Component vulnerability repair method, device, electronic device and storage medium

Abstract

The present application discloses a component vulnerability repair method, device, electronic device and storage medium, and relates to the field of vulnerability repair technology. The component vulnerability repair method includes obtaining vulnerability information of the component to be repaired, and performing static analysis on the component to be repaired to locate the vulnerability position of the component to be repaired; determining the vulnerability type of the component to be repaired according to the vulnerability information; detecting the program code of the vulnerability position respectively through different detectors corresponding to the vulnerability type, and repairing the program code of the vulnerability position based on the detection results and preset rules; verifying the program code of the repaired vulnerability position. The component vulnerability repair method of the present application can not only automatically repair component vulnerabilities in a timely and efficient manner without waiting for component version updates, but also ensure correctness and compatibility.

Description

Technical Field

[0001] The present application relates to the technical field of vulnerability repair, and in particular to a component vulnerability repair method, device, electronic device and storage medium. Background Art

[0002] With the development of the open source community and the gradual improvement of component dependency package management mechanisms, developers will introduce a large number of third-party components in the software development process to reduce development workload, and at the same time will also introduce vulnerabilities contained in the third-party components.

[0003] For developers, it is difficult to repair third-party components that are not developed by themselves. At present, the relevant technology uses the method of upgrading the version of components without vulnerabilities to achieve vulnerability repair, but this method cannot repair the vulnerabilities of components that have not been updated, and the updated version may have compatibility issues, causing the original program code to fail to run normally. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the related art, it is desirable to provide a component vulnerability repair method, device, electronic device and storage medium, which can automatically and timely repair component vulnerabilities without waiting for component version updates.

[0005] In a first aspect, the present application provides a component vulnerability repair method, the component vulnerability repair method comprising:

[0006] Acquire vulnerability information of the component to be repaired, and perform static analysis on the component to be repaired to locate the vulnerability position of the component to be repaired;

[0007] Determine the vulnerability type of the component to be repaired according to the vulnerability information;

[0008] Using different detectors corresponding to the vulnerability types, the program code at the vulnerability location is detected respectively, and the program code at the vulnerability location is repaired based on the detection results and preset rules;

[0009] Verify that the program code at the location of the vulnerability has been repaired.

[0010] Optionally, in some embodiments of the present application, the vulnerability type includes a structured query language injection type, and the program code for repairing the vulnerability location based on the detection result and the preset rule includes:

[0011] If the detection result includes a vulnerability pattern and the programming language and an operation parameter diagram of the program code, and the operation parameter diagram is used to characterize the threatened position of the program code, then a filtering node is added before the trigger statement corresponding to the threatened position according to the vulnerability pattern and the programming language.

[0012] Optionally, in some embodiments of the present application, the vulnerability type includes a command injection type, and the program code for repairing the vulnerability location based on the detection result and the preset rule includes:

[0013] If the detection result includes the programming language, the hazardous function position and the hazardous function type of the program code, then according to the programming language and the hazardous function type, the hazardous function at the hazardous function position is replaced with a safe function of the same type as the hazardous function;

[0014] Alternatively, if the detection result includes a dangerous command that is not related to the program code, a judgment statement is added to the program code, wherein the judgment statement is used to skip the execution of the dangerous command;

[0015] Alternatively, if the detection result includes special characters, the special characters are cleaned using regular expressions.

[0016] Optionally, in some embodiments of the present application, the vulnerability type includes a pointer type, and the program code for repairing the vulnerability location based on the detection result and a preset rule includes:

[0017] If the detection result is that the pointer is not released after use, then adding a release code after the final scope of the pointer or replacing the pointer with a smart pointer;

[0018] Alternatively, if the detection result is that a suspended pointer is used, the suspended pointer is pointed to a legal memory address or the suspended pointer is set to a null value;

[0019] Alternatively, if the detection result is a reference to a null pointer, a conditional statement is added to the program code to perform null determination processing to skip the execution of subsequent codes.

[0020] Optionally, in some embodiments of the present application, the vulnerability type includes an overflow type, and the program code for repairing the vulnerability location based on the detection result and a preset rule includes:

[0021] If the detection result includes a data input point and a data overflow point, an input verification code is added at the code snippet of the data input point and a boundary checking code is added at the code snippet of the data overflow point. The input verification code and the boundary checking code are used to detect input parameters and skip the execution of subsequent code when the input parameters do not meet preset conditions.

[0022] Optionally, in some embodiments of the present application, if the detection result also includes a dangerous call library, the dangerous call library is replaced with a safe call library.

[0023] Optionally, in some embodiments of the present application, the overflow type includes any one of a buffer overflow, an integer overflow and an array out of bounds.

[0024] In a second aspect, the present application provides a component vulnerability repair device, the component vulnerability repair device comprising:

[0025] A positioning module configured to obtain vulnerability information of the component to be repaired, and perform static analysis on the component to be repaired to locate the vulnerability position of the component to be repaired;

[0026] A determination module configured to determine the vulnerability type of the component to be repaired according to the vulnerability information;

[0027] A repair module, configured to detect the program code at the vulnerability location through different detectors corresponding to the vulnerability type, and repair the program code at the vulnerability location based on the detection results and preset rules;

[0028] A verification module is configured to verify the program code of the repaired vulnerability location.

[0029] In a third aspect, the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the component vulnerability repair method described in any one of the first aspects.

[0030] In a fourth aspect, the present application provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the component vulnerability repair method described in any one of the first aspects.

[0031] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0032] The embodiments of the present application provide a component vulnerability repair method, device, electronic device and storage medium, which determine the vulnerability type of the component to be repaired by actively obtaining the vulnerability information of the component to be repaired, and locate the vulnerability position of the component to be repaired by static analysis of the component to be repaired, and then use different detectors corresponding to the vulnerability type to detect the program code at the vulnerability position respectively, and then can automatically repair the program code at the vulnerability position based on the detection results and preset rules, in a timely and efficient manner, without waiting for the component version to be updated, and can also verify the program code at the repaired vulnerability position to ensure correctness and compatibility. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A basic flow chart of a component vulnerability repair method provided in an embodiment of the present application;

[0035] Figure 2 A structural block diagram of a component vulnerability repair device provided in an embodiment of the present application;

[0036] Figure 3 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0038] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0039] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. Figures 1 to 3 The component vulnerability repair method, device, electronic device and storage medium provided in the embodiments of the present application are described in detail.

[0040] Please refer to Figure 1 , which is a basic flow chart of a component vulnerability repair method provided by an embodiment of the present application, the method specifically comprises the following steps:

[0041] S101, obtaining vulnerability information of the component to be repaired, and performing static analysis on the component to be repaired to locate the vulnerability position of the component to be repaired.

[0042] Exemplarily, the embodiments of the present application can analyze the development project under test through the Software Composition Analysis (SCA) technology to identify the third-party component information contained in the development project under test, such as third-party components including but not limited to source code components, binary components, and package dependency components, and the dependency methods include direct dependency and indirect dependency; then, the third-party component information is matched with the public vulnerability website information to identify whether there are third-party components containing vulnerabilities, and the third-party components containing vulnerabilities are used as components to be repaired. Furthermore, component reachability analysis technology is used to confirm whether there is a call path for the component to be repaired and whether it is truly reachable, and when there is a call path for the component to be repaired, static analysis technology is used to locate the vulnerability position of the component to be repaired.

[0043] S102: Determine the vulnerability type of the component to be repaired according to the vulnerability information.

[0044] Exemplarily, the embodiment of the present application can classify the description information and label information in the vulnerability information through natural language processing (NLP) technology, and the description information and label information are obtained from the public vulnerability website. For example, the description information of injection vulnerabilities will contain keywords such as injection, SQL injection, and command injection, and the description information of pointer vulnerabilities will contain keywords such as pointer, memory address, and function return address, that is, classification is performed by identifying keywords.

[0045] S103, using different detectors corresponding to the vulnerability types, respectively detect the program code at the vulnerability location, and repair the program code at the vulnerability location based on the detection results and preset rules.

[0046] For example, injection vulnerabilities include but are not limited to structured query language (SQL) injection type, command injection type and code injection type, which exist in multiple programming languages ​​such as C / C++ and JAVA. ① For structured query language injection type, different detectors can detect situations such as true statements, error statements, end comments and joint queries. If the detection results include vulnerability patterns and the programming language and running parameter graph of the program code, and the running parameter graph is used to characterize the threatened position of the program code, then according to the vulnerability pattern and programming language, a filter node is added before the trigger statement corresponding to the threatened position. For example, the running parameter graph includes but is not limited to a data flow graph and a function call graph, where the data flow graph can display the data flow direction and the function call graph can display the execution path of the program code. Taking the vulnerability mode as an example, the embodiment of the present application can confirm the threatened position of the program code according to the data flow diagram, that is, where the threat is caused, and then add a corresponding filter node before the trigger statement corresponding to the threatened position according to the programming language of different program codes, filter the data content of the permanent true style "or 1=1", and retain the normal SQL statement before the permanent true style, thereby blocking the vulnerability triggering.

[0047] ② For command injection types, different detectors can detect command functions, special characters, comment methods, dangerous functions, and sensitive file path access in different programming languages. The command functions include but are not limited to fopen(), readfile(), and other functions, and the sensitive file path access includes but is not limited to / etc / passwd, C:\Windows\System, and other paths. If the detection result includes the programming language of the program code, the location of the dangerous function, and the type of the dangerous function, then according to the programming language and the type of the dangerous function, the dangerous function at the dangerous function location is replaced with a safe function of the same type as the dangerous function. For example, if the programming language is JAVA, the Statement function is a dangerous function, and the PreparedStatement function is a corresponding safe function of the same type. Alternatively, if the detection result includes dangerous commands that are not related to the program code, a judgment statement is added to the program code. The judgment statement is used to skip the execution of the dangerous command. For example, the function of the program code is to calculate a data, but it contains a command to download a file. The command to download a file is a dangerous command. For another example, the judgment statement can be an if statement. Alternatively, if the detection result includes special characters, the special characters are cleaned using a regular expression. For example, the special character may be the end character ";" of the SQL statement, and the regular expression may be Pattern pattern = Pattern.compile(".*;").

[0048] For example, pointer vulnerabilities include but are not limited to pointers not being released after use, use of floating pointers, and reference to null pointers, which mainly exist in C / C++ languages. ① If the detection result is that the pointer is not released after use, add release code after the final scope of the pointer or replace the pointer with a smart pointer, such as smart pointers including but not limited to std::unique_ptr, std::shared_ptr, etc., so that the pointer can be automatically released, reducing manual management and avoiding memory leaks. Or, ② If the detection result is the use of a floating pointer, point the floating pointer to a legal memory address or set the floating pointer to a null value (NULL). For example, the code line of the pointer declaration is "int *p;", and there is no subsequent initialization code, indicating that the floating pointer is caused by uninitialization. At this time, you can add a "= NULL" statement in the pointer declaration to get "int *p =NULL;". For another example, the pointer is not set to a null value after the free() or delete() function is executed in the conditional path, resulting in it still being used by subsequent code. At this time, you can add a "= NULL" statement after the free() or delete() function to avoid malicious use of the floating pointer. Alternatively, ③ if the detection result is a reference to a null pointer, a conditional statement is added to the program code to perform null judgment processing to skip the execution of subsequent code. For example, after the pointer is set to a null value, the detector will record the pointer status. If the subsequent code still calls the pointer, then an if statement is added to the program code to perform null judgment processing to skip the execution of subsequent code, and the pointer printing code is added for easy output viewing.

[0049] For another example, the overflow types of overflow vulnerabilities include but are not limited to buffer overflow, integer overflow, and array out of bounds. If the detection result includes data input points and data overflow points, then add input verification code at the code snippet of the data input point and add boundary checking code at the code snippet of the data overflow point. The input verification code and the boundary checking code are used to detect input parameters and skip the execution of subsequent code when the input parameters do not meet preset conditions. For example, the preset conditions may be preset data length or preset data format. Furthermore, if the detection result also includes dangerous functions, replace the dangerous functions with safe functions, and if the detection result also includes dangerous call libraries, replace the dangerous call libraries with safe call libraries, thereby ensuring that the program code runs in a predictable mode.

[0050] S104, verifying the program code at the repaired vulnerability location.

[0051] Exemplarily, for example, by using static analysis technology and using syntax checkers of different programming languages ​​to check whether the repaired program code has syntax errors. For another example, different types of unit testing frameworks are used for different programming languages ​​to check whether the functions of the repaired program code or functions are correct. For another example, different types of program-related graphs such as data flow graphs, value dependency graphs, and control flow graphs are generated through code parsing, and the program-related graphs before and after the repair are compared to determine whether the original logic of the program code has changed. For another example, compatibility is verified by checking whether the number of parameters and parameter types of the modified function have changed and whether the return parameter type has changed. For another example, different types of compilation environment sandboxes are used to compile the program code according to different compilation requirements to verify whether normal compilation is affected.

[0052] The component vulnerability repair method provided in the embodiment of the present application determines the vulnerability type of the component to be repaired by actively obtaining the vulnerability information of the component to be repaired, and locates the vulnerability position of the component to be repaired by static analysis of the component to be repaired, and then uses different detectors corresponding to the vulnerability type to respectively detect the program code at the vulnerability position, and then can automatically repair the program code at the vulnerability position based on the detection results and preset rules, which is timely and efficient, and there is no need to wait for the component version to be updated. In addition, the program code at the repaired vulnerability position can be verified to ensure correctness and compatibility.

[0053] Based on the above embodiments, the present application provides a component vulnerability repair device. The component vulnerability repair device 100 can be applied to Figure 1 In the component vulnerability repair method of the corresponding embodiment. Please refer to Figure 2 , the component vulnerability repair device 100 includes:

[0054] The positioning module 101 is configured to obtain vulnerability information of the component to be repaired, and perform static analysis on the component to be repaired to locate the vulnerability position of the component to be repaired;

[0055] A determination module 102, configured to determine the vulnerability type of the component to be repaired according to the vulnerability information;

[0056] The repair module 103 is configured to detect the program code at the vulnerability location through different detectors corresponding to the vulnerability type, and repair the program code at the vulnerability location based on the detection results and preset rules;

[0057] The verification module 104 is configured to verify the program code of the repaired vulnerability location.

[0058] Optionally, in some embodiments of the present application, the vulnerability type includes a structured query language injection type, and the repair module 103 is specifically configured to add a filter node before the trigger statement corresponding to the position to be threatened according to the vulnerability pattern and programming language if the detection result includes a vulnerability pattern and a programming language and an operation parameter graph of the program code, and the operation parameter graph is used to characterize the position to be threatened of the program code.

[0059] Optionally, in some embodiments of the present application, the vulnerability type includes a command injection type, and the repair module 103 is specifically configured to replace the dangerous function at the dangerous function position with a safe function of the same dangerous function type according to the programming language and the dangerous function type if the detection result includes the programming language of the program code, the dangerous function position, and the dangerous function type;

[0060] Alternatively, if the detection result includes a dangerous command that is not related to the program code, a judgment statement is added to the program code, and the judgment statement is used to skip the execution of the dangerous command;

[0061] Alternatively, if the detection result includes special characters, the special characters are cleaned using regular expressions.

[0062] Optionally, in some embodiments of the present application, the vulnerability type includes a pointer type, and the repair module 103 is specifically configured to add a release code after the final scope of the pointer or replace the pointer with a smart pointer if the detection result is that the pointer is not released after use;

[0063] Alternatively, if the detection result is that a dangling pointer is used, the dangling pointer is pointed to a legal memory address or the dangling pointer is set to a null value;

[0064] Alternatively, if the detection result is a reference to a null pointer, a conditional statement is added to the program code to perform null detection processing to skip the execution of subsequent code.

[0065] Optionally, in some embodiments of the present application, the vulnerability type includes an overflow type, and the repair module 103 is specifically configured to add input verification code at the code snippet of the data input point and add boundary checking code at the code snippet of the data overflow point if the detection result includes a data input point and a data overflow point. The input verification code and the boundary checking code are used to detect input parameters and skip the execution of subsequent code when the input parameters do not meet preset conditions.

[0066] Optionally, in some embodiments of the present application, the repair module 103 is specifically configured to replace the dangerous call library with a safe call library if the detection result also includes a dangerous call library.

[0067] Optionally, in some embodiments of the present application, the overflow type includes any one of a buffer overflow, an integer overflow, and an array out of bounds.

[0068] It should be noted that, for the description of the same steps and the same contents in this embodiment as those in other embodiments, reference can be made to the description in other embodiments and will not be repeated here.

[0069] The component vulnerability repair device provided in the embodiment of the present application determines the vulnerability type of the component to be repaired by actively obtaining the vulnerability information of the component to be repaired, and locates the vulnerability position of the component to be repaired by static analysis of the component to be repaired, and then uses different detectors corresponding to the vulnerability type to respectively detect the program code at the vulnerability position, and then can automatically repair the program code at the vulnerability position based on the detection results and preset rules, which is timely and efficient, and there is no need to wait for the component version to be updated. The program code at the repaired vulnerability position can also be verified to ensure correctness and compatibility.

[0070] Based on the above embodiments, the present application provides an electronic device. Figure 3 The electronic device 200 may include a processor 201 and a memory 202. The memory 202 stores at least one instruction, at least one program, code set or instruction set, which is loaded and executed by the processor 201 to implement Figure 1 The steps of the component vulnerability repair method of the corresponding embodiment.

[0071] As another aspect, the present application provides a computer-readable storage medium for storing program code, the program code for executing the aforementioned Figure 1 Any implementation method of the component vulnerability repair method of the corresponding embodiment.

[0072] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and modules described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0073] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms. The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0074] In addition, each functional module in each embodiment of the present application may be integrated into a processing unit, or each module may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit. If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.

[0075] Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the component vulnerability repair method of each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0076] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0077] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A component vulnerability repair method, characterized in that: The component vulnerability repair method includes: Acquire vulnerability information of the component to be repaired, and determine whether there is a call path for the component to be repaired by means of component reachability analysis; if there is a call path for the component to be repaired, perform static analysis on the component to be repaired and locate the vulnerability position of the component to be repaired, wherein the component to be repaired is a third-party component, and the third-party component includes a source code component, a binary component, and a package dependency component; Determine the vulnerability type of the component to be repaired according to the vulnerability information; Using different detectors corresponding to the vulnerability types, the program code at the vulnerability location is detected respectively, and the program code at the vulnerability location is repaired based on the detection results and preset rules; Verify the program code of the patched vulnerability location; Wherein, the vulnerability type includes a command injection type, and the program code of the vulnerability position is repaired based on the detection result and the preset rule, including: if the detection result includes the programming language, the dangerous function position and the dangerous function type of the program code, then according to the programming language and the dangerous function type, the dangerous function at the dangerous function position is replaced with a safe function of the same dangerous function type; or, if the detection result includes a dangerous command unrelated to the program code, then a judgment statement is added to the program code, and the judgment statement is used to skip the execution of the dangerous command; or, if the detection result includes special characters, the special characters are cleaned by using regular expressions; Among them, the vulnerability type includes a structured query language injection type, and the program code for repairing the vulnerability location based on the detection results and preset rules includes: if the detection results include a vulnerability pattern and the programming language and an operation parameter graph of the program code, and the operation parameter graph is used to characterize the threatened location of the program code, then according to the vulnerability pattern and the programming language, a filtering node is added before the trigger statement corresponding to the threatened location.

2. The component vulnerability repair method according to claim 1, characterized in that: The vulnerability type includes a pointer type, and the program code for repairing the vulnerability location based on the detection result and the preset rule includes: If the detection result is that the pointer is not released after use, then adding a release code after the final scope of the pointer or replacing the pointer with a smart pointer; Alternatively, if the detection result is that a suspended pointer is used, the suspended pointer is pointed to a legal memory address or the suspended pointer is set to a null value; Alternatively, if the detection result is a reference to a null pointer, a conditional statement is added to the program code to perform null determination processing to skip the execution of subsequent codes.

3. The component vulnerability repair method according to claim 1, characterized in that: The vulnerability type includes an overflow type, and the program code for repairing the vulnerability location based on the detection result and the preset rule includes: If the detection result includes a data input point and a data overflow point, an input verification code is added at the code snippet of the data input point and a boundary checking code is added at the code snippet of the data overflow point. The input verification code and the boundary checking code are used to detect input parameters and skip the execution of subsequent code when the input parameters do not meet preset conditions.

4. The component vulnerability repair method according to claim 3, characterized in that: If the detection result also includes a dangerous call library, the dangerous call library is replaced with a safe call library.

5. The component vulnerability repair method according to claim 3, characterized in that: The overflow type includes any one of a buffer overflow, an integer overflow and an array cross-bounds overflow.

6. A component vulnerability repair device, characterized in that: The component vulnerability repair device comprises: A positioning module is configured to obtain vulnerability information of a component to be repaired, and determine whether there is a call path for the component to be repaired by means of component reachability analysis. When there is a call path for the component to be repaired, static analysis is performed on the component to be repaired and the vulnerability position of the component to be repaired is located. The component to be repaired is a third-party component, and the third-party component includes a source code component, a binary component, and a package dependency component. A determination module configured to determine the vulnerability type of the component to be repaired according to the vulnerability information; A repair module, configured to detect the program code at the vulnerability location through different detectors corresponding to the vulnerability type, and repair the program code at the vulnerability location based on the detection results and preset rules; A verification module configured to verify the program code of the fixed vulnerability location; Wherein, the vulnerability type includes a command injection type, and the repair module is specifically configured to replace the dangerous function at the dangerous function position with a safe function of the same dangerous function type according to the programming language and the dangerous function type if the detection result includes the programming language, dangerous function position and dangerous function type of the program code; or, if the detection result includes a dangerous command that is not related to the program code, add a judgment statement in the program code, and the judgment statement is used to skip the execution of the dangerous command; or, if the detection result includes special characters, use regular expressions to clean the special characters; Among them, the vulnerability type includes a structured query language injection type, and the repair module is specifically configured to add a filtering node before the trigger statement corresponding to the position to be threatened according to the vulnerability pattern and the programming language if the detection result includes a vulnerability pattern and the programming language and an operation parameter diagram of the program code, and the operation parameter diagram is used to characterize the threatened position of the program code.

7. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the instruction, the program, the code set or the instruction set is loaded and executed by the processor to implement the steps of the component vulnerability repair method described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the component vulnerability repair method described in any one of claims 1 to 5.

Images