Source code static analysis method and device, equipment and storage medium

Abstract

The invention discloses a source code static analysis method and device, equipment and a storage medium, and relates to the technical field of code analysis, the method comprises the following steps: dynamically loading a dynamic link library file based on a preset data reading framework; analyzing the dynamic link library file to extract metadata in the dynamic link library file; performing format conversion processing on the metadata to obtain target library metadata; constructing an abstract syntax tree based on the target library metadata and the source code through a preset static code analysis tool; and generating a source code analysis result corresponding to the source code based on the abstract syntax tree. By means of the technical scheme, the technical problem that in the prior art, a static code analysis tool depends on a specific DLL structure of a Windows platform, and cross-platform static code analysis cannot be achieved is solved.

Description

Technical Field

[0001] The present application relates to the technical field of code analysis, and in particular to a source code static analysis method, apparatus, device and storage medium. Background Art

[0002] The C# programming language is a high-level programming language that runs on the .NET Framework and .NET Core (completely open source and cross-platform). In early versions of C# and .NET Framework, they were mainly limited to running on the Windows platform and relied on the API (Application Programming Interface) and DLL (Dynamic Link Library) structures that are unique to the Windows platform. Currently, most source code static code analysis tools on the market are mainly for the Windows platform, and cannot directly load DLL files on other platforms (such as the Linux platform), making it impossible to implement cross-platform static code analysis.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide a source code static analysis method, device, equipment and storage medium, aiming to solve the technical problem that static code analysis tools in the prior art rely on the DLL structure unique to the Windows platform and cannot implement cross-platform static code analysis.

[0005] To achieve the above objectives, the present application proposes a source code static analysis method, the method comprising: Dynamically load dynamic link library files based on a preset data reading framework; Parsing the dynamic link library file to extract metadata in the dynamic link library file; Performing format conversion processing on the metadata to obtain target library metadata; Building an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool; A source code analysis result corresponding to the source code is generated based on the abstract syntax tree.

[0006] In one embodiment, the step of parsing the dynamic link library file to extract metadata in the dynamic link library file includes: Parsing the dynamic link library file to obtain an assembly corresponding to the dynamic link library file; Obtain basic type information corresponding to all types in the assembly, the types including: classes and interfaces; Determine the method information, attribute information and member variable information corresponding to each type according to the basic information of the type; The metadata in the dynamic link library file is determined based on the method information, the attribute information and the member variable information.

[0007] In one embodiment, the step of performing format conversion processing on the metadata to obtain the target library metadata includes: Performing format conversion processing on the metadata based on a preset data structure and a standard data format to generate a namespace information array, a type information array, a method information array, and a field information array; Building target library metadata based on the namespace information array, the type information array, the method information array, and the field information array; Among them, the preset data structure is a type information set organized in a namespace, the elements in the namespace information array are string representations corresponding to the namespace, the elements in the type information array are used to represent type information, the elements in the method information array are used to represent method information, and the elements in the field information array are used to represent field information.

[0008] In one embodiment, before the step of constructing an abstract syntax tree based on the target library metadata and source code by a preset static code analysis tool, the method further includes: Real-time detection of whether the target library metadata meets the user project requirements; If not, the metadata of the library to be added is determined based on the user's project requirements; Updating the target library metadata based on the to-be-added library metadata; The step of constructing an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool includes: An abstract syntax tree is constructed based on the updated target library metadata and source code using a preset static code analysis tool.

[0009] In one embodiment, the step of constructing an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool includes: Extracting key code information in the source code based on the target library metadata and the source code by using a preset static code analysis tool; Converting the code key information into a code intermediate representation, where the code intermediate representation is an intermediate representation identified by a code attribute graph; The nodes and edges corresponding to the code attribute graph are determined according to the code intermediate representation, so as to construct an abstract syntax tree based on the nodes and the edges.

[0010] In one embodiment, the step of generating a source code analysis result corresponding to the source code based on the abstract syntax tree includes: Parsing the abstract syntax tree to determine code attribute graph node information in the abstract syntax tree; Generate a target graph structure based on the code attribute graph node information, the target graph structure including: a control flow graph, a data dependency graph and a program dependency graph; A source code analysis result corresponding to the source code is generated by a security scanning engine based on the target graph structure and preset security rules.

[0011] In one embodiment, the method further comprises: Define type storage class, method storage class and field storage class; Among them, the type storage class is used to store the full name, method and field of the type in the metadata information, the method storage class is used to store the name, return value and parameter list of the method in the metadata information, and the field storage class is used to store the field name and type related information in the metadata information.

[0012] In addition, to achieve the above purpose, the present application also proposes a source code static analysis device, the device comprising: A file loading module, used to dynamically load dynamic link library files based on a preset data reading framework; A file parsing module, used for parsing the dynamic link library file to extract metadata in the dynamic link library file; A format conversion module, used to perform format conversion processing on the metadata to obtain target library metadata; A syntax tree construction module, used for constructing an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool; A source code analysis module is used to generate a source code analysis result corresponding to the source code based on the abstract syntax tree.

[0013] In addition, to achieve the above-mentioned purpose, the present application also proposes a source code static analysis device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the source code static analysis method described above.

[0014] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the source code static analysis method described above are implemented.

[0015] The present application provides a source code static analysis method, which discloses dynamically loading a dynamic link library file based on a preset data reading framework; parsing the dynamic link library file to extract metadata in the dynamic link library file; performing format conversion processing on the metadata to obtain target library metadata; constructing an abstract syntax tree based on the target library metadata and source code through a preset static code analysis tool; generating source code analysis results corresponding to the source code based on the abstract syntax tree; compared with the prior art, the source code static code analysis tool is mainly oriented to the Windows platform, and the DLL file cannot be directly loaded on other platforms, resulting in the inability to implement cross-platform static code analysis. Since the present invention can extract and perform format conversion on the metadata in the dynamic link library file to obtain the target library metadata, and construct an abstract syntax tree based on the target library metadata and source code, so as to perform code analysis through the abstract syntax tree, the technical problem that the static code analysis tool in the prior art relies on the DLL structure unique to the Windows platform and cannot implement cross-platform static code analysis is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0018] Figure 1 A schematic diagram of a flow chart provided for the first embodiment of the source code static analysis method of the present application; Figure 2 A flowchart of source code security vulnerability scanning in the source code static analysis method of this application; Figure 3 A schematic diagram of a flow chart provided for Example 2 of the source code static analysis method of the present application; Figure 4 This is an example diagram of metadata in the source code static analysis method of this application; Figure 5 A schematic diagram of a flow chart provided for Example 3 of the source code static analysis method of the present application; Figure 6This is an example diagram of class definition in the source code static analysis method of this application; Figure 7 This is an example diagram of the JSON file newly added in the source code static analysis method of this application; Figure 8 This is a schematic diagram of the module structure of the source code static analysis device according to an embodiment of the present application; Fig. 9 Schematic diagram of the device structure of the hardware operating environment involved in the source code static analysis method in the embodiment of the present application.

[0019] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0020] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0021] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0022] The main solution of the embodiment of the present application is: dynamically load the dynamic link library file based on a preset data reading framework; parse the dynamic link library file to extract metadata in the dynamic link library file; perform format conversion processing on the metadata to obtain target library metadata; build an abstract syntax tree based on the target library metadata and source code through a preset static code analysis tool; and generate source code analysis results corresponding to the source code based on the abstract syntax tree.

[0023] Since the source code static code analysis tools in the prior art are mainly oriented to the Windows platform, and DLL files cannot be directly loaded on other platforms (such as the Linux platform), cross-platform static code analysis cannot be implemented.

[0024] The present application provides a solution that can extract and convert the metadata in a dynamic link library file to obtain the target library metadata, and build an abstract syntax tree based on the target library metadata and source code to perform code analysis through the abstract syntax tree, thereby solving the technical problem that static code analysis tools in the prior art rely on the DLL structure unique to the Windows platform and cannot implement cross-platform static code analysis.

[0025] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a source code static analysis device, etc. The following takes a source code static analysis device as an example (hereinafter referred to as the device) to illustrate this embodiment and the following embodiments.

[0026] Based on this, the present application embodiment provides a source code static analysis method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the source code static analysis method of the present application.

[0027] In this embodiment, the source code static analysis method includes steps S10 to S50: Step S10: dynamically loading the dynamic link library file based on a preset data reading framework.

[0028] It should be noted that the above-mentioned preset data reading framework can be a framework for reading, writing and editing .NET assemblies. The preset data reading framework in this embodiment may include but is not limited to the Mono.Cecil framework, wherein Mono.Cecil can easily load existing .NET assemblies and check the types, methods, fields and other information contained therein, so that developers can dynamically analyze and operate the contents of the assembly at runtime.

[0029] It should be understood that the above-mentioned dynamic link library file may be an executable file containing codes and data, which is used to support multiple programs to use the same function or resource at the same time in the Windows operating system, namely, a DLL (Dynamic Link Library) file.

[0030] In this embodiment, the Mono.Cecil framework can be used to load and parse DLL files. Mono.Cecil is a powerful library that allows us to directly access and manipulate the metadata of .NET assemblies without loading the assemblies into the runtime environment. Specifically, this solution can load DLL files through the AssemblyDefinition.ReadAssembly method of Mono.Cecil, where the main function of the AssemblyDefinition.ReadAssembly method is to read a .NET assembly file with a specified path and return an AssemblyDefinition object, which contains all the metadata of the assembly, such as type definition, method definition, field definition, etc. Developers can use this object to browse and modify the contents of the assembly.

[0031] Step S20: parsing the dynamic link library file to extract metadata in the dynamic link library file.

[0032] It is understandable that the above metadata is metadata of the third-party library, for example, key metadata such as classes, interfaces, methods, properties, member variables, etc. in the third-party library, which is not limited in this embodiment.

[0033] Step S30: performing format conversion processing on the metadata to obtain target library metadata.

[0034] It should be noted that the above-mentioned target library metadata can be standardized metadata. In practical applications, this solution makes the library metadata easy to share, parse and use in different operating systems and environments by extracting the standardized metadata of the third-party library. Specifically, in this embodiment, the metadata can be format converted to convert the metadata into the target library metadata in JSON format, wherein the JSON representation is used as a lightweight carrier of the library metadata, which greatly facilitates the sharing, parsing and utilization in different operating systems and development environments.

[0035] In actual applications, when dealing with early .NET Framework applications, since these applications mainly run on the Windows platform and the class libraries exist in the form of DLLs, these DLL files cannot be directly loaded in the Linux environment, thus limiting the static code analysis capabilities. Therefore, this solution can use the Roslyn compiler platform as a parsing tool for C# language source code, where Roslyn not only supports comprehensive parsing of the C# language, but also has the ability to run across platforms, ensuring effective execution in multiple operating system environments such as Windows, Linux, and macOS.

[0036] Step S40: constructing an abstract syntax tree based on the target library metadata and source code using a preset static code analysis tool.

[0037] It should be understood that the above-mentioned preset static code analysis tool can be a tool for analyzing the code without executing the program. In this embodiment, the code language corresponding to the source code and the parsing tool corresponding to the language can be determined first. For example, for C#, Roslyn can be called, and the parsing tool can be used to parse the source code to generate code abstract syntax tree information, and after obtaining AST, the intermediate representation of code property graph recognition can be generated in combination with metadata.

[0038] In practical applications, this solution can perform static code analysis based on the Abstract Syntax Tree (AST) technology. However, in the static code analysis process based on the AST technology, if the target source code lacks the code or metadata information of the third-party libraries it depends on, it may not be able to fully reflect the key elements such as the namespace and type of these external libraries, resulting in a high false positive rate due to the lack of necessary context information when identifying key functions in the source code and checking dependencies. Therefore, before the static code analysis of the C# source code begins, the static analysis tool will scan and load all relevant metadata, which will then be deeply integrated into the AST construction process to ensure that the AST not only contains the structural information of the source code, but also covers the detailed context of all dependent libraries and their members, so that the static code analysis tool can more accurately identify key functions and check dependencies, significantly improving the accuracy of the analysis. This comprehensive information integration strategy significantly improves the accuracy of code analysis and effectively reduces false positives caused by incomplete or missing dependency information.

[0039] Step S50: generating a source code analysis result corresponding to the source code based on the abstract syntax tree.

[0040] In the specific implementation, refer to Figure 2 , Figure 2 This is a flow chart of source code security vulnerability scanning in the source code static analysis method of this application. Figure 2 As shown, in this solution, a DDL parsing module can be set up, and the dynamic link library file can be dynamically loaded through the DDL parsing module, the metadata therein can be parsed and extracted, and the information can be structured into a unified and standardized JSON format target library metadata for storage, transmission and subsequent processing, wherein the metadata includes but is not limited to class definitions, interface declarations, method signatures, property descriptions, and member variables. Then, a static code security vulnerability scanning engine (i.e., the above-mentioned preset static code analysis tool) can be used to accurately parse the C# source code, and through advanced static analysis technology, potential code security vulnerabilities can be deeply detected and identified, and the scanning results can be finally output in a clear and detailed form to provide developers with timely security feedback and repair guidance. After the scanning engine successfully converts the source code into an abstract syntax tree (AST) specific to the engine, it will further use this AST information to construct a variety of graph structures required for the analysis phase, including but not limited to control flow graphs (CFGs), data dependency graphs (DDGs), and program dependency graphs (PDGs). Finally, the scanning engine will conduct in-depth and detailed analysis according to the preset security rules and patterns and output detailed scanning results.

[0041] The present embodiment provides a source code static analysis method, which discloses dynamically loading a dynamic link library file based on a preset data reading framework; parsing the dynamic link library file to extract metadata in the dynamic link library file; performing format conversion processing on the metadata to obtain target library metadata; constructing an abstract syntax tree based on the target library metadata and source code through a preset static code analysis tool; generating source code analysis results corresponding to the source code based on the abstract syntax tree; compared with the prior art, the source code static code analysis tool is mainly oriented to the Windows platform, and cannot directly load DLL files on other platforms, resulting in the inability to implement cross-platform static code analysis. Since the present embodiment can extract and perform format conversion on the metadata in the dynamic link library file to obtain the target library metadata, and construct an abstract syntax tree based on the target library metadata and source code, so as to perform code analysis through the abstract syntax tree, the technical problem that the static code analysis tool in the prior art relies on the DLL structure unique to the Windows platform and cannot implement cross-platform static code analysis is solved.

[0042] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 3 , Figure 3 A flow chart of the second embodiment of the source code static analysis method of the present application is provided.

[0043] In this embodiment, step S20 includes steps S201 to S204: Step S201: parsing the dynamic link library file to obtain an assembly corresponding to the dynamic link library file.

[0044] It should be understood that the above assembly may be a file compiled and generated by a compiler.

[0045] Step S202: Obtain basic type information corresponding to all types in the assembly, the types including: classes and interfaces.

[0046] It should be noted that the above type basic information may be basic information of all types in the assembly, wherein the types in the assembly include: classes and interfaces. In this embodiment, basic information such as the names of classes and interfaces, whether they are classes or interfaces, etc. may be extracted from the assembly to form the above type basic information.

[0047] Step S203: Determine the method information, attribute information and member variable information corresponding to each type according to the type basic information.

[0048] It should be noted that the above-mentioned method information can be the method name, return type, parameter list, generic parameters and other information corresponding to each type; the above-mentioned attribute information can be the attribute name, attribute type and whether it is readable and writable and other information corresponding to each type; the above-mentioned member variable information can be the variable name, variable type and whether it is static and other information corresponding to each type.

[0049] Step S204: determining metadata in the dynamic link library file based on the method information, the attribute information and the member variable information.

[0050] In this embodiment, after the method information, property information and member variable information corresponding to each type are determined, metadata in the dynamic link library file can be constructed based on the method information, property information and member variable information.

[0051] Further, the step S30 includes: performing format conversion processing on the metadata based on a preset data structure and a standard data format to generate a namespace information array, a type information array, a method information array and a field information array; constructing the target library metadata based on the namespace information array, the type information array, the method information array and the field information array; wherein the preset data structure is a type information set with the namespace as the organizational unit, the elements in the namespace information array are the string representations corresponding to the namespace, the elements in the type information array are used to represent the type information, the elements in the method information array are used to represent the method information, and the elements in the field information array are used to represent the field information.

[0052] It should be noted that the data structure of metadata is a collection of type information organized by namespace. Each namespace contains detailed information of multiple types, including: namespace information array, type information array, method information array and field information array. This information is represented in the form of JSON objects and follows certain rules and formats.

[0053] The namespace information array is an array composed of namespace information. The namespace information belongs to the outermost JSON object. The key of the outermost JSON object is a string representing a specific namespace, and its value is an array. Each element in the array represents the type information under the namespace. The type information array is an array composed of type information. In actual applications, refer to Figure 4 , Figure 4 This is an example diagram of metadata in the source code static analysis method of this application. Figure 4As shown, the value corresponding to each namespace is an array containing multiple type information. Each element in the array is an object, representing a specific type. Each type information object contains a name attribute, which represents the full name of the type (including namespace and type name). In addition, each type information object may also contain other attributes, such as "methods" and "fields", which represent the method and field information of the type respectively. The method information array is an array composed of method information. The content of the array may be empty. If there is content, each element in the array is an object, representing a specific method. Each method information object has 4 attributes, name (name), returnType (return value type), parameterTypes (parameter type list), isStatic (whether it is a static method). The field information array is an array composed of field information. The content of the array may be empty. If there is content, each element in the array is an object, representing a specific field. Each field information object has 2 attributes, name (name), fieldType (field type), isStatic (whether it is a static method).

[0054] Furthermore, the method also includes: defining a type storage class, a method storage class and a field storage class; wherein the type storage class is used to store the full name, method and field of the type in the metadata information, the method storage class is used to store the name, return value and parameter list of the method in the metadata information, and the field storage class is used to store the field name and type-related information in the metadata information.

[0055] In this embodiment, the core implementation steps of the DLL parsing module include: defining basic classes, parsing DDL files and serializing data, wherein the basic classes are defined to store metadata information, including: type storage class (TypeInfoDto), method storage class (MethodInfoDto) and field storage class (FieldInfoDto), wherein TypeInfoDto is used to store the full name, method, field and other information of the type; MethodInfoDto is used to store the name, return value, parameter list and other information of the method; FieldInfoDto is used to store the name of the field and type related information. Parsing the DDL file is to load the target DLL file through the AssemblyDefinition.ReadAssembly method of Mono.Cecil and obtain its assembly definition, and then the information related to all classes in the assembly, including type name, method and field related information, can be filled into the above defined data structure by traversing. Serializing the data is to use the JsonConvert.SerializeObject method (from the Newtonsoft.Json library) to serialize the above data into a JSON string, and output the serialized JSON string to the specified file.

[0056] In this embodiment, it is disclosed to parse a dynamic link library file to obtain an assembly corresponding to the dynamic link library file; obtain basic type information corresponding to all types in the assembly, the types including: class and interface; determine method information, attribute information and member variable information corresponding to each type according to the basic type information; determine metadata in the dynamic link library file based on the method information, attribute information and member variable information, so that all relevant metadata can be subsequently integrated into the construction process of the abstract syntax tree, thereby improving the integrity of the abstract syntax tree, and enabling static code analysis tools to more accurately identify key functions, check dependencies, and improve the accuracy of code static analysis.

[0057] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 5 , Figure 5 A flowchart of the third embodiment of the source code static analysis method of the present application is provided.

[0058] In this embodiment, before step S40, the method further includes steps S041 to S043: Step S041: Real-time detection of whether the target library metadata meets the user project requirements.

[0059] It can be understood that the above-mentioned user project requirements may be user requirements for specific projects, such as data query requirements, data modification requirements, etc., and this embodiment does not limit this.

[0060] Step S042: If not, determine the library metadata to be added based on the user project requirements.

[0061] It should be noted that when the above target library metadata cannot meet the user's specific needs, the user can add or modify the library metadata in JSON format according to the established rules, so that the user can adjust the metadata according to the actual needs of the project without relying on the update or modification of the third-party library.

[0062] Step S043: updating the target library metadata based on the to-be-added library metadata.

[0063] In this embodiment, in order to meet the user's flexible response to specific project needs, when the preset metadata library is not sufficient to cover the specific needs of the user's project, the user can add or modify metadata by editing the configuration file in JSON format according to predefined rules (such as the format and rules defined by the data structure of the metadata), so that the user can adjust the analysis environment according to the actual situation of the project without waiting for or relying on the update of the third-party library. For example, when a customer uses an internal library, the library is mainly based on the SqlSugar framework encapsulation to simplify database operations, in which the SqlSugarHelper class implements common query and modification operations, and these methods are often the focus of analysis in SQL injection scenarios. Since it is introduced in the form of DLL, there is no source code, so the user needs to add the metadata information corresponding to the library or the class (SqlSugarHelper) by himself, so as to more accurately identify related methods in the subsequent analysis process.

[0064] In the specific implementation, refer to Figure 6 and Figure 7 ,in, Figure 6 This is an example diagram of class definition in the source code static analysis method of this application; Figure 7 This is an example diagram of the JSON file added in the source code static analysis method of this application. Assume that the class definition of SqlSugarHelper is as follows Figure 6 As shown, if the user needs to add a DBUtilit.json file, based on the format and rules defined by the metadata data structure, add the information corresponding to the class to the file and put it in the location specified by the scanning engine. The content of the newly added json file is shown in 7.

[0065] Accordingly, the step S40 includes: Step S40 ′: construct an abstract syntax tree based on the updated target library metadata and source code using a preset static code analysis tool.

[0066] In practical applications, such as Figure 2 As shown, the user can add a custom library to the target library metadata to update the target library elements, and then use a preset static code analysis tool to build an abstract syntax tree based on the updated target library metadata and source code.

[0067] Furthermore, the step S40 further includes: Step S401: extracting key code information in the source code based on the target library metadata and the source code using a preset static code analysis tool.

[0068] It should be noted that the key code information refers to the information in the source code that can be used for security analysis, such as classes, methods, variables, control flow, data flow, etc., and this embodiment does not limit this.

[0069] Step S402: converting the code key information into a code intermediate representation, where the code intermediate representation is an intermediate representation identified by a code attribute graph.

[0070] It should be noted that the above-mentioned code intermediate representation can be a language-independent code representation recognized by a code attribute graph.

[0071] Step S403: determining nodes and edges corresponding to the code attribute graph according to the code intermediate representation, so as to construct an abstract syntax tree based on the nodes and the edges.

[0072] In the specific implementation, the code scanning engine in this embodiment adopts the technology based on code property graph (CPG) for code scanning, wherein the code property graph is a graph-based code representation method, which integrates multiple concepts such as abstract syntax tree, control flow graph (CFG) or evaluation sequence graph (EOG), data flow graph (DFG) or control dependency graph (CDG) into a unified super graph. Among them, when scanning the source code, a suitable parser can be selected and integrated according to the language corresponding to the source code. When selecting a parser, it is necessary to focus on cross-platform features. For example, for C# language, Roslyn parser can be selected to ensure that C# code can be accurately parsed and understood on mainstream platforms and C# related AST can be generated. The code parser is used to parse the specified code, extract necessary information such as classes, methods, variables, control flow, data flow, etc., and then convert this information into an intermediate representation recognized by CPG (i.e., language-independent code representation), forming the nodes and edges of CPG, and then constructing an abstract syntax tree based on the nodes and edges of CPG. In this embodiment, CPG is a comprehensive theoretical framework, in which the intermediate representation is a method for integrating and presenting multi-dimensional information of the code within the CPG framework, such as abstract syntax, control flow, data flow, etc.

[0073] Furthermore, the step S50 includes: parsing the abstract syntax tree to determine the code attribute graph node information in the abstract syntax tree; generating a target graph structure based on the code attribute graph node information, the target graph structure including: a control flow graph, a data dependency graph and a program dependency graph; and generating a source code analysis result corresponding to the source code based on the target graph structure and preset security rules through a security scanning engine.

[0074] It should be understood that the above code property graph node information can be node information in the code property graph, such as node type. For example, if there is a literal variable in C#, Roslyn parses it and determines that its corresponding node type is StringLiteralExpression. In CPG, the corresponding type is LITERAL. It is necessary to extract the relevant information in StringLiteralExpression according to the definition of LITERAL in CPG.

[0075] It is understandable that the above-mentioned preset security rules may be security rules pre-set in the scanning engine.

[0076] In actual applications, after the scanning engine converts the source code into an abstract syntax tree specific to the engine based on the target library metadata, it can further use the abstract syntax tree to build a variety of graph structures required for the analysis phase, including but not limited to the control flow graph (CFG), data dependency graph (DDG) and program dependency graph (PDG). Then, the scanning engine can perform in-depth and detailed analysis based on the preset security rules and patterns and output detailed scanning results.

[0077] In this embodiment, real-time detection of whether the target library metadata meets the user project requirements is disclosed; if not, the library metadata to be added is determined based on the user project requirements; the target library metadata is updated based on the library metadata to be added; an abstract syntax tree is constructed based on the updated target library metadata and source code through a preset static code analysis tool, so that when the metadata cannot meet the user's specific needs, the library metadata in JSON format can be added or modified according to established rules without relying on the update or modification of a third-party library, thereby improving the flexibility of code analysis.

[0078] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the source code static analysis method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0079] This application also provides a source code static analysis device, please refer to Figure 8 , the source code static analysis device comprises: A file loading module 10, used for dynamically loading a dynamic link library file based on a preset data reading framework; A file parsing module 20, used for parsing the dynamic link library file to extract metadata in the dynamic link library file; The format conversion module 30 is used to perform format conversion processing on the metadata to obtain target library metadata; A syntax tree construction module 40, configured to construct an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool; The source code analysis module 50 is used to generate a source code analysis result corresponding to the source code based on the abstract syntax tree.

[0080] The source code static analysis device provided by the present application adopts the source code static analysis method in the above embodiment, which can solve the technical problem that the static code analysis tools in the prior art rely on the DLL structure unique to the Windows platform and cannot implement cross-platform static code analysis. Compared with the prior art, the beneficial effects of the source code static analysis device provided by the present application are the same as the beneficial effects of the source code static analysis method provided by the above embodiment, and other technical features in the source code static analysis device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0081] The present application provides a source code static analysis device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the source code static analysis method in the above-mentioned embodiment 1.

[0082] Reference below Fig. 9 , which shows a schematic diagram of the structure of a source code static analysis device suitable for implementing the embodiment of the present application. The source code static analysis device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig. 9 The source code static analysis device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0083] like Fig. 9As shown, the source code static analysis device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the source code static analysis device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the source code static analysis device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows a source code static analysis device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0084] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0085] The source code static analysis device provided by the present application adopts the source code static analysis method in the above embodiment, which can solve the technical problems of source code static analysis. Compared with the prior art, the beneficial effects of the source code static analysis device provided by the present application are the same as the beneficial effects of the source code static analysis method provided by the above embodiment, and the other technical features in the source code static analysis device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0086] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0087] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0088] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the source code static analysis method in the above-mentioned embodiment.

[0089] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM: Random Access Memory), a read-only memory (ROM: Read Only Memory), an erasable programmable read-only memory (EPROM: Erasable Programmable Read Only Memory or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM: CD-Read Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency: Radio Frequency), etc., or any suitable combination of the above.

[0090] The computer-readable storage medium may be included in the source code static analysis device; or may exist independently without being assembled into the source code static analysis device.

[0091] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by a source code static analysis device, the source code static analysis device: dynamically loads a dynamic link library file based on a preset data reading framework; parses the dynamic link library file to extract metadata in the dynamic link library file; performs format conversion processing on the metadata to obtain target library metadata; constructs an abstract syntax tree based on the target library metadata and source code through a preset static code analysis tool; and generates a source code analysis result corresponding to the source code based on the abstract syntax tree.

[0092] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0093] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0094] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0095] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned source code static analysis method, and can solve the technical problem that the static code analysis tools in the prior art rely on the DLL structure unique to the Windows platform and cannot implement cross-platform static code analysis. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the source code static analysis method provided by the above-mentioned embodiment, and will not be repeated here.

[0096] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A source code static analysis method, characterized in that: The method includes: Dynamically load dynamic link library files based on a preset data reading framework; Parsing the dynamic link library file to extract metadata in the dynamic link library file; Performing format conversion processing on the metadata to obtain target library metadata; Building an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool; A source code analysis result corresponding to the source code is generated based on the abstract syntax tree.

2. The method according to claim 1, characterized in that The step of parsing the dynamic link library file to extract metadata in the dynamic link library file includes: Parsing the dynamic link library file to obtain an assembly corresponding to the dynamic link library file; Obtain basic type information corresponding to all types in the assembly, the types including: classes and interfaces; Determine the method information, attribute information and member variable information corresponding to each type according to the basic information of the type; The metadata in the dynamic link library file is determined based on the method information, the attribute information and the member variable information.

3. The method according to claim 1, characterized in that The step of converting the metadata into a format to obtain the target library metadata includes: Performing format conversion processing on the metadata based on a preset data structure and a standard data format to generate a namespace information array, a type information array, a method information array, and a field information array; Building target library metadata based on the namespace information array, the type information array, the method information array, and the field information array; Among them, the preset data structure is a type information set organized in a namespace, the elements in the namespace information array are string representations corresponding to the namespace, the elements in the type information array are used to represent type information, the elements in the method information array are used to represent method information, and the elements in the field information array are used to represent field information.

4. The method according to any one of claims 1 to 3, characterized in that Before the step of constructing an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool, the method further includes: Real-time detection of whether the target library metadata meets the user project requirements; If not, the metadata of the library to be added is determined based on the user's project requirements; Updating the target library metadata based on the to-be-added library metadata; The step of constructing an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool includes: An abstract syntax tree is constructed based on the updated target library metadata and source code using a preset static code analysis tool.

5. The method according to any one of claims 1 to 3, characterized in that The step of constructing an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool includes: Extracting key code information in the source code based on the target library metadata and the source code by using a preset static code analysis tool; Converting the code key information into a code intermediate representation, where the code intermediate representation is an intermediate representation identified by a code attribute graph; The nodes and edges corresponding to the code attribute graph are determined according to the code intermediate representation, so as to construct an abstract syntax tree based on the nodes and the edges.

6. The method according to any one of claims 1 to 3, characterized in that The step of generating a source code analysis result corresponding to the source code based on the abstract syntax tree comprises: Parsing the abstract syntax tree to determine code attribute graph node information in the abstract syntax tree; Generate a target graph structure based on the code attribute graph node information, the target graph structure including: a control flow graph, a data dependency graph and a program dependency graph; A source code analysis result corresponding to the source code is generated by a security scanning engine based on the target graph structure and preset security rules.

7. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Define type storage class, method storage class and field storage class; Among them, the type storage class is used to store the full name, method and field of the type in the metadata information, the method storage class is used to store the name, return value and parameter list of the method in the metadata information, and the field storage class is used to store the field name and type related information in the metadata information.

8. A source code static analysis device, characterized in that: The device comprises: A file loading module, used to dynamically load dynamic link library files based on a preset data reading framework; A file parsing module, used for parsing the dynamic link library file to extract metadata in the dynamic link library file; A format conversion module, used to perform format conversion processing on the metadata to obtain target library metadata; A syntax tree construction module, used for constructing an abstract syntax tree based on the target library metadata and source code by using a preset static code analysis tool; A source code analysis module is used to generate a source code analysis result corresponding to the source code based on the abstract syntax tree.

9. A source code static analysis device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the source code static analysis method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the source code static analysis method according to any one of claims 1 to 7 are implemented.

Images