Program security test method and device, electronic equipment and storage medium
By establishing a parameter chain structure and determining parameter availability based on detection rules, the problem of high false alarm rate in SAST in the case of abnormal detection parameter character splicing class is solved, and the accuracy of program safety detection is improved.
Patent Information
- Application Number
- CN202411284700.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-13
- Publication Date
- 2024-12-17
AI Technical Summary
Existing static program security test (SAST) has a high false alarm rate when detecting parameter character splicing class exceptions, making it difficult to determine whether the host part in the URL is controllable, resulting in inaccurate vulnerability scanning.
By establishing a parameter chain structure of the target code, determining the availability label of the parameters based on preset detection rules, and placing unutilized parameters in the scanning rule filter, ignoring their vulnerability scans, improving the accuracy of program security detection.
It effectively reduces the false alarms of SAST for parameters that cannot be used by stained data, and improves the accuracy of program safety detection.
Smart Images
Figure CN119150285A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to software testing, and in particular to a program security testing method, device, electronic equipment and storage medium. Background Art
[0002] At present, it is usually necessary to test the program code before the program is put online or during operation. Among them, SAST (Static Application Security Testing) is a widely used code testing method. The principle of SAST is to generate IR (intermediate representation) from source code, and then perform taint analysis on IR, that is, to track how specific data in the program (called "taint") propagates in the program, and at the same time, customize scanning rules to complete vulnerability scanning.
[0003] In the related technology, the frequently used scanning rules include SSRF (Server-Side RequestForgery), path injection, command injection, etc. However, since SAST itself cannot know the results of the program runtime, and the source of the string value may include multiple sources and SAST cannot read data from multiple data sources, this leads to a high false alarm rate for abnormal situations such as parameter character splicing in the related technology.
[0004] Taking SSRF as an example, the key to whether a vulnerability can be exploited lies in whether the host (host name, used to indicate the address of the target server) part in the URL (uniform resource locator, Uniform Resource Locator) can be controlled. However, since the URL is a string type, it is often composed of multiple parameters in different locations in the code through different character splicing methods. SSRF is difficult to perform word segmentation on the transfer of variable values, and SAST cannot run the program. Therefore, it is difficult to determine whether the host part in the URL is controllable, which makes SAST prone to false positives for parameters obtained by string splicing calls. Summary of the invention
[0005] In view of this, an embodiment of the present invention provides a program security testing method, device, electronic device and storage medium to improve the accuracy of program security testing.
[0006] According to one aspect of the present invention, a program security testing method is provided, the method comprising:
[0007] Based on the target source code, determining a parameter splicing call in the target source code;
[0008] Based on the concatenation and calling of the parameters, each parameter chain structure is obtained, wherein each parameter chain structure includes a plurality of parameters and a calling relationship between the plurality of parameters;
[0009] For each parameter included in the parameter chain structure, determining an availability tag of the parameter based on a preset detection rule, wherein the availability tag is used to indicate whether the parameter can be exploited by the tainted code, and the preset detection rule includes a string literal detection rule and a variable detection rule;
[0010] The parameter with the exploitability label of "no" is placed in the scan rule filter, so that the scan rule filter ignores the vulnerability scan of the parameter with the exploitability label of "no".
[0011] In a possible embodiment, the method further includes: determining an availability tag of a downstream parameter of the parameter based on the availability tag of the parameter, wherein the downstream parameter is a parameter that directly or indirectly references the parameter in the parameter chain structure.
[0012] In a possible embodiment, for each parameter included in the parameter chain structure, determining the availability label of the parameter based on a preset detection rule includes:
[0013] In the case where the parameter is a string literal value, the parameter is matched based on a preset explicit class regular set and a preset suspected class regular set. In the case where the parameter successfully matches the explicit class regular set, the availability label of the parameter and each parameter that references the parameter is determined to be no. In the case where the parameter successfully matches the suspected class regular set, the availability label of the parameter is determined to be uncertain.
[0014] In the case where the parameter is a variable type, the parameter is matched based on a preset parameter name regular set, and if the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0015] In the case where the parameter is of an attribute type, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0016] When the parameter is a method call type, the method name that calls the parameter and the preset parameter name regular set are matched. If the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes.
[0017] In a possible embodiment, when the parameter is a variable type, matching the parameter based on a preset parameter name regular set includes:
[0018] In the case where the variable type of the parameter is a string literal value, detecting the parameter based on the string literal value detection rule;
[0019] In the case where the parameter has no assignment statement or takes a value from a configuration file, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0020] In the case where the parameter is assigned by concatenating statements, a step of determining the availability label of the parameter based on a preset detection rule is performed for each parameter assigned with the parameter.
[0021] In a possible embodiment, determining the parameter splicing call in the target source code based on the target source code includes:
[0022] Converting the target source code into IR;
[0023] identifying a connection identifier in the IR;
[0024] Based on the parameters connected by the connection identifier, a parameter splicing call in the target source code is determined.
[0025] According to another aspect of the present invention, there is provided a program security testing device, the device comprising:
[0026] A determination module, used for determining a parameter splicing call in the target source code based on the target source code;
[0027] An acquisition module, configured to obtain parameter chain structures based on the concatenation of the parameters, wherein each parameter chain structure includes a plurality of parameters and a calling relationship between the plurality of parameters;
[0028] A detection module, for determining, for each parameter included in the parameter chain structure, an availability label of the parameter based on a preset detection rule, wherein the availability label is used to indicate whether the parameter can be exploited by the tainted code, and the preset detection rule includes a string literal detection rule and a variable detection rule;
[0029] The scanning module is used to place the parameter with the exploitability label as "no" in the scanning rule filter, so that the scanning rule filter ignores the vulnerability scanning of the parameter with the exploitability label as "no".
[0030] In a possible embodiment, the detection module is used to determine the availability label of the downstream parameter of the parameter based on the availability label of the parameter, wherein the downstream parameter is a parameter that directly or indirectly references the parameter in the parameter chain structure.
[0031] In a possible embodiment, for each parameter included in the parameter chain structure, determining the availability label of the parameter based on a preset detection rule includes:
[0032] In the case where the parameter is a string literal value, the parameter is matched based on a preset explicit class regular set and a preset suspected class regular set. In the case where the parameter successfully matches the explicit class regular set, the availability label of the parameter and each parameter that references the parameter is determined to be no. In the case where the parameter successfully matches the suspected class regular set, the availability label of the parameter is determined to be uncertain.
[0033] In the case where the parameter is a variable type, the parameter is matched based on a preset parameter name regular set, and if the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0034] In the case where the parameter is of an attribute type, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0035] When the parameter is a method call type, the method name that calls the parameter and the preset parameter name regular set are matched, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0036] When the parameter is a variable type, matching the parameter based on a preset parameter name regular set includes:
[0037] In the case where the variable type of the parameter is a string literal value, detecting the parameter based on the string literal value detection rule;
[0038] In the case where the parameter has no assignment statement or takes a value from a configuration file, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0039] In the case where the parameter is assigned by concatenating statements, a step of determining the availability label of the parameter based on a preset detection rule is performed for each parameter assigned with the parameter.
[0040] According to another aspect of the present invention, there is provided an electronic device, comprising:
[0041] Processor; and
[0042] Memory for storing programs,
[0043] The program includes instructions, and when the instructions are executed by the processor, the processor executes any of the above-mentioned program security detection methods.
[0044] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute any of the above-mentioned program security detection methods.
[0045] One or more technical solutions provided in the embodiments of the present invention establish a parameter chain structure of the target code, each parameter chain structure includes a reference relationship between multiple parameters, and performs an availability check on each parameter based on preset detection rules, and determines that the parameters that cannot be used by tainted data are added to the scanning rule filter. In the subsequent scanning process, the scanning rule filter will ignore these unusable parameters, thereby avoiding SAST from generating false positives for these parameters that cannot be used by tainted data, thereby improving the accuracy of program security detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0046] Further details, features and advantages of the invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:
[0047] Figure 1 A schematic diagram of a process flow of a program security detection method provided by an embodiment of the present invention;
[0048] Figure 2 A schematic diagram of a parameter chain structure established in an embodiment of the present invention;
[0049] Figure 3 A schematic diagram of another process flow of a program security detection method provided by an embodiment of the present invention;
[0050] Figure 4 A schematic diagram of the structure of a program security detection device provided by an embodiment of the present invention;
[0051] Figure 5 A block diagram of an exemplary electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION
[0052] Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.
[0053] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.
[0054] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.
[0055] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".
[0056] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.
[0057] In order to improve the accuracy of program security detection, the embodiments of the present invention provide a program security testing method, device, electronic device and storage medium. The program security testing method provided by the embodiments of the present invention can be applied to any electronic device with a program security testing function, which can be a server, a computer or a mobile terminal, etc. The scheme of the present invention is described below with reference to the accompanying drawings:
[0058] Figure 1 A flowchart of a program security testing method provided by an embodiment of the present invention may include the following steps:
[0059] S101, based on a target source code, determining a parameter splicing call in the target source code;
[0060] S102, based on the concatenation and calling of the parameters, obtaining parameter chain structures, wherein each parameter chain structure includes a plurality of parameters and a calling relationship between the plurality of parameters;
[0061] S103, for each parameter included in the parameter chain structure, determining an availability tag of the parameter based on a preset detection rule, wherein the availability tag is used to indicate whether the parameter can be exploited by the tainted code, and the preset detection rule includes a string literal detection rule and a variable detection rule;
[0062] S104: placing the parameter with the exploitability tag of "no" in the scan rule filter, so that the scan rule filter ignores the vulnerability scan of the parameter with the exploitability tag of "no".
[0063] By applying the embodiment of the present invention, a parameter chain structure of the target code is established, each parameter chain structure includes a reference relationship between multiple parameters, and each parameter is subjected to an availability check based on preset detection rules. The parameters that cannot be used by tainted data are determined and added to the scanning rule filter. In the subsequent scanning process, the scanning rule filter will ignore these unusable parameters, thereby preventing SAST from generating false positives for these parameters that cannot be used by tainted data, thereby improving the accuracy of program security detection.
[0064] The following is an exemplary description of S101-S104:
[0065] The target source code may be obtained in any feasible manner. In a possible embodiment, a program security detection page may be set, and the target source code may be copied to a preset location of the detection page by relevant personnel. In a possible embodiment, the storage location of the target source code may be filled in, and the storage location may include a database identifier or a database branch identifier where the target source code is located, etc. The target source code may be obtained based on the storage location.
[0066] Before determining the parameter splicing call of the target source code, the target source code may be formatted first. The size of the target source code is usually large. If the parameter splicing call in the target source code is directly identified from the target source code itself, it will take a lot of time due to the huge amount of data processing. In a possible embodiment, the target source code may be converted into an IR format. IR is usually used to represent the intermediate form of the source code. It can be an abstract data structure used to describe the semantic structure of the source code, or it can be a specific format that reflects the syntax and structure of the source code. Common IR formats include LLVM IR (Low-Level Virtual System Intermediate Representation), Java bytecode, and CIL (Common Intermediate Language).
[0067] Based on IR, the node where each target parameter is located without other parameters, methods, etc. references can be determined. The target parameter can be a url, variable, or other string. Exemplarily, if IR is in the form of a tree structure, the child node whose attribute is a parameter in the IR tree can be determined as the node where the target parameter is located. If IR is in the form of a graph structure, the graph node with no downstream node in the node whose attribute is a parameter can be determined as the node where the target parameter is located.
[0068] Starting from the node where the target parameter is located, searching upward for the nodes it references can obtain the chain structure of each parameter. For example, Figure 2 As shown, nodes 5 and 6 are both parameter nodes, and based on the reference relationship between the nodes, two parameter chain structures 1-2-4-6 and 1-3-5 can be determined.
[0069] In a possible embodiment, the connection identifier in the IR, that is, the parameter concatenation call symbol, can be identified, such as the "+", stringbuilder.append() and other symbols in the IR, and the parameters included in the symbol can be determined to determine the parameter concatenation call in the target source code, and then determine the parameter chain structure. Specifically, the parameter connected by the symbol can be used as the referenced parameter, and the parameter assigned by the symbol can be used as the target parameter. Exemplarily, the "+" included in the IR is identified, and the parameters connected by the symbol are: a=b+c, then the parameter chain structure of ba, ca can be determined.
[0070] Each parameter chain structure may include multiple parameters and the calling relationship between the parameters. For each parameter in the parameter chain structure, the parameter can be subjected to availability detection according to the preset detection rules. The availability detection refers to detecting whether the parameter can be utilized by tainted data. Among them, being utilized by tainted data means that tainted data can be spread through the parameter, such as controlling the host part in the URL through the parameter.
[0071] In a possible embodiment, each parameter chain structure can be traversed, and the availability of each parameter can be checked from front to back according to the reference order in each parameter chain structure, and the availability label of the downstream parameter that references the parameter can be determined based on the parameter availability check result, thereby reducing the amount of data processing.
[0072] In a possible embodiment, the above-mentioned preset detection rules may include character string detection rules and variable detection rules, wherein the character string detection rules are used to detect character string parameters, and the variable detection rules are used to detect variables.
[0073] In a possible embodiment, when the parameter is a string literal value, the parameter is matched based on a preset explicit class regular set and a suspected class regular set, and when the parameter successfully matches the explicit class regular set, the availability label of the parameter and each parameter that references the parameter is determined to be no, and when the parameter successfully matches the suspected class regular set, the availability label of the parameter is determined to be uncertain;
[0074] In the case where the parameter is a variable type, the parameter is matched based on a preset parameter name regular set, and if the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0075] In the case where the parameter is of an attribute type, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0076] When the parameter is a method call type, the method name that calls the parameter and the preset parameter name regular set are matched. If the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes.
[0077] In a possible embodiment, when the parameter is a variable type, matching the parameter based on a preset parameter name regular set includes:
[0078] In the case where the variable type of the parameter is a string literal value, detecting the parameter based on the string literal value detection rule;
[0079] In the case where the parameter has no assignment statement or takes a value from a configuration file, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0080] In the case where the parameter is assigned by concatenating statements, a step of determining the availability label of the parameter based on a preset detection rule is performed for each parameter assigned with the parameter.
[0081] The following is an exemplary description of the above matching rules:
[0082] In a possible embodiment, when the parameter is a string literal, the parameter can be detected for availability using a string detection rule, wherein a string literal refers to a string of constant characters, usually represented by zero or more characters enclosed in double quotes, such as "hello". String literals are used to represent text information, store and operate text data, etc., and remain unchanged during program execution. The above string detection rule can be based on a preset clear class regular set and a suspected class regular set to match the parameter, wherein the clear class regular set includes a first identifier, and the parameter after the first identifier is a non-host parameter. In the naming of url, the parameters accessed after some symbols must not be host identifiers, such as "?", "#", etc., and these identifiers can be included in the clear class regular set. When the parameter successfully matches the clear class regular set, it means that the parameter belongs to the first identifier, so the subsequent parameters or the parameters that reference it are all non-host parameters. Therefore, when an unavailable label is determined for the parameter, an unavailable label can be determined for the downstream parameters that reference the parameter in the parameter chain structure.
[0083] The above-mentioned suspected class regular set includes a second identifier, and the parameter following the second identifier may be a host identifier or may not be a host identifier, such as " / ". If the parameter successfully matches the suspected class regular set, it means that the downstream parameter that references the parameter may be a host identifier or may not be a host identifier. Therefore, the parameter and its downstream parameters can be marked with a suspected label, and the suspected label indicates that the parameter may be a host identifier.
[0084] When the parameter is a variable type, the variable detection rule can be used to detect the parameter. Since the variable type may include multiple subtypes, such as string type variables, non-assigned variables, assigned variables, etc., among which string type variables are used to represent string type data, therefore, for string type variables, the variable availability can be detected based on the above string detection method.
[0085] An assignment variable refers to a variable obtained by assigning values to other parameters. An assignment variable may also include multiple subtypes. For example, the assignment variable may be a multiple assignment variable obtained by assigning values to different variables multiple times. For example, a=b, and previously defined b=c, c=d, then variable a is a multiple assignment variable. It may be a single assignment variable obtained by directly assigning values to other variables, or a function assignment variable obtained by assigning values to the result of a function call, or a spliced assignment variable obtained by assigning values to other spliced statements.
[0086] For the above-mentioned multiple assignment variables and function assignment variables, the parameters can be matched through the preset parameter name regular set, which includes URL parameter names, such as query parameters and path parameters. These parameters are usually fixed parameter names. For example, according to different application scenarios, the path parameter name may include user ID userid, database ID databaseid, etc. If the parameter successfully matches the parameter name regular set, it means that the parameter belongs to the parameter in the URL that can identify data query related information, and therefore, it belongs to the parameter that can be exploited by the vulnerability, so the parameter can be marked as exploitable.
[0087] For the above-mentioned single-assignment variable, since the parameter is obtained by assigning values to other variables, the availability check can be performed on the other variables assigned to the parameter. If the availability of the other variable is no, that is, it cannot be used by tainted data, then the availability of the parameter is also no. If the availability label of the other variable is not no, then the availability label of the parameter is also not no.
[0088] For the concatenated assigned variables, the availability check can be performed on the variables that constitute the parameter. For example, a=b+c, url=a+b. When detecting the parameter url, since it is obtained by assigning values of a and b, the availability check can be performed on variables a and b. If the availability labels of a and b are both no, it can be determined that the availability label of url is no. If the availability label of any variable in a and b is not no, the availability label of url is also not no.
[0089] Non-assigned variables may also include multiple subtypes, such as defined variables without assignment statements, and configuration variables that take values from configuration files. For these non-assigned variables, the parameters can be matched based on the parameter name regular set. The parameter name regular set can include various pre-defined regular expressions of URL parameter names that can be used for tainted data. The parameter name regular set is used to detect the availability of non-assigned variables. During the detection process, there is no need to access the data source, so that effective detection of configuration variables and defined variables can be achieved.
[0090] If the parameter is a variable and does not belong to any of the above types, the availability check of the parameter can be skipped.
[0091] In a possible embodiment, the above parameters may also include attribute types, where attribute parameters are specific attribute values passed through URLs in certain specific application scenarios. These attribute values may be used to specify certain internal attributes or behaviors of specific resources. For example, in some complex Web applications or APIs, attribute parameters such as "filter" or "options" may be used to refine or customize the data returned by the server. Attribute type parameters can be regarded as variables, and the above variable detection rules can be used to detect the availability of the parameters.
[0092] The above parameters may also include method call types, which are values passed to a function or method when it is called. These values can be of various data types, such as numbers, strings, objects, etc., and they define the data that the method will process when it is executed. For these parameters, the corresponding method name can be obtained and matched based on the above parameter name regular set.
[0093] For a parameter that does not belong to any of the above types, the availability check of the parameter may be skipped.
[0094] In a possible embodiment, after performing an availability analysis on a single parameter in a parameter chain structure and obtaining an availability label, the availability label of the downstream parameter of the parameter in the parameter chain structure can be maintained according to the logical relationship. The downstream parameter of the parameter refers to other parameters in the parameter chain structure that directly or indirectly reference the parameter. Specifically, if the availability label of the parameter is no, the availability label of the downstream parameter of the parameter that successfully matches the above-mentioned clear class regular set is no, and the availability label of the downstream parameter of the parameter that successfully matches the above-mentioned suspected class regular set is uncertain.
[0095] After the availability check of a single parameter is completed, the availability check of its downstream parameters can be performed in a preset order. The preset order can be set according to actual needs, such as from front to back according to the reference relationship of the parameter chain structure mentioned above. For example, for the splicing parameter a=b+c, there is a parameter chain structure ba, ca. After the availability check of parameter b or c is performed, the availability check of parameter a can be performed.
[0096] In a possible embodiment, availability detection may be performed on parameters whose availability tags are not determined among downstream parameters of the parameters, so as to further reduce the amount of data processing.
[0097] After the availability detection of each parameter is completed, the parameter with the availability label of "no" can be put into the scanning rule filter Sanitizer. The scanning rule filter is used to scan the source code based on SSRF, code injection rules, etc. to determine the data that can be used by the tainted data. In a possible embodiment, the scanning rule filter can compare the parameters to be scanned with the identifiers of the parameters with the availability label of "no" stored in its internal storage before scanning. If they are consistent, the scanning of the parameter is skipped, and if they are inconsistent, the parameter is scanned. In a possible embodiment, after obtaining the scanning result, the scanning rule filter can compare the scanning result with the parameters with the availability label of "no" stored in its internal storage, and remove the parameters that are successfully compared from the scanning result, and output warning information for the remaining results after removal. Exemplarily, the scanning result may include parameter identifiers that may be used by tainted data, and these scanning results are compared with the parameter identifiers with the availability label of "no". If the identifiers are consistent, it means that the scanning result may contain false positives, so these scanning results that are consistent with the parameter identifiers with the availability label of "no" can be removed to reduce false positives.
[0098] like Figure 3 As shown, Figure 3 Another flow chart of the program security detection method provided by the embodiment of the present invention, specifically, it can parse the concatenation methods of various types of strings, establish a string concatenation model (i.e., the parameter chain structure mentioned above), and judge each parameter in the string concatenation model one by one. Specifically, first judge the parameter type. If the parameter is a plain text string, determine whether the parameter is a clear representation value based on the string value, that is, match the parameter based on the above-mentioned clear class regular set. If so, maintain the parameter and its downstream parameter's availability label value as no. If not, determine whether the parameter is a suspected representation value, that is, match the parameter based on the above-mentioned suspected class regular set. If so, maintain the parameter and its downstream parameter's availability label value as an uncertain value.
[0099] If the parameter is a variable / constant type, determine whether the definition of the variable can be found, that is, determine whether the assigned variable of the variable can be found. If it can be found, then check the assigned variable. If it cannot be found, determine whether the parameter is a suspected parameter name, that is, match the parameter with the parameter name regular set. If the match is successful, maintain the parameter availability label as yes. If the match is not successful, maintain the parameter availability label as uncertain.
[0100] If the parameter is a method call type or an object attribute, determine whether the parameter is a suspected parameter name. If the parameter is of other types, skip the availability check of the parameter.
[0101] After maintaining the availability label value for the parameter, it can be determined whether the loop is ended, that is, whether the availability label has been set for each parameter in the string concatenation model. If not, the step of determining the parameter type is performed for the next parameter. If the loop is ended, the entire process ends.
[0102] By applying the embodiment of the present invention, a string concatenation model is established by parsing the character concatenation statements in the program. The model is evaluated and analyzed by using a series of clear representation values, suspected representation values, etc. as standards to draw a conclusion on whether the model may have vulnerabilities. By establishing a string concatenation model, the splicing judgment false alarm of the string concatenation vulnerability scanning rule is basically solved.
[0103] Based on the same inventive concept, the embodiment of the present invention also provides a program security detection device, such as Figure 4 As shown, the apparatus 400 may include:
[0104] A determination module 401 is used to determine a parameter splicing call in the target source code based on the target source code;
[0105] The acquisition module 402 is used to obtain parameter chain structures based on the splicing call of each parameter, wherein each parameter chain structure includes multiple parameters and the calling relationship between the multiple parameters;
[0106] A detection module 403, for determining, for each parameter included in the parameter chain structure, an availability tag of the parameter based on a preset detection rule, wherein the availability tag is used to indicate whether the parameter can be exploited by the tainted code, and the preset detection rule includes a string literal detection rule and a variable detection rule;
[0107] The scanning module 404 is configured to place the parameter with the exploitability tag of "no" in the scanning rule filter, so that the scanning rule filter ignores the vulnerability scanning of the parameter with the exploitability tag of "no".
[0108] In a possible embodiment, the detection module is used to determine the availability label of the downstream parameter of the parameter based on the availability label of the parameter, wherein the downstream parameter is a parameter that directly or indirectly references the parameter in the parameter chain structure.
[0109] In a possible embodiment, for each parameter included in the parameter chain structure, determining the availability label of the parameter based on a preset detection rule includes:
[0110] In the case where the parameter is a string literal value, the parameter is matched based on a preset explicit class regular set and a preset suspected class regular set. In the case where the parameter successfully matches the explicit class regular set, the availability label of the parameter and each parameter that references the parameter is determined to be no. In the case where the parameter successfully matches the suspected class regular set, the availability label of the parameter is determined to be uncertain.
[0111] In the case where the parameter is a variable type, the parameter is matched based on a preset parameter name regular set, and if the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0112] In the case where the parameter is of an attribute type, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0113] When the parameter is a method call type, the method name that calls the parameter and the preset parameter name regular set are matched, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0114] When the parameter is a variable type, matching the parameter based on a preset parameter name regular set includes:
[0115] In the case where the variable type of the parameter is a string literal value, detecting the parameter based on the string literal value detection rule;
[0116] In the case where the parameter has no assignment statement or takes a value from a configuration file, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes;
[0117] In the case where the parameter is assigned by concatenating statements, a step of determining the availability label of the parameter based on a preset detection rule is performed for each parameter assigned with the parameter.
[0118] Among them, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present invention are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0119] The exemplary embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program that can be executed by the at least one processor, and the computer program is used to enable the electronic device to perform a method according to an embodiment of the present invention when executed by the at least one processor.
[0120] Exemplary embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present invention.
[0121] An exemplary embodiment of the present invention further provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor of a computer, the computer is used to enable the computer to perform a method according to an embodiment of the present invention.
[0122] refer to Figure 5 , a block diagram of an electronic device 500 that can be used as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0123] like Figure 5 As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.
[0124] A plurality of components in the electronic device 500 are connected to the I / O interface 505, including: an input unit 506, an output unit 507, a storage unit 508, and a communication unit 509. The input unit 506 may be any type of device capable of inputting information to the electronic device 500, and the input unit 506 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 507 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 508 may include, but is not limited to, a disk, an optical disk. The communication unit 509 allows the electronic device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.
[0125] The computing unit 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 501 performs the various methods and processes described above. For example, in some embodiments, the above-mentioned program security detection method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. In some embodiments, the computing unit 501 may be configured to perform the above-mentioned program security detection method by any other appropriate means (e.g., by means of firmware).
[0126] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.
[0127] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0128] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.
[0129] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).
[0130] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communications network). Examples of communications networks include: a local area network (LAN), a wide area network (WAN), and the Internet.
[0131] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.
Claims
1. A program security testing method, characterized in that: The method comprises: Based on the target source code, determining a parameter splicing call in the target source code; Based on the concatenation and calling of the parameters, each parameter chain structure is obtained, wherein each parameter chain structure includes a plurality of parameters and a calling relationship between the plurality of parameters; For each parameter included in the parameter chain structure, determining an availability tag of the parameter based on a preset detection rule, wherein the availability tag is used to indicate whether the parameter can be exploited by the tainted code, and the preset detection rule includes a string literal detection rule and a variable detection rule; The parameter with the exploitability label of "no" is placed in the scan rule filter, so that the scan rule filter ignores the vulnerability scan of the parameter with the exploitability label of "no".
2. The method according to claim 1, characterized in that The method further comprises: Based on the availability tag of the parameter, an availability tag of a downstream parameter of the parameter is determined, wherein the downstream parameter is a parameter that directly or indirectly references the parameter in the parameter chain structure.
3. The method according to claim 1, characterized in that The determining of the availability label of each parameter included in the parameter chain structure based on a preset detection rule includes: In the case where the parameter is a string literal value, the parameter is matched based on a preset explicit class regular set and a preset suspected class regular set. In the case where the parameter successfully matches the explicit class regular set, the availability label of the parameter and each parameter that references the parameter is determined to be no. In the case where the parameter successfully matches the suspected class regular set, the availability label of the parameter is determined to be uncertain. In the case where the parameter is a variable type, the parameter is matched based on a preset parameter name regular set, and if the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes; In the case where the parameter is of an attribute type, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes; When the parameter is a method call type, the method name that calls the parameter and the preset parameter name regular set are matched. If the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes.
4. The method according to claim 3, characterized in that When the parameter is a variable type, matching the parameter based on a preset parameter name regular set includes: In the case where the variable type of the parameter is a string literal value, detecting the parameter based on the string literal value detection rule; In the case where the parameter has no assignment statement or takes a value from a configuration file, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes; In the case where the parameter is assigned by concatenating statements, a step of determining the availability label of the parameter based on a preset detection rule is performed for each parameter assigned with the parameter.
5. The method according to claim 1, characterized in that The step of determining the parameter splicing call in the target source code based on the target source code includes: Converting the target source code into IR; identifying a connection identifier in the IR; Based on the parameters connected by the connection identifier, a parameter splicing call in the target source code is determined.
6. A program security testing device, characterized in that: The device comprises: A determination module, used for determining a parameter splicing call in the target source code based on the target source code; An acquisition module, configured to obtain parameter chain structures based on the concatenation of the parameters, wherein each parameter chain structure includes a plurality of parameters and a calling relationship between the plurality of parameters; A detection module, for determining, for each parameter included in the parameter chain structure, an availability label of the parameter based on a preset detection rule, wherein the availability label is used to indicate whether the parameter can be exploited by the tainted code, and the preset detection rule includes a string literal detection rule and a variable detection rule; The scanning module is used to place the parameter with the exploitability label as "no" in the scanning rule filter, so that the scanning rule filter ignores the vulnerability scanning of the parameter with the exploitability label as "no".
7. The device according to claim 6, characterized in that The detection module is used to determine the availability label of the downstream parameter of the parameter based on the availability label of the parameter, wherein the downstream parameter is a parameter that directly or indirectly references the parameter in the parameter chain structure.
8. The device according to claim 6, characterized in that The determining of the availability label of each parameter included in the parameter chain structure based on a preset detection rule includes: In the case where the parameter is a string literal value, the parameter is matched based on a preset explicit class regular set and a preset suspected class regular set. In the case where the parameter successfully matches the explicit class regular set, the availability label of the parameter and each parameter that references the parameter is determined to be no. In the case where the parameter successfully matches the suspected class regular set, the availability label of the parameter is determined to be uncertain. In the case where the parameter is a variable type, the parameter is matched based on a preset parameter name regular set, and if the match is successful, the availability label of the parameter and each parameter that references the parameter is determined to be yes; In the case where the parameter is of an attribute type, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes; When the parameter is a method call type, the method name that calls the parameter and the preset parameter name regular set are matched, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes; When the parameter is a variable type, matching the parameter based on a preset parameter name regular set includes: In the case where the variable type of the parameter is a string literal value, detecting the parameter based on the string literal value detection rule; In the case where the parameter has no assignment statement or takes a value from a configuration file, the parameter is matched based on the preset parameter name regular set, and if the match succeeds, the availability label of the parameter and each parameter that references the parameter is determined to be yes; In the case where the parameter is assigned by concatenating statements, a step of determining the availability label of the parameter based on a preset detection rule is performed for each parameter assigned with the parameter.
9. An electronic device, comprising: processor; as well as Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 5.
10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to make a computer execute the method according to any one of claims 1-5.