A source code static analysis method, device, equipment and medium

Abstract

The present application discloses a method, device, equipment and medium for static analysis of source code, and relates to the field of software detection technology. The method includes constructing a control flow graph and a function call graph based on an abstract syntax tree obtained by parsing the source code; performing a fixed value analysis on the control flow graph using the function call graph to construct an initial value flow graph; adding edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph; the C++ language parameters are parameter nodes and / or variable nodes obtained based on the abstract syntax tree; and performing static detection of the source code based on the final value flow graph to obtain a static detection result. The present application can reduce false positives and negatives caused by the lack of edges corresponding to parameter nodes of the C++ language, and effectively improve the accuracy of static detection of source code.

Description

Technical Field

[0001] The present application relates to the field of software detection technology, and in particular to a source code static analysis method, device, equipment and medium. Background Art

[0002] Static Analysis is a technique that checks source code, binary files, or other intermediate representations without executing the code to find errors, vulnerabilities, style issues, or non-compliance with coding standards. This analysis method works by parsing and checking the structure, syntax, data flow, control flow, and other information of the code without actually running the program.

[0003] At present, traditional static analysis methods have the defect of low detection accuracy when checking C++ language code, so there is an urgent need for a static analysis method that can effectively improve the detection accuracy. Summary of the invention

[0004] The purpose of this application is to provide a source code static analysis method, device, equipment and medium, which can improve the static detection accuracy of C++ language code.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides a source code static analysis method, comprising: constructing a control flow graph and a function call graph based on an abstract syntax tree obtained by parsing the source code; performing arrival fixed value analysis on the control flow graph using the function call graph to construct an initial value flow graph; adding edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph; the C++ language parameters are parameter nodes and / or variable nodes obtained based on the abstract syntax tree; and performing static detection on the source code based on the final value flow graph to obtain a static detection result.

[0007] Optionally, adding edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph includes: adding edges corresponding to macro branch nodes to the initial value flow graph to obtain a first value flow graph; adding edges corresponding to global variables to the first value flow graph to obtain a second value flow graph; adding edges corresponding to class members to the second value flow graph to obtain a third value flow graph; adding edges corresponding to pointer variables to the third value flow graph to obtain a fourth value flow graph; adding edges corresponding to actual parameter variables of special functions to the fourth value flow graph to obtain a final value flow graph.

[0008] Optionally, adding the edge corresponding to the macro branch node to the initial value flow graph to obtain the first value flow graph includes: traversing all nodes of the abstract syntax tree, obtaining the preprocessing command node of the abstract syntax tree and extracting the header file name and header file of the preprocessing command node; splicing the extracted header file of the preprocessing command node according to the execution order of the abstract syntax tree, and filtering the header file based on the determined repeated header file name during the splicing process to obtain a spliced ​​abstract syntax tree; traversing all nodes of the spliced ​​abstract syntax tree to obtain macro definition nodes and the macro branch nodes; adding the macro definition nodes and the macro branch nodes to the control flow graph to obtain a first control flow graph; performing arrival constant analysis on the first control flow graph to obtain the edges corresponding to the macro definition nodes and the macro branch nodes; removing unnecessary branches of the initial value flow graph based on the edges corresponding to the macro definition nodes and the macro branch nodes to obtain a first value flow graph.

[0009] Optionally, adding the edge corresponding to the global variable to the first value flow graph to obtain the second value flow graph includes: traversing all nodes of the concatenated abstract syntax tree to obtain the global variables of the concatenated abstract syntax tree; adding the global variables to the first control flow graph to obtain the second control flow graph; generating a hypergraph based on the second control flow graph and the function call graph; traversing the hypergraph with the corresponding node of the global variable as the starting node, simplifying the hypergraph to obtain a sparse graph; performing arrival constant analysis on the sparse graph to obtain the edge corresponding to the global variable; adding the edge corresponding to the global variable to the first value flow graph to obtain the second value flow graph.

[0010] Optionally, adding edges corresponding to the class members to the second value flow graph to obtain a third value flow graph includes: traversing all nodes of the concatenated abstract syntax tree to obtain classes and objects of the concatenated abstract syntax tree, wherein the classes of the concatenated abstract syntax tree include member variables and member functions; adding objects of the concatenated abstract syntax tree, member variables and member functions of the classes of the concatenated abstract syntax tree to the second control flow graph to obtain a third control flow graph; performing additional signatures on the objects of the concatenated abstract syntax tree and the creation points of the objects of the concatenated abstract syntax tree, and performing arrival constant analysis on the member functions of the third control flow graph to obtain edges with additional signatures; utilizing a static modifier Perform class signature on the member variables, and perform arrival fixed value analysis on the member variables with class signature of the third control flow graph to obtain edges with different signatures; obtain the destructor of the spliced ​​abstract syntax tree, and add the destructor to the third control flow graph; perform arrival fixed value analysis on the destructor of the third control flow graph after adding the destructor, and determine the edge corresponding to the destructor; the destructor is located at the node where the object life cycle of the spliced ​​abstract syntax tree ends or the node where the object life cycle is ended; add edges with additional signatures, edges with class signatures, and edges corresponding to the destructor to the second value flow graph to obtain the third value flow graph.

[0011] Optionally, adding the edge corresponding to the pointer variable to the third value flow graph to obtain a fourth value flow graph includes: traversing all nodes of the concatenated abstract syntax tree to obtain the pointer variable of the concatenated abstract syntax tree; the pointer variable is an actual parameter variable; adding the pointer variable to the third control flow graph to obtain a fourth control flow graph; traversing the fourth control flow graph and the sparse graph with the corresponding node of the pointer variable as the starting node to obtain the edge corresponding to the pointer variable; adding the edge corresponding to the pointer variable to the third value flow graph to obtain the fourth value flow graph.

[0012] Optionally, adding edges corresponding to the actual parameter variables of the special function to the fourth value flow graph to obtain the final value flow graph includes: obtaining the name of the special function and the parameter position information to be connected input by the terminal; the special function is a custom function set by the user based on the library function of the C++ language; querying the fourth control flow graph based on the name of the special function to determine the actual parameter variables corresponding to the special function; creating edges corresponding to the actual parameter variables based on the actual parameter variables and the parameter position information to be connected; adding edges corresponding to the actual parameter variables to the fourth value flow graph to obtain the final value flow graph.

[0013] In a second aspect, the present application provides a source code static analysis device, comprising:

[0014] Parsing construction module, used to build control flow graph and function call graph based on the abstract syntax tree obtained by parsing the source code;

[0015] An analysis and construction module, used for performing arrival fixed value analysis on the control flow graph and the function call graph, and constructing an initial value flow graph;

[0016] A node adding module, used for adding edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph; the C++ language parameters are parameter nodes and / or variable nodes obtained based on the abstract syntax tree;

[0017] A static detection module is used to perform static detection on the source code based on the final value flow graph to obtain a static detection result.

[0018] In a third aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any one of the source code static analysis methods described above.

[0019] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any one of the source code static analysis methods described above.

[0020] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any one of the source code static analysis methods described above.

[0021] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0022] The present application provides a source code static analysis method, apparatus, device and medium, which parses the source code to obtain an abstract syntax tree; constructs a control flow graph and a function call graph according to the abstract syntax tree; uses the function call graph to perform arrival fixed value analysis on the control flow graph to construct an initial value flow graph; adds edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph; uses the final value flow graph to perform static detection of source code defects in the C++ language, which not only reduces the error rate of false positives and missed negatives caused by the lack of edges corresponding to C++ language parameters, but also effectively improves the accuracy of source code static detection; and can more accurately express source code information, making it convenient for developers to trace source code defects. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A schematic diagram of a flow chart of a source code static analysis method provided in one embodiment of the present application;

[0025] Figure 2 A value stream provided by an embodiment of the present application without adding edges corresponding to C++ language parameters Figure 1 ;

[0026] Figure 3 A simplified schematic diagram of a hypergraph provided in one embodiment of the present application;

[0027] Figure 4 A schematic diagram of a second value stream diagram provided in an embodiment of the present application;

[0028] Figure 5 A value stream provided by an embodiment of the present application without adding edges corresponding to C++ language parameters Figure 2 ;

[0029] Figure 6 A schematic diagram of a third value stream diagram provided in an embodiment of the present application;

[0030] Figure 7 A value stream provided by an embodiment of the present application without adding edges corresponding to C++ language parameters Figure 3 ;

[0031] Figure 8 A schematic diagram of a fourth value flow diagram provided in an embodiment of the present application;

[0032] Fig. 9 A value stream provided by an embodiment of the present application without adding edges corresponding to C++ language parameters Figure 4 ;

[0033] Fig.10 A schematic diagram of a final value flow diagram provided by an embodiment of the present application;

[0034] Fig.11 A schematic diagram of functional modules of a source code static analysis device provided by an embodiment of the present application;

[0035] Fig.12 A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0037] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0038] In an exemplary embodiment, Figure 1 As shown, a source code static analysis method is provided, which is executed by a computer device, and can be specifically executed by a computer device such as a terminal or a server alone, or can be executed by a terminal and a server together. In an embodiment of the present application, the source code static analysis method can include the following steps 110 to 140, wherein:

[0039] Step 110, constructing a control flow graph and a function call graph based on the abstract syntax tree obtained by parsing the source code.

[0040] In the example embodiment, the Abstract Syntax Tree (AST), Control Flow Graph (CFG), and Call Graph (CG) representation models are commonly used analysis tools and techniques. Among them, the Abstract Syntax Tree is a tree-like representation of the abstract syntax structure of the source code. Each node on the tree represents a structure in the source code. This tree-like structure can clearly express the syntax structure of the source code. The control flow graph is a graph that represents the possible flow of execution of all basic blocks in a process, and can also reflect the real-time execution process of a process; each node of the control flow graph represents a basic block, and directed edges are used to represent jumps in the control flow. The function call graph is a graph that represents the call relationship between methods (functions) in the entire program, and the edges represent the call relationship; the nodes of the function call graph represent functions or methods, and the directed edges point from the caller to the callee.

[0041] In one implementation, the source code is first parsed into an abstract syntax tree by the compiler. After the parsing stage, the compiler cuts the abstract syntax tree into basic statement blocks based on non-branching structures, and then builds a control flow graph and a function call graph based on the segmented basic statement blocks.

[0042] Step 120, using the function call graph to perform arrival fixed value analysis on the control flow graph, and construct an initial value flow graph.

[0043] In the example embodiment, the Value Flow Graph (VFG) is a directed value flow graph constructed from variable definition to variable use, where the value refers to the value of the variable (pointer); the nodes of the value flow graph represent the definition and use of variables or data, and the directed edges represent the direction of data flow; the nodes of the value flow graph represent the values ​​of variables or expressions in the source code, and the edges represent the flow or dependency between these values. Reaching-Definition Analysis is an important application in data flow analysis, which is used to determine whether the definition (i.e., the assignment of a variable) of a variable in a program has "reached" a specific program point.

[0044] In combination with the above embodiments, it can be understood that, for example: at position A of program, contaminated data can be passed into the program through an external input function. If this contaminated data is passed into a target function at position B of program, it will cause a program running error; that is, the index value of the array is a variable. This variable may exceed the size of the array itself when propagated to the array point through the program, resulting in an out-of-bounds access to the array, causing a program running error; or program A receives an external input value containing malicious code or sensitive data, which propagates in the program along with the control flow of the program and may be used as input for other operations, such as network sending, file writing, or other operations that may affect system security, seriously affecting program security. In order to solve the above problems, it is necessary to check the source code without executing the program to achieve source code defect tracking and vulnerability analysis.

[0045] In the embodiment of the present application, for the basic block of the abstract syntax tree (consisting of a series of branchless statements), the compiler will create a control flow graph to represent the control flow of the source code. For variables and their use, the compiler may construct an initial value flow graph based on the control flow graph and the function call graph. However, since the initial value flow graph lacks edges corresponding to the C++ language parameters, the accuracy of defect tracking and vulnerability analysis will be reduced. Therefore, in the subsequent steps of this embodiment, edges corresponding to the C++ language parameters are added to the initial value flow graph to complete the edges of the initial value flow graph, thereby improving the ability of defect tracking and the accuracy of vulnerability analysis.

[0046] Step 130, adding edges corresponding to the C++ language parameters to the initial value flow graph to obtain a final value flow graph.

[0047] In an exemplary embodiment, C++ language parameters are parameter nodes and / or variable nodes obtained based on an abstract syntax tree; for example, C++ language parameters include macro branch nodes, global variables, class members, pointer variables, and actual parameter variables of special functions.

[0048] In one embodiment, the above step S130 may include steps S1301 to S1305, wherein:

[0049] Step S1301, adding edges corresponding to macro branch nodes to the initial value flow graph to obtain a first value flow graph.

[0050] Understandably, there are unnecessary macro branches in the initial value flow graph, which will increase the defect tracking path and thus increase the probability of the initial value flow graph reporting an error. In order to reduce the error rate caused by unnecessary macro branches, the edges corresponding to the macro branch nodes are added to the initial value flow graph.

[0051] Specifically, adding edges corresponding to macro branch nodes to the initial value flow graph may include: traversing all nodes of the abstract syntax tree, obtaining preprocessing command nodes of the abstract syntax tree and extracting header file names and header files of the preprocessing command nodes; splicing the extracted header files of the preprocessing command nodes according to the execution order of the abstract syntax tree, and filtering the header files based on determined repeated header file names during the splicing process to obtain a spliced ​​abstract syntax tree; traversing all nodes of the spliced ​​abstract syntax tree to obtain macro definition nodes and macro branch nodes; adding macro definition nodes and macro branch nodes to the control flow graph to obtain a first control flow graph; performing arrival constant value analysis on the first control flow graph to obtain edges corresponding to macro definition nodes and macro branch nodes; removing unnecessary branches of the initial value flow graph based on the edges corresponding to the macro definition nodes and macro branch nodes to obtain a first value flow graph.

[0052] It is understandable that first, all nodes in the abstract syntax tree need to be traversed to find all preprocessing command nodes. For the preprocessing command nodes found, extract the header file name and header file. The extracted header files are spliced ​​in the order in which they appear in the abstract syntax tree (splicing the abstract syntax tree nodes in the header file into the total abstract syntax tree node library). In the process of splicing, the repeated header file names are determined and the header files are filtered according to the repeated header file names to obtain the number of abstract syntax files after splicing and filtering. Among them, when determining the repeated header file names, data structures such as lists can be used to save the header file names. For nested included header files, they need to be processed according to the inclusion hierarchy. For example, if a header file A includes another header C, then when splicing, A should be spliced ​​first, then C, and then the include in A. <c>The statement that follows the statement.

[0053] During the filtering process, for example, in the source code (source program), #include <filename>and #include "filename", which need to be processed separately. Usually, the search paths for standard library header files (using angle brackets) and user-defined header files (using double quotes) are different. For header files that are included repeatedly, filtering is required. This can be done by using data structures such as sets to save the names of header files that have been included. For newly appearing header files, first search in the set. If they already exist, filter them out, otherwise add them to the set and header file list. Also, for preprocessing commands for conditional compilation, such as #ifdef, #ifndef, #if, etc., it is necessary to decide whether to include the corresponding header file based on the results of conditional compilation.

[0054] By adding edges corresponding to macro branch nodes to the initial value flow graph, unnecessary macro branches can be removed to obtain a relatively sparse value flow graph, namely the first value flow graph; by adding edges corresponding to macro branch nodes to the initial value flow graph, the error rate caused by unnecessary macro branches can be effectively reduced, and the node values ​​of the final value flow graph can be accurately determined.

[0055] Step S1302, adding edges corresponding to the global variables to the first value flow graph to obtain a second value flow graph.

[0056] Understandably, because the initial value flow graph analyzes the value flow transfer of variables within the process, it may lack consideration of global variables, and the defect information transmitted by global variables that may exist in the source program cannot be effectively tracked. Therefore, in order to solve the above defects, it is necessary to generate global variable nodes in the initial value flow graph and perform defect tracking and transfer.

[0057] Specifically, adding edges corresponding to global variables to the first value flow graph may include: traversing all nodes of the concatenated abstract syntax tree to obtain global variables of the concatenated abstract syntax tree; adding global variables to the first control flow graph to obtain a second control flow graph; generating a hypergraph based on the second control flow graph and the function call graph; traversing the hypergraph with the corresponding node of the global variable as the starting node, simplifying the hypergraph, and obtaining a sparse graph; performing arrival constant value analysis on the sparse graph to obtain edges corresponding to global variables; adding edges corresponding to global variables to the first value flow graph to obtain a second value flow graph.

[0058] It is understandable that compared to the traditional processing method of adding global variables to the value flow graph, that is, combining the control flow graph, the function call graph and the global variables to form a hypergraph, and performing the arrival fixed value analysis in the hypergraph to form a value flow graph, the hypergraph needs to be simplified in this embodiment. Because the above processing method may have a dense graph of hundreds of thousands of nodes and hundreds of thousands of edges in the hypergraph for a single project, it will take a lot of time to iterate the calculation of the arrival fixed value algorithm in the dense graph. Therefore, when simplifying the hypergraph in this embodiment, only the nodes and edges corresponding to the global variables are retained to form a sparse graph, and the sparse graph is used to complete the first value flow graph.

[0059] For example, the following source code snippet:

[0060] 1.int globalVariable;

[0061] 2.void intermediateFunction1() {

[0062] 3. globalVariable = sourceFunction();

[0063] 4. / / other Operations

[0064] 5.}

[0065] 6.void intermediateFunction2() {

[0066] 7.int localVariable = globalVariable;

[0067] 8.sinkFunction(localVariable);

[0068] 9. / / other Operations

[0069] 10.}

[0070] 11. void main(){

[0071] 12.intermediateFunction1();

[0072] 13.intermediateFunction2();

[0073] 14.}

[0074] Among them, globalVariable is a global variable, sourceFunction is the defect input point, and sinkFunction is the function for capturing the data flow endpoint. Before the global variable analysis is performed, due to the lack of global variable nodes, the initial value flow graph formed according to the control flow graph is as follows Figure 2 That is, Figure 2 There is no global variable node in Figure 2 The globalVariable variable is an undefined value and cannot be analyzed for propagation. Therefore, it is impossible to perform effective pollution propagation analysis from the source node at the third line of the above source code.

[0075] Therefore, in order to solve the above defects, when adding the edge corresponding to the global variable to the first value flow graph, it is necessary to determine the global variable, such as Figure 3 As shown, in the unsimplified hypergraph, there will be many nodes (white dots) that have no operations related to the current global variables (black dots). In order to obtain a hypergraph that only involves global variables (black dots), in this embodiment, a point corresponding to the global variable is used as the starting point, and traverses back and forth step by step. If there is no view, this point is deleted, and the edge is connected to the next point. This global operation is performed on the hypergraph until the edges and points in the hypergraph no longer change, indicating that the simplification is completed. At this point, the hypergraph with millions of nodes and edges becomes a sparse graph with tens of thousands. Data flow analysis is performed on the sparse graph to form a simplified SG corresponding to the sparse graph. Then the nodes and edges in the simplified SG are completed to the first value flow graph, and the following is obtained. Figure 4 The value stream diagram shown in the lower right corner.

[0076] By simplifying the hypergraph, not only can the value flow transfer relationship of global variables be represented more clearly and intuitively, but also the time for forming the final value flow graph can be reduced, thereby improving detection efficiency.

[0077] Step S1303: Add edges corresponding to class members to the second value flow graph to obtain a third value flow graph.

[0078] It is understandable that compared with C language, C++ language has additional classes (classes include member variables and member functions) and objects, which makes the general value flow graph unable to fully express the source code structure of C++, and it is very easy to cause false positives and false negatives in static detection of C++ source code. Therefore, in order to solve the above defects, it is necessary to add edges corresponding to class members to the second value flow graph.

[0079] Specifically, adding edges corresponding to class members to the second value flow graph may include: traversing all nodes of the spliced ​​abstract syntax tree to obtain classes and objects of the spliced ​​abstract syntax tree, where the classes include member variables and member functions; adding objects, member variables and member functions of the class to the second control flow graph to obtain a third control flow graph; performing additional signatures on objects and their creation points, and performing arrival value analysis on member functions of the third control flow graph to obtain edges with additional signatures; performing class signatures on member variables using static modifiers, and performing arrival value analysis on member variables with class signatures of the third control flow graph to obtain edges with class signatures; obtaining a destructor of the spliced ​​abstract syntax tree, and adding the destructor to the third control flow graph; performing arrival value analysis on the destructor of the third control flow graph after adding the destructor to determine the edges corresponding to the destructor; the destructor is located at a node where the object life cycle of the spliced ​​abstract syntax tree ends or a node where the object life cycle is ended; adding edges with additional signatures, edges with class signatures, and edges corresponding to destructors to the second value flow graph to obtain a third value flow graph.

[0080] It can be understood that according to the object's creation node, the object is additionally signed. For member variables modified by static modifiers, additional signatures are added according to the member variables of the class. An edge connecting the destructor is added at the end of the class object declaration cycle in the control flow graph. An additional signature judgment function is added to the edges in the control flow graph involved in the member functions modified by non-static modifiers. On this basis, an arrival fixed value analysis is performed to obtain edges with additional signatures, edges with class signatures, and edges corresponding to destructors.

[0081] For example, the following source code snippet:

[0082] 1.Class Person{

[0083] 2.Private:

[0084] 3.Static int personCount; 4.

[0086] 5.Public:

[0087] 6.String name;

[0088] 7. int age; 8.

[0090] 9.Person(){

[0091] 10. personCount++;

[0092] 11.} 12.

[0094] 13. Person(String nameStr, int number): name(nameStr), age(number){

[0095] 14. personCount++;

[0096] 15.} 16.

[0098] 17. int getPersonCount(){

[0099] 18. return personCount;

[0100] 19.} 20.

[0102] 21.~Person(){

[0103] 22. personCount--;

[0104] 23.}

[0105] 24.}

[0106] 25.int main(){

[0107] 26. int number = 32;

[0108] 27. String stainStr = getStainInfoFunction();

[0109] 28. Person p1 = new Person("Alice”,30);

[0110] 29. Person p2 = new Person();

[0111] 30. p2.name = "Bob”;

[0112] 31. p2.age = number;

[0113] 32. Person p3 = new Person("lex”,30);

[0114] 33. int number2 = p3.age;

[0115] 34. delete p1;

[0116] 35. int personCount = p2.getPersonCount();

[0117] 36. return 0;

[0118] 37.}

[0119] The value flow diagram formed according to the above source code is as follows Figure 5 As shown in the figure, because the two objects p1 and p3 of Person call the same constructor when they are created, after the value flow graph is generated, if the value flow graph is used for taint analysis, the tainted data passed in by line 27 will flow to the node in line 32 and subsequent nodes through the corresponding path, which is obviously an incorrect analysis.

[0120] Therefore, to solve the above defects, for member functions and member variables of classes in C++ language, we can adopt the allocationSite idea in pointer analysis, add the object and its creation point information as the node signature of the value flow graph, and set an edge with the additional signature when passing values ​​in member functions in the class to prevent path confusion caused by different objects calling the same member function. That is, create a Person class instance in line 28 of the program, then for the member variable name in Person, the additional signature can be expressed as follows Figure 6 o(28).name in.

[0121] However, if you add additional signatures based on the corresponding object creation points to all member variables and member functions in general, when static-modified member variables appear, the generated value flow graph will lose the original semantics that the static-modified member variables want to represent. Therefore, for static-modified member variables, you can only add the class name as the signature information in the "global variables" of the class, which is shared by all objects of the same type, such as the modification method Person.personCount.

[0122] If only the instance object location signature is added without considering the destructor, the value flow graph involving the Static intpersonCount node is as follows Figure 7 As shown in the left view, it is impossible to effectively analyze the static members of the class. Therefore, the embodiment of the present application creates the member variables modified by static when the class is first instantiated, and checks whether there is a corresponding operation in the destructor at the end of the declaration cycle of each class instance object, and connects them, so that the following can be obtained: Figure 7 The value stream diagram is shown in the view on the right.

[0123] By adding edges corresponding to class members to the second value flow graph, the final value flow graph can clearly represent the value flow direction of the class's member variables and member functions, thereby achieving the purpose of improving the accuracy of source code defect detection corresponding to the class.

[0124] Step S1304, adding an edge corresponding to the pointer variable to the third value flow graph to obtain a fourth value flow graph.

[0125] In the example embodiment, for pointer variables, only the transfer in the called function is considered, and the variable changes after the call are not considered, and the sensitive location cannot be effectively tracked through the pollution information source of the source code. Therefore, in order to solve the above defects, it is necessary to add edges corresponding to the pointer variables to the third value flow graph.

[0126] Specifically, adding edges corresponding to pointer variables to the third value flow graph may include: traversing all nodes of the concatenated abstract syntax tree to obtain the pointer variable of the concatenated abstract syntax tree; the pointer variable is an actual parameter variable; adding the pointer variable to the third control flow graph to obtain a fourth control flow graph; traversing the fourth control flow graph and the sparse graph with the corresponding node of the pointer variable as the starting node to obtain edges corresponding to the pointer variable; adding edges corresponding to the pointer variable to the third value flow graph to obtain a fourth value flow graph.

[0127] Understandable, for example, source code snippet example:

[0128] 1 void function(char *x){

[0129] 2 char arr[] = sourceFunction();

[0130] 3 *x = arr;

[0131] 4}

[0132] 5 char *p = "Hello, World!";

[0133] 6 function(p);

[0134] 7 sinkFunction(p);

[0135] 8 char q

[20] ;

[0136] 9 strcpy(q,p);

[0137] 10 sinkFunction(q);

[0138] For the above source code, without considering the difference between pointer variables and non-pointer variables, the value flow graph is as follows Figure 8 As shown, the value flow graph cannot effectively track sensitive locations through the pollution information source of the source code. Therefore, in this embodiment, the function call points in the control flow graph and the sparse graph regarding the pointer variables as actual parameters are reconnected. That is, only the connection between the initial call point and the definition point of the pointer variable is retained. If there is a point in the called function that modifies the content of the memory area pointed to by the pointer variable, the use point of the pointer variable is connected and points to the next pointer variable use point. If the content of the memory area pointed to by the pointer variable is not modified in the called function, the first point is connected to the next pointer variable use point. By repeating this process, a complete pointer variable use path can be formed, such as Fig. 9 As shown, an effective defect tracking detection path can be provided to improve the static analysis results.

[0139] Step S1305, adding edges corresponding to the actual parameter variables of the special function to the fourth value flow graph to obtain the final value flow graph.

[0140] In the example embodiment, the special function is a custom function set by the user based on the library function of the C++ language. Because in the process of generating the value flow graph, in order to reduce unnecessary nodes and improve the generation efficiency of the value flow graph, the C++ library function will be filtered, so the source code nodes inside the library function cannot be reflected in the generated value flow graph, for example, Fig. 9 The strcpy function in line 9 of the value flow graph shown in the figure copies the content pointed to by pointer p and passes the result to the address pointed to by pointer q, but it is not reflected in the value flow graph. Therefore, part of the value transfer information will be lost, reducing the accuracy of the value flow graph. In order to solve the above defects, a custom special function parameter connection method is set. That is, the function name and the parameter position information that needs to be connected are given, and then the parameter node corresponding to the function in the value flow graph is found and an intermediate directed connection is created, which means that the value carried in the a position parameter can flow into the b position parameter through this function. For example, Fig. 9 To perfect the generation Fig.10 .

[0141] Specifically, adding an edge corresponding to the actual parameter variable of the special function to the fourth value flow graph may include: obtaining the name of the special function input by the terminal and the parameter position information to be connected; the special function is a custom function set by the user based on the library function of the C++ language; querying the fourth control flow graph based on the name of the special function to determine the actual parameter variable corresponding to the special function; creating an edge corresponding to the actual parameter variable based on the actual parameter variable and the parameter position information to be connected; adding an edge corresponding to the actual parameter variable to the fourth value flow graph to obtain the final value flow graph.

[0142] It is understandable, for example: for the strcpy function itself, there is value transfer information for its two parameters. When the user inputs (strcpy, 0, 1), an edge is created at the second actual parameter node of strcpy to point to the first actual parameter node; and for the transfer after the function call, the user input (strcpy, 0) indicates that the memory content pointed to by the first parameter of strcpy is changed, and an edge needs to be created to point to the point of pointer operation related to the first parameter after the strcpy call ends.

[0143] It should be noted that, in order to facilitate the description of the technical solution of the present application, this embodiment is described in the order of step S1301 to step S1305. The order of the above steps does not constitute a limitation to the present technical solution. In other embodiments, the above steps S1301 to step S1305 can be arranged at will, and the embodiments of the present application do not provide examples for illustration.

[0144] Step 140: statically test the source code based on the final value flow graph to obtain a static test result.

[0145] In the example embodiment, the source code is detected using the final value flow graph to obtain the defect location information, defect type, defect type explanation, etc. of the source code, which facilitates the developer to modify and improve the source code according to the static detection results.

[0146] Implement the above steps 110 to 140 to obtain an abstract syntax tree by parsing the source code; construct a control flow graph and a function call graph based on the abstract syntax tree; use the function call graph to perform arrival constant value analysis on the control flow graph to construct an initial value flow graph; obtain a final value flow graph by adding edges corresponding to C++ language parameters to the initial value flow graph; use the final value flow graph to perform static detection of source code defects in the C++ language, which not only reduces the error rate of false positives and missed negatives caused by the lack of edges corresponding to C++ language parameters, but also effectively improves the accuracy of static detection of source code; it can also more accurately express source code information, making it easier for users to trace source code defects.

[0147] Based on the same inventive concept, the embodiment of the present application also provides a source code static analysis device for implementing the source code static analysis method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more source code static analysis device embodiments provided below can refer to the limitations of the source code static analysis method above, and will not be repeated here.

[0148] In an exemplary embodiment, Fig.11 As shown, a source code static analysis device 300 is provided, which includes a parsing construction module 310, an analysis construction module 320, a node adding module 330 and a static detection module 340; wherein,

[0149] The parsing and building module 310 is used to build a control flow graph and a function call graph based on the abstract syntax tree obtained by parsing the source code;

[0150] The analysis and construction module 320 is used to perform arrival fixed value analysis on the control flow graph using the function call graph and construct an initial value flow graph;

[0151] The node adding module 330 is used to add edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph; the C++ language parameters are parameter nodes and / or variable nodes obtained based on the abstract syntax tree;

[0152] The static detection module 340 is used to perform static detection on the source code based on the final value flow graph to obtain a static detection result.

[0153] Among them, by implementing this implementation method, an abstract syntax tree can be obtained by parsing the source code; a control flow graph and a function call graph can be constructed based on the abstract syntax tree; an initial value flow graph can be constructed by performing arrival fixed value analysis on the control flow graph using the function call graph; a final value flow graph is obtained by adding edges corresponding to C++ language parameters to the initial value flow graph; and static detection of source code defects of the C++ language is performed using the final value flow graph, which not only reduces false positives and negatives caused by the lack of edges corresponding to C++ language parameters, and effectively improves the accuracy of static detection of source code; but also can more accurately express source code information, making it convenient for developers to trace defects in the source code.

[0154] As an optional implementation, the node adding module 330 is also used to add edges corresponding to macro branch nodes to the initial value flow graph to obtain a first value flow graph; add edges corresponding to global variables to the first value flow graph to obtain a second value flow graph; add edges corresponding to class members to the second value flow graph to obtain a third value flow graph; add edges corresponding to pointer variables to the third value flow graph to obtain a fourth value flow graph; add edges corresponding to actual parameter variables of special functions to the fourth value flow graph to obtain a final value flow graph.

[0155] As an optional implementation, the node adding module 330 is also used to traverse all nodes of the abstract syntax tree, obtain preprocessing command nodes of the abstract syntax tree and extract header file names and header files of the preprocessing command nodes; splice the extracted header files of the preprocessing command nodes according to the execution order of the abstract syntax tree, and filter the header files based on the determined repeated header file names during the splicing process to obtain a spliced ​​abstract syntax tree; traverse all nodes of the spliced ​​abstract syntax tree to obtain macro definition nodes and macro branch nodes; add macro definition nodes and macro branch nodes to the control flow graph to obtain a first control flow graph; perform arrival constant analysis on the first control flow graph to obtain edges corresponding to the macro definition nodes and the macro branch nodes; remove unnecessary branches of the initial value flow graph based on the edges corresponding to the macro definition nodes and the macro branch nodes to obtain a first value flow graph.

[0156] As an optional implementation, the node adding module 330 is also used to traverse all nodes of the concatenated abstract syntax tree to obtain the global variables of the concatenated abstract syntax tree; add the global variables to the first control flow graph to obtain the second control flow graph; generate a hypergraph based on the second control flow graph and the function call graph; traverse the hypergraph with the corresponding node of the global variable as the starting node, simplify the hypergraph, and obtain a sparse graph; perform arrival constant value analysis on the sparse graph to obtain the edges corresponding to the global variables; add the edges corresponding to the global variables to the first value flow graph to obtain the second value flow graph.

[0157] As an optional implementation, the node adding module 330 is also used to traverse all nodes of the spliced ​​abstract syntax tree, obtain the class and object of the spliced ​​abstract syntax tree, the class includes member variables and member functions; add objects, class member variables and member functions to the second control flow graph to obtain a third control flow graph; perform additional signatures on objects and object creation points, and perform arrival value analysis on member functions of the third control flow graph to obtain edges with additional signatures; perform class signatures on member variables using static modifiers, and perform arrival value analysis on member variables with class signatures of the third control flow graph. Value analysis is performed to obtain edges with different signatures; the destructor of the spliced ​​abstract syntax tree is obtained, and the destructor is added to the third control flow graph; the destructor of the third control flow graph after the destructor is added is subjected to arrival constant value analysis to determine the edges corresponding to the destructor; the destructor is located at the node where the object life cycle of the spliced ​​abstract syntax tree ends or the node where the object life cycle is ended; the object after the additional signature and the object creation point, the member variables after the class signature, the edges with the additional signature, the edges with the class signature and the edges corresponding to the destructor are added to the second value flow graph to obtain the third value flow graph.

[0158] As an optional implementation, the node adding module 330 is also used to traverse all nodes of the concatenated abstract syntax tree to obtain a pointer variable of the concatenated abstract syntax tree; the pointer variable is an actual parameter variable; the pointer variable is added to the third control flow graph to obtain a fourth control flow graph; the corresponding node of the pointer variable is used as the starting node to traverse the fourth control flow graph and the sparse graph to obtain the edge corresponding to the pointer variable; the edge corresponding to the pointer variable is added to the third value flow graph to obtain a fourth value flow graph.

[0159] As an optional implementation, the node adding module 330 is also used to obtain the name of the special function input by the terminal and the parameter position information to be connected; the special function is a custom function set by the user based on the library function of the C++ language; the fourth control flow graph is queried based on the name of the special function to determine the actual parameter variable corresponding to the special function; based on the actual parameter variable and the parameter position information to be connected, an edge corresponding to the actual parameter variable is created; and an edge corresponding to the actual parameter variable is added to the fourth value flow graph to obtain the final value flow graph.

[0160] It should be noted that, when the source code static analysis device provided in the above embodiment executes the source code static analysis method, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0161] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Fig.12 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store video tag processing data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a source code static analysis method is implemented.

[0162] Those skilled in the art will understand that Fig.12 The structure shown in the figure is merely a block diagram of a partial structure corresponding to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0163] In an exemplary embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0164] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0165] In an exemplary embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0166] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the corresponding data must comply with the corresponding regulations.

[0167] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the corresponding hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0168] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0169] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0170] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.< / filename> < / c>

Claims

1. A source code static analysis method, characterized in that: The source code static analysis method comprises: Based on the abstract syntax tree obtained by parsing the source code, a control flow graph and a function call graph are constructed; Performing arrival fixed value analysis on the control flow graph using the function call graph to construct an initial value flow graph; Adding edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph; the C++ language parameters are parameter nodes and / or variable nodes obtained based on the abstract syntax tree; Performing static detection on the source code based on the final value flow graph to obtain a static detection result; The C++ language parameters include macro branch nodes, global variables, class members, pointer variables, and actual parameter variables of special functions; adding edges corresponding to the C++ language parameters to the initial value flow graph to obtain the final value flow graph includes: Adding an edge corresponding to the macro branch node to the initial value flow graph to obtain a first value flow graph; Adding an edge corresponding to the global variable to the first value flow graph to obtain a second value flow graph; Adding edges corresponding to the class members to the second value flow graph to obtain a third value flow graph; Adding an edge corresponding to the pointer variable to the third value flow graph to obtain a fourth value flow graph; Add edges corresponding to the actual parameter variables of the special function to the fourth value flow graph to obtain a final value flow graph.

2. The source code static analysis method according to claim 1, characterized in that: The step of adding an edge corresponding to the macro branch node to the initial value flow graph to obtain a first value flow graph includes: Traversing all nodes of the abstract syntax tree, obtaining a preprocessing command node of the abstract syntax tree and extracting a header file name and a header file of the preprocessing command node; Splicing the extracted header files of the preprocessing command nodes according to the execution order of the abstract syntax tree, and filtering the header files based on the determined repeated header file names during the splicing process to obtain a spliced ​​abstract syntax tree; Traversing all nodes of the concatenated abstract syntax tree to obtain macro definition nodes and the macro branch nodes; Adding the macro definition node and the macro branch node to the control flow graph to obtain a first control flow graph; Performing an arrival fixed value analysis on the first control flow graph to obtain edges corresponding to the macro definition node and the macro branch node; Based on the edges corresponding to the macro definition nodes and the macro branch nodes, unnecessary branches of the initial value flow graph are removed to obtain a first value flow graph; the unnecessary branches are macro branches without data flow in the initial value flow graph.

3. The source code static analysis method according to claim 2, characterized in that: The adding an edge corresponding to the global variable to the first value flow graph to obtain a second value flow graph includes: Traversing all nodes of the concatenated abstract syntax tree to obtain global variables of the concatenated abstract syntax tree; Adding the global variable to the first control flow graph to obtain a second control flow graph; Generate a hypergraph based on the second control flow graph and the function call graph; Using the node corresponding to the global variable as the starting node to traverse the hypergraph, simplifying the hypergraph to obtain a sparse graph; Performing arrival value analysis on the sparse graph to obtain edges corresponding to the global variables; An edge corresponding to the global variable is added to the first value flow graph.

4. The source code static analysis method according to claim 3, characterized in that: The adding the edge corresponding to the class member to the second value flow graph to obtain a third value flow graph includes: Traversing all nodes of the concatenated abstract syntax tree to obtain a class and an object of the concatenated abstract syntax tree, wherein the class of the concatenated abstract syntax tree includes member variables and member functions; Adding the object of the concatenated abstract syntax tree, the member variables and member functions of the class of the concatenated abstract syntax tree to the second control flow graph to obtain a third control flow graph; Additional signatures are performed on the objects of the concatenated abstract syntax trees and the creation points of the objects of the concatenated abstract syntax trees, and arrival value analysis is performed on the member functions of the third control flow graph to obtain edges with additional signatures; Performing a class signature on the member variable by using a static modifier, and performing an arrival value analysis on the member variable with the class signature of the third control flow graph to obtain an edge with the class signature; Obtaining a destructor of the concatenated abstract syntax tree, and adding the destructor to the third control flow graph; Performing an arrival value analysis on the destructor of the third control flow graph after adding the destructor, and determining an edge corresponding to the destructor; the destructor is located at a node where the object life cycle of the concatenated abstract syntax tree ends or a node where the object life cycle is ended; An edge with an additional signature, an edge with a class signature, and an edge corresponding to the destructor are added to the second value flow graph.

5. The source code static analysis method according to claim 4, characterized in that: The step of adding an edge corresponding to the pointer variable to the third value flow graph to obtain a fourth value flow graph comprises: Traversing all nodes of the concatenated abstract syntax tree to obtain a pointer variable of the concatenated abstract syntax tree; the pointer variable is an actual parameter variable; Adding the pointer variable to the third control flow graph to obtain a fourth control flow graph; Taking the node corresponding to the pointer variable as the starting node, traversing the fourth control flow graph and the sparse graph, and obtaining an edge corresponding to the pointer variable; An edge corresponding to the pointer variable is added to the third value flow graph.

6. The source code static analysis method according to claim 5, characterized in that: The adding edges corresponding to the actual parameter variables of the special function to the fourth value flow graph to obtain a final value flow graph includes: Obtaining the name of the special function and the parameter position information to be connected input by the terminal; the special function is a user-defined function set by the user based on the library function of the C++ language; Query the fourth control flow graph based on the name of the special function to determine the actual parameter variable corresponding to the special function; Based on the actual parameter variable and the parameter position information of the line to be connected, create an edge corresponding to the actual parameter variable; An edge corresponding to the actual parameter variable is added to the fourth value flow graph.

7. A source code static analysis device, characterized in that: The source code static analysis device comprises: Parsing construction module, used to build control flow graph and function call graph based on the abstract syntax tree obtained by parsing the source code; An analysis and construction module, used to perform arrival fixed value analysis on the control flow graph using the function call graph, and construct an initial value flow graph; A node adding module, used for adding edges corresponding to C++ language parameters to the initial value flow graph to obtain a final value flow graph; the C++ language parameters are parameter nodes and / or variable nodes obtained based on the abstract syntax tree; A static detection module, used for performing static detection on the source code based on the final value flow graph to obtain a static detection result; Among them, the C++ language parameters include macro branch nodes, global variables, class members, pointer variables and actual parameter variables of special functions; the above-mentioned node adding module is also used to: add edges corresponding to the macro branch nodes to the initial value flow graph to obtain a first value flow graph; add edges corresponding to the global variables to the first value flow graph to obtain a second value flow graph; add edges corresponding to the class members to the second value flow graph to obtain a third value flow graph; add edges corresponding to the pointer variables to the third value flow graph to obtain a fourth value flow graph; add edges corresponding to the actual parameter variables of the special function to the fourth value flow graph to obtain a final value flow graph.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the source code static analysis method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the source code static analysis method described in any one of claims 1 to 6 are implemented.

Images