Component processing method and device, equipment and storage medium

Abstract

The invention provides a component processing method and device, equipment and a storage medium. The method comprises the following steps: reading a source file list of a to-be-referenced component, and screening and retaining source code files in the source file list to obtain a source code file list; aiming at each source code file in the source code file list, performing path analysis based on class object dependence to obtain a reference class list in one-to-one correspondence with each source code file; performing class component matching based on the group identifier and the component identifier between the reference class list and the vulnerability component feature library; in response to the matched target class component, judging whether the target class component is a class component with an attack behavior or a defect based on a vulnerability component feature library; and if yes, replacing the target class component with a predefined repaired class component in the vulnerability component feature library, and generating a minimum dependency package for the to-be-referenced component replaced with the repaired class component. The invention provides a solution for safely referencing a high-risk component.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a component processing method, device, equipment and storage medium. Background Art

[0002] At present, in order to improve software development efficiency and reduce software development costs, practitioners basically rely on and integrate third-party open source components into their own projects. However, while developers enjoy the benefits brought by third-party components, they also inevitably introduce security risks contained in third-party components. For example, security defects, software vulnerabilities, etc. There are currently two common solutions to deal with the security risks of third-party components. One is to upgrade the component version, and the other is to replace the component. However, if the component is no longer active and no longer upgraded, there may be no fixed version. At this time, developers can only look for alternative components to deal with.

[0003] In the related technology, only tools for analyzing code dependency components are currently provided, and developers have to find upgrade methods based on the dependency component list. There is no complete solution for solving the reference of high-risk components, the upgrade process relies on manual work, and it will incur a large R&D cost.

[0004] Therefore, the present application provides a component processing method, device, equipment and storage medium to solve one of the above technical problems. Summary of the invention

[0005] The purpose of this application is to provide a component processing method, device, equipment and storage medium, which can solve at least one of the technical problems mentioned above. The specific solution is as follows: According to a specific implementation of the present application, in a first aspect, the present application provides a component processing method, comprising: Read the source file list of the component to be referenced, filter and retain the source code files in the source file list, and obtain the source code file list; for each source code file in the source code file list, perform path analysis based on class object dependency to obtain a reference class list corresponding to each source code file; wherein the reference class list is used to mark each class component that does not belong to the source code project to which the source code file belongs; perform class component matching based on group identifier and component identifier between the reference class list and the vulnerability component feature library; in response to matching to a target class component, determine whether the target class component is a class component with attack behavior or defects based on the vulnerability component feature library; if so, replace the target class component with a repaired class component predefined in the vulnerability component feature library, and generate a minimum dependency package for the component to be referenced that is replaced with the repaired class component.

[0006] In one embodiment, the method also includes: initializing the vulnerability component feature library, the vulnerability component feature library at least including the component package name, version number, file MD5, a flag indicating whether secondary packaging is allowed according to the license agreement specifications, the class name with attack behavior or defect, and the repaired class files corresponding to the different attack behavior or defect class names.

[0007] In one embodiment, the method further includes: in response to determining that the target class component allows packaging, retaining all package classes to which the target class component belongs.

[0008] In one embodiment, the method further includes: generating a security advice description document, wherein the security advice description document includes a list of vulnerable components, a list of class files included in the minimum dependency package, a list of stripped class files, and repair suggestions for the components to be referenced.

[0009] In one embodiment, for each source code file in the source code file list, path analysis based on class object dependency is performed to obtain a reference class list corresponding one-to-one to each source code file, including: for each source code file in the source code file list, based on an import keyword and a group identifier and a component identifier of a source code project corresponding to the source code file, a reference class list that does not belong to the source code project is screened to obtain a reference class list as a reference class list corresponding one-to-one to each source code file.

[0010] According to a specific implementation of the present application, in a second aspect, the present application provides a component processing device, including: A processing unit is used to read a source file list of a component to be referenced, filter and retain the source code files in the source file list, and obtain a source code file list; and for performing a path analysis based on class object dependency for each source code file in the source code file list, and obtaining a reference class list corresponding to each source code file one by one; wherein the reference class list is used to mark each class component that does not belong to a source code project to which the source code file belongs; and for performing class component matching between the reference class list and a vulnerability component feature library based on a group identifier and a component identifier; a judgment unit, in response to matching a target class component, judges whether the target class component is a class component with attack behavior or defects based on the vulnerability component feature library; if so, replaces the target class component with a repaired class component predefined in the vulnerability component feature library, and generates a minimum dependency package for the component to be referenced that is replaced with the repaired class component.

[0011] In one embodiment, the processing unit is also used to: initialize the vulnerability component feature library, and the vulnerability component feature library at least includes the component package name, version number, file MD5, a flag indicating whether secondary packaging is allowed according to the license agreement specifications, the class name with attack behavior or defect, and the repaired class files corresponding to different attack behavior or defect class names.

[0012] In one embodiment, the processing unit is further configured to: in response to determining that the target class component allows packaging, retain all package classes to which the target class component belongs.

[0013] According to the specific implementation of the present application, in a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory, characterized in that the processor executes the computer program to implement any one of the methods described in the first aspect.

[0014] According to the specific implementation of the present application, in a fourth aspect, the present application provides a computer-readable storage medium having a computer program / instruction stored thereon, characterized in that when the computer program / instruction is executed by a processor, the method described in any one of the first aspects is implemented.

[0015] Compared with the prior art, the above scheme of the embodiment of the present application has at least the following beneficial effects: The present application provides a component processing method, which can accurately identify reference class components that do not belong to the source code project by reading the source file list of the component to be referenced and performing path analysis of the class object dependency. By matching with the vulnerability component feature library, class components with attack behaviors or defects can be effectively identified and replaced with repaired class components, thereby generating a minimum dependency package. This method not only improves the security of the component, but also reduces the size of the dependency package, improving the security and applicability of the component reference scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flow chart showing a component processing method; Figure 2 A flow chart showing another component processing method; Figure 3 A flow chart showing yet another component processing method; Figure 4 A flow chart showing another component processing method is shown; Figure 5 A schematic diagram of a process for pre-processing a referenced document is shown; Figure 6 A schematic diagram of class dependency in a constant pool is shown; Figure 7A schematic diagram of a hexadecimal bytecode is shown; Figure 8 A unit block diagram of a component processing device according to an embodiment of the present application is shown; Fig. 9 The invention is a block diagram of an electronic device for component processing according to an exemplary embodiment. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0018] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two.

[0019] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0020] It should be understood that although the terms first, second, third, etc. may be used to describe in the embodiments of the present application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, without departing from the scope of the embodiments of the present application, the first may also be referred to as the second, and similarly, the second may also be referred to as the first.

[0021] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0022] It should also be noted that the term "includes", "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, so that a commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprising a ..." do not exclude the existence of other identical elements in the commodity or device including the elements.

[0023] It should be particularly noted that any symbols and / or numbers in the specification that are not marked in the accompanying drawings are not drawing marks.

[0024] At present, in order to improve software development efficiency and reduce software development costs, practitioners basically rely on and integrate third-party open source components into their own projects. However, while developers enjoy the benefits brought by third-party components, they also inevitably introduce security risks contained in third-party components. For example, security defects, software vulnerabilities, etc. There are currently two common solutions to deal with the security risks of third-party components. One is to upgrade the component version, and the other is to replace the component. However, if the component is no longer active and no longer upgraded, there may be no fixed version. At this time, developers can only look for alternative components to deal with.

[0025] In the related technology, only tools for analyzing code dependency components are currently provided, and developers have to find upgrade methods based on the dependency component list. There is no complete solution for solving the reference of high-risk components, the upgrade process relies on manual work, and it will incur a large R&D cost.

[0026] In view of this, the present application provides a component processing method, which aims at a continuous integration environment, based on the vulnerability component feature library, class object dependency path analysis, matching and identifying a set of high-risk component dependency classes, and cutting out a package with minimum security dependencies to achieve safe reference to vulnerable components without affecting business performance and functions.

[0027] The present application can be applied to different types of development projects. For ease of description, the following embodiments are exemplified by Java projects.

[0028] The optional embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0029] The embodiment provided in this application is an embodiment of a component processing method.

[0030] Combine the following Figure 1 The embodiments of the present application are described in detail.

[0031] Figure 1A flowchart of a component processing method is shown, such as Figure 1 As shown, the process includes the following steps S101 to S105.

[0032] Step S101, reading a source file list of a component to be referenced, screening and retaining source code files in the source file list, and obtaining a source code file list.

[0033] Step S102 : performing path analysis based on class object dependency on each source code file in the source code file list to obtain a reference class list corresponding to each source code file.

[0034] The reference class list is used to mark various class components that do not belong to the source code project to which the source code file belongs.

[0035] Step S103, class component matching based on the group identifier and the component identifier is performed between the reference class list and the vulnerability component feature library.

[0036] Step S104, in response to matching the target class component, based on the vulnerability component feature library, it is determined whether the target class component is a class component with attack behavior or defects.

[0037] Step S105: If yes, the target class component is replaced with a repaired class component predefined in the vulnerability component feature library, and a minimum dependency package is generated for the component to be referenced that is replaced with the repaired class component.

[0038] Correspondingly, if not, it means that the target class component is not a vulnerable component and no processing is performed.

[0039] The present application provides a component processing method, which can accurately identify reference class components that do not belong to the source code project by reading the source file list of the component to be referenced and performing path analysis of the class object dependency. By matching with the vulnerability component feature library, class components with attack behaviors or defects can be effectively identified and replaced with repaired class components to generate a minimum dependency package. This method not only improves the security of the component, but also reduces the size of the dependency package, improving the overall performance and reliability of the system.

[0040] In a Java project, read all source files in the project, filter and retain files with the suffix .java, and form a list of source code files. Perform path analysis of class object dependencies on each source code file, extract class components introduced by the import keyword, and generate a list of reference classes. Match these reference class lists with the vulnerability component feature library, and find that MyClass1 has a vulnerability. Use the repaired MyClass1 to replace the original class file, and finally generate a minimum dependency package.

[0041] Figure 2A flowchart showing another component processing method is shown. Figure 2 As shown, the process includes the following steps S201 to S206.

[0042] Step S201, initializing the vulnerability component feature library.

[0043] Among them, the vulnerability component feature library at least includes the component package name, version number, file MD5, a flag indicating whether secondary packaging is allowed according to the license agreement specifications, the class name with attack behavior or defects, and the repaired class files corresponding to different attack behavior or defect class names.

[0044] Step S202, reading the source file list of the component to be referenced, screening and retaining the source code files in the source file list, and obtaining the source code file list.

[0045] Step S203 , for each source code file in the source code file list, path analysis based on class object dependency is performed to obtain a reference class list corresponding to each source code file one by one.

[0046] Step S204: class component matching based on the group identifier and the component identifier is performed between the reference class list and the vulnerability component feature library.

[0047] Step S205, in response to matching the target class component, based on the vulnerability component feature library, it is determined whether the target class component is a class component with attack behavior or defects.

[0048] Step S206: If yes, the target class component is replaced with a repaired class component predefined in the vulnerability component feature library, and a minimum dependency package is generated for the component to be referenced that is replaced with the repaired class component.

[0049] The present application further provides a method for initializing a vulnerability component feature library to ensure that the feature library contains comprehensive component package names, version numbers, file MD5, a flag indicating whether secondary packaging is allowed, class names with attack behaviors or defects, and repaired class files. This enables more accurate identification and processing of high-risk components when performing class component matching, thereby improving the security of the system. When initializing the vulnerability component feature library, known vulnerability information is obtained from the public CVE database, and combined with manual research and judgment, the missing information is supplemented. In this way, high-risk components can be more accurately identified and processed when performing class component matching.

[0050] As a feasible embodiment, the present application can also retain all the package classes to which the target class component belongs when it is determined that the target class component allows packaging.

[0051] This application ensures the normal operation of the project by retaining all the package classes of the target class component after determining that the target class component is allowed to be packaged, ensuring that the generated minimum dependency package contains all necessary class files. This not only improves the security of the system, but also ensures the integrity and stability of the system.

[0052] In this application, there are 6 common open source license agreements that are relatively common and widely used, and each agreement has its specific usage scenarios and constraints. These 6 licenses are GPL, LGPL, MIT, Apache, BSD and Mozilla Public License (MPL), as shown in Table 1 below.

[0053] Table 1

[0054] Among them, the GPL, LGPL, and Mozilla protocols have strict requirements, so it can be considered that the components under these three protocols cannot modify their packaged content, so as to avoid the problem that commercial projects that cannot be open sourced are forced to open source due to the requirements of the protocols. This application only performs the processing described in the above embodiment for components that allow the modification of packaged content.

[0055] Figure 3 A flowchart of another component processing method is shown. Figure 3 As shown, the process includes the following steps S301 to S305.

[0056] Step S301, read the source file list of the component to be referenced, filter and retain the source code files in the source file list, and obtain the source code file list.

[0057] Step S302 , for each source code file in the source code file list, path analysis based on class object dependency is performed to obtain a reference class list corresponding to each source code file.

[0058] The reference class list is used to mark various class components that do not belong to the source code project to which the source code file belongs.

[0059] Step S303: class component matching based on the group identifier and the component identifier is performed between the reference class list and the vulnerability component feature library.

[0060] Step S304, in response to matching the target class component, based on the vulnerability component feature library, it is determined whether the target class component is a class component with attack behavior or defects.

[0061] Step S305: If yes, the target class component is replaced with the repaired class component predefined in the vulnerability component feature library, and a minimum dependency package and a security recommendation description document are generated for the component to be referenced that is replaced with the repaired class component.

[0062] The security advice document includes a list of vulnerable components, a list of class files included in the minimum dependency package, a list of stripped class files, and repair suggestions for components to be referenced.

[0063] For example, after generating the minimum dependency package, a security recommendation document is generated, which includes a list of vulnerable components (such as MyClass1), a list of class files included in the minimum dependency package (such as MyClass1, MyClass2, MyClass3), a list of stripped class files (such as UnusedClass), and repair suggestions (such as regularly updating the dependency library and using the latest repaired version). Developers can perform subsequent maintenance and optimization based on this document to ensure the security and stability of the system.

[0064] This application generates a security advice document, providing a list of vulnerable components, a list of class files included in the minimum dependency package, a list of stripped class files, and repair suggestions for components to be referenced. This allows developers to clearly understand the various information in the processing process, facilitates subsequent maintenance and optimization, and improves the security and maintainability of the system.

[0065] As a feasible embodiment, the path analysis based on class object dependency can be implemented through keyword recognition method.

[0066] Figure 4 A flowchart of another component processing method is shown. Figure 4 As shown, the process includes the following steps S401 to S405.

[0067] Step S401, reading a source file list of a component to be referenced, screening and retaining source code files in the source file list, and obtaining a source code file list.

[0068] Step S402, for each source code file in the source code file list, based on the import keyword and the group identifier and component identifier of the source code project corresponding to the source code file, a reference class list that does not belong to the source code project is screened to serve as a reference class list corresponding to each source code file one by one.

[0069] The reference class list is used to mark various class components that do not belong to the source code project to which the source code file belongs.

[0070] Step S403: class component matching based on the group identifier and the component identifier is performed between the reference class list and the vulnerability component feature library.

[0071] Step S404, in response to matching the target class component, based on the vulnerability component feature library, it is determined whether the target class component is a class component with attack behavior or defects.

[0072] Step S405: If yes, the target class component is replaced with a repaired class component predefined in the vulnerability component feature library, and a minimum dependency package is generated for the component to be referenced that is replaced with the repaired class component.

[0073] For example, when performing path analysis of class object dependencies, read the import keyword in the source code file, combine the group and artifact component package name corresponding to the source code file, and filter out the reference class list that does not belong to the source code project. For example, for import com.example.MyClass1, combined with group com.example and artifact my-library, it is determined that MyClass1 does not belong to the source code project, and it is added to the reference class list. In this way, the generated reference class list is accurate, ensuring that the subsequent processing process goes smoothly.

[0074] This application obtains a reference class list that does not belong to a source code project by screening based on the import keyword and the group identifier and component identifier of the source code project corresponding to the source code file, ensuring that the generated reference class list is accurate. This enables more accurate identification and processing of high-risk components when matching class components, thereby improving the security of the system.

[0075] Figure 5 A schematic diagram of a process for pre-processing a referenced file is shown.

[0076] This application combines the following Figure 5 An embodiment of pre-processing of a document to be cited is shown, including processes S1 to S8.

[0077] S1: Initialize the vulnerability component feature library. Initialize the vulnerability component feature library, the content of which includes: component package name, version number, file MD5, a flag indicating whether secondary packaging is allowed according to the license agreement specification (1 means packaging is allowed, 0 means packaging is not allowed), class names with attack behaviors or defects, and class files that are promptly repaired on the source code according to the vulnerability repair suggestions within the project. Some data comes from the license agreement and CVE information publicly available on the Internet, and some information is a feature library formed by manual research and combined with vulnerability repair suggestions. An example is shown in Table 2 below.

[0078] Table 2

[0079] S2: Read the list of source files to be compiled. Read the list of source files to be compiled, filter and retain the files with the suffix .java, and filter out other types of files to form a list of Java source code files to be analyzed.

[0080] S3: Determine whether there is more to be analyzed in the list. Determine whether the list of Java source code files to be analyzed is empty. If so, proceed to S9; otherwise, select a file to be analyzed from the list and proceed to S4, and mark the file as analyzed.

[0081] S4: Perform class object dependency path analysis. For the source code file to be analyzed, use the class object dependency path analysis method (including but not limited to the keyword identification method), the import keyword, and the group and artifact component package names of the source code project to filter and obtain a list of reference class names that do not belong to the source code project.

[0082] S5: Matching in combination with the vulnerability component feature library. In combination with the vulnerability component feature library, match the referenced class list with the group and artifact component package names of the vulnerability component library. If the match is successful, it means that the referenced class is a high-risk vulnerability component, and further check the value of the flag bit to see whether it is allowed to be packaged. If the flag bit is 1, secondary packaging is allowed and enter S6; if the flag bit is 0, packaging is not allowed, jump to S2, and record the name of the discovered vulnerability component.

[0083] Figure 6 A schematic diagram of class dependencies in a constant pool is shown.

[0084] S6: Save the classes in the directly dependent third-party packages and the project's own classes that they reference. According to the classes in the directly dependent third-party packages, in order to ensure that these classes can be executed normally, it is necessary to find and retain the project's own classes that these classes reference. Find the class file corresponding to the class in the directly dependent third-party package, and through bytecode technical analysis, there is reference class information in the bytes described in the constant pool (ConstantPool). Find the CONSTANT_Class_info entries in the constant pool. These entries point to specific types and contain references to other classes or interfaces. For example, an entry of the form #N = Class #M / / fully / qualified / ClassName, where fully / qualified / ClassName is the fully qualified name of the dependent class, see Figure 6 .

[0085] For example, we filter the project's own component package name to get a set of classes that reference the project itself. We keep recursively calling the classes in the set and record the new class information we find until no new classes appear or another third-party component class is found. At this point, the project's own class set will be a minimum set of runtime dependency classes.

[0086] Figure 7A schematic diagram of a hexadecimal bytecode is shown.

[0087] For example, class bytecode is a specific binary file format that can be recognized and executed by the Java virtual machine. It is a set of binary streams based on 8-bit bytes. Each data item is arranged in a strict order in the class file without any separators. This makes the content stored in the entire class file almost all the necessary data for the program to run. For class bytecode examples, refer to Figure 7 For a description of the meaning of the bytecode content, please refer to Table 3 below.

[0088] Table 3

[0089] S7: Determine whether the directly referenced class matches the attack behavior or defect class. Combined with the vulnerability component feature library, determine whether the directly referenced class matches the attack behavior or defect class. If the match is successful, the repaired class file in the vulnerability component library is used to replace the original vulnerable class file; if the match is not successful, proceed to S8.

[0090] S8: Record and save the classes in the third-party packages that are directly dependent and the classes of the project itself that are directly referenced. Record and save the classes in the third-party packages that are directly dependent and the classes of the project itself that are directly referenced. It will be convenient to merge them together into the minimum dependency package later. Then loop again and enter S2.

[0091] S9: Output the minimum dependency package. After all the files to be analyzed are completed, if the class set that directly depends on the third-party package is not empty, this step will output the minimum dependency JAR package according to the JAR package specification. Based on the vulnerability component information collected in the previous judgment logic and the process information of the minimum dependency package, a security recommendation document is output at the same time. The security recommendation document includes a list of identified high-risk vulnerability components, a list of class files included in the minimum dependency package, a list of stripped class files, and repair suggestions for the components to be referenced.

[0092] For example, when installing the minimum dependency package, you need to pay attention to the following specifications: Use the jar command and parameters that come with JDK to package and avoid problems caused by compression. For example, use jar -cvfM0 HelloWorld.jar, which can create an uncompressed JAR file. Keep the necessary metadata, ensure that the META-INF / MANIFEST.MF file is correctly configured when packaging, specify the main class (Main-Class), packaged JDK version information, etc., which is very necessary for running JAR files. The contents of the manifest file usually include: Manifest-Version: 1.0; Created-By: JDK version; Class-Path: dependent JAR package path (optional); Main-Class: the full name of the main class (optional).

[0093] Reasonably organize the project directory structure, for example, name the class files according to the package and put them into the corresponding folder. Following the above points, you can successfully type out the normal minimum security dependency package.

[0094] The present application also provides an apparatus embodiment that is consistent with the above embodiment, which is used to implement the method steps of the above embodiment. The explanation based on the same name meaning is the same as the above embodiment, and has the same technical effect as the above embodiment, which will not be repeated here.

[0095] like Figure 8 As shown, the present application provides a component processing device 800, including: Processing unit 801 is used to read the source file list of the component to be referenced, filter and retain the source code files in the source file list, and obtain a source code file list. And for each source code file in the source code file list, respectively, to perform path analysis based on class object dependency to obtain a reference class list corresponding to each source code file. Among them, the reference class list is used to mark each class component that does not belong to the source code project to which the source code file belongs. And for matching class components based on group identifiers and component identifiers between the reference class list and the vulnerability component feature library. Judgment unit 802, in response to matching the target class component, determines whether the target class component is a class component with attack behavior or defects based on the vulnerability component feature library. If so, the target class component is replaced with a repaired class component predefined in the vulnerability component feature library, and a minimum dependency package is generated for the component to be referenced that is replaced with the repaired class component.

[0096] In one embodiment, the processing unit 801 is also used to: initialize the vulnerability component feature library, which includes at least the component package name, version number, file MD5, a flag indicating whether secondary packaging is allowed according to the license agreement specifications, the class name with attack behavior or defect, and the repaired class files corresponding to different attack behavior or defect class names.

[0097] In one implementation, the processing unit 801 is further configured to: in response to determining that the target class component allows packaging, retain all package classes to which the target class component belongs.

[0098] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0099] Fig. 9 is a block diagram of an electronic device 900 for component processing according to an exemplary embodiment.

[0100] like Fig. 9 As shown, an embodiment of the present application provides an electronic device 900. The electronic device 900 includes a memory 901, a processor 902, and an input / output (I / O) interface 903. The memory 901 is used to store instructions. The processor 902 is used to call the instructions stored in the memory 901 to execute the component processing method of the embodiment of the present application. The processor 902 is connected to the memory 901 and the I / O interface 903, respectively, for example, through a bus system and / or other forms of connection mechanisms (not shown). The memory 901 can be used to store programs and data, including programs of the component processing methods involved in the embodiments of the present application, and the processor 902 executes various functional applications and data processing of the electronic device 900 by running the programs stored in the memory 901.

[0101] In the embodiment of the present application, the processor 902 can be implemented in at least one hardware form of a digital signal processor (Digital Signal Processing, DSP), a field programmable gate array (Field Programmable Gate Array, FPGA), and a programmable logic array (Programmable Logic Array, PLA). The processor 902 can be a central processing unit (Central Processing Unit, CPU) or one or a combination of other forms of processing units with data processing capabilities and / or instruction execution capabilities.

[0102] The memory 901 in the embodiment of the present application may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD), etc.

[0103] In the embodiment of the present application, the I / O interface 903 may be used to receive input instructions (such as digital or character information, and key signal input related to user settings and function control of the electronic device 900), and may also output various information to the outside (such as images or sounds). In the embodiment of the present application, the I / O interface 903 may include one or more of a physical keyboard, a function key (such as a volume control key, a switch key, etc.), a mouse, a joystick, a trackball, a microphone, a speaker, a touch panel, etc.

[0104] In some embodiments, the present application provides a computer-readable storage medium, which stores computer-executable instructions. When the computer-executable instructions are executed by a processor, any of the methods described above is performed.

[0105] In some embodiments, the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, any of the methods described above is performed.

[0106] Although operations are described in a particular order in the drawings, this should not be understood as requiring that the operations be performed in the particular order shown or in serial order, or that all shown operations be performed to achieve desired results. In certain circumstances, multitasking and parallel processing may be advantageous.

[0107] The methods, devices, equipment and storage media of the present application can be implemented using standard programming techniques, using rule-based logic or other logic to implement various method steps. It should also be noted that the words "device" and "module" used herein and in the claims are intended to include implementations using one or more lines of software code and / or hardware implementations and / or devices for receiving input.

[0108] Any steps, operations or procedures described herein may be performed or implemented using one or more hardware or software modules, either alone or in combination with other devices. In one embodiment, the software module is implemented using a computer program product including a computer-readable medium containing computer program code, which can be executed by a computer processor to perform any or all of the described steps, operations or procedures.

[0109] The foregoing description of the implementation of the present application has been given for the purpose of illustration and description. The foregoing description is not exhaustive nor is it intended to limit the present application to the exact form disclosed, and various variations and modifications may exist according to the above teachings or may be obtained from the practice of the present application. These embodiments are selected and described in order to illustrate the principles of the present application and its practical application, so that those skilled in the art can utilize the present application in various embodiments and various modifications suitable for the specific purpose contemplated.

[0110] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0111] It can be further understood that, unless otherwise specified, “connection” includes a direct connection without other components between the two, and also includes an indirect connection with other components between the two.

[0112] It is further understood that, although the operations are described in a specific order in the drawings in the embodiments of the present application, it should not be understood as requiring the operations to be performed in the specific order or serial order shown, or requiring the execution of all the operations shown to obtain the desired results. In certain environments, multitasking and parallel processing may be advantageous.

[0113] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to encompass any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the field of the present application that are not disclosed in the present application. The specification and embodiments are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following scope of rights.

[0114] It should be understood that the present application is not limited to the precise structures described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the scope of the appended claims.

[0115] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A component processing method, characterized in that: The following steps are involved: Reading a source file list of a component to be referenced, filtering and retaining source code files in the source file list, and obtaining a source code file list; For each source code file in the source code file list, path analysis based on class object dependency is performed to obtain a reference class list corresponding to each source code file one by one; wherein the reference class list is used to mark each class component that does not belong to the source code project to which the source code file belongs; Performing class component matching based on group identifiers and component identifiers between the reference class list and the vulnerability component feature library; In response to matching a target class component, judging whether the target class component is a class component having attack behavior or defects based on the vulnerability component feature library; If so, the target class component is replaced with a repaired class component predefined in the vulnerability component feature library, and a minimum dependency package is generated for the component to be referenced that is replaced with the repaired class component.

2. The method according to claim 1, characterized in that: The method further comprises: Initialize the vulnerability component feature library, which at least includes the component package name, version number, file MD5, a flag indicating whether secondary packaging is allowed according to the license agreement specifications, the class name with attack behavior or defect, and the repaired class files corresponding to different attack behavior or defect class names.

3. The method according to claim 1, characterized in that The method further comprises: In response to determining that the target class component allows packaging, all package classes to which the target class component belongs are retained.

4. The method according to claim 1, characterized in that: The method further comprises: Generate a security advice description document, which includes a list of vulnerable components, a list of class files included in the minimum dependency package, a list of stripped class files, and repair suggestions for the components to be referenced.

5. The method according to claim 1, characterized in that The path analysis based on class object dependency is performed for each source code file in the source code file list to obtain a reference class list corresponding to each source code file, including: For each source code file in the source code file list, based on the import keyword and the group identifier and component identifier of the source code project corresponding to the source code file, a reference class list that does not belong to the source code project is screened to serve as a reference class list corresponding to each source code file one by one.

6. A component processing device, characterized in that: include: A processing unit, configured to read a source file list of a component to be referenced, filter and retain source code files in the source file list, and obtain a source code file list; and for performing path analysis based on class object dependency for each source code file in the source code file list, respectively, to obtain a reference class list corresponding to each source code file one by one; wherein the reference class list is used to mark each class component that does not belong to the source code project to which the source code file belongs; and for performing class component matching between the reference class list and the vulnerability component feature library based on the group identifier and the component identifier; The judgment unit, in response to matching a target class component, judges whether the target class component is a class component with attack behavior or defects based on the vulnerability component feature library; if so, replaces the target class component with a repaired class component predefined in the vulnerability component feature library, and generates a minimum dependency package for the component to be referenced that is replaced with the repaired class component.

7. The device according to claim 6, characterized in that The processing unit is also used for: Initialize the vulnerability component feature library, which at least includes the component package name, version number, file MD5, a flag indicating whether secondary packaging is allowed according to the license agreement specifications, the class name with attack behavior or defect, and the repaired class files corresponding to different attack behavior or defect class names.

8. The device according to claim 6, characterized in that The processing unit is also used for: In response to determining that the target class component allows packaging, all package classes to which the target class component belongs are retained.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the method according to any one of claims 1 to 5.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images