Invalid API (Application Program Interface) detection method and device, electronic equipment and storage medium

Abstract

The invention provides an invalid API detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a target abstract syntax tree of a target code based on a programming language of the target code, obtaining target API information based on the target abstract syntax tree, comprising all APIs and API identifiers contained in the target code; and detecting the APIs based on a preset detection rule to obtain invalid APIs. By detecting the invalid API based on the static code, the invalid API can be detected at any time, the system security problem possibly caused by the hysteresis of detecting the invalid API based on the flow is avoided, the invalid API detection efficiency is improved, related personnel can take corresponding measures before the invalid API is applied, potential performance problems or security vulnerabilities are prevented, and the system security is improved. And the operation safety of the system is further improved.

Description

Technical Field

[0001] The present invention relates to the technical field of API detection, and in particular to an invalid API detection method, device, electronic device and storage medium. Background Art

[0002] API (Application Programming Interface) is a set of predefined functions that aims to provide applications and developers with the ability to access a set of routines based on certain software or hardware without having to access the source code or understand the details of the internal working mechanism. In actual business scenarios, there may be zombie APIs, which refer to forgotten APIs that were previously valid and approved, but were eventually abandoned or replaced by newer versions, thus becoming invalid APIs.

[0003] In the related art, invalid APIs are usually discovered by observing and analyzing the traffic received by the API and the usage of the API. For example, if an API has not been called for a long time or is used very rarely, it may be a zombie API.

[0004] The method based on traffic observation is essentially a post-detection mechanism, that is, the detection is performed after the API request is completed, which has a certain lag. This means that the zombie API request may have been executed in the system for a period of time, and the request received by the zombie API is usually an attack request that threatens the system security, which may have a potential impact on system performance or security. Summary of the invention

[0005] In view of this, the embodiments of the present invention provide an invalid API detection method, device, electronic device and storage medium to improve the invalid API detection efficiency and thereby improve the system operation security.

[0006] According to one aspect of the present invention, a method for detecting an invalid API is provided, the method comprising:

[0007] Get the object code;

[0008] Based on the programming language of the target code, obtaining a target abstract syntax tree of the target code, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods;

[0009] Based on the target abstract syntax tree, acquiring target API information of the target code, the target API information including all APIs included in the target code and identifiers of each of the APIs;

[0010] Each of the APIs is detected based on the preset detection rules and the target API information to obtain an invalid API.

[0011] In a possible embodiment, obtaining a target abstract syntax tree of the target code based on the programming language of the target code includes:

[0012] Based on the configuration file of the target code, obtaining the programming language of the target code;

[0013] Determine a corresponding target AST engine based on the programming language of the target code;

[0014] The target AST engine is used to obtain a target abstract syntax tree of the target code.

[0015] In a possible embodiment, the configuration file of the target code also includes a development framework of the target code;

[0016] The step of obtaining a target abstract syntax tree of the target code by using the target AST engine includes:

[0017] Using the target AST engine to obtain a target abstract syntax tree of the target code based on a target conversion relationship, wherein the target conversion relationship is a correspondence between elements and values ​​preset for a development framework of the target code;

[0018] The acquiring target API information of the target code based on the target abstract syntax tree includes:

[0019] Based on the numerical value corresponding to the API, target API information of the target code is obtained from the target abstract syntax tree.

[0020] In a possible embodiment, the detecting each API based on a preset detection rule and the target API information to obtain an invalid API includes:

[0021] For each of the APIs, determine an identifier of the API based on the target API information, wherein the identifier includes a version identifier of the API;

[0022] Determine whether the API is the latest version based on the version identifier, and if the API is not the latest version, determine that the API is an invalid API; and / or,

[0023] It is determined whether the identifier of the API contains a preset keyword. If the API identifier contains the preset keyword, the API is determined to be an invalid API.

[0024] In a possible embodiment, the method further includes:

[0025] An invalid API detection report is obtained based on the preset template and the invalid API, and the invalid API detection report includes invalid API information and the number of invalid APIs.

[0026] According to another aspect of the present invention, there is provided an invalid API detection device, the device comprising:

[0027] A code acquisition module, used to acquire target code;

[0028] A syntax tree acquisition module, used for acquiring a target abstract syntax tree of the target code based on the programming language of the target code, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods;

[0029] An API information acquisition module, configured to acquire target API information of the target code based on the target abstract syntax tree, wherein the target API information includes all APIs contained in the target code and an identifier of each API;

[0030] The detection module is used to detect each of the APIs based on preset detection rules and the target API information to obtain invalid APIs.

[0031] In a possible embodiment, obtaining a target abstract syntax tree of the target code based on the programming language of the target code includes:

[0032] Based on the configuration file of the target code, obtaining the programming language of the target code;

[0033] Determine a corresponding target AST engine based on the programming language of the target code;

[0034] Obtaining a target abstract syntax tree of the target code using the target AST engine;

[0035] The configuration file of the target code also includes a development framework of the target code;

[0036] The step of obtaining a target abstract syntax tree of the target code by using the target AST engine includes:

[0037] Using the target AST engine to obtain a target abstract syntax tree of the target code based on a target conversion relationship, wherein the target conversion relationship is a correspondence between elements and values ​​preset for a development framework of the target code;

[0038] The acquiring target API information of the target code based on the target abstract syntax tree includes:

[0039] Based on the numerical value corresponding to the API, target API information of the target code is obtained from the target abstract syntax tree.

[0040] In a possible embodiment, the detecting each API based on a preset detection rule and the target API information to obtain an invalid API includes:

[0041] For each of the APIs, determine an identifier of the API based on the target API information, wherein the identifier includes a version identifier of the API;

[0042] Determine whether the API is the latest version based on the version identifier, and if the API is not the latest version, determine that the API is an invalid API; and / or,

[0043] It is determined whether the identifier of the API contains a preset keyword. If the API identifier contains the preset keyword, the API is determined to be an invalid API.

[0044] According to another aspect of the present invention, there is provided an electronic device, comprising:

[0045] Processor; and

[0046] Memory for storing programs,

[0047] The program includes instructions, which, when executed by the processor, enable the processor to execute any of the invalid API detection methods described above.

[0048] According to another aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute any of the above-mentioned invalid API detection methods.

[0049] One or more technical solutions provided in the embodiments of the present invention obtain a target abstract syntax tree of the target code based on the programming language of the target code, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods; based on the target abstract syntax tree, obtain target API information of the target code, and the target API information includes all APIs contained in the target code and the identifier of each API; and detect each API based on preset detection rules and the target API information to obtain an invalid API.

[0050] By applying the embodiments of the present invention, invalid APIs can be detected at any time by detecting invalid APIs based on static code, thereby avoiding system security issues that may be caused by the lag in invalid API detection based on traffic flow, improving the efficiency of invalid API detection, and further improving system operation security. Furthermore, the embodiments of the present invention can be applied at any stage of code development, testing, and maintenance, so that relevant personnel can take corresponding measures before invalid APIs are applied, prevent potential performance issues or security vulnerabilities, and further improve system operation security. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Further details, features and advantages of the invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0052] Figure 1 A schematic diagram of a flow chart of an invalid API detection method provided by an embodiment of the present invention;

[0053] Figure 2 A schematic diagram of another process of an invalid API detection method provided by an embodiment of the present invention;

[0054] Figure 3 A schematic diagram of the structure of an invalid API detection device provided by an embodiment of the present invention;

[0055] Figure 4 A block diagram of an exemplary electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0056] Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are only for exemplary purposes and are not intended to limit the scope of protection of the present invention.

[0057] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0058] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0059] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0060] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0061] In order to improve the efficiency of invalid API detection and thus improve the safety of system operation, the embodiments of the present invention provide an invalid API detection method, device, electronic device and storage medium. The invalid API detection method provided by the embodiments of the present invention can be applied to any electronic device with API detection function, which can be a server, a computer or a mobile terminal, etc. The scheme of the present invention is described below with reference to the accompanying drawings:

[0062] Figure 1 A flow chart of an invalid API detection method provided by an embodiment of the present invention may include the following steps:

[0063] S101, obtaining target code;

[0064] S102, based on the programming language of the target code, obtaining a target abstract syntax tree of the target code, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods;

[0065] S103, based on the target abstract syntax tree, obtaining target API information of the target code, wherein the target API information includes all APIs included in the target code and an identifier of each API;

[0066] S104: Detect each of the APIs based on a preset detection rule and the target API information to obtain an invalid API.

[0067] In an embodiment of the present invention, based on the programming language of the target code, a target abstract syntax tree of the target code is obtained, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods; based on the target abstract syntax tree, target API information of the target code is obtained, and the target API information includes all APIs contained in the target code and the identifier of each API; based on preset detection rules and the target API information, each API is detected to obtain an invalid API.

[0068] By applying the embodiments of the present invention, invalid APIs can be detected at any time by detecting invalid APIs based on static code, thereby avoiding system security issues that may be caused by the lag in invalid API detection based on traffic flow, improving the efficiency of invalid API detection, and further improving system operation security. Furthermore, the embodiments of the present invention can be applied at any stage of code development, testing, and maintenance, so that relevant personnel can take corresponding measures before invalid APIs are applied, prevent potential performance issues or security vulnerabilities, and further improve system operation security.

[0069] The following is an exemplary description of S101-S104:

[0070] The target code can be submitted by the user before or after the code is put into use. For example, the user can submit the target code at any time during code writing, code testing, and code maintenance. In a possible embodiment, an invalid API detection function entry can be added to the system used in the enterprise. Relevant personnel can enter the invalid API detection page through the function entry, and then copy the target code to be detected to the corresponding area in the API detection page.

[0071] In a possible embodiment, the user can input storage information of the target code, and the electronic device can obtain the target code based on the storage information to avoid the user from performing a large number of copy operations and improve the user experience. The above storage information may include code library addresses, branches, etc., where a branch is an independent code repository for storing codes for specific services.

[0072] In a possible implementation, the invalid API detection function entry can also be embedded in the code writing page, and relevant personnel can directly enter the function entry when writing the page to perform invalid API detection on the code in the code writing page, thereby further improving the efficiency of invalid API detection.

[0073] After obtaining the target code, you can get the AST (Abstract Syntax Tree) of the target code. The abstract syntax tree is the representation of the abstract syntax structure of the code in the computer memory. Each node in the AST represents a grammatical structure in the code, such as a variable declaration, expression, control structure, class, etc. Each node may include multiple child nodes, which are specific elements contained in the node, such as function name, parameter list, function body, etc.

[0074] In a possible embodiment, an AST engine can be used to obtain the AST of the target code. Since each business line may use different programming languages ​​to write code, in order to adapt to the application environment of multiple programming languages, multiple AST engines can be preset in the embodiment of the present invention, such as a Java AST engine, a Golong AST engine, and a PHP AST engine. The above-mentioned multiple AST engines can analyze, convert, and generate ASTs of corresponding programming languages.

[0075] The AST engine can segment the target code based on a preset lexical unit library to obtain multiple segmentation results (called tokens). The lexical units can include keywords, identifiers, operators, comments, etc. The keywords refer to keywords that can represent methods and classes. Afterwards, the multiple segmentation results can be classified according to the type of the lexical units, and each segmentation result can be converted into AST form according to the structure of the target code. In the embodiment of the present invention, any feasible AST engine can be used to parse the target code by any feasible method. This is only an example and does not impose any limitation on the present invention.

[0076] In a possible embodiment, the invalid API detection method provided by the embodiment of the present invention may further include:

[0077] Based on the configuration file of the target code, obtaining the programming language of the target code;

[0078] Determine a corresponding target AST engine based on the programming language of the target code;

[0079] The target AST engine is used to obtain a target abstract syntax tree of the target code.

[0080] The configuration file of the target code may include the programming language of the target code, the writing personnel information, business information, etc. When it is necessary to generate the AST of the target code, the programming language of the target code can be determined based on the configuration file of the target code, and based on the correspondence between the preset AST engine and the programming language, the target AST engine corresponding to the target code can be determined, and then the AST of the target code is generated using the AST engine adapted to the target code.

[0081] Through the above technical solution, by setting up multiple AST engines, it is possible to detect codes written in different programming languages, thereby expanding the scope of application of invalid API detection.

[0082] After obtaining the AST of the target code, the target AST can be traversed to obtain the API information included therein. As a possible implementation method, in the process of generating the target AST, different word segmentation results will be classified, and different values ​​will be pre-set for different classifications, and the methods, classes or identifiers that constitute the API are usually fixed, that is, the values ​​corresponding to the API are usually fixed values. Therefore, a numerical group can be preset for the API, which can include values ​​corresponding to API-related methods, classes, identifiers, etc., by traversing each node in the target AST, and determining the nodes that meet the preset numerical group as APIs, and using the node information as API information. The above-mentioned node information may include business information, programmer information, and the like.

[0083] In a possible embodiment, developers may write different codes through different development frameworks. A development framework is a software tool that provides a set of common structural specifications and tools to help developers build software applications faster and more efficiently. Taking Java as an example, commonly used development frameworks include Spring, Hibernate, etc. The API-related methods and identifiers used in different development frameworks may be different. As a possible implementation method, different API value groups may be preset for different development frameworks.

[0084] Accordingly, the step of obtaining the target abstract syntax tree of the target code by using the target AST engine includes:

[0085] Using the target AST engine to obtain a target abstract syntax tree of the target code based on a target conversion relationship, wherein the target conversion relationship is a correspondence between elements and values ​​preset for a development framework of the target code;

[0086] In a possible embodiment, different correspondences between elements and values ​​may be set for different development frameworks, such as different values ​​corresponding to different methods, classes or identifiers.

[0087] The acquiring target API information of the target code based on the target abstract syntax tree includes:

[0088] Based on the numerical value corresponding to the API, target API information of the target code is obtained from the target abstract syntax tree.

[0089] In this embodiment, each node in the target AST may include node attributes, which may include the function module identifier, business identifier, etc. corresponding to the node. After determining the relevant nodes of the API, the target API information can be obtained based on the node attributes of the relevant nodes.

[0090] The target API information includes the identifier of each API, business information, etc., wherein the API identifier can be the API name. Then, based on the target API information, it can be detected whether each API is an invalid API. In a possible embodiment, each API can be invalidated by the following steps:

[0091] For each of the APIs, determine an identifier of the API based on the target API information, wherein the identifier includes a version identifier of the API;

[0092] Determine whether the API is the latest version based on the version identifier, and if the API is not the latest version, determine that the API is an invalid API; and / or,

[0093] It is determined whether the identifier of the API contains a preset keyword. If the API identifier contains the preset keyword, the API is determined to be an invalid API.

[0094] For example, in API interface design, iteration through versions is a common practice. For example, in the API identifiers / v1 / getUser and / v2 / getUser, / v1 / getUser may be an earlier, stable API interface, and / v2 / getUser may be an extension or improvement of / v1 / getUser, which may introduce new parameters, increase the returned information, or change the naming or type of certain fields. Such a design allows developers to provide additional functions for new clients or applications without affecting old versions of clients. Since / v1 / getUser has been replaced by / v2 / getUser, the interface corresponding to / v1 / getUser may be a zombie API.

[0095] The keywords in the preset detection rules refer to characters that cannot appear in a valid API identifier. For example, a test identifier can be set for a test API. If the API identifier contains the keyword test, it can be determined that the API is invalid.

[0096] In a possible embodiment, after the invalid API is determined, an invalid API detection report may be obtained based on a preset template and the invalid API, wherein the invalid API detection report includes invalid API information and the number of invalid APIs.

[0097] The above preset template can be set according to the actual application scenario. For example, the invalid API detection report can be set to display various API information in the form of a list. The API information may include API identification, business information, author information, etc. As a possible implementation method, each API information in the target API information can be stored in the form of KV, where the key value is a different information identifier and the value corresponding to the key is the specific value of the information. In this way, by extracting the value corresponding to the information identifier included in the preset template and filling it in the corresponding position in the template, an invalid API detection report can be obtained.

[0098] The invalid API detection report may also include a summary column, in which the number of invalid APIs, the number of functions involved, and the like may be counted.

[0099] In a possible embodiment, the invalid API detection report can also be pushed to a preset client via instant messaging, email, etc., so that relevant personnel can take measures as soon as possible to avoid the threat of invalid API to system security.

[0100] like Figure 2 As shown, Figure 2 Another flowchart of the invalid API detection method provided by the embodiment of the present invention may include the following steps:

[0101] S201. Source code download.

[0102] The source code can be downloaded from the corresponding code repository based on the code repository address, branch and other information entered by the user.

[0103] S202. Develop language recognition.

[0104] In this step, the development language of the source code can be identified based on the source code configuration file, including Java, golang, etc.

[0105] S203. Determine whether there is a parsing engine for the target development language. If so, determine the corresponding AST engine from the preset AST engines, which include: Java AST engine, Golang AST engine, PHP AST engine, etc. If there is no parsing engine for the target development language, end the process.

[0106] S204, using the corresponding AST engine to construct AST according to the source code.

[0107] S205: Identify and obtain API based on AST.

[0108] S206: Invalid API analysis and judgment.

[0109] In this step, whether the API is invalid can be determined by using preset rules, which include version-based rules and keyword-based rules.

[0110] S207: Generate an invalid API detection report.

[0111] By applying the embodiments of the present invention, accurate and efficient detection of zombie APIs in source code can be achieved through the use of API recognition and analysis based on the abstract syntax tree (AST), AST engine selection with multi-language support, and analysis and judgment logic of zombie APIs.

[0112] Based on the same inventive concept, the embodiment of the present invention also provides an invalid API detection device, such as Figure 3 As shown, the device 300 may include:

[0113] The code acquisition module 301 is used to acquire the target code;

[0114] A syntax tree acquisition module 302, configured to acquire a target abstract syntax tree of the target code based on the programming language of the target code, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods;

[0115] An API information acquisition module 303 is used to acquire target API information of the target code based on the target abstract syntax tree, wherein the target API information includes all APIs contained in the target code and identifiers of each API;

[0116] The detection module 304 is used to detect each of the APIs based on a preset detection rule and the target API information to obtain an invalid API.

[0117] In a possible embodiment, obtaining a target abstract syntax tree of the target code based on the programming language of the target code includes:

[0118] Based on the configuration file of the target code, obtaining the programming language of the target code;

[0119] Determine a corresponding target AST engine based on the programming language of the target code;

[0120] Obtaining a target abstract syntax tree of the target code using the target AST engine;

[0121] The configuration file of the target code also includes a development framework of the target code;

[0122] The step of obtaining a target abstract syntax tree of the target code by using the target AST engine includes:

[0123] Using the target AST engine to obtain a target abstract syntax tree of the target code based on a target conversion relationship, wherein the target conversion relationship is a correspondence between elements and values ​​preset for a development framework of the target code;

[0124] The acquiring target API information of the target code based on the target abstract syntax tree includes:

[0125] Based on the numerical value corresponding to the API, target API information of the target code is obtained from the target abstract syntax tree.

[0126] In a possible embodiment, the detecting each API based on a preset detection rule and the target API information to obtain an invalid API includes:

[0127] For each of the APIs, determine an identifier of the API based on the target API information, wherein the identifier includes a version identifier of the API;

[0128] Determine whether the API is the latest version based on the version identifier, and if the API is not the latest version, determine that the API is an invalid API; and / or,

[0129] It is determined whether the identifier of the API contains a preset keyword. If the API identifier contains the preset keyword, the API is determined to be an invalid API.

[0130] Among them, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present invention are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0131] The exemplary embodiment of the present invention further provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor in communication. The memory stores a computer program that can be executed by the at least one processor, and the computer program is used to enable the electronic device to perform a method according to an embodiment of the present invention when executed by the at least one processor.

[0132] Exemplary embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is used to cause the computer to perform a method according to an embodiment of the present invention.

[0133] An exemplary embodiment of the present invention further provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor of a computer, the computer is used to enable the computer to perform a method according to an embodiment of the present invention.

[0134] refer to Figure 4 , a block diagram of an electronic device 400 that can be used as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0135] like Figure 4 As shown, the electronic device 400 includes a computing unit 401, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded from a storage unit 408 into a random access memory (RAM) 403. In the RAM 403, various programs and data required for the operation of the electronic device 400 can also be stored. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0136] A plurality of components in the electronic device 400 are connected to the I / O interface 405, including: an input unit 406, an output unit 407, a storage unit 408, and a communication unit 409. The input unit 406 may be any type of device capable of inputting information to the electronic device 400, and the input unit 406 may receive input digital or character information, and generate key signal inputs related to user settings and / or function control of the electronic device. The output unit 407 may be any type of device capable of presenting information, and may include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 408 may include, but is not limited to, a disk, an optical disk. The communication unit 409 allows the electronic device 400 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks, and may include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0137] The computing unit 401 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 401 performs the various methods and processes described above. For example, in some embodiments, the above-mentioned invalid API detection method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 408. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 400 via the ROM 402 and / or the communication unit 409. In some embodiments, the computing unit 401 may be configured to perform the above-mentioned invalid API detection method by any other appropriate means (e.g., by means of firmware).

[0138] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code can be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0139] In the context of the present invention, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0140] As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0141] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0142] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0143] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

Claims

1. A method for detecting invalid API, characterized in that: The method comprises: Get the object code; Based on the programming language of the target code, obtaining a target abstract syntax tree of the target code, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods; Based on the target abstract syntax tree, acquiring target API information of the target code, the target API information including all APIs included in the target code and identifiers of each of the APIs; Each of the APIs is detected based on the preset detection rules and the target API information to obtain an invalid API.

2. The method according to claim 1, characterized in that The step of obtaining a target abstract syntax tree of the target code based on the programming language of the target code comprises: Based on the configuration file of the target code, obtaining the programming language of the target code; Determine a corresponding target AST engine based on the programming language of the target code; The target AST engine is used to obtain a target abstract syntax tree of the target code.

3. The method according to claim 2, characterized in that The configuration file of the target code also includes a development framework of the target code; The step of obtaining a target abstract syntax tree of the target code by using the target AST engine includes: Using the target AST engine to obtain a target abstract syntax tree of the target code based on a target conversion relationship, wherein the target conversion relationship is a correspondence between elements and values ​​preset for a development framework of the target code; The acquiring target API information of the target code based on the target abstract syntax tree includes: Based on the numerical value corresponding to the API, target API information of the target code is obtained from the target abstract syntax tree.

4. The method according to claim 1, characterized in that: The detecting each of the APIs based on the preset detection rules and the target API information to obtain an invalid API includes: For each of the APIs, determine an identifier of the API based on the target API information, wherein the identifier includes a version identifier of the API; Determine whether the API is the latest version based on the version identifier, and if the API is not the latest version, determine that the API is an invalid API; and / or, It is determined whether the identifier of the API contains a preset keyword. If the API identifier contains the preset keyword, the API is determined to be an invalid API.

5. The method according to claim 1, characterized in that: The method further comprises: An invalid API detection report is obtained based on the preset template and the invalid API, and the invalid API detection report includes invalid API information and the number of invalid APIs.

6. An invalid API detection device, characterized in that: The device comprises: A code acquisition module, used to acquire target code; A syntax tree acquisition module, used for acquiring a target abstract syntax tree of the target code based on the programming language of the target code, wherein the target abstract syntax tree includes various constituent elements included in the target code, and the constituent elements include annotations and methods; An API information acquisition module, configured to acquire target API information of the target code based on the target abstract syntax tree, wherein the target API information includes all APIs contained in the target code and an identifier of each API; The detection module is used to detect each of the APIs based on preset detection rules and the target API information to obtain invalid APIs.

7. The device according to claim 6, characterized in that The step of obtaining a target abstract syntax tree of the target code based on the programming language of the target code comprises: Based on the configuration file of the target code, obtaining the programming language of the target code; Determine a corresponding target AST engine based on the programming language of the target code; Obtaining a target abstract syntax tree of the target code using the target AST engine; The configuration file of the target code also includes a development framework of the target code; The step of obtaining a target abstract syntax tree of the target code by using the target AST engine includes: Using the target AST engine to obtain a target abstract syntax tree of the target code based on a target conversion relationship, wherein the target conversion relationship is a correspondence between elements and values ​​preset for a development framework of the target code; The acquiring target API information of the target code based on the target abstract syntax tree includes: Based on the numerical value corresponding to the API, target API information of the target code is obtained from the target abstract syntax tree.

8. The device according to claim 6, characterized in that The detecting each of the APIs based on the preset detection rules and the target API information to obtain an invalid API includes: For each of the APIs, determine an identifier of the API based on the target API information, wherein the identifier includes a version identifier of the API; Determine whether the API is the latest version based on the version identifier, and if the API is not the latest version, determine that the API is an invalid API; and / or, It is determined whether the identifier of the API contains a preset keyword. If the API identifier contains the preset keyword, the API is determined to be an invalid API.

9. An electronic device, comprising: processor; as well as Memory for storing programs, The program includes instructions, which, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 5.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to make a computer execute the method according to any one of claims 1-5.

Images