A low-code platform JavaScript code sandbox environment monitoring method and system

Abstract

The present invention relates to a low-code platform JavaScript code sandbox environment monitoring method and system, which ensures that JavaScript program code is safely executed in the sandbox without generating dangerous program behavior by defining access control inside the sandbox, automatically generating sandbox monitoring code, and detecting the sandbox internal code in real time.

Description

Technical Field

[0001] The present invention relates to the field of low-code platforms, and in particular to a method and system for monitoring a JavaScript code sandbox environment on a low-code platform. Background Art

[0002] With the development of computer technology, the service functions provided by low-code generated Web front-end pages are becoming more and more diverse. In the front-end pages generated by low-code, in some customized business scenarios, users are required to upload some JavaScript codes for secondary development to implement customized scenarios. Since these codes come from external users, their quality is difficult to guarantee and may contain malicious code, vulnerabilities, and unverified logic, thus posing a threat to the low-code system itself. JavaScript, as a dynamic type, interpreted and executed scripting language, has high flexibility, but it is also vulnerable to various security vulnerabilities and attack methods. For example, cross-site scripting attacks (XSS) and code injection attacks can use certain features of JavaScript to execute malicious code. Therefore, the operation of these codes needs to undergo strict security review and filtering to prevent these attack methods from being exploited. Summary of the invention

[0003] In order to solve the above problems, the purpose of the present invention is to provide a low-code platform JavaScript code sandbox environment monitoring method and system, which ensures that JavaScript program code is safely executed inside the sandbox without generating dangerous program behavior by defining access control inside the sandbox, automatically generating sandbox monitoring code, and detecting the internal code of the sandbox in real time.

[0004] To achieve the above object, the present invention adopts the following technical solutions:

[0005] A method for monitoring a JavaScript code sandbox environment on a low-code platform, comprising the following steps:

[0006] Step 1: Define the path string array that needs to be restricted and monitored;

[0007] Step 2: Obtain the JavaScript code block content generated by the user through the JavaScript code editor;

[0008] Step 3: Use the with statement to extend the scope chain of the user-defined code block to the parameter variables of the custom code block;

[0009] Step 4: In the code execution event, convert the user-defined code block into an executable function object, that is, create an executable function of the custom code block through the Function constructor. If an exception is captured during the creation process, it means that if there is a syntax exception or a logic exception in the custom code block, the program will exit directly, otherwise continue to the next step;

[0010] Step 5: Create a Proxy object to proxy the function's parameters and record that the current path is empty. The path will be updated in real time during the monitoring and identification process. The path format is consistent with the restricted access path array item format defined in step 1, expressed in dot syntax. If the current path is empty, it is an empty string path.

[0011] Step 6: Create a proxy object Handler;

[0012] Step 7: Add the has method of Handler. The key of the has method indicates the target attribute key that needs to be checked for existence. Concatenate the attribute key and the current record path in dot syntax to check whether the concatenated path is included in any restricted access path.

[0013] If it is included, a Boolean value of true is returned, indicating that the restricted access path is hit, so as to trigger the get method of the subsequent handler and continue to step 8. If it is not included, the restricted access is not hit, so it is only necessary to determine whether the current target object contains the target attribute key, return the result, and exit the current monitoring program;

[0014] Step 8: Add the get method of Handler. The key of the get method indicates the target attribute key that needs to be obtained. Concatenate the attribute key and the current record path in dot syntax. Check whether the concatenated path is included in any restricted access path. If not, directly obtain the attribute value in the returned target object. Otherwise, execute step 9.

[0015] Step 9: If the concatenated path is included and is not completely equal to the restricted access path, obtain the target object attribute value to determine whether the attribute value is an object value; if it is not an object value, it means that there is an error in the restricted access path definition, and directly return the attribute value; if it is an object value, create a Proxy object for the value, and update the new path after the current concatenation key as the current path, and return to step 6 to continue execution;

[0016] Step 10: If the concatenated path is completely equal to the restricted access path, the restricted access path is hit. If the current path is not allowed to be accessed, a null value is directly returned, prohibiting the user from accessing the current resource attributes. The information reporting HTTP interface is called to report the current restricted access complete path and the current user information as violation information.

[0017] Furthermore, the path string array in step 1 includes paths of objects, variables, and functions that the code is not allowed to access.

[0018] Furthermore, the formal parameter variable customizes and intercepts the search and read operations of its attributes through the Proxy proxy object, thereby realizing the reading monitoring of its attributes.

[0019] Furthermore, Handler implements basic operations to modify objects, allowing interception and custom processing of various operations on proxy objects, using the has method to intercept and check whether an object has a certain attribute, using the get method to intercept the reading operation of object attributes, and using the apply method to intercept function calls.

[0020] A JavaScript code sandbox environment management system based on a low-code platform includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically executes the steps in the low-code platform JavaScript code sandbox environment monitoring method as described above.

[0021] The present invention has the following beneficial effects:

[0022] The present invention ensures that JavaScript program codes are safely executed in the sandbox without generating dangerous program behaviors by defining access control inside the sandbox, automatically generating sandbox monitoring codes, and detecting the sandbox internal codes in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0024] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0025] refer to Figure 1 In this embodiment, a low-code platform JavaScript code sandbox environment monitoring method is provided, characterized in that it includes the following steps:

[0026] Step 1: Define the path string array that needs to be restricted and monitored;

[0027] Step 2: Obtain the JavaScript code block content generated by the user through the JavaScript code editor;

[0028] Step 3: Use the with statement to extend the scope chain of the user-defined code block to the parameter variables of the custom code block;

[0029] Step 4: In the code execution event, convert the user-defined code block into an executable function object, that is, create an executable function of the custom code block through the Function constructor. If an exception is captured during the creation process, it means that if there is a syntax exception or a logic exception in the custom code block, the program will exit directly, otherwise continue to the next step;

[0030] Step 5: Create a Proxy object to proxy the function's parameters and record that the current path is empty. The path will be updated in real time during the monitoring and identification process. The path format is consistent with the restricted access path array item format defined in step 1, expressed in dot syntax. If the current path is empty, it is an empty string path.

[0031] Step 6: Create a proxy object Handler;

[0032] Step 7: Add the has method of Handler. The key of the has method indicates the target attribute key that needs to be checked for existence. The attribute key and the current record path are concatenated in dot syntax to find out whether the concatenated path is included in any restricted access path (i.e., a subpath of any path or an equal path). If it is included, a Boolean value of true is returned, indicating that the restricted access path is hit, so as to trigger the get method of the subsequent handler and continue to step 8. If it is not included, the restricted access is not hit. Then, it is only necessary to determine whether the current target object contains the target attribute key, return the result, and exit the current monitoring program.

[0033] Step 8: Add the get method of Handler. The key of the get method indicates the target attribute key that needs to be obtained. Concatenate the attribute key and the current record path in dot syntax. Check whether the concatenated path is included in any restricted access path. If not, directly obtain the attribute value in the returned target object. Otherwise, execute step 9.

[0034] Step 9: If the concatenated path is included and is not completely equal to the restricted access path, obtain the target object attribute value to determine whether the attribute value is an object value; if it is not an object value, it means that there is an error in the restricted access path definition, and directly return the attribute value; if it is an object value, create a Proxy object for the value, and update the new path after the current concatenation key as the current path, and return to step 6 to continue execution;

[0035] Step 10: If the concatenated path is completely equal to the restricted access path, the restricted access path is hit. If the current path is not allowed to be accessed, a null value (undefined) is directly returned, prohibiting the user from accessing the current resource attributes. The information reporting HTTP interface is called to report the current restricted access complete path and the current user information as violation information.

[0036] In this embodiment, the path string array in step 1 includes the paths of objects, variables, and functions that are not allowed to be accessed by the code. The path is expressed in dot syntax, for example: ["window.alert", "window.fetch"], which means that the alert method under the window object is prohibited from popping up a dialog box and the fetch request method is prohibited from initiating an HTTP request. The length of the path array is not limited and can be 1 or more.

[0037] In this embodiment, the formal parameter variable customizes and intercepts the search and read operations of its attributes through the Proxy proxy object, thereby realizing the reading monitoring of its attributes.

[0038] In this embodiment, Handler implements the basic operation of modifying objects, allows interception and custom processing of various operations on proxy objects, uses the has method to intercept and check whether an object has a certain attribute, uses the get method to intercept the reading operation of object attributes, and uses the apply method to intercept function calls.

[0039] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0040] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0041] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0042] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0043] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A low-code platform JavaScript code sandbox environment monitoring method, characterized in that: The following steps are involved: Step 1: Define the string array of the path to which access needs to be restricted; Step 2: Obtain the JavaScript code block content generated by the user through the JavaScript code editor, that is, the user-defined code block; Step 3: Use the with statement to extend the scope chain of the user-defined code block to the parameter variables of the custom code block of the low-code platform; Step 4: In the code execution event, convert the user-defined code block into an executable function, that is, create an executable function of the user-defined code block through the Function constructor. If an exception is captured during the creation process, it means that there is a syntax exception or a logic exception in the user-defined code block, then the program will exit directly, otherwise continue to the next step; Step 5: Create a Proxy object to proxy the parameters of the executable function and record that the current path is empty. The path will be updated in real time during the monitoring and identification process. The path format is consistent with the restricted access path format defined in step 1, expressed in dot syntax. The current path is empty, that is, an empty string path; Step 6: Create a proxy object Handler; Step 7: Add the has method of Handler. The key of the has method indicates the target attribute key that needs to be checked for existence. Concatenate the attribute key and the current path in dot syntax to find out whether the concatenated path is included in any restricted access path. If it is included, a Boolean value of true is returned, indicating that the restricted access path is hit, so as to trigger the subsequent Handler get method and continue to step 8. If it is not included, the restricted access path is not hit, so it is only necessary to determine whether the current target object contains the target attribute key, return the result, and exit the current monitoring program; Step 8: Add the get method of Handler. The key of the get method indicates the target attribute key that needs to be obtained. Concatenate the attribute key and the current path in dot syntax. Check whether the concatenated path is included in any restricted access path. If not, directly obtain and return the attribute value in the current target object. Otherwise, execute step 9. Step 9: If the concatenated path is included and is not completely equal to the restricted access path, obtain the current target object attribute value to determine whether the attribute value is an object value; if it is not an object value, it means that there is an error in the restricted access path definition, and directly return the attribute value; If it is an object value, create a Proxy object for the value, and update the new path after the current key is concatenated to the current path, and return to step 6 to continue execution; Step 10: If the concatenated path is completely equal to the restricted access path, the restricted access path is hit. If the current path is not allowed to be accessed, a null value is directly returned, prohibiting the user from accessing the current resource attributes. The information reporting HTTP interface is called to report the current path and current user information as violation information.

2. According to a low-code platform JavaScript code sandbox environment monitoring method according to claim 1, it is characterized in that: The path string array in step 1 includes objects, variables, and function paths that are not allowed to be accessed by the code.

3. A low-code platform JavaScript code sandbox environment monitoring method according to claim 1, characterized in that: The formal parameter variable customizes and intercepts the search and read operations of its attributes through the Proxy proxy object, thereby realizing the reading monitoring of its attributes.

4. A low-code platform JavaScript code sandbox environment monitoring method according to claim 1, characterized in that: The Handler implements the basic operation of modifying objects, allows interception and custom processing of proxy object operations, uses the has method to intercept and check whether an object has a certain attribute, uses the get method to intercept the reading operation of object attributes, and uses the apply method to intercept function calls.

5. A JavaScript code sandbox environment management system based on a low-code platform, characterized in that: It includes a processor, a memory and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in a low-code platform JavaScript code sandbox environment monitoring method as described in any one of claims 1-4.

Images