Structured query language scanning method, device, equipment, medium and product

Abstract

The application discloses a structured query language scanning method and device, equipment, medium and product, and relates to the technical field of computers.The method comprises the following steps: replacing tags in extensible markup language files with texts; based on a persistence layer framework, analyzing the preprocessed extensible markup language files, encapsulating configuration information of each extensible markup language file into a bottom encapsulation object, and loading the configuration information into corresponding configuration objects according to the directories to which the configuration information belongs; and scanning structured query languages corresponding to the bottom encapsulation objects in each configuration object. By replacing the tags in the extensible markup language files with texts, the content of the fragment references and the tags can be correctly identified during scanning; by encapsulating and loading the configuration information into the configuration objects corresponding to the directories to which the configuration information belongs, each configuration object is used for saving the configuration information of the corresponding directory, the problem that the scanning fails due to the global use of the same configuration object is solved, the SQL code is correctly identified and checked, and the reliability of the scanning is improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to a scanning method, apparatus, device, medium and product for a structured query language. Background Technology

[0002] Databases are indispensable middleware in various production systems. Structured Query Language (SCL) code, as the standard syntax for database operations, is used extensively in daily development; almost every system involves SQL code writing. However, developers' SQL development skills vary greatly. To avoid production incidents caused by SQL code quality issues and to improve SQL execution efficiency, timely and comprehensive code style checks of SQL code are crucial during the development process.

[0003] The Mybatis framework is widely used as a common database persistence layer technology. Mybatis uses simple XML or annotations to configure and map native information. A single Extensible Markup Language (XML) file contains several, a dozen, or even more SQL statements. With technological advancements and the popularity of microservice architectures, a typical Java project often contains multiple microservices, numerous functional modules, and a massive amount of code. Different functional modules may share the same Mybatis-XML filenames and mapping object (mapper) namespaces, causing existing SQL code style scanning solutions under the Mybatis framework to be incompatible, resulting in exceptions and scanning task failures. Furthermore, since SQL style scanning is static code scanning, it doesn't dynamically identify code snippets or content within tags, leading to false positives. In conclusion, the reliability of code scanning needs improvement. Summary of the Invention

[0004] This invention provides a method, apparatus, device, medium, and product for scanning Structured Query Language (SQL) to correctly identify and inspect SQL code, thereby improving the reliability of code scanning.

[0005] In a first aspect, embodiments of the present invention provide a scanning method for a structured query language, comprising:

[0006] For the path information of each Extensible Markup Language (XML) file in the path set, the corresponding XML file is preprocessed according to the path information to replace the referenced tags in the XML file with text;

[0007] Based on the persistence layer framework, the preprocessed Extensible Markup Language (XML) files are parsed to obtain the configuration information of each XML file.

[0008] Each configuration information is encapsulated into a corresponding underlying encapsulation object, and each underlying encapsulation object is loaded into the corresponding configuration object according to the directory to which the corresponding configuration information belongs;

[0009] The structured query language corresponding to the underlying encapsulation objects in each of the configuration objects is scanned.

[0010] Secondly, embodiments of the present invention also provide a scanning device for a structured query language, the device comprising:

[0011] The preprocessing module is used to preprocess the corresponding Extensible Markup Language (XML) file according to the path information of each XML file in the path set, so as to replace the referenced tags in the XML file with text.

[0012] The parsing module is used to parse the preprocessed Extensible Markup Language (XML) files based on the persistence layer framework to obtain the configuration information of each XML file;

[0013] The loading module is used to encapsulate each configuration information into a corresponding underlying encapsulation object, and load each underlying encapsulation object into the corresponding configuration object according to the directory to which the corresponding configuration information belongs;

[0014] The scanning module is used to scan the structured query language corresponding to the underlying encapsulated objects in each of the configuration objects.

[0015] Thirdly, embodiments of the present invention also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a scanning method for a structured query language as described in any of the embodiments of the present invention.

[0016] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a scanning method for a structured query language as described in any of the embodiments of the present invention.

[0017] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements a scanning method for a structured query language as described in any of the embodiments of the present invention.

[0018] In this embodiment of the invention, during preprocessing, referenced tags in Extensible Markup Language (XML) files are replaced with text. The preprocessed XML files are parsed using a persistence layer framework, and the configuration information of each XML file is encapsulated into a low-level encapsulation object. This encapsulation object is then loaded into the corresponding configuration object based on the directory to which the configuration information belongs. The low-level encapsulation object is obtained through the configuration object, and relevant Structured Query Language (SCL) queries are scanned. By replacing referenced tags in XML files with text, the problem of not being able to identify fragment references and tag content is solved. By encapsulating the configuration information and loading it into the configuration object corresponding to its directory, each configuration object can store the configuration information of the corresponding directory, solving the problem of scanning failure caused by using the same configuration object globally. This ensures that SQL code is correctly identified and checked during the scanning process, improving the reliability of code scanning. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating a scanning method for a structured query language provided in an embodiment of the present invention;

[0021] Figure 2 A flowchart for loading a low-level encapsulated object into a corresponding configuration object according to a directory is provided in an embodiment of the present invention;

[0022] Figure 3 A flowchart illustrating another scanning method for a structured query language provided in an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of a scanning device for a structured query language provided in an embodiment of the present invention;

[0024] Figure 5 A schematic diagram of an electronic device that can be used to implement embodiments of the present invention is provided. Detailed Implementation

[0025] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0026] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0027] The acquisition, storage, use, and processing of data in this application comply with the relevant provisions of national laws and regulations.

[0028] It should be noted that in the embodiments of this application, certain software, components or models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the relevant content of the solution.

[0029] Mybatis is a Java-based persistence framework widely used in Java applications. Mybatis encapsulates Java Database Connectivity, allowing developers to focus solely on the SQL statements without the complexities of loading drivers, creating connections, and creating states (statements). Various Statements can be configured via XML files or annotations, and the final SQL statement is generated by mapping Java objects to dynamic parameters in the Statement. Finally, the Mybatis framework executes the SQL and returns the results as Java objects.

[0030] The configuration object is an object in the Mybatis package used to describe Mybatis configuration information. It defines a large number of properties to control the runtime behavior of Mybatis, and other components can obtain configuration information by calling the configuration object.

[0031] The underlying encapsulation object (mapperStatement): When Mybatis starts, it parses the XML file containing SQL, wraps the parsed result into a mapperStatement, and registers the mapperStatement with the configuration. The mapperStatement can be obtained through the configuration, and then the corresponding SQL code can be obtained.

[0032] The overall process of the Mybatis framework mainly includes:

[0033] Load configuration and initialize: Load the SQL configuration information into a mapperStatement object (including input parameter mapping configuration, executed SQL statement, and result mapping configuration) and store it in memory;

[0034] Receiving Invocation Requests: When the Application Programming Interface (API) provided by Mybatis is invoked and the SQL identifier (SQL ID) is passed in, the request is passed to the lower-level request processing layer for processing;

[0035] Handling operation requests: Mybatis locates the corresponding MappedStatement based on the SQL ID, then parses the MappedStatement according to the passed parameter object. After parsing, it obtains the final SQL statement and parameters to be executed. The final SQL and parameters are then retrieved from the database for execution, and the execution result is obtained.

[0036] Return processing result: The execution result will be transformed according to the mapping configuration.

[0037] The current process of scanning SQL code under the Mybatis framework mainly includes:

[0038] S1. Iterate through all files in the entire project code package, store the XML file paths in a collection, and create a configuration object.

[0039] S2. Using the XMLmapperBuilder in the Mybatis framework, the XML files in the collection are processed sequentially. The parameterMap, resultMap, and select / insert / update / delete information in the current XML file are parsed. Simultaneously, the namespace of the current XML file is retrieved. If it is not empty, the classForName method in the Resource class is called to construct an object of the corresponding class. If the current mapper class does not exist in the mapperRegistry property of the configuration, it is added; otherwise, an exception is thrown. The namespace is also added to the loadedResources property, indicating that the namespace has been loaded.

[0040] S3. Call the parsePendingStatements method to parse the Statements configuration information obtained from the XML file in S2. Construct a map object with Namespace + "." + SQL id as the key and statement information as the value, and put it into the mapperStatements property of the configuration. If the key to be put in already exists, an exception will be thrown, indicating that the statement already exists.

[0041] S4. Retrieve all mapperStatements in the configuration, iterate through each mapperStatement object, perform string matching on the text content of all SQL statements of type select|update|delete against the rules, and output the SQL statements that do not conform to the rules.

[0042] The following issues exist with the code scanning process described above:

[0043] ① Since the mapperStatement stored in the configuration cannot be duplicated, the mapperStatement will use namespace + "." + SQL id as a unique identifier key. However, each scan task only creates one configuration globally. When scanning a multi-module microservice project, multiple services may have XML files with the same namespace and SQL statements with the same SQL id. In this case, the scan process will throw an exception, causing the scan task to fail.

[0044] ② Because SQL specification scanning is a static code scan, the SQL fragments in the mapperStatement within the configuration will only retain the text content of the select, insert, update, and delete elements. Fragment references and content within tags will not be dynamically identified or replaced, nor will parameters be replaced. Therefore, during the scanning process... <where>,<trimprefix=”where”> Or nested in <if>If the where tag in the judgment tag is not recognized, it will cause false alarms.

[0045] The purpose of this invention is to solve the problems of poor compatibility and high failure rate of current code scanning methods for microservice system engineering, and to solve the problems of inaccurate recognition of references and tag syntax provided by the Mybatis framework and high false alarm rate caused by incomplete analysis of business logic in SQL.

[0046] In addition, some other issues related to code scanning can be addressed in some embodiments, such as: scanning too many useless files, traversing all source code files in the project, and not filtering XML files in directories such as target and bin after compilation, resulting in slow scanning speed and low efficiency; not considering the case of the asterisk "*" as a multiplication sign during scanning, and only judging whether the SQL statement uses SELECT* query by whether the string contains "*", which is prone to false alarms, etc.

[0047] Figure 1 This is a flowchart illustrating a method for scanning a structured query language (SCL) according to an embodiment of the present invention. This embodiment is applicable to situations where flowcharts are generated by a process engine. The method can be executed by a SCL scanning device, which can be implemented in hardware and / or software and can be configured in an electronic device. The electronic device includes, but is not limited to, computers, terminals, and servers, as well as other devices with data processing capabilities.

[0048] like Figure 1 As shown, the method includes:

[0049] S110. For the path information of each Extensible Markup Language (XML) file in the path set, preprocess the corresponding XML file according to the path information to replace the referenced tags in the XML file with text.

[0050] In this embodiment, the path information (including the full path name) of the XML files to be processed in the entire project code package can be stored in a path set. Then, all XML files in the path set are traversed. For elements containing tags in the XML files, these elements are usually referenced in other elements. The referenced tags can be replaced with the text content of the referenced object, so that the tags referenced in the query fields or query conditions can be correctly identified during scanning. Here, the tags can be...<include refid=”sql-id”> Tags referenced in the form of , or tags within elements named with query restrictions, such as . <where>or<trim preix=”where”> wait.

[0051] S120. Based on the persistence layer framework, the preprocessed Extensible Markup Language (EXPLAIN) files are parsed to obtain the configuration information of each EXPLAIN file.

[0052] Specifically, the persistence layer framework mainly refers to Mybatis. Mybatis sequentially reads the path information of each XML file in the path collection, and uses dom4j to parse the elements and attributes in the XML files to obtain the configuration information. dom4j is a Java-based XML API that can be used to read and write XML files.

[0053] S130. Each configuration information is encapsulated into a corresponding underlying encapsulation object, and each underlying encapsulation object is loaded into the corresponding configuration object according to the directory to which the corresponding configuration information belongs.

[0054] In this embodiment, configurations are created based on the project directory, with different directories corresponding to different configurations. The XML file is parsed using the Mybatis framework to obtain all configuration information, which is then placed into the corresponding configuration based on its directory.

[0055] Specifically, addressing the issue where existing solutions throw exceptions when storing information from XML files sharing the same namespace across different functional modules within the same configuration, a solution can be developed that leverages the typical Java project directory structure. Separate configurations can be created for each directory, with each configuration storing the configuration information from the corresponding XML files. This configuration information can be encapsulated into mapper statements and stored in their respective configurations. Furthermore, during scanning, SQL identification can be performed on the configurations corresponding to different directories. Even if configuration information from XML files in different directories or functional modules contains the same namespace and SQLID, the configurations in different directories and functional modules can be used to differentiate between them, thus preventing errors.

[0056] For example, XML files are usually located in the " / resources" or "src / main / java" directory. Based on this characteristic, different configurations can be created for each directory. The parsed results of the XML files in the " / resources" or "src / main / java" directory are encapsulated into mapperStatements and placed into the corresponding configurations. For XML files that do not belong to the " / resources" and "src / main / java" directories, a configuration can also be created to store the mapperStatements corresponding to the configuration information of the XML files that do not belong to the " / resources" and "src / main / java" directories.

[0057] S140. Scan the structured query language corresponding to the underlying encapsulation objects in each of the configuration objects.

[0058] Specifically, the process involves retrieving the mapperStatement from each configuration and then extracting and formatting the SQL statement code within it. Based on the inspection rules, the code for SQL statements of type SELECT, UPDATE, or DELETE can be retrieved from the mapperStatement, and this code can be uniformly converted to lowercase. Following this, the code for the SQL statements is scanned and inspected. If any SQL code violates the rules, the name of the violated rule, the XML file containing the violating SQL code, and the first line number are retrieved and output as the scan results.

[0059] The method provided in this embodiment can scan the SQL statement code in a microservice system based on the Mybatis framework during the development phase to check for non-compliant SQL statement segments, thereby improving the performance and security of SQL statements. By analyzing the common directory structure of current code projects and preprocessing XML files, it solves the problems of high scan failure rate and low scan efficiency, improves the recognition rate and accuracy of various Mybatis tags used in SQL statements, reduces the false alarm rate, and allows developers to focus their efforts on truly problematic SQL statements. By moving SQL statement code scanning to the development phase, it improves scanning efficiency and accuracy, helps developers discover potential problems in SQL statements in advance, and serves as an auxiliary testing tool, providing strong support for improving system performance, reliability, and security. By encapsulating configuration information and loading it into configuration objects corresponding to their respective directories, each configuration object is used to store the configuration information of its corresponding directory, solving the problem of scan failure caused by using the same configuration object globally, correctly identifying and checking SQL code, and improving the reliability of scanning.

[0060] In one embodiment, for the path information of each Extensible Markup Language (XML) file in the path set, the corresponding XML file is preprocessed according to the path information to replace the referenced tags in the XML file with text, including:

[0061] S1110. Read the path information in the path set in sequence. For the first type element of the referenced tag in the corresponding Extensible Markup Language file of the currently read path information, add the number attribute value of the first type element as the key and the text of the first type element as the value to the key-value mapping object.

[0062] S1120. For the second type element of the reference tag in the Extensible Markup Language file corresponding to the currently read path information, replace the key corresponding to the tag in the parent element of the second type element with the corresponding value according to the key-value mapping object.

[0063] Specifically, the first type of element mainly refers to elements containing referenced tags, which can be elements whose names contain "sql". These elements are usually found within other elements...<include refid=”sql-id”> The format is as follows: The ID attribute value of the first type element is used as the key, and the text of the first type element is used as the value, which are then placed into a key-value map object for subsequent processing.

[0064] The second type of element primarily refers to elements with reference tags, specifically elements of type `include`. Based on the reference ID (refid) attribute value of this second type of element, the corresponding value can be retrieved from the map, i.e., the referenced text content. The parent element of this `include` element is then retrieved, and the `include` tag within the parent element is replaced with the retrieved value. Furthermore, by replacing the referenced tags with the text content of the referenced object, situations where query fields or conditions are not recognized can be avoided, improving the recognition rate and accuracy of various Mybatis tags used in SQL statements and reducing the false alarm rate.

[0065] In one embodiment, the method further includes:

[0066] S1130. For the third type of element in the Extensible Markup Language file corresponding to the currently read path information, the query restriction condition tag in the parent element of the third type of element is concatenated with the query restriction keyword.

[0067] Specifically, the third type of element mainly refers to elements containing query restriction labels, such as... <where>or<trim preix=”where”> The third category of elements includes all elements named "where" or "trim" with the prefix attribute "where". For each third category element, the query restriction tag under its parent element is replaced with the text content of the third category element, and then the "where" keyword is appended. This ensures the "where" keyword is correctly identified during subsequent SQL code scanning.

[0068] In one embodiment, the method further includes:

[0069] S1100: Read the path information in the path set sequentially. For the currently read path information, remove the specified element from the elements contained in the corresponding Extensible Markup Language file of the currently read path information. The specified element does not participate in the scanning of the Structured Query Language.

[0070] During the traversal, elements in the XML file can be filtered to reduce the workload of subsequent scanning. For example, elements in the XML file whose names contain resultMap (meaning that the columns in the query result set are mapped to the properties of the bean object), parameterMap (meaning that the value types of the query result columns are automatically mapped to the property types of Java objects), cache (meaning that the cache configuration for a given namespace is configured), cache-Ref (meaning that the cache configuration for other namespaces is referenced), and typeAlias ​​(meaning that the existing type is renamed) can be removed. The code in such elements usually does not cause any coding style issues. Removing these elements can reduce the amount of SQL code to be scanned.

[0071] In one embodiment, each configuration information is encapsulated into a corresponding underlying encapsulation object, and each underlying encapsulation object is loaded into the corresponding configuration object according to the directory to which the corresponding configuration information belongs, including:

[0072] S1310. For each preprocessed Extensible Markup Language (EXPLAIN) file, if the EXPLAIN file does not conform to the specified path in the project directory, the configuration information of the EXPLAIN file is loaded into the first configuration object created.

[0073] S1320. If the path information of the Extensible Markup Language file matches the specified path in the project directory, then extract all or part of the path name from the path information as the target key.

[0074] S1330. Load the configuration information of the Extensible Markup Language file into the created second configuration object or the configuration object corresponding to the target key according to the target key.

[0075] In this embodiment, a configuration (i.e., a first configuration object) can be created to store configuration information for XML files that do not conform to a specified path. The specified path can be, for example, "resources" or "src / main / java". Additionally, a configurationMap (i.e., a key-value mapping configuration object) of type Map can be created to store the key-value mapping relationship between the specified path information and the configuration, where the path information is the key and the corresponding configuration is the value. The configurationMap can include key-value mapping relationships for non-specified paths (e.g., neither "resources" nor "src / main / java") and configurations (i.e., the first configuration object) created for non-specified paths.

[0076] For any given XML file, if the XML file does not conform to the specified path, that is, the full path name of the XML file does not contain "resources" or "src / main / java", then the XML file is loaded and parsed, and the parsed information is placed into the first configuration object created.

[0077] If the XML file matches the specified path, i.e., the full path name contains "resources" or "src / main / java", then all or part of the path name is extracted from the path information as the target key. The configuration information is then loaded into another created configuration (i.e., the created second configuration object) or into an existing configuration object corresponding to the target key (such as the configuration object corresponding to the "resources" or "src / main / java" level). The second configuration object is used to store the XML file that matches the specified path. Specifically, the key of the configuration information of the XML file that matches the specified path can be determined according to the specific level in the path name, and the created second configuration object is used as the value, thereby establishing a key-value mapping relationship between the configuration information of the XML file that matches the specified path and the second configuration object.

[0078] In one embodiment, loading configuration information of an Extensible Markup Language (EXPLAIN) file into a created second configuration object or a configuration object corresponding to the target key based on the target key includes:

[0079] S13310. If the key-value mapping type configuration object does not contain the target key, then the configuration information of the Extensible Markup Language file is loaded into the created second configuration object;

[0080] S13320. If the key-value mapping type configuration object contains a target key, then the configuration information of the Extensible Markup Language file will be loaded into the configuration object corresponding to the target key.

[0081] Specifically, for an XML file that matches a specified path in the project directory, check if the configurationMap contains the target key obtained by extracting the path information of the XML file. If it does not contain the target key, it means that a corresponding second configuration object has not yet been created for this target key. In this case, a configuration (i.e., a second configuration object) can be created, the configuration information can be stored in the second configuration object after parsing the XML file, and the key-value mapping relationship between the target key and the second configuration object can be added to the configurationMap. If the target key is contained, it means that a corresponding configuration object has been created for this target key. In this case, the configuration corresponding to the target key in the configurationMap can be obtained based on the target key, the configuration information can be updated in the configuration after parsing the XML file.

[0082] In one embodiment, the specified path includes a first specified path and a second specified path;

[0083] If the path information of the Extensible Markup Language file matches the specified path in the project directory, then extract all or part of the path name from the path information as the target key, including:

[0084] S13210. If the path information of the Extensible Markup Language file matches the first specified path in the project directory, then extract the penultimate level identifier and the path name before the penultimate level identifier from the path information as the target key.

[0085] S13220. If the path information of the Extensible Markup Language file matches the second specified path in the project directory, then if the number of directory levels after the second specified path is greater than or equal to a set value, the last level identifier and the path name before the last level identifier are extracted from the path information as the target key; if the number of directory levels after the second specified path is less than the set value, the level identifier of the next level to the level to which the second specified path belongs is extracted from the path information as the target key.

[0086] Specifically, for ease of explanation, taking "src / main / java" and "resources" as examples, the hierarchical identifier in the path information can be " / ".

[0087] In this embodiment, the key of the configuration information of the XML file matching the specified path is determined according to the specific hierarchy in the path name, and the created second configuration object is used as the value, thereby establishing a key-value mapping relationship between the configuration information of the XML file matching the specified path and the second configuration object. Specifically, for the XML file matching the specified path, according to the specific hierarchy in its path name, it is first determined whether the full path name of the XML file contains "resources". If it does not contain it, the XML file is in the "src / main / java" directory (i.e., it matches the first specified path in the project directory), and the path name can be truncated to the second to last " / " as the key of the configurationMap;

[0088] If "resources" is included (i.e., the second specified path in the project directory is met), then it is determined whether the directory level after "resources" is greater than or equal to the set value (e.g., 3). If it is greater than or equal to the set value, then the path name is truncated to the last " / " as the key of the configurationMap. Otherwise, the full path name is truncated to the first " / " after "resources / " as the key of the configurationMap.

[0089] Figure 2 This is a flowchart illustrating how to load a low-level encapsulated object into a corresponding configuration object based on a directory, as provided in an embodiment of the present invention. Figure 2 As shown,

[0090] 1) First, create a configurationMap and a configuration (the first configuration object);

[0091] 2) For an XML file, enter the path information of the XML file (mainly the full path name);

[0092] 3) Determine whether the input full path name contains the specified path;

[0093] 4) If the path information in the XML file does not contain the specified path, then parse the XML file, encapsulate the obtained configuration information, and load it into the created configuration;

[0094] 5) If the path information of the XML file contains the specified path, then further determine whether it contains "resources";

[0095] 6) If it does not contain "resources", then extract the path information of the XML file, keeping the second-to-last " / " and the content before it as the key;

[0096] 7) Check if the key already exists in the configurationMap;

[0097] 8) If the key already exists in the configurationMap, retrieve the corresponding configuration based on the key, and encapsulate and load the configuration information obtained from parsing the XML file into the corresponding configuration;

[0098] 9) If the key does not exist in the configurationMap, create a configuration (second configuration object), encapsulate the configuration information obtained from parsing the XML file and load it into the created configuration, and add the key-value mapping relationship between the key and the created configuration to the configurationMap;

[0099] 10) If the path information of the XML file contains "resources", then determine whether the directory level after "resources" is greater than or equal to 3.

[0100] 11) If the value is greater than or equal to 3, extract the path information of the XML file, keeping the last " / " and the content before it as the key;

[0101] 12) If the value is less than 3, extract the path information of the XML file, keeping the first " / " after "resources" and the content before it as the key;

[0102] Based on steps 11) and 12), steps 7), 8), and 9) are executed, which involves determining whether the key already exists in the configurationMap. If the key already exists in the configurationMap, the corresponding configuration is retrieved based on the key, and the configuration information obtained from parsing the XML file is encapsulated and loaded into the corresponding configuration. If the key does not exist in the configurationMap, a configuration (second configuration object) is created, the configuration information obtained from parsing the XML file is encapsulated and loaded into this created configuration, and a key-value mapping relationship between the key and the created configuration is added to the configurationMap.

[0103] Based on this, different configuration objects are created according to the project directory. The configuration information of XML files in the corresponding directories is stored separately in the different configuration objects. That is, the configuration information of XML files with the same namespace but different paths is stored separately in different configurations. In this way, during the SQL code scanning process, the configuration information of XML files with the same namespace in different directories can be identified without throwing an exception, thereby improving the reliability of the scan.

[0104] In one embodiment, scanning the structured query language associated with the underlying encapsulated object includes:

[0105] S1410. Scan the underlying structured query language code for associating encapsulated objects to see if it contains a specified string. The specified string must include at least the character "1=1"; if it is included, there is an irregular query statement.

[0106] Specifically, consider the following check rule: SELECT statement query conditions should not contain "1=1". Because adding the "1=1" filter condition prevents the database system from using indexes and other query optimization strategies, the system will be forced to scan each row of data—a full table scan—to compare whether the row meets the filter condition. When the table contains a large amount of data, the query speed will be very slow.

[0107] In this embodiment, it is determined whether the SQL code contains "1=1" or other "1=1" strings with spaces, newlines, etc. If it does, it violates the rule that the SELECT statement query condition should not contain "1=1". In this case, the output scan result may contain information about the abnormal SQL code, such as the rule name of the violated check rule, the XML file where the abnormal SQL code is located, and the first line number.

[0108] In one embodiment, scanning the structured query language associated with the underlying encapsulated object includes:

[0109] S1420. Scan the underlying structured query language code for association of encapsulated objects to see if it contains keywords for representing query conditions. If it does not contain keywords for representing query conditions, then there are non-standard query (SELECT) statements, update (UPDATE) statements, and / or delete (DELETE) statements.

[0110] Specifically, one checking rule is that SELECT, UPDATE, and DELETE statements should include a WHERE condition. This is because without a WHERE condition, a full table scan will be performed during a SELECT query. If the table contains a large amount of data, the resulting map object will be too large, potentially causing memory overflow. Similarly, without a WHERE condition, updating or deleting data will operate on the entire table, resulting in low efficiency and increasing the risk of errors, such as updating or deleting incorrect data.

[0111] In this embodiment, it is determined whether the SQL code contains the "where" keyword. If it does not, it violates the rule that SELECT, UPDATE, and DELETE statements should include a WHERE condition. In this case, the output scan results may contain information about the abnormal SQL code, such as the name of the violated check rule, the XML file containing the abnormal SQL code, and the first line number. Based on this, it can effectively avoid situations where SQL statements containing WHERE tags are falsely reported as not containing a WHERE condition.

[0112] In one embodiment, scanning the structured query language associated with the underlying encapsulated object includes:

[0113] S1430. If the underlying structured query language code containing asterisks contains whitespace characters in the structured query language code, remove the whitespace characters in the structured query language code.

[0114] S1440. If the code of the structured query language does not contain instructions for counting rows, scan the code of the structured query language to see if it contains instructions for using an asterisk as a wildcard.

[0115] S1450. If an instruction contains an asterisk as a wildcard, then there is a query statement that violates the rule.

[0116] Specifically, one inspection rule is to prohibit the use of SELECT * for queries, and to explicitly specify which fields should be queried. Using "*" as the list of locations increases the parsing cost for the query analyzer, can lead to inconsistencies with the resultMap configuration when adding or removing fields, and increases network consumption with unnecessary fields, especially text fields.

[0117] In this embodiment, if an asterisk (*) appears in the SQL statement, all whitespace characters are first removed. Then, it is checked whether "count(*)" is still present. If not, the scan continues. By analyzing a large number of SQL statements in various programs, it is found that when using SELECT* for querying, "*" is usually followed by an English comma or "from". Therefore, during the scan, it is checked whether the SQL statement contains "*," or "*from". If it does, the rule prohibiting the use of SELECT* is violated. In this case, the output scan result can contain information about the abnormal SQL code, such as the rule name of the violated check rule, the XML file where the abnormal SQL code is located, and the first line number. Based on this, it is possible to avoid judging cases where "*" represents a multiplication sign in SQL as a rule violation, thus reducing the false positive rate.

[0118] In one embodiment, before preprocessing the corresponding Extensible Markup Language (XML) file according to the path information of each XML file in the path set to replace the referenced tags in the XML file with text, the method further includes:

[0119] S1010. Traverse the files in the project code package to save the path information of the Extensible Markup Language files in the project code package in the path set;

[0120] S1020: Remove path information containing the specified path name from the path set.

[0121] In this embodiment, based on the directory structure characteristics of a microservice system project developed using the Spring + Mybatis framework, directories and files that do not need to be scanned are filtered. Specifically, the full path names of all files under the code project to be scanned are traversed. If a file is an XML file, its full path name is added to the path set. Then, directories and files in the path set that do not need to be scanned are filtered. Since Java projects often generate target or bin directories after compilation, which contain compiled Java files and XML configuration files, the XML files are exactly the same as those in the src directory and do not need to be scanned. In addition, there are also test directories in the project, such as src / test, and the files in this directory do not need to be scanned. Based on these characteristics, path information whose full path names contain " / target / ", " / bin / ", and " / src / test / " can be removed from the path set, reducing the number of files to be scanned.

[0122] The SQL scanning method provided in this invention obtains the full path names of all files under the project, filters directories and files that do not need to be scanned based on the directory structure characteristics of a microservice system project developed using the Spring+Mybatis framework, and sequentially traverses XML files for preprocessing, parsing the XML file configuration information. During preprocessing, tags and referenced content appearing in the XML are identified and replaced with plain text content. During parsing, multiple configuration objects are created based on the XML file paths, and the XML configuration information is uniformly loaded into the corresponding configuration objects. Finally, the mapper statements in all configurations are obtained, and the SQL statements within them are scanned according to various inspection rules, outputting the rule scanning results, thus improving the reliability and comprehensiveness of the scan.

[0123] Figure 3 A flowchart of another scanning method for a structured query language provided in an embodiment of the present invention.

[0124] like Figure 3 As shown, the scanning process includes:

[0125] a) Iterate through the full path names of all files in the code project to be scanned. If the file is an XML file, put the path information (mainly the full path name) of the file into a path collection (List collection);

[0126] b) Filter directories and XML files that do not need to be scanned, such as removing those whose full path names contain " / target / ", " / bin / ", or " / src / test / " from the list collection to reduce the number of XML files to be scanned;

[0127] c) Traverse the full path names in the path collection, preprocess the XML file, and use dom4j to parse the elements and attributes in the XML file to obtain all elements in the XML file. Remove elements whose names contain resultMap, parameterMap, cache, cache-Ref, and typeAlias ​​to reduce the amount of SQL code scanned. During the traversal, referenced tags are also replaced with text. On the one hand, the ID attribute value of the element named sql can be used as the key and the text of the element as the value, and put into a map. Then, for all include type elements, the corresponding value is retrieved from the map based on the refid attribute value, which is used to replace the include tag in the parent element of the include element. On the other hand, for... <where>,<trim preix=”where”> The tag is processed to get all elements with the name "where" or "trim" and the prefix attribute is "where". The tag under the parent element of the element is replaced with the text content of the element and the keyword "where" is concatenated. The keyword "where" can be recognized during subsequent rule scanning.

[0128] d) Taking into account the typical Java project directory structure (XML files are usually located in the " / resources" or "src / main / java" directories), multiple configuration objects are created based on the project directory. The Mybatis framework is used to parse the XML files, obtain all configuration information, and place the configuration information from XML files in different directories into the corresponding configurations. For example, for XML files in the " / resources" or "src / main / java" directories, the parsed configuration information is placed into the corresponding configuration for that directory. For XML files not located in the " / resources" or "src / main / java" directories, the parsed configuration information is uniformly placed into the created configuration. This process can be implemented using a configurationMap and by extracting the path name as the key; see any of the above embodiments for details, which will not be elaborated here.

[0129] e) Obtain each configuration and the mapperStatement in each configuration, and format the SQL statement code in the mapperStatement, for example, by converting it to lowercase letters.

[0130] f) Based on the inspection rules, scan the SQL code in the mapperStatement whose SQL type is SELECT, UPDATE, or DELETE;

[0131] g) Output the scan results, which include information about SQL codes that violate the inspection rules.

[0132] This invention provides an SQL scanning method that analyzes situations where XML files with the same namespace may exist in microservice systems based on the Mybatis framework. It proposes creating different configurations based on the directory to which the XML files belong. Each configuration object only stores the parsed information of the XML files in its corresponding directory. This solves the problem of exceptions easily thrown and scanning failures when using a single global configuration object to store XML file information, greatly improving scanning efficiency and reducing the need for manual intervention. Furthermore, it analyzes the frequent false alarms reported by developers and addresses issues in the SQL code. <include> 、 <where>、<trim prefix=”where”>、 <if>The system parses and replaces tags; in addition, it identifies and filters business scenarios where asterisks are used as multiplication signs in SQL, which greatly reduces the false alarm rate of rule scanning, allowing developers to focus their energy on SQL code that does not conform to the standard and significantly reducing the workload of developers.

[0133] This invention provides a scanning device for a structured query language. Figure 4 This is a schematic diagram of a scanning device for a structured query language provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the device includes:

[0134] The preprocessing module 410 is used to preprocess the corresponding Extensible Markup Language (XML) file according to the path information of each XML file in the path set, so as to replace the referenced tags in the XML file with text.

[0135] The parsing module 420 is used to parse the preprocessed Extensible Markup Language (XML) files based on the persistence layer framework to obtain the configuration information of each XML file.

[0136] The loading module 430 is used to encapsulate each configuration information into a corresponding underlying encapsulation object, and load each underlying encapsulation object into the corresponding configuration object according to the directory to which the corresponding configuration information belongs;

[0137] The scanning module 440 is used to scan the structured query language corresponding to the underlying encapsulated objects in each of the configuration objects.

[0138] This invention provides a scanning device for a structured query language. By replacing referenced tags in an Extensible Markup Language (EXPLAIN) file with text, it solves the problem of not being able to identify fragment references and tag content. By encapsulating configuration information and loading it into configuration objects corresponding to their respective directories, each configuration object can store the configuration information of the corresponding directory, thus solving the problem of scanning failure caused by using the same configuration object globally and improving the reliability of scanning.

[0139] Optional, preprocessing module 410, for:

[0140] The path information in the path set is read sequentially. For the first type element of the referenced tag in the corresponding Extensible Markup Language file of the currently read path information, the number attribute value of the first type element is used as the key and the text of the first type element is used as the value, and added to the key-value mapping object.

[0141] For the second type element of the reference tag in the corresponding Extensible Markup Language file of the currently read path information, the key corresponding to the tag in the parent element of the second type element is replaced with the corresponding value according to the key-value mapping object.

[0142] Optionally, the preprocessing module 410 is also used for:

[0143] For the third type of element in the corresponding Extensible Markup Language file of the currently read path information, the query restriction condition tag in the parent element of the third type of element is concatenated with the query restriction keyword.

[0144] Optionally, the preprocessing module 410 is also used for:

[0145] The path information in the path set is read sequentially. For the currently read path information, a specified element is removed from the elements contained in the corresponding Extensible Markup Language file of the currently read path information. The specified element does not participate in the scanning of the Structured Query Language.

[0146] Optionally, load module 430 for:

[0147] For each of the preprocessed Extensible Markup Language (XML) files, if the XML file does not conform to the specified path in the project directory, the configuration information of the XML file is loaded into the created first configuration object;

[0148] If the path information of the Extensible Markup Language file matches the specified path in the project directory, then all or part of the path name is extracted from the path information as the target key.

[0149] The configuration information of the Extensible Markup Language file is loaded into the created second configuration object or the configuration object corresponding to the target key based on the target key.

[0150] Optionally, loading the configuration information of the Extensible Markup Language file into the created second configuration object or the configuration object corresponding to the target key according to the target key includes:

[0151] If the key-value mapping type configuration object does not contain the target key, then the configuration information of the Extensible Markup Language file is loaded into the created second configuration object;

[0152] If the key-value mapping type configuration object contains the target key, then the configuration information of the Extensible Markup Language file is loaded into the configuration object corresponding to the target key.

[0153] Optionally, the specified path includes a first specified path and a second specified path;

[0154] If the path information of the Extensible Markup Language file matches the specified path in the project directory, then all or part of the path name is extracted from the path information as the target key, including:

[0155] If the path information of the Extensible Markup Language file matches the first specified path in the project directory, then the penultimate level identifier and the path name before the penultimate level identifier are extracted from the path information as the target key;

[0156] If the path information of the Extensible Markup Language file matches the second specified path in the project directory, then if the number of directory levels after the second specified path is greater than or equal to a set value, the last level identifier and the path name before the last level identifier are extracted from the path information as the target key; if the number of directory levels after the second specified path is less than the set value, the level identifier of the next level to the level to which the second specified path belongs is extracted from the path information as the target key.

[0157] Optionally, the scanning module 440 is used for:

[0158] Scan whether the structured query language code associated with the underlying encapsulated object contains a specified string, wherein the specified string includes at least the character "1=1";

[0159] If the specified string is included, then there is an irregular query statement.

[0160] Optionally, the scanning module 440 is used for:

[0161] Scan the structured query language code associated with the underlying encapsulated object to see if it contains keywords used to represent query conditions;

[0162] If no keywords are included to represent the query conditions, then there are non-standard query statements, update statements, and / or delete statements.

[0163] Optionally, the scanning module 440 is used for:

[0164] If the underlying encapsulated object's associated structured query language code contains asterisks, remove whitespace characters from the structured query language code.

[0165] If the code of the structured query language does not contain instructions for counting rows, scan the code of the structured query language to see if it contains instructions for using an asterisk as a wildcard.

[0166] If an instruction contains an asterisk as a wildcard, then there is a query that violates the rules.

[0167] Optionally, before preprocessing the corresponding Extensible Markup Language (XML) file according to the path information for each XML file in the path set to replace referenced tags in the XML file with text, the apparatus further includes: a filtering module, configured to:

[0168] Traverse the files in the project code package to store the path information of the Extensible Markup Language files in the project code package in a path set;

[0169] Remove path information containing the specified path name from the path set.

[0170] The structured query language scanning device provided in this embodiment of the invention can execute the structured query language scanning method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0171] Figure 5 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is provided. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the embodiments of the invention described and / or claimed herein.

[0172] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0173] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0174] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as a scanning method for a structured query language.

[0175] In some embodiments, a structured query language scanning method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the structured query language scanning method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform a structured query language scanning method by any other suitable means (e.g., by means of firmware).

[0176] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0177] Computer programs for implementing the methods of embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0178] In the context of embodiments of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. Examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0179] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0180] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0181] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0182] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements a scanning method for a structured query language as provided in any embodiment of this application.

[0183] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0184] It should be understood that the various forms of processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the embodiments of the present invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of the embodiments of the present invention can be achieved, and this document does not impose any restrictions.

[0185] The specific embodiments described above do not constitute a limitation on the scope of protection of the embodiments of the present invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the embodiments of the present invention should be included within the scope of protection of the embodiments of the present invention.

[0186] The above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.< / if> < / where> < / include> < / where> < / where> < / where> < / if> < / where>

Claims

1. A scanning method for a structured query language, characterized in that, include: For the path information of each Extensible Markup Language (XML) file in the path set, the corresponding XML file is preprocessed according to the path information to replace the referenced tags in the XML file with text; Based on the persistence layer framework, the preprocessed Extensible Markup Language (XML) files are parsed to obtain the configuration information of each XML file. Each configuration information is encapsulated into a corresponding underlying encapsulation object, and each underlying encapsulation object is loaded into the corresponding configuration object according to the directory to which the corresponding configuration information belongs. Different directories correspond to different configuration objects. The structured query language corresponding to the underlying encapsulation objects in each of the configuration objects is scanned.

2. The method according to claim 1, characterized in that, For the path information of each Extensible Markup Language (XML) file in the path set, the corresponding XML file is preprocessed according to the path information to replace the referenced tags in the XML file with text, including: The path information in the path set is read sequentially. For the first type element of the referenced tag in the corresponding Extensible Markup Language file of the currently read path information, the number attribute value of the first type element is used as the key and the text of the first type element is used as the value, and added to the key-value mapping object. For the second type element of the reference tag in the corresponding Extensible Markup Language file of the currently read path information, the key corresponding to the tag in the parent element of the second type element is replaced with the corresponding value according to the key-value mapping object.

3. The method according to claim 2, characterized in that, Also includes: For the third type of element in the corresponding Extensible Markup Language file of the currently read path information, the query restriction keywords are concatenated into the query restriction condition tags in the parent element of the third type of element.

4. The method according to claim 1, characterized in that, Also includes: The path information in the path set is read sequentially. For the currently read path information, a specified element is removed from the elements contained in the corresponding Extensible Markup Language file of the currently read path information. The specified element does not participate in the scanning of the Structured Query Language.

5. The method according to claim 1, characterized in that, Each configuration information is encapsulated into a corresponding underlying encapsulation object, and each underlying encapsulation object is loaded into the corresponding configuration object according to the directory to which the configuration information belongs, including: For each of the preprocessed Extensible Markup Language (XML) files, if the XML file does not conform to the specified path in the project directory, the configuration information of the XML file is loaded into the created first configuration object; If the path information of the Extensible Markup Language file matches the specified path in the project directory, then all or part of the path name is extracted from the path information as the target key. The configuration information of the Extensible Markup Language file is loaded into the created second configuration object or the configuration object corresponding to the target key based on the target key.

6. The method according to claim 5, characterized in that, Loading the configuration information of the Extensible Markup Language file into the created second configuration object or the configuration object corresponding to the target key based on the target key includes: If the key-value mapping type configuration object does not contain the target key, then the configuration information of the Extensible Markup Language file is loaded into the created second configuration object; If the key-value mapping type configuration object contains the target key, then the configuration information of the Extensible Markup Language file is loaded into the configuration object corresponding to the target key.

7. The method according to claim 5, characterized in that, The specified path includes a first specified path and a second specified path; If the path information of the Extensible Markup Language file matches the specified path in the project directory, then all or part of the path name is extracted from the path information as the target key, including: If the path information of the Extensible Markup Language file matches the first specified path in the project directory, then the penultimate level identifier and the path name before the penultimate level identifier are extracted from the path information as the target key; If the path information of the Extensible Markup Language file matches the second specified path in the project directory, then if the number of directory levels after the second specified path is greater than or equal to a set value, the last level identifier and the path name before the last level identifier are extracted from the path information as the target key; if the number of directory levels after the second specified path is less than the set value, the level identifier of the next level to the level to which the second specified path belongs is extracted from the path information as the target key.

8. The method according to claim 1, characterized in that, The structured query language associated with the underlying encapsulated object is scanned, including: Scan the code of the structured query language associated with the underlying encapsulated object to check whether it contains a specified string, which includes at least the character "1=1"; If the specified string is included, then there is an irregular query statement.

9. The method according to claim 1, characterized in that, The code of the structured query language associated with the underlying encapsulated object is scanned, including: Scan the code of the structured query language associated with the underlying encapsulated object to check whether it contains keywords used to represent query conditions; If no keywords are included to represent the query conditions, then there are non-standard query statements, update statements, and / or delete statements.

10. The method according to claim 1, characterized in that, The structured query language associated with the underlying encapsulated object is scanned, including: If the underlying encapsulated object's associated structured query language code contains asterisks, remove whitespace characters from the structured query language code. If the code of the structured query language does not contain instructions for counting rows, scan the code of the structured query language to check whether it contains instructions that use an asterisk as a wildcard. If an instruction contains an asterisk as a wildcard, then there is a query that violates the rules.

11. The method according to any one of claims 1-10, characterized in that, Before preprocessing the corresponding Extensible Markup Language (XML) file according to the path information of each XML file in the path set, to replace the referenced tags in the XML file with text, the process further includes: Traverse the files in the project code package to store the path information of the Extensible Markup Language files in the project code package in a path set; Remove path information containing the specified path name from the path set.

12. A scanning device for a structured query language, characterized in that, include: The preprocessing module is used to preprocess the corresponding Extensible Markup Language (XML) file according to the path information of each XML file in the path set, so as to replace the referenced tags in the XML file with text. The parsing module is used to parse the preprocessed Extensible Markup Language (XML) files based on the persistence layer framework to obtain the configuration information of each XML file; The loading module is used to encapsulate each configuration information into a corresponding underlying encapsulation object, and load each underlying encapsulation object into the corresponding configuration object according to the directory to which the corresponding configuration information belongs; The scanning module is used to scan the structured query language corresponding to the underlying encapsulated objects in each of the configuration objects.

13. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the scanning method of the structured query language as described in any one of claims 1-11.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the scanning method of the structured query language as described in any one of claims 1-11.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the scanning method of the structured query language as described in any one of claims 1-11.

Images