A method and system for creating a database component of a process orchestration platform

Abstract

The present invention discloses a method and system for creating a database component of a process orchestration platform, which realizes basic database operation query, paging query, addition, modification, and deletion, supports visual selection of database tables, field selection, static / dynamic assignment, function processing, and SQL preview, and can be implemented without writing programs, thereby streamlining a large number of basic database operations, ensuring the parsing and execution efficiency of process orchestration in business scenarios, and verifying SQL keywords during database component information and database component interpretation and execution to prevent the risk of SQL dynamic injection, thereby achieving low-code development, which is safer and more convenient.

Description

Technical Field

[0001] The present invention belongs to the technical field of databases, and in particular relates to a method and system for creating a database component of a process orchestration platform. Background Art

[0002] Database technology studies the basic theories and implementation methods of database structure, storage, design, management and application, and uses these theories to process, analyze and understand data in the database. Among them, the low-code platform uses dynamic SQL to execute SQL query statements, aiming to provide a more flexible and efficient query method.

[0003] At present, there are many rapid development platforms for low-code process orchestration on the market, which mainly orchestrate the code modules that have been hard-coded and developed. However, hard coding increases the complexity of some simple processes. In particular, a large number of basic database operations are repetitive and inefficient, and cannot guarantee the execution efficiency of some common business scenarios. In addition, SQL injection frequently occurs in the rapid development platform of low-code process orchestration. SQL injection: refers to the application's failure to judge or filter the legitimacy of user input data. Attackers can add additional SQL statements to the end of pre-defined query statements in the application, perform illegal operations without the administrator's knowledge, and deceive the database server into executing unauthorized arbitrary queries, thereby further obtaining corresponding data information; SQL injection can lead to data leakage, data modification, data integrity destruction, and even cracking database passwords, posing a serious threat to database information security. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the present application provides a method and system for creating a database component of a process orchestration platform.

[0005] In a first aspect, the present application proposes a method for creating a database component of a process orchestration platform, the method comprising:

[0006] Create a new business transaction service interface, enter the corresponding process arrangement interface based on the business transaction service interface, and drag the database component in the process arrangement interface to the process canvas;

[0007] In response to the sql type of the database component, the business database table and the business transaction field selected by the user, assign values ​​to the business transaction fields, wherein the sql types include adding, modifying, deleting, querying and paging querying;

[0008] Call the backend interface to save the information in the frontend process arrangement to the process canvas file;

[0009] The process canvas parsing engine is called to parse and execute the process canvas file, and the database component sql type selected in the process canvas file is executed. After the execution is completed, the result is returned and assembled into json data and put into the process canvas context. The process canvas context result is converted according to the process orchestration and the response data is returned to realize the database component parsing and execution of the front-end process orchestration.

[0010] In some embodiments, the calling of the background interface to save the assignment information of the database component to the process canvas file also includes: verifying the SQL keywords of the information in the front-end process orchestration during the saving process, and canceling the saving as the process canvas file if the background interface detects that the SQL injection keywords are included; if the SQL injection keywords are not included, the information is saved as the process canvas file.

[0011] In some embodiments, selecting a corresponding business transaction field according to the business database table and assigning a value to the business transaction field includes:

[0012] The interface request parameters, functions, constants and return values ​​of other nodes in the process are assigned to the business transaction fields through parameter EL expressions.

[0013] In some embodiments, the calling of the backend interface saves the information in the frontend process arrangement to the process canvas file, and during the saving process, checks the SQL keywords of the information in the frontend process arrangement. If the backend interface detects that the SQL injection keywords are included, the saving as the process canvas file is cancelled. If the SQL injection keywords are not included, the saving as the process canvas file includes:

[0014] The call interface saves the information in the front-end process arrangement to the process canvas file, wherein the information in the front-end process arrangement includes field information, table information and condition information, the field information is used to assemble the SQL body of the database component, the table information is used as the business database table of the SQL operation of the database component, and the condition information is used to assemble the SQL condition of the database component;

[0015] Check whether there is a sql injection keyword in the field information and the condition information. If any one of the field information and the condition information contains the sql injection keyword, cancel saving as a process canvas file. If neither the field information nor the condition information contains the sql injection keyword, save it as the process canvas file.

[0016] In some embodiments, the calling process canvas parsing engine parses and executes the process canvas file, executes the database component sql type selected in the process canvas file, returns the result after the execution is completed, assembles it into json data and puts it into the process canvas context, and the process canvas context result is converted according to the process orchestration and returns the response data, so as to realize the database component parsing and execution of the front-end process orchestration, including:

[0017] Step 1: call up the database component parsing execution class, and pass the process engine context into the database component parsing execution class;

[0018] Step 2: Convert the front-end process orchestration information saved in the process canvas file of the database component into a database component node definition class;

[0019] Step 3: Assemble the SQL according to the SQL type of the database component, including assembling the SQL body of the database component with the field information in the database component node definition class, using the table information as the business database table of the SQL operation, and the condition information as the SQL condition for assembling the database component;

[0020] Step 4: Replace the parameter EL expression in the SQL assembly process with the SQL statement recognized and executed by the business database;

[0021] Step 5: Put all parameter EL expressions in step 4 into the parameter set;

[0022] Step 6: traverse the parameter set and pass the parameter EL expression into the process engine context, parse the corresponding data by parsing the parameter EL expression method, and check again to make sure that the running state parameters do not contain SQL injection keywords to prevent SQL injection, and put the actual value after replacement into the parameter array;

[0023] Step 7: Call the business database to connect to the parameter array according to the selected database component sql type, and execute the addition, modification, deletion, query and paging query corresponding to the sql type;

[0024] Step 8: After execution is completed, the query component in the database component will put the field values ​​returned by the query or paging query into the context of the canvas process. Database addition, modification, and deletion will put the number of executions into the context of the canvas process, ready for direct dragging and dropping in subsequent process canvases.

[0025] In some embodiments, step 3 further comprises:

[0026] When assembling SQL, the sqlType field of the node information is used to distinguish between paging query SQL and regular SQL. Among them, the paging query SQL needs to be assembled separately with a query total number SQL. The value passed in by the node information is assembled according to the SQL type to obtain the SQL statement adapted to the business database execution.

[0027] In some embodiments, step 8 further comprises:

[0028] The result returned by the database component is directly used in the subsequent business logic judgment, business logic processing and direct response assignment of the process canvas, indicating the actual value of the parameter EL expression when the result returned by the database component is obtained during the process of parsing the parameter EL expression.

[0029] In a second aspect, the present application proposes a system for creating a database component of a process orchestration platform, including a visual orchestration module, a SQL keyword verification module, and a parsing module;

[0030] The visual arrangement module is used to execute the front-end visual process arrangement steps, and the front-end visual process arrangement steps include:

[0031] Create a new business transaction service interface, enter the corresponding process arrangement interface based on the business transaction service interface, drag the database component in the process arrangement interface to the process canvas by dragging, and select the corresponding database component sql type according to the business service category;

[0032] Select the corresponding business database table according to the database component sql type. The business database table includes all business parameter tables and business control parameter tables used by the microservice corresponding to the current business transaction service interface. Select the corresponding business transaction field according to the business database table and assign values ​​to the business transaction field to complete the front-end process arrangement.

[0033] The sql keyword verification module is used to perform a sql keyword verification step, and the sql keyword verification step includes:

[0034] Calling the backend interface to save the information in the frontend process arrangement as a process canvas file, during the saving process, verifying the database component information and the SQL keywords when the database component is interpreted and executed, if the backend interface detects that the SQL injection keywords are included, then the saving as the process canvas file is cancelled, if the SQL injection keywords are not included, then the process canvas file is saved;

[0035] The parsing module is used to perform the underlying process parsing steps, and the underlying process parsing steps include:

[0036] The process canvas parsing engine is called to parse and execute the process canvas file, and the database component sql type selected in the process canvas file is executed. After the execution is completed, the result is returned and assembled into json data and put into the process canvas context. The process canvas context result is converted according to the process orchestration and the response data is returned to realize the database component parsing and execution of the front-end process orchestration.

[0037] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0038] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0039] Beneficial effects of the present invention:

[0040] This solution can realize basic database operation query, pagination query, addition, modification, and deletion, and supports visual selection of database tables, field selection, static / dynamic assignment, function processing, and SQL preview. It can be implemented without writing programs, thereby streamlining a large number of basic database operations, ensuring the parsing and execution efficiency of process orchestration in business scenarios, and verifying SQL keywords during database component information and database component interpretation and execution to prevent the risk of SQL dynamic injection, thereby achieving low-code development, which is safer and more convenient. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is the overall flow chart of the present invention.

[0042] Figure 2 It is a system principle diagram of the present invention. DETAILED DESCRIPTION

[0043] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein; on the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0044] In the first aspect, the present application proposes a method for creating a database component of a process orchestration platform, such as Figure 1 As shown, it includes front-end visual process arrangement steps, SQL keyword verification steps and underlying process analysis steps;

[0045] The front-end visual process arrangement steps include:

[0046] S100: Create a new business transaction service interface, enter the corresponding process arrangement interface based on the business transaction service interface, and drag the database component in the process arrangement interface to the process canvas;

[0047] Among them, the database component is an independent technical component of process orchestration and must be used in conjunction with process orchestration. A process orchestration is a business interface. The execution of the database component is initiated by a business transaction and then configured and saved as a process canvas file for interpretation and execution.

[0048] S200: In response to the sql type of the database component, the business database table and the business transaction field selected by the user, assign values ​​to the business transaction fields, wherein the sql types include adding, modifying, deleting, querying and paging querying;

[0049] Among them, after selecting the sql type, select the business database table to be operated. The business database table is all the tables in the business database used by the microservice where the current interface is located. It is directly obtained from the business database without the need for advance configuration or code writing. The business database table is shown in Table 1 below:

[0050] Table 1

[0051] Classification Serial number Table English name Table Chinese name Service Control Parameters 57 ib_para_busi Intermediary business classification table Service Control Parameters 58 ib_para_busi_area Business Release Area Table Service Control Parameters 59 ib_para_busi_bran Business publishing organization table Service Control Parameters 31 ib_para_tmp_ctrl Platform temporary switch table Service Control Parameters 32 ib_para_trad Transaction Information Table Service Control Parameters 33 ib_para_trad_busi Business Service Release Table Business Parameters 20 ib_para_code_desc Code Description Table Business Parameters 21 ib_para_code_map Platform response code conversion table Business Parameters 22 ib_para_code_type Coding classification table Business Parameters 24 ib_para_item Project parameter information table Business Parameters 63 ib_para_key_ftp Parameter configuration table Business Parameters 27 ib_para_plat Platform parameter table

[0052] In some embodiments, selecting a corresponding business transaction field according to the business database table and assigning a value to the business transaction field includes:

[0053] The interface request parameters, functions, constants and return values ​​of other nodes in the process are assigned to the business transaction fields through parameter EL expressions.

[0054] Among them, select the business database table and then select the business transaction field, and assign values ​​to the fields through parameter EL expressions. The assignment supports using functions or directly obtaining parameters from interface request parameters. Interface request parameters, functions, constants, and return values ​​of other nodes in the process are the source types of business transaction field values, such as the original interface request parameters sent by the channel, the date or serial number obtained through the time function, constants are some estimated values ​​(such as: the status value is 1), and the return values ​​of other nodes in the process (such as the account number queried by the first component of the database can be used as the condition for the next component to query the account transaction details); through dynamic selection and dynamic assignment, the database can be added, modified, deleted, and paging queries can be completed without writing any code. EL expression (Expression Language) is a simplified expression language for accessing and manipulating data in Java Web applications, mainly used to obtain and display data in JSP pages. EL expression provides a concise way to access the properties and methods of JavaBean, making JSP pages more concise and no longer needing to embed Java code. The syntax format of EL expression is ${expression}, where the expression can be a variable name, attribute name, or arithmetic expression, etc.;

[0055] For example:

[0056] In the sql component, the function {@env:getSystemTime()} and the request parameter {$request.groupNameCns} are parsed with { as the beginning of the EL expression. The function at the beginning of {@ is found according to env:getSystemTime() to find the function execution class and method to obtain the function value and assign it to the parameter. The request parameter at the beginning of {$ will intercept the content in {$ and} and obtain the actual value passed in according to request.groupNameCns in the process context.

[0057] S300: calling the backend interface to save the information in the frontend process arrangement to the process canvas file;

[0058] In some embodiments, the calling of the backend interface to save the assignment information of the database component to the process canvas file also includes: verifying the sql keywords of the information in the front-end process arrangement during the saving process, and canceling the saving as the process canvas file if the backend interface detects that the sql injection keywords are included, and saving as the process canvas file if the sql injection keywords are not included, including:

[0059] The call interface saves the information in the front-end process arrangement to the process canvas file, wherein the information in the front-end process arrangement includes field information, table information and condition information, the field information is used to assemble the SQL body of the database component, the table information is used as the business database table of the SQL operation of the database component, and the condition information is used to assemble the SQL condition of the database component;

[0060] Check whether there is a sql injection keyword in the field information and the condition information. If any one of the field information and the condition information contains the sql injection keyword, cancel saving as a process canvas file. If neither the field information nor the condition information contains the sql injection keyword, save it as the process canvas file.

[0061] Among them, after the database component is assigned, the backend interface is called to save the information in the front-end process arrangement to the process canvas file (**.flowgraph). The field information (fields) is used to assemble the SQL body, the table information (tableCondition) is used as the database table for SQL operation, and the condition information (condition) is used to assemble the SQL condition. The condition information refers to the condition of the database operation statement SQL (the condition is after where in the SQL statement). The query statement has query conditions, the update statement has update conditions, and the delete statement has delete conditions. The default operation without additional condition information is prone to the risk of misoperation of the entire table.

[0062] Among them, the SQL injection keywords include:

[0063] ("|select|or|and|exec|insert|delete|update|*|chr|mid|master|truncate|drop|char|declarel|;|,|"), etc. However, the database component only needs to check whether there are SQL injection keywords other than |select|or|and| in the field information and condition information. When the field information and condition information strings are found to contain:

[0064] The keyword string ("|exec|insert|delete|update|*|chr|mid|master|truncate|drop|char|declarel|;|,|") is considered as SQL injection.

[0065] S400: Call the process canvas parsing engine to parse and execute the process canvas file, execute the database component sql type selected in the process canvas file, return the result after execution, assemble it into json data and put it into the process canvas context, convert the process canvas context result according to the process orchestration and return the response data, so as to realize the database component parsing and execution of the front-end process orchestration.

[0066] In some embodiments, the calling process canvas parsing engine parses and executes the process canvas file, executes the database component sql type selected in the process canvas file, returns the result after the execution is completed, assembles it into json data and puts it into the process canvas context, and the process canvas context result is converted according to the process orchestration and returns the response data, so as to realize the database component parsing and execution of the front-end process orchestration, including:

[0067] Step 1: call up the database component parsing execution class, and pass the process engine context into the database component parsing execution class;

[0068] Step 2: Convert the front-end process orchestration information saved in the process canvas file of the database component into a database component node definition class;

[0069] By converting into a general data structure "node definition class" through step 2, compared with the existing hard-coded definition of a data entity class for each entity, a large number of data entity definitions are reduced;

[0070] Step 3: Assemble the SQL according to the SQL type of the database component, including assembling the SQL body of the database component with the field information in the database component node definition class, using the table information as the business database table of the SQL operation, and the condition information as the SQL condition for assembling the database component;

[0071] In some embodiments, step 3 further comprises:

[0072] When assembling SQL, the sqlType field of the node information is used to distinguish between paging query SQL and regular SQL. Among them, the paging query SQL needs to be assembled separately with a query total number SQL. The value passed in by the node information is assembled according to the SQL type to obtain the SQL statement adapted to the business database execution.

[0073] Step 4: Replace the parameter EL expression in the SQL assembly process with the SQL statement recognized and executed by the business database;

[0074] Step 5: Put all parameter EL expressions in step 4 into the parameter set;

[0075] Step 6: traverse the parameter set and pass the parameter EL expression into the process engine context, parse the corresponding data by parsing the parameter EL expression method, and check again to make sure that the running state parameters do not contain SQL injection keywords to prevent SQL injection, and put the actual value after replacement into the parameter array;

[0076] Steps 3, 4, 5, and 6 are used to dynamically convert the SQL type. Compared with the existing hard-coded parameter assignment and business logic processing according to each SQL type, a large amount of repeated and similar coding is reduced.

[0077] Step 7: Call the business database to connect to the parameter array according to the selected database component sql type, and execute the addition, modification, deletion, query and paging query corresponding to the sql type;

[0078] By converting to "general database execution" in step 7, compared with the existing hard-coded database access object for each database table, a large number of database access object definitions are reduced;

[0079] Step 8: After execution is completed, the query component in the database component will put the field values ​​returned by the query or paging query into the context of the canvas process. Database addition, modification, and deletion will put the number of executions into the context of the canvas process, ready for direct dragging and dropping in subsequent process canvases.

[0080] The specific method of calling the process canvas parsing engine to parse and execute the process canvas file is as follows:

[0081] 1. Call up the database component parsing execution class (SqlComponentBranch) and pass the process engine context (processSession) to the database component parsing execution class;

[0082] 2. Obtain the information saved by the database component in the process canvas file (**.flowgraph) and convert it into the database component node definition class (VersionGraphNodeDTO);

[0083] 3. Assemble the add, delete, query and modify SQL according to the database component SQL type (sqlType), obtain the field information (fields) in the database component node definition class (VersionGraphNodeDTO) to assemble the SQL body, use the table information (tableCondition) as the database table for SQL operations, and use the condition information (condition) as the SQL condition;

[0084] Among them, add fields (field information), tableCondition (table condition), sqlType (sql type), datasourceId (data source id), pageNum (number of pages for paging query), pageSize (number of pages returned by paging query) fields in the process canvas VersionGraphNodeDTO process node information dto;

[0085] The VersionGraphNodeDTO data structure is as follows:

[0086] Example update:

[0087] {

[0088] "nodeIcon": "node_sql_component",

[0089] "nodeCd": "sql_component",

[0090] "nodeNm": "updateProject project update",

[0091] "commonFlag": true,

[0092] "serFlag": "notService",

[0093] "dragFlag": true,

[0094] "groupFlag": false,

[0095] "nodeId": "ka5s25knslo0",

[0096] "branId": "kspj2ccd3d00",

[0097] "pid": "vl5qhjf0es80",

[0098] "groupSort": 0,

[0099] "branSort": 3,

[0100] "permission": "canvas_panel_sql",

[0101] "sqlType": "update",

[0102] "msg": "Project Update",

[0103] "responseParamNm": "updateProject",

[0104] "condition": "id = {$request.id}",

[0105] "tableCondition": "BASE_PROJECT",

[0106] "fields": "[{\"name\":\"NAME_ENS\",\"value\":\"{$request.groupNameEns}\"},{\"name\":\"NAME_CNS\",\"value\":\"{$request.groupNameCns}\"},{\"name\":\"REMARK\",\"value\":\"{$request.groupNameCns}\"},{\"name\":\"PROJECT_STATUS\",\"value\":\"1\"},{\"name\":\"MANAGER_NAME\",\"value\":\"{$request.groupNameEns}\"},{\"name\":\"GROUP_PATH\",\"value\":\"''\"}]",

[0107] "datasourceId": "1763466087581614080"

[0108] };

[0109] Taking the above data structure as an example, the SQL assembly example is as follows:

[0110] Update BASE_PROJECT set:

[0111] NAME_ENS={$request.groupNameEns},NAME_CNS={$request.groupNameCns},REMARK={$request.groupNameCns},PROJECT_STATUS=1,MANAGER_NAME={$request.groupNameEns},GROUP_PATH='' where id = {$request.id}

[0112] 4. Replace the parameter EL expression (such as {$request.groupNameEns}) in the assembled SQL with a SQL statement that can be recognized and executed by the database;

[0113] When dragging the EL expression to assign a value, wrap it in a layer of brackets. After assembling the SQL, you can use regular expressions to filter out all EL expressions and put them into the variables collection through {}, and replace the positions in the EL expression with question marks. Because the canvas cannot use fixed values ​​when dynamically assigning values ​​to database components, EL expressions are used. EL expressions can pass in variables, and when they are actually executed, the variables are converted into actual values ​​at the time of execution;

[0114] The above assembled SQL cannot be executed by any open source database operation. The parameter {$request.groupNameEns} needs to be replaced with a SQL statement that can be recognized and executed by the database. The parameter {$request.groupNameEns} is a dynamic parameter in the canvas context, which can be passed in by the interface parameter or obtained by calling other systems.

[0115] The following is an example of converting to SQL language that can be recognized and executed:

[0116] Update BASE_PROJECT set:

[0117] NAME_ENS=? ,NAME_CNS=? ,REMARK=? ,PROJECT_STATUS=1,MANAGER_NAME=? ,GROUP_PATH='' where id =?

[0118] 5. Put all the parameters in 4 (such as: {$request.groupNameEns}) into a set;

[0119] For example: put the parameters {$request.groupNameEns}, {$request.groupNameCns}, and {$request.id} involved in assembling SQL into the SQL parameter set, and then parse the EL expression in the process context to assemble the parameters of the database SQL execution. For example: the request message is {"groupNameEns":"aaa","groupNameCns":"Test a","id":"123456"}, {$request.groupNameEns} will become "aaa" after parsing, {$request.groupNameCns} will become "Test a" after parsing, and {$request.id} will become "123456" after parsing;

[0120] 6. Traverse the collection and pass the parameters to the processSession.executeExpression() method to parse the EL expression to obtain the corresponding data, and check again that the running state parameters do not contain SQL keywords to prevent SQL injection, and put the actual value after replacement into the parameter array once;

[0121] Among them, check again whether there are sql injection keywords in the field information and condition information: ("|exec|insert|delete|update|*|chr|mid|master|truncate|drop|char|declarel|;|,|"). If they do not exist, save them to prevent sql injection risks. When checking whether there are sql injection keywords except |select|or|and| in the field information and condition information, and the field information and condition information strings contain:

[0122] ("|exec|insert|delete|update|*|chr|mid|master|truncate|drop|char|declarel|;|,|"), the keyword string is judged as SQL injection.

[0123] 7. Get the Druid database connection pool;

[0124] 8. According to the SQL type of the database component: add, modify, delete, query, and paging query call the database connection to pass in the SQL assembled in 4 and the parameter array in 6; add, modify, and delete call the database update method; query and paging query call the database query method;

[0125] If it is to query SQL, call template.queryForList(sql, parameters) method to execute. If it is to add, delete or modify SQL, call template.update(sql, parameters) method to execute.

[0126] 9. After the SQL is executed, the database component query component will put the field value dataList returned by the query into the context of the canvas process (processSession). The database addition, modification, and deletion will put the execution number dataResult into the context of the canvas process (processSession), which can be directly dragged and used in the subsequent process canvas.

[0127] In the second aspect, the present application proposes a system for creating a database component of a process orchestration platform, such as Figure 2 As shown, it includes a visual arrangement module, a SQL keyword verification module and a parsing module;

[0128] The visual arrangement module is used to execute the front-end visual process arrangement steps, and the front-end visual process arrangement steps include:

[0129] Create a new business transaction service interface, enter the corresponding process arrangement interface based on the business transaction service interface, drag the database component in the process arrangement interface to the process canvas by dragging, and select the corresponding database component sql type according to the business service category;

[0130] Select the corresponding business database table according to the database component sql type. The business database table includes all business parameter tables and business control parameter tables used by the microservice corresponding to the current business transaction service interface. Select the corresponding business transaction field according to the business database table and assign values ​​to the business transaction field to complete the front-end process arrangement.

[0131] The sql keyword verification module is used to perform a sql keyword verification step, and the sql keyword verification step includes:

[0132] Calling the backend interface to save the information in the frontend process arrangement as a process canvas file, during the saving process, verifying the database component information and the SQL keywords when the database component is interpreted and executed, if the backend interface detects that the SQL injection keywords are included, then the saving as the process canvas file is cancelled, if the SQL injection keywords are not included, then the process canvas file is saved;

[0133] The parsing module is used to perform the underlying process parsing steps, and the underlying process parsing steps include:

[0134] The process canvas parsing engine is called to parse and execute the process canvas file, and the database component sql type selected in the process canvas file is executed. After the execution is completed, the result is returned and assembled into json data and put into the process canvas context. The process canvas context result is converted according to the process orchestration and the response data is returned to realize the database component parsing and execution of the front-end process orchestration.

[0135] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0136] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0137] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0138] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0139] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0140] In the embodiments provided in the present disclosure, it should be understood that the disclosed apparatus / computer equipment and methods can be implemented in other ways. For example, the apparatus / computer equipment embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the apparatus or unit, which may be electrical, mechanical or other forms.

[0141] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0143] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0144] The above are only preferred implementations of the present invention. It should be pointed out that a number of modifications and improved technical solutions made by those skilled in the art without departing from the technical solution should also be deemed to fall within the scope of protection required by the claims.

Claims

1. A method for creating a database component of a process orchestration platform, characterized in that: The method comprises: Create a new business transaction service interface, enter the corresponding process arrangement interface based on the business transaction service interface, and drag the database component in the process arrangement interface to the process canvas; In response to the sql type of the database component, the business database table and the business transaction field selected by the user, assign values ​​to the business transaction fields, wherein the sql types include adding, modifying, deleting, querying and paging querying; Calling the backend interface to save the information in the frontend process arrangement to the process canvas file, further comprising: verifying the sql keywords of the information in the frontend process arrangement during the saving process, and canceling the saving as the process canvas file if the backend interface detects that the information includes the sql injection keyword, and saving the information as the process canvas file if the information does not include the sql injection keyword; The process canvas parsing engine is called to parse and execute the process canvas file, and the database component sql type selected in the process canvas file is executed. After the execution is completed, the result is returned and assembled into json data and put into the process canvas context. The process canvas context result is converted according to the process orchestration and the response data is returned to realize the database component parsing and execution of the front-end process orchestration.

2. The method according to claim 1, characterized in that: The selecting a corresponding business transaction field according to the business database table and assigning a value to the business transaction field includes: The interface request parameters, functions, constants and return values ​​of other nodes in the process are assigned to the business transaction fields through parameter EL expressions.

3. The method according to claim 2, characterized in that: The calling backend interface saves the information in the frontend process arrangement to the process canvas file, verifies the SQL keywords during the saving process, and cancels the saving as the process canvas file if the backend interface detects that the SQL injection keywords are included; if the SQL injection keywords are not included, the process canvas file is saved, including: The call interface saves the information in the front-end process arrangement to the process canvas file, wherein the information in the front-end process arrangement includes field information, table information and condition information, the field information is used to assemble the SQL body of the database component, the table information is used as the business database table of the SQL operation of the database component, and the condition information is used to assemble the SQL condition of the database component; Check that the field information and the condition information do not contain the SQL injection keyword, then save it as the process canvas file.

4. The method according to claim 3, characterized in that: The calling process canvas parsing engine parses and executes the process canvas file, executes the database component sql type selected in the process canvas file, returns the result after the execution is completed, assembles it into json data and puts it into the process canvas context, and converts the process canvas context result according to the process arrangement and returns the response data, so as to realize the database component parsing and execution of the front-end process arrangement, including: Step 1: call up the database component parsing execution class, and pass the process engine context into the database component parsing execution class; Step 2: Convert the front-end process orchestration information saved in the process canvas file of the database component into a database component node definition class; Step 3: Assemble the SQL according to the SQL type of the database component, including assembling the SQL body of the database component with the field information in the database component node definition class, using the table information as the business database table of the SQL operation, and the condition information as the SQL condition for assembling the database component; Step 4: Replace the parameter EL expression in the SQL assembly process with the SQL statement recognized and executed by the business database; Step 5: Put all parameter EL expressions in step 4 into the parameter set; Step 6: traverse the parameter set and pass the parameter EL expression into the process engine context, parse the corresponding data by parsing the parameter EL expression method, and check again to make sure that the running state parameters do not contain SQL injection keywords to prevent SQL injection, and put the actual value after replacement into the parameter array; Step 7: Call the business database to connect to the parameter array according to the selected database component sql type, and execute the addition, modification, deletion, query and paging query corresponding to the sql type; Step 8: After execution is completed, the query component in the database component will put the field values ​​returned by the query or paging query into the context of the canvas process. Database addition, modification, and deletion will put the number of executions into the context of the canvas process, ready for direct dragging and dropping in subsequent process canvases.

5. The method according to claim 4, characterized in that: The step 3 also includes: When assembling SQL, the sqlType field of the node information is used to distinguish between paging query SQL and regular SQL. Among them, the paging query SQL needs to be assembled separately with a query total number SQL. The value passed in by the node information is assembled according to the SQL type to obtain the SQL statement adapted to the business database execution.

6. The method according to claim 5, characterized in that: The step 8 also includes: The result returned by the database component is directly used in the subsequent business logic judgment, business logic processing and direct response assignment of the process canvas, indicating the actual value of the parameter EL expression when the result returned by the database component is obtained during the process of parsing the parameter EL expression.

7. A system for creating a database component of a process orchestration platform, characterized in that: Including visual arrangement module, SQL keyword verification module and parsing module; The visual arrangement module is used to execute the front-end visual process arrangement steps, and the front-end visual process arrangement steps include: Create a new business transaction service interface, enter the corresponding process arrangement interface based on the business transaction service interface, drag the database component in the process arrangement interface to the process canvas by dragging, and select the corresponding database component sql type according to the business service category; Select the corresponding business database table according to the database component sql type. The business database table includes all business parameter tables and business control parameter tables used by the microservice corresponding to the current business transaction service interface. Select the corresponding business transaction field according to the business database table and assign values ​​to the business transaction field to complete the front-end process arrangement. The sql keyword verification module is used to perform a sql keyword verification step, and the sql keyword verification step includes: Calling the backend interface to save the information in the frontend process arrangement as a process canvas file, further comprising: verifying the sql keywords of the information in the frontend process arrangement during the saving process, and canceling the saving as the process canvas file if the backend interface detects that the information includes the sql injection keyword, and saving the information as the process canvas file if the information does not include the sql injection keyword; The parsing module is used to perform the underlying process parsing steps, and the underlying process parsing steps include: The process canvas parsing engine is called to parse and execute the process canvas file, and the database component sql type selected in the process canvas file is executed. After the execution is completed, the result is returned and assembled into json data and put into the process canvas context. The process canvas context result is converted according to the process orchestration and the response data is returned to realize the database component parsing and execution of the front-end process orchestration.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images