A method and device for handling security vulnerabilities of front-end dependencies

Abstract

The present invention discloses a method and device for processing security vulnerabilities of front-end dependencies, which relates to the field of Internet technology. The method includes: using first object data to convert dependency information of multiple first target dependencies after parsing to obtain target dependency information; generating a security vulnerability query request based on the target dependency information and receiving the security vulnerability query result; when it is determined that there is a security vulnerability identifier in the security vulnerability query result, using second object data to loop through the second target dependency with the security vulnerability identifier to determine whether there is security vulnerability detailed information of the second target dependency; if not, generating a security vulnerability detailed information acquisition request based on the security vulnerability identifier and receiving the security vulnerability detailed information of the second target dependency; and feeding back the security vulnerability detailed information to the target user. The present invention can timely and accurately query dependencies with security vulnerabilities and obtain corresponding security vulnerability detailed information, and timely feedback to the target user.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a method and device for processing security vulnerabilities that are dependent on a front-end. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. No statement herein is admitted to be prior art by virtue of its inclusion in this section.

[0003] Front-end dependencies, also known as dependencies in front-end engineering projects (third-party libraries), typically refer to JavaScript libraries or frameworks written by third-party developers or teams to simplify development, provide common functionality, or solve specific problems. A front-end engineering project is a web application or website project built using a series of engineering methods and techniques throughout its entire lifecycle, from requirements analysis, design, coding, testing, deployment, and maintenance.

[0004] Since front-end dependencies can be written and maintained by different developer teams, they may contain known security vulnerabilities, such as code injection, cross-site scripting (XSS), cross-site request forgery (CSRF), insecure data processing, denial of service (DoS) attacks, etc. Timely and accurate query of front-end dependency security vulnerabilities and feedback of relevant security vulnerability information to target users (such as relevant developers) for review and processing can reduce project operation risks, improve business operation continuity, and protect user data security.

[0005] However, the existing technology usually requires relevant developers to manually query the security vulnerabilities of each front-end dependency from a large number of front-end dependencies with different versions and names, and then manually query the detailed information of the security vulnerabilities. This method is time-consuming and labor-intensive, and has low accuracy, resulting in higher project operation risks, discontinuous business operations, and higher risks to user data.

[0006] To address the above issues, no effective solutions have been proposed so far. Summary of the Invention

[0007] The embodiments of this specification provide a method and device for handling security vulnerabilities in front-end dependencies, which can timely and accurately query dependencies with security vulnerabilities and obtain corresponding security vulnerability details, and promptly feedback to target users for review and processing, which can reduce project operation risks, improve business operation continuity, and protect user data security.

[0008] In a first aspect, an embodiment of this specification provides a method for handling security vulnerabilities in front-end dependencies, the method comprising:

[0009] Using the first object data, converting the parsed dependency information of the plurality of first target dependencies to obtain target dependency information of the plurality of first target dependencies;

[0010] Generate a security vulnerability query request based on the target dependency information, and receive a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request;

[0011] When it is determined that the security vulnerability identifier exists in the security vulnerability query result, using the second object data to loop through the second target dependency where the security vulnerability identifier exists, to determine whether there is security vulnerability detailed information of the second target dependency;

[0012] When it is determined that the security vulnerability detailed information of the second target dependency does not exist, generating a security vulnerability detailed information obtaining request according to the security vulnerability identifier of the second target dependency, and receiving the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information obtaining request;

[0013] Feedback the security vulnerability details to the target user.

[0014] In some embodiments, the method further comprises:

[0015] Call the first interface of the preset plug-in workspace to obtain the path information of the workspace;

[0016] Calling a second interface for file reading to read all files in the workspace root directory corresponding to the path information;

[0017] Search all files for a target dependency lock file, where the target dependency lock file contains dependency information of multiple installed front-end dependencies.

[0018] When it is determined that the target dependency locking file exists, the preset parsing library is called to parse the dependency information of multiple front-end dependencies in the target dependency locking file to obtain the dependency information of the multiple front-end dependencies after parsing, wherein the multiple front-end dependencies after parsing include multiple first target dependencies.

[0019] In some embodiments, the preset plug-in includes a VS Code plug-in, the target dependency locking file includes one of a package-lock.json file, a yarn.lock file, and a pnpm-lock.yaml file, the preset parsing library includes snyk-nodejs-lockfile-parser, the multiple front-end dependencies include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies, multiple development dependencies and indirect dependencies corresponding to multiple development dependencies, and the multiple first target dependencies include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies.

[0020] In some embodiments, the first object data stores dependency information in the form of key-value pairs; accordingly, the first object data is used to convert the parsed dependency information of the plurality of first target dependencies to obtain target dependency information of the plurality of first target dependencies, including:

[0021] The first object data is used to recursively traverse the resolved dependency information of the multiple first target dependencies, and the dependency information of the multiple first target dependencies is converted into dependency information in the form of key-value pairs as the target dependency information.

[0022] In some embodiments, the method further comprises:

[0023] The target dependency information is stored in the first object data in a key-value pair format, where the first object data includes depsMap object data.

[0024] In some embodiments, the target dependency information includes a target dependency name and a target dependency version; accordingly, generating a security vulnerability query request based on the target dependency information includes:

[0025] Obtaining a third interface of a first database, wherein the first database stores security vulnerabilities that a front-end depends on;

[0026] The third interface, the target dependency name, and the target dependency version are concatenated to generate a security vulnerability query request corresponding to the target dependency information.

[0027] In some embodiments, the step of looping through the second target dependency containing the security vulnerability identifier using the second object data to determine whether detailed information on the security vulnerability of the second target dependency exists includes:

[0028] Looping through the second target dependency containing the security vulnerability identifier in the first object data using the second object data to determine whether detailed information on the security vulnerability of the second target dependency exists in the second object data;

[0029] When it is determined that the security vulnerability details of the second target dependency exist, the security vulnerability details are written into the front-end root directory.

[0030] In some embodiments, generating a security vulnerability detailed information acquisition request according to the security vulnerability identifier of the second target dependency includes:

[0031] Obtaining a fourth interface of a second database, wherein the second database stores detailed information on security vulnerabilities that the front-end depends on;

[0032] The security vulnerability identifiers of the fourth interface and the second target dependency are concatenated to generate a request for obtaining detailed security vulnerability information.

[0033] In some embodiments, the method further comprises:

[0034] The obtained security vulnerability detailed information of the second target dependency is stored in the second object data, wherein the security vulnerability detailed information includes the second target dependency name, the second target dependency version, the security vulnerability identifier of the second target dependency, the security vulnerability brief description of the second target dependency and the security vulnerability detail information of the second target dependency.

[0035] In some embodiments, feeding back the security vulnerability details to the target user includes:

[0036] The preset write method is called to write the security vulnerability details of the second target dependency in the second object data into a preset configuration file in the front-end root directory, and the preset configuration file is used for the target user to view the security vulnerability details.

[0037] In some embodiments, the preset write method includes writeFileSync, and the preset configuration file includes a securityVulnerabilities.json file.

[0038] In a second aspect, the embodiments of this specification further provide a front-end dependent security vulnerability processing device, which includes:

[0039] a conversion module, configured to convert the parsed dependency information of the plurality of first target dependencies using the first object data to obtain target dependency information of the plurality of first target dependencies;

[0040] A first acquisition module is configured to generate a security vulnerability query request based on the target dependency information and receive a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request;

[0041] a loop traversal module, configured to, when determining that a security vulnerability identifier exists in the security vulnerability query result, loop traverse the second target dependency containing the security vulnerability identifier using the second object data to determine whether there is security vulnerability detailed information of the second target dependency;

[0042] A second acquisition module is configured to, when it is determined that the security vulnerability detailed information of the second target dependency does not exist, generate a security vulnerability detailed information acquisition request according to the security vulnerability identifier of the second target dependency, and receive the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information acquisition request;

[0043] The feedback module is used to feed back the detailed information of the security vulnerability to the target user.

[0044] On the third aspect, the embodiments of this specification also provide a computer device, including a memory, a processor and a computer program / instructions stored on the memory, wherein the processor executes the computer program / instructions to implement the steps of the above-mentioned front-end-dependent security vulnerability processing method.

[0045] In a fourth aspect, an embodiment of this specification further provides a computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of the above-mentioned front-end-dependent security vulnerability handling method.

[0046] In a fifth aspect, the embodiments of this specification also provide a computer program product, which implements the steps of the above-mentioned front-end dependent security vulnerability processing method when the computer program / instructions are executed by a processor.

[0047] The embodiments of this specification provide a method and device for processing security vulnerabilities of front-end dependencies. First, using the first object data, the dependency information of multiple first target dependencies after parsing is converted and processed to obtain target dependency information of multiple first target dependencies. Secondly, a security vulnerability query request is generated based on the target dependency information, and a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request is received. Then, when it is determined that there is a security vulnerability identifier in the security vulnerability query result, the second object data is used to loop through the second target dependency with the security vulnerability identifier to determine whether there are security vulnerability details of the second target dependency. Then, when it is determined that there are no security vulnerability details of the second target dependency, a security vulnerability details acquisition request is generated based on the security vulnerability identifier of the second target dependency, and the security vulnerability details of the second target dependency returned based on the security vulnerability details acquisition request are received. Finally, the security vulnerability details are fed back to the target user. In the embodiments of this specification, by using the first object data to convert the dependency information of multiple first target dependencies after parsing to obtain target dependency information of multiple first target dependencies, the complexity of the multiple first target dependencies obtained after parsing can be effectively reduced. A security vulnerability query request is generated based on the target dependency information after the conversion process, and the security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request can be automatically, accurately and quickly received. Afterwards, when it is determined that there is a security vulnerability identifier in the security vulnerability query result, the second object data is used to loop through the second target dependency with the security vulnerability identifier to determine whether there are security vulnerability detailed information of the second target dependency, which can improve the query efficiency of the security vulnerability detailed information. When it is determined that there are no security vulnerability detailed information of the second target dependency, a security vulnerability detailed information acquisition request is generated based on the security vulnerability identifier of the second target dependency, and the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information acquisition request can be automatically, accurately and quickly received. Finally, the security vulnerability detailed information can be fed back to the target user in a timely manner for viewing and processing, thereby reducing the risk of project operation, improving business operation continuity, and protecting user data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0049] Figure 1This is a flow chart of a method for handling front-end dependent security vulnerabilities provided by an embodiment of this specification;

[0050] Figure 2 This is a schematic diagram of an embodiment of a method for handling security vulnerabilities of front-end dependencies provided by an embodiment of this specification, in a scenario example;

[0051] Figure 3 This is a schematic diagram of an embodiment of a method for handling security vulnerabilities of front-end dependencies provided by an embodiment of this specification, in a scenario example;

[0052] Figure 4 This is a schematic diagram of an embodiment of a method for handling security vulnerabilities of front-end dependencies provided by an embodiment of this specification, in a scenario example;

[0053] Figure 5 This is a schematic diagram of an embodiment of a method for handling security vulnerabilities of front-end dependencies provided by an embodiment of this specification, in a scenario example;

[0054] Figure 6 This is a schematic diagram of the structure of a front-end-dependent security vulnerability processing device provided in an embodiment of this specification;

[0055] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0056] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0057] Front-end dependencies, or dependencies in front-end engineering projects (third-party libraries), typically refer to JavaScript libraries or frameworks written by third-party developers or teams to simplify development, provide common functionality, or solve specific problems. These libraries are widely used in web development and cover aspects such as DOM manipulation, AJAX communication, UI components, data visualization, state management, routing and navigation, animation effects, testing tools, and more. A front-end engineering project refers to a web application or website project built using a series of engineering methods and technologies throughout its entire lifecycle, from requirements analysis and design, coding, testing, deployment, and maintenance.

[0058] Dependencies in front-end projects are typically published to the Npm registry (registry.npmjs.org). Npm (NodePackage Manager) is the central package repository for the JavaScript language, and most front-end projects use Npm to manage and install these dependencies. Examples of front-end dependencies published on Npm include React (a JavaScript library for building user interfaces that supports a declarative component-based programming model), Vue.js (a progressive JavaScript framework for building user interfaces known for its ease of use and flexibility), Redux (a state container for JavaScript applications that provides predictable state management), Axios (a Promise-based HTTP client used to make HTTP requests in browsers and Node.js), Lodash (a JavaScript utility library that facilitates working with data structures such as arrays and objects), and jQuery (which can be installed via Npm and is used to process HTML documents, perform Ajax requests, and handle events).

[0059] Dependency security in front-end projects primarily refers to the security risks of JavaScript libraries, frameworks, and other auxiliary tools introduced from public or private repositories through package managers such as Npm. Since front-end dependencies can be written and maintained by different developer teams, they may contain known security vulnerabilities such as code injection, cross-site scripting (XSS), cross-site request forgery (CSRF), insecure data processing, and denial of service (DoS) attacks. Timely and accurate querying of front-end dependency security vulnerabilities and feeding back relevant security vulnerability information to target users (such as relevant developers) for review and processing can reduce project operation risks, improve business operation continuity, and protect user data security.

[0060] However, the existing technology usually requires relevant developers to manually query the security vulnerabilities of each front-end dependency from a large number of front-end dependencies with different versions and names, and then manually query the detailed information of the security vulnerabilities. This method is time-consuming and labor-intensive, and has low accuracy, resulting in higher project operation risks, discontinuous business operations, and higher risks to user data.

[0061] In response to the above-mentioned problems existing in the existing methods and the specific reasons for the above-mentioned problems, this application considers introducing a method and device for handling security vulnerabilities of front-end dependencies, which can timely and accurately query dependencies with security vulnerabilities and obtain corresponding security vulnerability details, and promptly feedback to target users so that target users can view and take corresponding measures in a timely manner, thereby reducing project operation risks, improving business operation continuity, and protecting user data security.

[0062] It should be noted that the user-related information and data involved in the embodiments of this specification are all information and data authorized by the user or fully authorized by relevant parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users or relevant parties to choose to authorize or refuse.

[0063] It should also be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned. They should be regarded as exemplary and their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0064] Figure 1 It is a flow chart of a front-end dependent security vulnerability handling method provided by the embodiment of this specification. Although this specification provides the method operation steps or device structure shown in the following embodiments or drawings, the method or device may include more or fewer operation steps or module units after partial merger based on routine or no creative labor. In the steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure is applied to an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiment or drawings (for example, a parallel processor or multi-threaded processing environment, or even an implementation environment of distributed processing and server clusters). For specific implementation, please refer to Figure 1 As shown, the method may include the following contents.

[0065] S101: using first object data, converting the parsed dependency information of the plurality of first target dependencies to obtain target dependency information of the plurality of first target dependencies.

[0066] S102: Generate a security vulnerability query request according to the target dependency information, and receive a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request.

[0067] S103: When it is determined that a security vulnerability identifier exists in the security vulnerability query result, use the second object data to loop through the second target dependency containing the security vulnerability identifier to determine whether detailed information on the security vulnerability exists for the second target dependency.

[0068] S104: When it is determined that the security vulnerability detailed information of the second target dependency does not exist, a security vulnerability detailed information obtaining request is generated according to the security vulnerability identifier of the second target dependency, and the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information obtaining request is received.

[0069] S105: Feedback the security vulnerability details to the target user.

[0070] Based on the above embodiment, by utilizing the first object data, the dependency information of the multiple first target dependencies after parsing is converted and processed to obtain the target dependency information of the multiple first target dependencies, which can effectively reduce the complexity of the multiple first target dependencies obtained after parsing. A security vulnerability query request is generated based on the converted target dependency information, and the security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request can be automatically, accurately and quickly received. Afterwards, when it is determined that there is a security vulnerability identifier in the security vulnerability query result, the second object data is used to loop through the second target dependency with the security vulnerability identifier to determine whether there are security vulnerability details of the second target dependency, which can improve the query efficiency of the security vulnerability details. When it is determined that there are no security vulnerability details of the second target dependency, a security vulnerability details acquisition request is generated based on the security vulnerability identifier of the second target dependency, and the security vulnerability details of the second target dependency returned based on the security vulnerability details acquisition request can be automatically, accurately and quickly received. Finally, the security vulnerability details can be fed back to the target user in a timely manner for viewing and processing, thereby reducing project operation risks, improving business operation continuity, and protecting user data security.

[0071] In some embodiments, the above-mentioned front-end-dependent security vulnerability processing method can be specifically applied to the server side, where the server can be connected to the user terminal.

[0072] In this embodiment, the server may specifically include a backend server applied to a network service platform that can implement functions such as data transmission and data processing. Specifically, the server may be, for example, an electronic device with data computing, storage, and network interaction functions. Alternatively, the server may be a software program running on the electronic device that provides support for data processing, storage, and network interaction. In this embodiment, the number of servers is not specifically limited. The server may specifically be one server, several servers, or a server cluster formed by several servers.

[0073] The user terminal may specifically include a front-end, applied to the user side, capable of performing functions such as data collection and data transmission. Specifically, the user terminal may be, for example, an electronic device such as a desktop computer, tablet computer, laptop computer, or smartphone. Alternatively, the user terminal may be a software application capable of running on the aforementioned electronic devices.

[0074] The above-mentioned users may specifically be developers of the network service platform.

[0075] In specific implementations, a file named package.json can exist in the root directory of a front-end project. This file is used to store project metadata and dependency information. Target users (e.g., developers) can select a front-end project and define the required dependencies and their versions by configuring the package.json file. They can then call the corresponding dependency installation instructions (e.g., npm / NPM install, which uses npm by default, but can also use yarn / Yarn or pnpm package management tools) to install the customized dependencies and dependency versions. After the dependencies are installed, the installed dependency information is saved in the corresponding dependency lock file (e.g., using npm to install dependencies saves the installed dependency information in package-lock.json; using yarn to install dependencies saves the installed dependency information in yarn.lock; using pnpm to install dependencies saves the installed dependency information in pnpm-lock.yaml. After the dependency installation is complete, the corresponding package-lock.json, yarn.lock, and pnpm-lock.yaml are automatically created or updated). The dependency lock file is saved in the root directory of the front-end project.

[0076] After the server detects that the dependencies under the root directory of the front-end project have changed or been updated, it can trigger the application of the front-end dependency security vulnerability processing method provided in the embodiment of the present application to automatically detect whether there are dependencies with security vulnerabilities in the front-end engineering project selected by the user and automatically obtain detailed security vulnerability information of the dependencies with security vulnerabilities, and promptly feedback to the user for review and processing (such as: upgrading dependencies with security vulnerabilities or security risks to problem-free versions), thereby reducing project operation risks, improving business operation continuity, and protecting user data security. Specifically, first, the first object data can be used to convert the dependency information of the parsed multiple first target dependencies (the dependency information of the parsed multiple first target dependencies can be obtained by parsing the target dependency lock file in the root directory of the front-end project or workspace); then a security vulnerability query request is generated based on the target dependency information obtained after the conversion, and a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request is received; when it is determined that there is a security vulnerability identifier in the security vulnerability query result, the second object data is used to loop through the second target dependency with the security vulnerability identifier to determine whether there is security vulnerability detailed information of the second target dependency; when it is determined that there is no security vulnerability detailed information of the second target dependency, a security vulnerability detailed information acquisition request is generated based on the security vulnerability identifier of the second target dependency, and the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information acquisition request is received; finally, the security vulnerability detailed information is fed back to the target user.

[0077] In some embodiments, before the above S101, the specific implementation may also include:

[0078] S1: Call the first interface of the preset plug-in workspace to obtain the path information of the workspace;

[0079] S2: calling a second interface for reading files to read all files in the workspace root directory corresponding to the path information;

[0080] S3: Check whether there is a target dependency lock file in all files, and the target dependency lock file contains dependency information of multiple installed front-end dependencies;

[0081] S4: When it is determined that the target dependency locking file exists, a preset parsing library is called to parse the dependency information of multiple front-end dependencies in the target dependency locking file to obtain the dependency information of the multiple front-end dependencies after parsing, wherein the multiple front-end dependencies after parsing include multiple first target dependencies.

[0082] In some embodiments, the above-mentioned preset plug-in may include a VS Code plug-in, the target dependency locking file may include one of a package-lock.json file, a yarn.lock file, and a pnpm-lock.yaml file, the preset parsing library may include snyk-nodejs-lockfile-parser, the multiple front-end dependencies may include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies, multiple development dependencies and indirect dependencies corresponding to multiple development dependencies, and the multiple first target dependencies may include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies.

[0083] In some embodiments, the above-mentioned VS Code (Visual Studio Code) is a free, open source and cross-platform source code editor that can provide an efficient and flexible development environment. Developers can easily search and install required plug-ins in the built-in extension market (Extension Marketplace) of VS Code to improve development efficiency and experience.

[0084] The target dependency lock file mentioned above can be recorded as packageFile, which can be any one of package-lock.json, yarn.lock, and pnpm-lock.yaml. When packageFile is package-lock.json, it means that npm is used to install dependencies; when packageFile is yarn.lock, it means that yarn is used to install dependencies; when packageFile is pnpm-lock.yaml, it means that pnpm is used to install dependencies. Among them, npm / NPM, yarn / Yarn, and pnpm are dependency installation tools or package managers.

[0085] Among them, the installation methods of front-end engineering dependencies can be divided into the following three types:

[0086] (1) Front-end project dependency installation is mainly achieved through the package manager in the Node.js ecosystem, among which npm (Node Package Manager) is the most commonly used tool. The package.json file of the front-end project records the configuration and dependencies of the project. Then, you can install the dependencies by: npminstall, which will install all the dependencies of the project. For project-specific dependency installation, such as React or Vue framework and its related plug-ins, run npminstall in the project directory. <package-name>or simply npm i <package-name>, which will install the dependency in the node_modules directory within the project and add the dependency information to the dependencies or devDependencies field of package.json. After the dependency is installed, the dependency information is saved in package-lock.json.

[0087] (2) Package manager Yarn, which has similar functions to npm, but has been optimized in terms of performance and consistency. When using Yarn, the corresponding installation command is yarn add <package-name>(install common dependencies) and yarn add --dev <package-name>(Install development dependencies). After the dependency installation is complete, the dependency information is saved in yarn.lock.

[0088] (3) Package manager pnpm. When using pnpm for package management, the pnpm-lock.yaml file will be automatically created or updated after running the pnpminstall command. The pnpm-lock.yaml file records in detail the exact version numbers and dependency graphs of all directly and indirectly installed (i.e., sub-dependencies) packages.

[0089] The main purpose of the package-lock.json, yarn.lock, and pnpm-lock.yaml files is to ensure the certainty and consistency of project dependencies:

[0090] The package-lock.json file, introduced in npm version 5 and later, is automatically generated when executing npm install . This file details the exact version of every dependency in your project, its sub-dependencies, and the relationships between them. It locks each dependency to a specific version, ensuring consistent versions across different development environments and during continuous integration. This is crucial for reproducible builds and avoiding potential issues caused by dependency version changes.

[0091] The yarn.lock file is a built-in locking mechanism within the YARN package manager that also records the precise version information of a project's dependencies. After each yarn install, YARN generates or updates this lock file based on the version range defined in package.json. The presence of yarn.lock ensures an identical dependency tree across multiple developers and deployment environments, enhancing project reproducibility and reliability while also speeding up dependency installation.

[0092] The pnpm-lock.yaml file plays the role of fixing dependency versions in the project, ensuring consistency between the development environment and the production environment. Whenever a project dependency is installed through `pnpminstall`, pnpm obtains and installs the corresponding software package and its sub-dependencies according to the version range defined in `package.json`. Afterwards, `pnpm-lock.yaml` records the exact version information of each dependency package that is actually installed. In this way, when collaborating in a team or deploying across environments, when the installation command is executed again, it will be restored strictly according to the version locked in the `pnpm-lock.yaml` file, avoiding the uncertainty caused by dependency version updates in the remote repository, thereby ensuring stable and predictable behavior during project build and runtime.

[0093] The above-mentioned preset parsing library snyk-nodejs-lockfile-parser can be used to parse the dependency information of multiple front-end dependencies in the target dependency lock file (such as package-lock.json or yarn.lock or pnpm-lock.yaml. These dependency lock files are used to record the exact dependency tree of the project and its corresponding version number to ensure consistency when installing dependencies in different environments), and obtain the dependency information of multiple front-end dependencies after parsing (including multiple production dependencies, multiple development dependencies, indirect dependencies corresponding to multiple production dependencies, and indirect dependencies corresponding to multiple development dependencies). Specifically, the interface of the preset parsing library snyk-nodejs-lockfile-parser (such as buildDepTreeFromFiles API) can be called to obtain the dependency information of the front-end project. The returned content is a tree structure, recorded as tree. The returned content, i.e., the dependency information, can include: the name (name) and version (version) of each dependency (including production dependencies and development dependencies, and corresponding indirect dependencies). Since the interface of calling the preset parsing library snyk-nodejs-lockfile-parser returns a tree structure, in order to reduce the complexity of multiple first target dependencies (multiple production dependencies, and indirect dependencies corresponding to multiple production dependencies) obtained after parsing, multiple first target dependencies can be converted, that is, the tree structure data is converted into a flat structure. How to perform the conversion will be explained later and will not be repeated in this manual.

[0094] Among them, production dependencies are the indispensable dependencies or components of the project in the production environment (when running online). These dependencies directly support the core functions of the application and the user interaction experience, such as the front-end framework (React, Vue.js), the HTTP request library required for actual runtime (such as axios), and the basic tool library (such as lodash), etc. They will be compiled and packaged into the final production code for users to call when accessing the website or application. Development dependencies (devDependencies) refer to tools or libraries used for building, testing, debugging, code quality assurance and other functions during the development phase. These dependencies are more important during the project development and construction process, but are no longer needed after deployment to the production environment. Since development dependencies are not dependencies required for the actual operation of the project, this application mainly analyzes production dependencies and their indirect dependencies.

[0095] Indirect dependencies in front-end projects refer to third-party modules or libraries that aren't directly imported or required by the project itself, but are instead referenced by the project's explicitly listed direct dependencies. In other words, indirect dependencies are "downstream" dependencies of direct dependencies. That is, when a library or framework is installed, it also pulls in and installs other required dependencies to function. These indirect dependencies are also necessary for the project to build and run. For example, if a project directly references library A, and library A declares a dependency on library B in its package.json file, library B becomes an indirect dependency of the project. In projects managed by package managers like npm, yarn, and pnpm, indirect dependencies are also installed in the node_modules folder and are correctly linked and packaged during the build process. Properly identifying and managing indirect dependencies is crucial for ensuring consistent project builds, optimizing the dependency tree structure, and mitigating security risks.

[0096] In some embodiments, the above-mentioned workspace can be a front-end project selected by the target user (such as a developer). The front-end project can be understood as a project project produced for a certain business development business, and the root directory of the front-end project can be viewed or configured by the developer. The target user (such as a developer) can configure the required dependencies and their versions in the root directory of the front-end project and call the corresponding dependency installation instructions to install the dependencies. Afterwards, the server can parse the multiple front-end dependencies in the target dependency lock file under the root directory of the front-end project, and then convert the dependency information of the multiple first target dependencies in the multiple front-end dependencies after parsing to obtain the target dependency information of the multiple first target dependencies. By parsing the multiple front-end dependencies under the root directory of the front-end project and then converting them, the foundation can be laid for the subsequent automatic, accurate and rapid query of dependencies with security vulnerabilities and obtaining detailed information on the security vulnerabilities of the dependencies.

[0097] Specifically, the parsing process is as follows: first, a first interface (e.g., vscode.workspace.workspaceFolders API) of a preset plug-in (e.g., VS Code plug-in) is called to obtain the path information of the workspace, then a second interface (e.g., readdirSync API) for file reading is called to read all files in the root directory of the workspace corresponding to the path information, and then a target dependency lock file (e.g., packageFile) is searched for in all files. The target dependency lock file may contain dependency information of multiple installed front-end dependencies. When it is determined that a target dependency lock file (e.g., packageFile, where packageFile can be any one of package-lock.json, yarn.lock, and pnpm-lock.yaml) exists, a preset parsing library (e.g., snyk-nodejs-lockfile-parse) is called to parse the dependency information of multiple front-end dependencies in the target dependency lock file (e.g., packageFile), and finally the parsed dependency information of multiple front-end dependencies is obtained. Then, the dependency information of multiple first target dependencies (multiple production dependencies and indirect dependencies corresponding to multiple production dependencies) in the multiple front-end dependencies is converted, that is, the tree structure dependency is converted into a flat structure stored in the form of key-value pairs.

[0098] In some embodiments, the first object data stores dependency information in the form of key-value pairs; accordingly, using the first object data to convert the parsed dependency information of the plurality of first target dependencies to obtain target dependency information of the plurality of first target dependencies may include:

[0099] The first object data is used to recursively traverse the resolved dependency information of the multiple first target dependencies, and the dependency information of the multiple first target dependencies is converted into dependency information in the form of key-value pairs as the target dependency information.

[0100] In some embodiments, after obtaining the target dependency information, the specific implementation may further include:

[0101] The target dependency information is stored in the first object data in a key-value pair format, where the first object data includes depsMap object data.

[0102] In some embodiments, the first object data may include depsMap object data. DepsMap is a special built-in object in JavaScript. It provides a way to store data, allows any type of value (including objects) as a key, and maintains a mapping relationship between key-value pairs. The format of the depsMap object key is "dependency name@dependency version", and the value is an object in the format of {name: 'dependency name', version: 'dependency version'}. An example of a depsMap that produces dependency information is as follows: The dependency name is core-js and the version is 3.37.0. The above form is a flat structure.

[0103] Specifically, the conversion process is: the newly created first object data can be used to recursively traverse the dependency information of multiple first target dependencies in the multiple front-end dependencies after parsing (that is, recursively traverse the dependencies in the tree (that is, only obtain the dependency information of the production dependency and the indirect dependency of this production dependency)), and convert the dependency information of multiple first target dependencies into dependency information in the form of key-value pairs (that is, obtain the target dependency information after conversion).

[0104] In some embodiments, the target dependency information can be stored in the first object data in the form of a key-value pair, so that the second object data can be used to directly loop through the dependency information in the first object data, and it can be more accurately and quickly determined whether there are security vulnerability details with corresponding dependency names and dependency versions, thereby improving the efficiency and accuracy of obtaining security vulnerability details.

[0105] In some embodiments, the target dependency information includes a target dependency name and a target dependency version. Accordingly, generating a security vulnerability query request based on the target dependency information may include:

[0106] S1: Obtain a third interface of a first database, where the first database stores security vulnerabilities that the front-end depends on;

[0107] S2: Concatenate the third interface, the target dependency name, and the target dependency version to generate a security vulnerability query request corresponding to the target dependency information.

[0108] In some embodiments, the above-mentioned first database can record or store the names, version information, and security vulnerabilities of the front-end dependencies and their indirect dependencies, and the first database can be the deps.dev website. Among them, the main function of the deps.dev website (https: / / deps.dev / , https: / / deps.dev / is an open source tool from Google, called Open Source Insights) is to help developers understand the dependencies of their projects more deeply. Through this website, developers can obtain the dependencies of any open source project, including direct dependencies and dependencies of dependencies (indirect dependencies), that is, developers can see the complete dependency graph. The website also provides license information about these dependencies to help users understand and manage the dependencies of the project more comprehensively, which can help to separate and better manage the project and avoid potential problems, that is, to show whether the dependency has security vulnerabilities. The deps.dev website provides an API (i.e. the third interface mentioned above, such as: GetVersion API) for developers to call, that is, the GetVersion API is provided in the website's documentation (https: / / docs.deps.dev / api / v3 / ).

[0109] The third interface, target dependency name, and target dependency version of the first database (deps.dev website) can be spliced ​​in a certain format to generate a security vulnerability query request corresponding to the target dependency information. For example, when the dependency name is @babel / traverse and the version is 7.23.0, it can be spliced ​​together through the URI format of / v3 / systems / {versionKey.system} / packages / encodeURIComponent{versionKey.name} / versions / {versionKey.version}, where versionKey.system is assigned to npm (front-end projects can use npm to install dependencies by default), versionKey.name is the dependency name, and is assigned to encodeURIComponent (@babel / traverse). encodeURIComponent is a global function built into JavaScript that is used to encode URI components because there may be special characters (such as @) in the dependency name. VersionKey.version is the dependency version and is assigned to 7.23.0. After the above assignments, the security vulnerability query request corresponding to the target dependency information is generated as follows:

[0110] https: / / api.deps.dev / v3 / systems / npm / packages / %40babel%2Ftraverse / versions / 7.23.0

[0111] A security vulnerability query request corresponding to the target dependency information can be sent to a browser. By entering the above request in the browser webpage, the security vulnerability query result returned for the dependency name @babel / traverse and version 7.23.0 can be obtained and then sent to the server. The server can receive the security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request, and determine whether there is a security vulnerability identifier in the security vulnerability query result. If it is determined that there is a security vulnerability identifier in the security vulnerability query result, it means that the first target dependency with the dependency name @babel / traverse and version 7.23.0 has a security vulnerability.

[0112] Among them, when there are multiple target dependency information, such as multiple different dependency names and versions, corresponding security vulnerability query requests corresponding to dependencies with different names and versions can be generated. The server can receive security vulnerability query results corresponding to dependencies with different names and versions, and can determine whether there are security vulnerabilities in dependencies with different names and versions by determining whether there are security vulnerability identifiers in the security vulnerability query results corresponding to dependencies with different names and versions.

[0113] The security vulnerability query results received by the server may include the advisoryKeys field and the advisoryKeys.id field. The advisoryKeys field provides information about known security vulnerabilities that affect this package version. The advisoryKeys.id field provides the OSV identifier of the security vulnerability.

[0114] The server determines whether a security vulnerability identifier exists in the security vulnerability query result. That is, it determines whether the advisoryKeys field exists in the returned security vulnerability query result, and whether there is an id field under the advisoryKeys field (for example, whether there is: GHSA-67hx-6x53-jw92). If there is an id field under the advisoryKeys field, it indicates that a security vulnerability identifier exists, that is, a security vulnerability exists in the dependency with the corresponding name and version.

[0115] Among them, the axios library can be used to automatically send the generated security vulnerability query request, and receive the security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request. If the security vulnerability query result contains the id field under the advisoryKeys field, the security vulnerability ID (securityVulnerabilitiesId) can be recorded or stored so that the security vulnerability detailed information of the corresponding dependency name and dependency version can be obtained in a timely manner later.

[0116] In some embodiments, the above-mentioned looping through the second target dependency containing the security vulnerability identifier using the second object data to determine whether the second target dependency contains detailed information on the security vulnerability may include:

[0117] S1: using the second object data to loop through the second target dependency containing the security vulnerability identifier in the first object data, and determining whether the second object data contains detailed information on the security vulnerability of the second target dependency;

[0118] S2: When it is determined that detailed information of a security vulnerability of the second target dependency exists, the detailed information of the security vulnerability is written into the front-end root directory.

[0119] In some embodiments, the above-mentioned second object data can be recorded as securityVulnerabilitiesCache, and the second object data can be used to record detailed information on security vulnerabilities of front-end dependencies. When it is determined that there is a security vulnerability identifier in the security vulnerability query result (that is, when it is determined that there is a dependency with a security vulnerability, the dependency with a security vulnerability can be defined as a second target dependency, and the second target dependency is among multiple first target dependencies), the newly created second object data can be used to loop through the second target dependency with a security vulnerability identifier in the first object data (depsMap) to determine whether there is detailed information on security vulnerabilities of the second target dependency in the second object data. When it is determined that there is detailed information on security vulnerabilities of the second target dependency, the detailed information on security vulnerabilities can be written to the root directory of the front-end project (that is, the front-end root directory) for easy viewing and processing by target users (such as developers).

[0120] In some embodiments, when it is determined that the security vulnerability detailed information of the second target dependency does not exist, a security vulnerability detailed information acquisition request may be generated according to the security vulnerability identifier of the second target dependency.

[0121] In some embodiments, the above-mentioned generation of a request for obtaining detailed information of a security vulnerability based on the security vulnerability identifier of the second target dependency may include:

[0122] S1: Obtain a fourth interface of a second database, where the second database stores detailed information on security vulnerabilities that the front-end depends on;

[0123] S2: Concatenate the security vulnerability identifier of the fourth interface and the second target dependency to generate a request for obtaining detailed security vulnerability information.

[0124] In some embodiments, the second database may be the OSV.dev website. OSV.dev is an open source project maintained by Google. Its primary function is to provide developers with a unified platform for tracking and managing detailed information about security vulnerabilities in the open source software they rely on. OSV.dev provides a database that is updated in real time. The core of OSV.dev is a database that is updated in real time and contains detailed information about open source vulnerabilities from multiple sources (e.g., CVE, OSS-Fuzz, etc.).

[0125] The OSV.dev website (https: / / osv.dev / ) provides an API (the fourth interface mentioned above) for developers to call. This API can be combined with the vulnerability identifier of the second target dependency in a specific format to generate a request for obtaining detailed vulnerability information, such as https: / / api.osv.dev / v1 / vulns / GHSA-67hx-6x53-jw92. GHSA-67hx-6x53-jw92 is the vulnerability identifier or vulnerability ID for the dependency named @babel / traverse, version 7.23.0.

[0126] You can send a request to obtain the security vulnerability details to the browser. By entering the request in the browser webpage, you can obtain the security vulnerability details returned by the dependency name @babel / traverse and version 7.23.0, and then send it to the server.

[0127] In some embodiments, after receiving the security vulnerability details of the second target dependency returned based on the security vulnerability details acquisition request, the specific implementation may further include:

[0128] The obtained security vulnerability detailed information of the second target dependency is stored in the second object data, wherein the security vulnerability detailed information includes the second target dependency name, the second target dependency version, the security vulnerability identifier of the second target dependency, the security vulnerability brief description of the second target dependency and the security vulnerability detail information of the second target dependency.

[0129] In some embodiments, the obtained security vulnerability detailed information of the second target dependency can be stored in the second object data (securityVulnerabilitiesCache), and the security vulnerability detailed information of the second target dependency can include: dependency name (name), dependency version (version), security vulnerability identifier (securityVulnerabilitiesId), security vulnerability summary (summary), and security vulnerability details (details). By storing the obtained security vulnerability detailed information of the second target dependency in the second object data (securityVulnerabilitiesCache), when it is determined that there is a dependency with a security vulnerability, if the dependency information has been obtained, it can be directly obtained from the second object data (securityVulnerabilitiesCache) without the need to re-acquire it, thereby improving the query efficiency of the dependency security vulnerability detailed information.

[0130] In some embodiments, the above-mentioned feedback of the security vulnerability details to the target user may include:

[0131] The preset write method is called to write the security vulnerability details of the second target dependency in the second object data into a preset configuration file in the front-end root directory, and the preset configuration file is used for the target user to view the security vulnerability details.

[0132] In some embodiments, the preset write method may include writeFileSync, and the preset configuration file may include a securityVulnerabilities.json file.

[0133] In some embodiments, the preset write method (writeFileSync write method) of the file fs module can be called to write the content in the second object data (securityVulnerabilitiesCache) into the preset configuration file (securityVulnerabilities.json file) in the root directory of the front-end project, so that the target users (such as: front-end developers) can quickly view and repair them in time according to the detailed information of the vulnerability, such as: upgrading the dependency with security vulnerabilities to a problem-free version, thereby reducing the project operation risk, improving business operation continuity, and protecting user data security.

[0134] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. For details, please refer to the description of the aforementioned related processing embodiments, and no further description is given here.

[0135] The above describes the present invention. However, it is worth noting that this specific embodiment is only intended to better illustrate the present application and to describe specific embodiments of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0136] In a specific implementation scenario, the front-end dependency security vulnerability handling method provided in this specification can be applied to automatically handle security vulnerabilities in VS Code's front-end dependencies. The specific implementation process may include the following:

[0137] In this scenario example, before specific implementation, refer to Figure 2 As shown, VS Code extensions can be designed in the following ways.

[0138] S1: Initialize the plug-in project.

[0139] Specifically, you can set the project's name, description, publisher, and other information.

[0140] S2: Install plugin dependencies.

[0141] Specifically, you can install necessary development dependencies such as TypeScript and @types / vscode to support writing plugins in TypeScript.

[0142] S3: Define the plugin contribution point.

[0143] Specifically, in Visual Studio Code (VS Code) plugin development, "contributes points" refer to the extensions or customized features that a plugin provides to the editor through a specific configuration section in its package.json file. The contributes field in package.json declares that the plugin will be activated when the developer executes a specific command.

[0144] S4: Implement plugin logic.

[0145] Specifically, it can quickly and accurately scan the dependencies in the front-end project and provide feedback on the dependencies with security vulnerabilities used.

[0146] S5: Package and publish the plugin.

[0147] Specifically, the core logic of the plug-in has been developed and published to the plug-in market. Developers can search and install this plug-in and use it to quickly scan whether there are security vulnerabilities in the front-end project dependencies. If there are vulnerabilities, they can be repaired in a timely manner according to the vulnerability information.

[0148] The core logic implementation process of the plug-in is as follows: the above plug-in will register a command (such as dependencyAnalysis). The developer presses Cmd+Shift+P on a Mac computer or Ctrl+Shift+P on a Windows computer to open the command panel, and the developer enters dependencyAnalysis to start the dependency analysis process.

[0149] For specific implementation, see Figure 3 As shown, the following contents may be included.

[0150] (1) Obtain the front-end engineering production dependencies and the indirect dependencies of production dependencies.

[0151] (2) Obtain dependencies with security risks in the front-end project.

[0152] (3) Obtain detailed information on dependencies with potential security risks.

[0153] (4) Output information about security dependencies.

[0154] Among them, the above-mentioned acquisition of front-end engineering production dependencies and indirect dependencies of production dependencies may include the following contents during specific implementation.

[0155] (1) Get the workspace directory path

[0156] Call the vscode workspace API (vscode.workspace.workspaceFolders API) to get the actual path of the workspace (i.e. the front-end project).

[0157] (2) See Figure 4 As shown, you can first call the file reading API (readdirSync) to read all files in the workspace root directory. Then, search for a package-lock.json, yarn.lock, or pnpm-lock.yaml file among all the files, denoted as packageFile. (Only one of these files exists: if the front-end project installs dependencies using npm, there will be a package-lock.json file; if the front-end project installs dependencies using yarn, there will be a yarn.lock file; if the front-end project installs dependencies using pnpm, there will be a pnpm-lock.yaml file.) If any of these three files exists, packageFile is the file name of the existing file (i.e., it can be package-lock.json, arn.lock, or pnpm-lock.yaml). If none of these files exists, it means that the front-end project has not yet installed its dependencies. In this case, call the "npm i" command to install the dependencies (using the npm package manager by default). After the dependencies are installed, a package-lock.json file will be generated, and the value of packageFile will be "package-lock.json".

[0158] (3) To obtain all dependencies of the front-end project (including direct and indirect dependencies), you need to use the snyk-nodejs-lockfile-pars library (mainly used to parse the dependency lock files of Node.js projects, such as package-lock.json, yarn.lock or pnpm-lock.yaml). In the Node.js ecosystem, lock files such as package-lock.json, yarn.lock, pnpm-lock.yaml, etc. are used to record the exact dependency tree of the project and its corresponding version number to ensure consistency when installing dependencies in different environments. Calling the buildDepTreeFromFiles API of the snyk-nodejs-lockfile-parser library can obtain the dependencies of the front-end project (the returned content is a tree structure), recorded as tree. Since the returned content is a tree structure, parsing the dependencies is relatively complicated. This application converts the fed-back tree structure data into a flat structure.

[0159] See Figure 5 As shown, you can get the project dependencies based on the packageFile, and then get the name and version of the dependencies (including direct and indirect dependencies), and flatten the tree dependencies. Specifically, you can create a new Map object (denoted as depsMap, the Map object in JavaScript is a special built-in object that provides a way to store data, allowing any type of value (including objects) as a key, and maintaining a mapping relationship between key-value pairs) to store dependency information, recursively traverse the tree (the dependencies in the tree include both production dependencies and development dependencies, this application only filters and processes production dependencies) for each dependency (that is, only obtain production dependencies) and the indirect dependencies of this dependency (indirect dependencies also only obtain production dependencies of indirect dependencies). The format of the depsMap object key is "dependency name@dependency version", and the value is an object in the format of {name: "dependency name", version: "dependency version"}. The above form is a flat structure.

[0160] Among them, the above-mentioned dependencies with security risks in obtaining front-end projects may include the following contents when implemented specifically.

[0161] (1) Obtain the dependencies with security risks in the front-end project through the deps.dev website (deps.dev can be understood as a large database that records the indirect dependencies (including dependency name and version information) of the dependencies, as well as whether the dependencies have security vulnerabilities or security risks. This application can go to this website (through the API) to obtain whether it is an unsafe dependency based on the dependency information (dependency name and dependency version). (https: / / deps.dev / ) to obtain information about a certain dependency. https: / / deps.dev / is a tool from Google called Open Source Insights. The main function of this website is to help developers understand the dependencies of their projects more deeply. Through this website, developers can obtain the dependencies of any open source project, including direct dependencies and dependencies of dependencies, that is, developers can see the complete dependency graph. The website also provides license information about these dependencies to help users understand and manage project dependencies more comprehensively, which can help separate and better manage projects and avoid potential problems. The potential problem is to show whether the dependency has security vulnerabilities.

[0162] The deps.dev website provides an API for developers to call. The GetVersion API is provided in the website documentation (https: / / docs.deps.dev / api / v3 / ). This API is in the form of sending a request, such as:

[0163] https: / / api.deps.dev / v3 / systems / npm / packages / %40babel%2Ftraverse / versions / 7.23.0) This API returns the following: advisoryKeys and advisoryKeys.id fields. The advisoryKeys field provides information about security vulnerabilities known to affect this package version. The advisoryKeys.id field provides the OSV identifier of the security vulnerability. For example, to obtain the 7.23.0 version of the @babel / traverse dependency, we use the URI format / v3 / systems / {versionKey.system} / packages / encodeURIComponent{versionKey.name} / versions / {versionKey.version}. VersionKey.system is assigned the value of npm (npm is the default for front-end projects), versionKey.name is the dependency name, and is assigned the value of encodeURIComponent(@babel / traverse). encodeURIComponent is a global function built into JavaScript that encodes URI components because dependency names may contain special characters (such as @). VersionKey.version is the dependency version and is assigned the value of 7.23.0. After the above assignments, we get the request to obtain dependency information:

[0164] https: / / api.deps.dev / v3 / systems / npm / packages / %40babel%2Ftraverse / versions / 7.23.0

[0165] You can enter the above address in the browser to view the return information of this dependency (@babel / travers version 7.23.0). For example, in the return information of @babel / traverse version 7.23.0, the id field of the advisoryKeys field contains a value (GHSA-67hx-6x53-jw92), indicating that this version has a security vulnerability.

[0166] (2) Create a new Map object (referred to as securityVulnerabilitiesCache) to record the security vulnerabilities of the dependencies, loop through each dependency (depsMap), and splice the request in the format of https: / / api.deps.dev / v3 / systems / {versionKey.system} / packages / encodeURIComponent{versionKey.name} / versions / {versionKey.version}. Use the axios library to automatically send the request. If the response to the request contains the advisoryKeys field and there is an id field under the advisoryKeys field (indicating that this dependency has a security vulnerability, record the securityVulnerabilitiesId) so that detailed information about the security vulnerability can be obtained later.

[0167] The above-mentioned detailed information on the dependencies with potential security risks may include the following contents during specific implementation.

[0168] To obtain detailed vulnerability information, visit OSV.dev (https: / / osv.dev / ). OSV.dev is an open source project maintained by Google. Its primary purpose is to provide developers with a unified platform for tracking and managing security vulnerabilities in the open source software they rely on. OSV.dev provides a live database. At its core, OSV.dev is a live database containing open source vulnerability information from multiple sources (such as CVE, OSS-Fuzz, etc.). This data is structured and standardized to facilitate developers' search, query, and matching with their projects. Through the / v1 / vulns / {id} API (see https: / / google.github.io / osv.dev / get-v1-vulns / ), id is the ID of the security vulnerability, and detailed information about this vulnerability can be obtained, such as https: / / api.osv.dev / v1 / vulns / GHSA-67hx-6x53-jw92, where GHSA-67hx-6x53-jw92 is the vulnerability ID of @babel / traverse 7.23.0. Developers can upgrade dependencies based on the detailed information. Based on the above security vulnerability ID (securityVulnerabilitiesId), a spliced ​​request is made to https: / / api.osv.dev / v1 / vulns / {id}. Axios is used to request detailed information about the security vulnerability, obtain the summary and details fields, and store them in the securityVulnerabilitiesCache along with the dependency name (name), dependency version (version), and dependency vulnerability ID.

[0169] The above output contains security-dependent information, which may include the following content during specific implementation.

[0170] Based on the dependency security vulnerability information (securityVulnerabilitiesCache), call the writeFileSync write method of the file fs module to write the securityVulnerabilitiesCache content to the securityVulnerabilities.json file in the root directory of the front-end project, so that front-end developers can quickly view it.

[0171] By automatically handling security vulnerabilities based on VS Code's front-end dependencies, the following effects can be achieved:

[0172] (1) Protecting user data security: There may be vulnerabilities in front-end dependencies that may lead to data leakage or tampering. Attackers can exploit these vulnerabilities to steal user privacy data, account information, or perform illegal operations. Ensuring dependency security helps protect the personal information security of end users.

[0173] (2) Preventing applications from being controlled or destroyed: Some security vulnerabilities can allow attackers to execute malicious code or control the behavior of applications, which not only affects the user experience but may also damage the corporate brand image and cause immeasurable losses.

[0174] (3) Compliance and legal requirements: Many industries have strict legal and regulatory requirements for data security and privacy protection. Ensuring the security of dependencies is a key part of meeting compliance requirements.

[0175] (4) Maintaining business continuity: Security vulnerabilities may cause service interruption or performance degradation. Regularly detecting and repairing security issues in dependent libraries can maintain the stability of the business system and avoid unnecessary downtime and operation and maintenance costs.

[0176] (5) Preventing supply chain attacks: With the development of the open source ecosystem, supply chain attacks have become increasingly prominent. Attackers may inject malicious code into popular open source libraries, indirectly affecting a large number of applications that use these libraries. Regularly checking and updating dependencies can effectively prevent such attacks.

[0177] (6) Improve development efficiency: Timely discovery and repair of security issues in dependencies can avoid emergency repair tasks in subsequent development stages, which is beneficial to the long-term stability and iteration speed of the project.

[0178] Although this specification provides examples such as the following examples or the accompanying Figure 6 The method operation steps or device structure shown, but based on routine or no creative labor, the method or device may include more or fewer operation steps or module units after partial merger. In the steps or structures that do not logically have a necessary causal relationship, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure described is applied to an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or drawings (for example, a parallel processor or multi-threaded processing environment, or even a distributed processing, server cluster implementation environment). Based on the above-mentioned front-end-dependent security vulnerability processing method, the embodiment of this specification also proposes an embodiment of a front-end-dependent security vulnerability processing device. As Figure 6 As shown, the device may specifically include the following modules:

[0179] The conversion module 601 may be configured to convert the parsed dependency information of the plurality of first target dependencies using the first object data to obtain target dependency information of the plurality of first target dependencies;

[0180] The first acquisition module 602 may be configured to generate a security vulnerability query request based on the target dependency information and receive a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request;

[0181] The loop traversal module 603 may be configured to, upon determining that a security vulnerability identifier exists in the security vulnerability query result, loop traverse the second target dependency containing the security vulnerability identifier using the second object data to determine whether there is security vulnerability detailed information of the second target dependency;

[0182] The second obtaining module 604 may be configured to generate a security vulnerability detailed information obtaining request according to the security vulnerability identifier of the second target dependency when it is determined that the security vulnerability detailed information of the second target dependency does not exist, and receive the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information obtaining request;

[0183] The feedback module 605 may be used to feed back the security vulnerability detailed information to the target user.

[0184] In some embodiments, the above-mentioned conversion module 601 can also be used to call the first interface of the workspace of the preset plug-in to obtain the path information of the workspace; call the second interface for file reading to read all files under the root directory of the workspace corresponding to the path information; search all files for whether there is a target dependency lock file, and the target dependency lock file contains dependency information of multiple installed front-end dependencies; when it is determined that the target dependency lock file exists, call the preset parsing library to parse the dependency information of multiple front-end dependencies in the target dependency lock file to obtain the dependency information of multiple front-end dependencies after parsing, and the multiple front-end dependencies after parsing include multiple first target dependencies.

[0185] In some embodiments, the above-mentioned preset plug-in includes a VS Code plug-in, the target dependency locking file includes one of a package-lock.json file, a yarn.lock file, and a pnpm-lock.yaml file, the preset parsing library includes snyk-nodejs-lockfile-parser, the multiple front-end dependencies include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies, multiple development dependencies and indirect dependencies corresponding to multiple development dependencies, and the multiple first target dependencies include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies.

[0186] In some embodiments, the first object data in the above-mentioned conversion module 601 stores dependency information in the form of key-value pairs; accordingly, the above-mentioned conversion module 601 can be specifically used to utilize the first object data to recursively traverse the dependency information of multiple first target dependencies after parsing, and convert the dependency information of multiple first target dependencies into dependency information in the form of key-value pairs as the target dependency information.

[0187] In some embodiments, the conversion module 601 may be further configured to store the target dependency information in the first object data in the form of key-value pairs, where the first object data includes depsMap object data.

[0188] In some embodiments, the target dependency information in the above-mentioned first acquisition module 602 may include a target dependency name and a target dependency version; accordingly, the above-mentioned first acquisition module 602 can be specifically used to obtain the third interface of the first database, which stores security vulnerabilities of front-end dependencies; splicing the third interface, the target dependency name and the target dependency version to generate a security vulnerability query request corresponding to the target dependency information.

[0189] In some embodiments, the above-mentioned loop traversal module 603 can be specifically used to use the second object data to loop through the second target dependency in the first object data where the security vulnerability identifier exists, and determine whether the second target dependency's security vulnerability details exist in the second object data; when it is determined that the second target dependency's security vulnerability details exist, the security vulnerability details are written into the front-end root directory.

[0190] In some embodiments, the above-mentioned second acquisition module 604 can be specifically used to obtain the fourth interface of the second database, which stores detailed information of security vulnerabilities that the front-end depends on; splicing the security vulnerability identifier of the fourth interface and the second target dependency to generate a request for obtaining detailed information of the security vulnerability.

[0191] In some embodiments, the above-mentioned second acquisition module 604 can also be used to store the acquired security vulnerability detailed information of the second target dependency in the second object data, and the security vulnerability detailed information includes the second target dependency name, the second target dependency version, the security vulnerability identifier of the second target dependency, the security vulnerability summary of the second target dependency and the security vulnerability detail information of the second target dependency.

[0192] In some embodiments, the above-mentioned feedback module 605 can be specifically used to call a preset write method to write the security vulnerability details of the second target dependency in the second object data into a preset configuration file in the front-end root directory, and the preset configuration file is used for the target user to view the security vulnerability details.

[0193] In some embodiments, the preset writing method in the feedback module 605 includes writeFileSync, and the preset configuration file includes a securityVulnerabilities.json file.

[0194] As can be seen from the above, a front-end dependency security vulnerability processing device provided based on the embodiment of this specification can timely and accurately query dependencies with security vulnerabilities and obtain corresponding security vulnerability detailed information, and promptly feedback to the target user for review and processing, thereby reducing project operation risks, improving business operation continuity, and protecting user data security.

[0195] An embodiment of this specification also provides an electronic device based on the above-mentioned front-end dependency security vulnerability processing method, including a processor and a memory for storing processor executable programs / instructions. When the processor is specifically implemented, it can perform the following steps according to the program / instructions: using first object data, converting and processing the dependency information of multiple first target dependencies after parsing to obtain target dependency information of multiple first target dependencies; generating a security vulnerability query request based on the target dependency information, and receiving a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request; when it is determined that there is a security vulnerability identifier in the security vulnerability query result, using second object data to loop through the second target dependency with the security vulnerability identifier to determine whether there is security vulnerability detailed information of the second target dependency; when it is determined that there is no security vulnerability detailed information of the second target dependency, generating a security vulnerability detailed information acquisition request based on the security vulnerability identifier of the second target dependency, and receiving the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information acquisition request; and feeding back the security vulnerability detailed information to the target user.

[0196] In order to complete the above instructions more accurately, refer to Figure 7 As shown, the embodiment of this specification also provides another specific electronic device, wherein the electronic device includes a network communication port 701, a processor 702 and a memory 703, and the above structures are connected through internal cables so that each structure can perform specific data interaction.

[0197] The network communication port 701 may be used to convert the parsed dependency information of the plurality of first target dependencies using the first object data to obtain target dependency information of the plurality of first target dependencies.

[0198] The processor 702 can be specifically used to generate a security vulnerability query request based on the target dependency information, and receive a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request; when it is determined that a security vulnerability identifier exists in the security vulnerability query result, use the second object data to loop through the second target dependency that has the security vulnerability identifier to determine whether there are security vulnerability details of the second target dependency; when it is determined that the security vulnerability details of the second target dependency do not exist, generate a security vulnerability details acquisition request based on the security vulnerability identifier of the second target dependency, receive the security vulnerability details of the second target dependency returned based on the security vulnerability details acquisition request; and feed back the security vulnerability details to the target user;

[0199] The memory 703 may be specifically used to store corresponding instruction programs.

[0200] In this embodiment, the network communication port 701 can be a virtual port that is bound to different communication protocols, thereby being capable of sending or receiving different data. For example, the network communication port can be a port responsible for web data communication, a port responsible for FTP data communication, or a port responsible for email data communication. Furthermore, the network communication port can also be a physical communication interface or communication chip. For example, it can be a wireless mobile network communication chip, such as GSM or CDMA; it can also be a Wi-Fi chip; or it can be a Bluetooth chip.

[0201] In this embodiment, the processor 702 may be implemented in any suitable manner. For example, the processor may take the form of a microprocessor or a processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, an embedded microcontroller, etc. This specification is not intended to limit this.

[0202] In this embodiment, the memory 703 may include multiple levels. In a digital system, anything that can store binary data can be a memory. In an integrated circuit, a circuit with a storage function that does not have a physical form is also called a memory, such as RAM, FIFO, etc. In a system, a storage device with a physical form is also called a memory, such as a memory stick, TF card, etc.

[0203] An embodiment of this specification also provides a computer storage medium for a security vulnerability processing method based on the above-mentioned front-end dependency, wherein the computer storage medium stores a computer program / instruction, which, when executed, implements: using first object data to convert and process the dependency information of multiple first target dependencies after parsing to obtain target dependency information of multiple first target dependencies; generating a security vulnerability query request based on the target dependency information, and receiving a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request; when it is determined that a security vulnerability identifier exists in the security vulnerability query result, using second object data to loop through the second target dependency that has the security vulnerability identifier to determine whether there is security vulnerability detailed information of the second target dependency; when it is determined that there is no security vulnerability detailed information of the second target dependency, generating a security vulnerability detailed information acquisition request based on the security vulnerability identifier of the second target dependency, and receiving the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information acquisition request; and feeding back the security vulnerability detailed information to the target user.

[0204] In this embodiment, the storage medium includes, but is not limited to, random access memory (RAM), read-only memory (ROM), cache, hard disk drive (HDD), or memory card. The memory can be used to store computer program instructions. The network communication unit can be an interface configured in accordance with the standards specified by the communication protocol for network connection communication.

[0205] In this embodiment, the functions and effects specifically implemented by the program instructions stored in the computer storage medium can be explained in comparison with other implementations and will not be repeated here.

[0206] An embodiment of this specification also provides a computer program product based on the above-mentioned front-end dependency security vulnerability processing method, including a non-transitory computer-readable storage medium storing a computer program / instruction, wherein the computer program / instruction is operable to cause the computer to perform the following steps: using first object data to convert and process the dependency information of multiple first target dependencies after parsing to obtain target dependency information of multiple first target dependencies; generating a security vulnerability query request based on the target dependency information, and receiving a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request; when it is determined that a security vulnerability identifier exists in the security vulnerability query result, using second object data to loop through the second target dependency that has the security vulnerability identifier to determine whether there is security vulnerability detailed information of the second target dependency; when it is determined that there is no security vulnerability detailed information of the second target dependency, generating a security vulnerability detailed information acquisition request based on the security vulnerability identifier of the second target dependency, and receiving the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information acquisition request; and feeding back the security vulnerability detailed information to the target user.

[0207] Although this specification provides the method operation steps as described in the embodiments or flow charts, more or fewer operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the device or client product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "comprise", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. Words such as first and second are used to represent names and do not represent any particular order.

[0208] Those skilled in the art will also appreciate that, in addition to implementing the controller in pure computer-readable program code, it is entirely possible to implement the same functionality by logically programming the method steps in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, embedded microcontrollers, and the like. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered structures within the hardware component. Alternatively, the devices for implementing various functions can be considered both software modules implementing the method and structures within the hardware component.

[0209] This specification may be described in the general context of computer-executable instructions, such as program modules, executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, classes, and the like that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including storage devices.

[0210] Through the description of the above embodiments, it can be seen that those skilled in the art can clearly understand that this specification can be implemented by means of software plus the necessary general hardware platform. Based on this understanding, the technical solution of this specification can essentially be embodied in the form of a software product. This computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in various embodiments or certain parts of the embodiments of this specification.

[0211] The various embodiments in this specification are described in a progressive manner. References to the common or similar parts of the various embodiments are sufficient. Each embodiment focuses on the differences from the other embodiments. This specification can be used in a variety of general-purpose or specialized computer system environments or configurations. For example, personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, and distributed computing environments that include any of the above systems or devices.

[0212] Although the present specification has been described with reference to the embodiments, persons skilled in the art will appreciate that there are many variations to the present specification without departing from the spirit of the present specification, and it is intended that the appended claims encompass such variations without departing from the spirit of the present specification.

Claims

1. A method for handling security vulnerabilities of front-end dependencies, characterized in that: include: Using the first object data, converting the parsed dependency information of the plurality of first target dependencies to obtain target dependency information of the plurality of first target dependencies; Generate a security vulnerability query request based on the target dependency information, and receive a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request; When it is determined that the security vulnerability identifier exists in the security vulnerability query result, using the second object data to loop through the second target dependency where the security vulnerability identifier exists, to determine whether there is security vulnerability detailed information of the second target dependency; When it is determined that the security vulnerability detailed information of the second target dependency does not exist, generating a security vulnerability detailed information obtaining request according to the security vulnerability identifier of the second target dependency, and receiving the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information obtaining request; Feedback the security vulnerability details to the target user.

2. The method according to claim 1, characterized in that The method further comprises: Call the first interface of the preset plug-in workspace to obtain the path information of the workspace; Calling a second interface for file reading to read all files in the workspace root directory corresponding to the path information; Search all files for a target dependency lock file, where the target dependency lock file contains dependency information of multiple installed front-end dependencies. When it is determined that the target dependency locking file exists, the preset parsing library is called to parse the dependency information of multiple front-end dependencies in the target dependency locking file to obtain the dependency information of the multiple front-end dependencies after parsing, wherein the multiple front-end dependencies after parsing include multiple first target dependencies.

3. The method according to claim 2, characterized in that The preset plug-in includes a VS Code plug-in, the target dependency locking file includes one of a package-lock.json file, a yarn.lock file, and a pnpm-lock.yaml file, the preset parsing library includes snyk-nodejs-lockfile-parser, the multiple front-end dependencies include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies, multiple development dependencies and indirect dependencies corresponding to multiple development dependencies, and the multiple first target dependencies include multiple production dependencies and indirect dependencies corresponding to multiple production dependencies.

4. The method according to claim 1, wherein The first object data stores dependency information in the form of key-value pairs; accordingly, the first object data is used to convert the parsed dependency information of the multiple first target dependencies to obtain target dependency information of the multiple first target dependencies, including: The first object data is used to recursively traverse the resolved dependency information of the multiple first target dependencies, and the dependency information of the multiple first target dependencies is converted into dependency information in the form of key-value pairs as the target dependency information.

5. The method according to claim 4, characterized in that The method further comprises: The target dependency information is stored in the first object data in a key-value pair format, where the first object data includes depsMap object data.

6. The method according to claim 1, characterized in that The target dependency information includes a target dependency name and a target dependency version. Accordingly, generating a security vulnerability query request based on the target dependency information includes: Obtaining a third interface of a first database, wherein the first database stores security vulnerabilities that a front-end depends on; The third interface, the target dependency name, and the target dependency version are concatenated to generate a security vulnerability query request corresponding to the target dependency information.

7. The method according to claim 1, characterized in that The looping through the second target dependency containing the security vulnerability identifier using the second object data to determine whether detailed information on the security vulnerability of the second target dependency exists includes: Looping through the second target dependency containing the security vulnerability identifier in the first object data using the second object data to determine whether detailed information on the security vulnerability of the second target dependency exists in the second object data; When it is determined that the security vulnerability details of the second target dependency exist, the security vulnerability details are written into the front-end root directory.

8. The method according to claim 1, characterized in that Generating a security vulnerability detailed information acquisition request according to the security vulnerability identifier of the second target dependency includes: Obtaining a fourth interface of a second database, wherein the second database stores detailed information on security vulnerabilities that the front-end depends on; The security vulnerability identifiers of the fourth interface and the second target dependency are concatenated to generate a request for obtaining detailed security vulnerability information.

9. The method according to claim 1, characterized in that The method further comprises: The obtained security vulnerability detailed information of the second target dependency is stored in the second object data, wherein the security vulnerability detailed information includes the second target dependency name, the second target dependency version, the security vulnerability identifier of the second target dependency, the security vulnerability brief description of the second target dependency and the security vulnerability detail information of the second target dependency.

10. The method according to claim 1, characterized in that Feedback of the detailed information of the security vulnerability to the target user includes: The preset write method is called to write the security vulnerability details of the second target dependency in the second object data into a preset configuration file in the front-end root directory, and the preset configuration file is used for the target user to view the security vulnerability details.

11. The method according to claim 10, characterized in that The preset writing method includes writeFileSync, and the preset configuration file includes a securityVulnerabilities.json file.

12. A front-end dependent security vulnerability processing device, characterized in that: include: a conversion module, configured to convert the parsed dependency information of the plurality of first target dependencies using the first object data to obtain target dependency information of the plurality of first target dependencies; A first acquisition module is configured to generate a security vulnerability query request based on the target dependency information and receive a security vulnerability query result corresponding to the target dependency information returned based on the security vulnerability query request; a loop traversal module, configured to, when determining that a security vulnerability identifier exists in the security vulnerability query result, loop traverse the second target dependency containing the security vulnerability identifier using the second object data to determine whether there is security vulnerability detailed information of the second target dependency; A second acquisition module is configured to, when it is determined that the security vulnerability detailed information of the second target dependency does not exist, generate a security vulnerability detailed information acquisition request according to the security vulnerability identifier of the second target dependency, and receive the security vulnerability detailed information of the second target dependency returned based on the security vulnerability detailed information acquisition request; The feedback module is used to feed back the detailed information of the security vulnerability to the target user.

13. A computer device comprising a memory, a processor, and a computer program / instruction stored in the memory, characterized in that: The processor executes the computer program / instructions to implement the steps of the method according to any one of claims 1 to 11.

14. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

15. A computer program product comprising a computer program / instructions, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images