matched by the first configuration item and any set of functions matched by the second configuration item, a starting node of the dependency path is the set of functions matched by the first configuration item, and an ending node of the dependency path is the set of functions matched by the second configuration item. In one example, the set of functions matched by the first configuration item and the set of functions matched by the second configuration item on the dependency path can be direct dependency or indirect dependency. In the scenario of indirect dependency, the starting node and the ending node of the dependency path further include other nodes.

[0104] In the embodiment of the present application, the target result includes a program return value, which indicates whether the detection of the target code passes or not. When there is no forbidden dependency in the dependency information of the target code, the program return value indicates that the detection of the target code passes, for example, can be 1; when there is a forbidden dependency in the dependency information of the target code, the program return value indicates that the detection of the target code does not pass, for example, can be 0.

[0105] In the present scheme, the dependency between the sets of functions in the code can be determined, and whether there is an unnecessary forbidden dependency in the code can be analyzed based on the dependency between the sets of functions, so as to intercept the occurrence of architecture corruption and improve the security of code development.

[0106] In some possible scenarios, the server 102 executes the method provided in the embodiments of the present application through a deployed CI system. Further, in the embodiments of the present application, when the dependency information of the target code does not exist the prohibited dependency, the CI system determines that the detection of the target code passes, and when the dependency information of the target code exists the prohibited dependency, the CI system determines that the detection of the target code fails. In a specific implementation, when the server 102 determines that the program return value indicates that the detection of the target code passes, the CI system determines that the detection of the target code passes, and when the server 102 determines that the program return value indicates that the detection of the target code fails, the CI system determines that the detection of the target code fails.

[0107] In the scheme, all dependencies between the function sets of the code to be analyzed are obtained, and an analysis result is generated according to the prohibited dependency configured by a user. The analysis result can be integrated with a CI system to block the code to be analyzed that has a problem, and the code containing the prohibited dependency that should not exist can be blocked, so that the occurrence of architecture corruption is blocked, and the security of code development is improved.

[0108] Based on the code dependency analysis method provided above, a specific application of the code dependency analysis method is described. Figure 6 A flowchart of a specific application of a code dependency analysis method provided in the embodiments of the present application is shown in FIG. 1. Figure 6 As shown in FIG. 1, the specific content includes:

[0109] The embodiments of the present application take the go language as an example, and provide a prohibited dependency judgment tool, which includes two modules: a package dependency generation module and a package dependency analysis module. The package dependency generation module takes a go language code module as input and outputs a package dependency DAG between the entire code modules. The package dependency analysis module takes the package dependency DAG and a prohibited dependency relationship list, analyzes whether the prohibited dependency relationship in the prohibited dependency relationship list actually exists, outputs whether the prohibited dependency relationship exists, and when the prohibited dependency relationship exists, also outputs related information of a dependency path of the prohibited dependency relationship.

[0110] A possible implementation of the package dependency generation module is shown as follows:

[0111] The complete code directory and the dependent code directory are traversed. For the go language, each code directory is a package. The package name, the directory, the go file name under the directory, and the import statement and line number in each file are recorded. A possible data structure is shown as follows:

[0112]

[0113] A possible implementation of the package dependency analysis module is shown as follows: Figure 7 The specific content is as follows:

[0114] a) For each forbidden dependency in the forbidden dependency list, perform the following operations one by one. Wherein, the forbidden dependency is an item formed by the From field (the first configuration item described above) to the To field (the first configuration item described above) such as {“From”:“example.com / presentasion”,“to”:“example.com / business”};

[0115] b) Prefix the From field in the forbidden dependency, and search for all starting dependency node list 1 in the package dependency DAG, which consists of several nodes (for the sake of description and distinction, they can be called starting nodes);

[0116] c) Prefix the To field in the forbidden dependency, and search for all destination dependency node list 2 in the package dependency DAG, which consists of several nodes (for the sake of description and distinction, they can be called destination nodes);

[0117] d) Perform full combination on the starting dependency node list 1 and the destination dependency node list 2 to obtain a complete forbidden dependency item list, which consists of a plurality of forbidden dependency items arranged in order, and each forbidden dependency item consists of a starting node and a destination node.

[0118] e) Determine the reachability of the starting node to the destination node described in each forbidden dependency item in the forbidden dependency item list through the package dependency DAG. The reachability determination can be achieved by algorithms such as depth-first algorithm, Dijkstra algorithm, Bellman-Ford algorithm, etc.

[0119] f) If it is found that the forbidden dependency is reachable, it is determined that the forbidden dependency relationship is violated, and the program returns a non-zero value. It is output which forbidden dependency relationship is violated, and the node information on the dependency path of the forbidden dependency item under the forbidden dependency relationship, including package name, code path (path to the location of the dependent code in the package), code line number (line number of the dependent code in the package), etc.

[0120] g) If it is found that each forbidden dependency is unreachable, it is determined that the forbidden dependency relationship is complied with, and the program does not make any output determination.

[0121] h) After all the above dependency analysis is completed and all the forbidden dependency relationships are complied with, the program returns a value of 0.

[0122] It should be noted that, according to industry convention, the program return value of a Linux program is 0 for success and a non-0 value for failure. When the dependency judgment tool is prohibited from being integrated with the CI system, the program return value of the dependency judgment tool can be used to determine whether the detection of the go language is successful. If the detection is successful, the CI system can perform subsequent operations, otherwise, it represents that the operation fails.

[0123] Based on the same concept as the method embodiments of the present application, the code dependency analysis device provided in the embodiments of the present application is also provided. The code dependency analysis device includes a plurality of modules, each module is used to execute each step in the code dependency analysis method provided in the embodiments of the present application, and the division of the modules is not limited herein. Those skilled in the art can clearly understand that in actual application, each step in the code dependency analysis method provided in the embodiments of the present application can be completed by different modules according to needs, that is, the internal structure of the device is divided into different modules to complete all or part of the functions described above. Each module in the embodiments can be integrated in one processing unit, or each unit can exist physically, or two or more modules can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software function unit. In addition, the specific names of the modules are only for easy distinction, and do not limit the protection scope of the present application. The specific working process of the modules in the device can refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

[0124] For example, the code dependency analysis device is used to execute the code dependency analysis method provided in the embodiments of the present application, Figure 8 is a structural schematic diagram of the code dependency analysis device provided in the embodiments of the present application. As Figure 8 shown, the code dependency analysis device provided in the embodiments of the present application includes:

[0125] The acquisition module 801 is configured to acquire target code and target code corresponding prohibition information, the target code includes a plurality of function sets; each function set in the plurality of function sets includes at least one function, and the prohibition information indicates the prohibited dependency relationship of the plurality of function sets;

[0126] The dependency analysis module 802 is configured to determine the dependency information corresponding to the target code, and the dependency information indicates the dependency relationship between the plurality of function sets;

[0127] The result determination module 803 is configured to determine the target result based on the prohibition information and the dependency information, and the target result indicates whether there is a prohibited dependency relationship in the dependency information of the target code.

[0128] Based on the same idea as the method embodiments of the present application, the embodiments of the present application further provide a computing device. The computing device can be the server 102. The structure of the computing device can refer to the server 102 in Figure 2 Figure 2 For example only, in practical applications, more or less devices, etc. can be included than Figure 2

[0129] In a specific application, the computing device can include a processor 111 and a memory, which can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a hard disk 123. The volatile memory can be a memory 112. Specifically, the memory of the computing device, such as the hard disk 123 and the memory 112, can store a computer program. When the computing device is running, the processor 111 can read the computer program stored in the memory, such as reading the computer program stored in the hard disk 123 to the memory 112, and reading the computer program from the memory 112, to implement the steps in the above code dependency analysis method, for example Figure 3

[0130] For example, the computer program can be divided into one or more modules / units, which can be a series of computer program instruction segments capable of completing a specific function, and the one or more modules / units are stored in the memory such as the hard disk 123 and executed by the processor 111 to complete the present application. For example, the computer program can be divided into an acquisition module 801, a dependency analysis module 802, and a result determination module 803, and the specific functions of each module are described above.

[0131] ​​​In addition to the methods, apparatuses, and computing devices described above, embodiments of the present disclosure can also provide a computer program product including computer program instructions that, when executed by a processor, cause the processor to perform the steps of the code dependency analysis methods described in the “METHODS” section above. The computer program product can be written in any combination of one or more programming languages, including an object-oriented programming language such as Java, C++, etc., and conventional procedural programming languages, such as the “C” programming language, or the like. The computer program code can be in a source code form, an object code form, an executable form, or some intermediate form. The computer program code can be executed entirely on the user’s computing device, executed partly on the user’s computing device and partly on a remote computing device, executed partly on the user’s computing device and partly on a remote computing device, or executed entirely on a remote computing device or server.

[0132] In addition, embodiments of the present disclosure can also provide a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, cause the processor to perform the steps of the code dependency analysis methods described in the “METHODS” section above according to various embodiments of the present disclosure. The computer-readable storage medium can employ any combination of one or more non-transitory media. The non-transitory media can be a non-transitory signal or a non-transitory storage medium. The non-transitory storage medium can include, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the non-transitory storage medium include the following: an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. It should be noted that the contents of the computer-readable medium can be appropriately added or deleted according to requirements of legislation and patent practice in a jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals.

[0133] In the above embodiments, the description of each embodiment focuses on different aspects, and parts not described or recorded in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0134] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the application.

[0135] The above describes the basic principles of the application in combination with specific embodiments, but it should be pointed out that the advantages, advantages, effects and the like mentioned in the application are only examples and not limitations, and these advantages, advantages, effects and the like cannot be considered as the various embodiments of the present disclosure must have. In addition, the specific details of the above disclosure are only for the purpose of example and for the purpose of understanding, and are not limited to the above specific details, and the above details do not limit the present disclosure to be necessarily implemented with the above specific details.

[0136] The block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are not intended to require or imply the connection, arrangement, configuration shown in the block diagram. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have" and the like are open-ended words, which mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.

[0137] It should also be noted that in the devices, equipment and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombination should be considered as equivalent solutions of the present disclosure.

[0138] The above description has been given for the purpose of illustration and description. Furthermore, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain modifications, alterations, changes, additions and sub-combinations thereof.

[0139] It can be understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of differentiation in the description, and are not used to limit the scope of the embodiments of the present application.

Claims

1. A code dependency analysis method, characterized in that, include: Obtain target code and corresponding prohibition information, wherein the target code includes multiple function sets; each function set includes at least one function, and the prohibition information indicates the prohibition dependencies of the multiple function sets; Determine the dependency information corresponding to the target code, wherein the dependency information indicates the dependency relationships between the multiple functional sets; Based on the prohibited information and the dependent information, a target result is determined, wherein the target result indicates whether there are prohibited dependencies in the dependency information of the target code; The prohibition of dependency indicates that the first configuration item prohibits dependency on the second configuration item; the first configuration item is used to match at least one of the plurality of function sets; The second configuration item is used to match at least one of the plurality of function sets; The dependency information is a directed graph, and the determination of the target result based on the prohibition information and the dependency information includes: Determine the target node corresponding to the function set matched by the first configuration item in the directed graph, and check whether each dependency path in the directed graph, with the target node as the starting point and the leaf node as the ending point, includes the function set matched by the second configuration item. If not, then it is determined that the set of functions matched by the first configuration item does not depend on the set of functions matched by the second configuration item; If so, it is determined that there exists a set of functions that match the first configuration item that depends on the set of functions that match the second configuration item.

2. The method according to claim 1, characterized in that, The determination of the target result based on the prohibited information and the dependent information includes: Determine at least one function set that matches the first configuration item from the plurality of function sets; Determine at least one set of functions that matches the second configuration item from the plurality of function sets; Based on the dependency information, determine whether each set of functions matched by the first configuration item depends on the set of functions matched by the second configuration item, and obtain the target result.

3. The method according to claim 2, characterized in that, The step of determining whether each set of functions matched by the first configuration item depends on the set of functions matched by the second configuration item, based on the dependency information, to obtain the target result includes: When each set of functions matched by the first configuration item does not depend on the set of functions matched by the second configuration item, it is determined that there is no prohibited dependency relationship in the dependency information of the target code; When any set of functions matched by the first configuration item depends on the set of functions matched by the second configuration item, it is determined that there is a prohibited dependency relationship in the dependency information of the target code.

4. The method according to any one of claims 1 to 3, characterized in that, The target code is a multi-layered architecture; the function set matched by the first configuration item indicates the function set of the first layer in the multi-layered architecture, the function set matched by the second configuration item indicates the function set of the second layer in the multi-layered architecture, and the function sets between the first layer and the second layer are prohibited from depending on each other.

5. The method according to any one of claims 1 to 3, characterized in that, The target code contains prohibited dependencies, and the target result also indicates the dependency paths between sets of functions with prohibited dependencies in the target code.

6. The method according to claim 5, characterized in that, The target result includes code in each feature set on the dependency path that has prohibited dependencies.

7. The method according to any one of claims 1 to 3, 6, characterized in that, The target result includes a program return value, which indicates whether the target code has passed the detection. If there are no prohibited dependencies in the dependency information of the target code, the program return value indicates that the target code has passed the detection; if there are prohibited dependencies in the dependency information of the target code, the program return value indicates that the target code has failed the detection.

8. The method according to any one of claims 1 to 3, 6, characterized in that, The dependency information is a directed graph, and the nodes in the directed graph are any one of the multiple function sets. Determining the dependency information corresponding to the target code includes: Based on the target code, determine the function sets that each of the plurality of function sets depends on; Using each of the multiple function sets as a node, each function set and its dependent function sets are connected by directed lines to construct a directed graph.

9. A computing device, characterized in that, Includes processor and memory; among which, The memory is used to store programs; The processor shown is used to execute a program stored in the memory, and when the program stored in the memory is executed, it performs the method according to any one of claims 1 to 8.

Images