Vulnerability repairing method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention discloses a vulnerability repairing method and device, equipment, a storage medium and a program product, and belongs to the technical field of information security. The method comprises the following steps: under the condition that a vulnerability exists in a code project, performing step-by-step inspection on a functional component based on a dependency relationship of the functional component in the code project to obtain an inspection result; determining the first functional component as a to-be-upgraded component under the condition that the inspection result indicates that the first functional component has the vulnerability and the second functional component on which the first functional component depends does not have the vulnerability, or the first functional component has the vulnerability and the first functional component does not have the second functional component on which the first functional component depends; version upgrading is conducted on the first functional component in the component code package, and the first functional component after version upgrading does not have vulnerabilities. By adopting the scheme provided by the embodiment of the invention, when the vulnerability exists in the code project, the reason for causing the vulnerability can be determined, and targeted repair can be performed.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular to vulnerability repair methods, devices, equipment, storage media and program products. Background Art

[0002] With the continuous development of the software industry, modern software has evolved from a monolithic model to a large-scale collaborative model represented by open source software. Complex software often involves many open source components, and the security and reliability of the software are closely related to its complexity. However, most open source components have security vulnerabilities.

[0003] In the related art, the software vulnerability database records the vulnerability information of various open source components. Generally, by querying whether the vulnerability information collected in the vulnerability database contains the functional components that the software program depends on, it is determined whether the software program has a security vulnerability. After determining that there is a security vulnerability, the version of the open source component that the software program directly depends on is upgraded to fix the vulnerability.

[0004] However, in the solutions provided in the related art, it is often only possible to upgrade the open source functional components that the software program directly depends on. Since the directly applied open source components may be relatively large, the workload of directly upgrading the components is large, resulting in poor applicability. Summary of the invention

[0005] The embodiments of the present application provide a vulnerability repair method, device, equipment, storage medium and program product. The scheme is as follows:

[0006] On the one hand, an embodiment of the present application provides a vulnerability repair method, the method comprising:

[0007] In the case where there are vulnerabilities in the code project, based on the dependency relationships of the functional components in the code project, the functional components are inspected level by level to obtain inspection results;

[0008] When the inspection result indicates that the first functional component has a vulnerability, and the second functional component on which the first functional component depends does not have a vulnerability, or when the first functional component has a vulnerability, and the first functional component does not have a second functional component on which it depends, determining that the first functional component is a component to be upgraded;

[0009] The first functional component in the component code package is upgraded to a version, wherein the first functional component after the version upgrade has no vulnerability.

[0010] On the other hand, the present application provides a vulnerability repair device, the device comprising:

[0011] A test module, used to test the functional components level by level based on the dependency relationship of the functional components in the code project when there are vulnerabilities in the code project, and obtain test results;

[0012] a determination module, configured to determine that the first functional component is a component to be upgraded if the inspection result indicates that the first functional component has a vulnerability and the second functional component on which the first functional component depends does not have a vulnerability, or if the first functional component has a vulnerability and the first functional component does not have a second functional component on which it depends;

[0013] An upgrade module is used to upgrade the version of the first functional component in the component code package, wherein the first functional component after the version upgrade has no vulnerabilities.

[0014] On the other hand, an embodiment of the present application provides a computer device, which includes a processor and a memory; the memory stores at least one instruction, and the at least one instruction is used to be executed by the processor to implement the vulnerability repair method described in the above aspect.

[0015] On the other hand, an embodiment of the present application provides a computer-readable storage medium, in which at least one program code is stored, and the program code is loaded and executed by a processor to implement the vulnerability repair method as described in the above aspects.

[0016] On the other hand, an embodiment of the present application provides a computer program product, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the vulnerability repair method provided in various optional implementations of the above aspects.

[0017] In the embodiment of the present application, when there are vulnerabilities in the code engineering, the computer device checks the functional components level by level based on the dependency relationship of the functional components in the code engineering to check the vulnerabilities in the functional components, thereby determining the first functional component to be upgraded, and upgrading the first function. The vulnerability repair method proposed in the embodiment of the present application can determine the low-level dependent functional component that needs to be repaired according to the dependency relationship, and repair the vulnerability of the code engineering by upgrading the functional component, thereby reducing the workload of vulnerability repair, and has stronger applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 A flowchart of a vulnerability repair method provided by an exemplary embodiment of the present application is shown;

[0020] Figure 2 A schematic diagram showing the dependency relationship of functional components provided by an exemplary embodiment of the present application is shown;

[0021] Figure 3 A flowchart of a step-by-step inspection process provided by an exemplary embodiment of the present application is shown;

[0022] Figure 4 A schematic diagram of a step-by-step inspection provided by an exemplary embodiment of the present application is shown;

[0023] Figure 5 A flow chart of a version upgrade process provided by an exemplary embodiment of the present application is shown;

[0024] Figure 6 A schematic diagram of performing vulnerability repair provided by an exemplary embodiment of the present application is shown;

[0025] Figure 7 A flowchart of vulnerability detection and repair provided by an exemplary embodiment of the present application is shown;

[0026] Figure 8 A structural block diagram of a vulnerability repair device provided by an exemplary embodiment of the present application is shown;

[0027] Fig. 9 A structural block diagram of a computer device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0029] For ease of understanding, the nouns involved in the embodiments of the present application are explained below.

[0030] Code Engineering: Usually, during the development of a program, the source code of the program is stored in a dedicated folder. This dedicated folder for the current program is the project file. Code engineering is a program that can be installed and run, and the project file serves as a support for running the application.

[0031] Functional components: Functional components are open source software that code engineering relies on to support programs to complete different functions. Code engineering relies on functional components, and there may also be dependencies between different functional components.

[0032] Vulnerability: A vulnerability refers to a defect in the specific implementation of hardware, software, or a protocol or in the system security policy. That is, a vulnerability refers to a certain type of problem that occurs in hardware, software, or a protocol at various stages of its life cycle. These problems may affect the security of the system, such as the confidentiality, security, and availability of the system. In the embodiments of the present application, a vulnerability refers to a vulnerability at the software level.

[0033] Nowadays, software has evolved from a monolithic model to a modeled collaborative model represented by open source software. Complex software involves many open source software. And there are often complex dependencies between these open source software. It can be seen that open source software has become a part of the modern information industry. However, open source software also has certain security risks. During the program development process, if open source software with vulnerabilities is applied in the code project, the code project will also face security risks because of the application of open source software with vulnerabilities.

[0034] In order to mitigate the security risks brought by open source software vulnerabilities, various vulnerability methods have been proposed in the related art for open source software. In the solutions provided in the related art, usually, based on the functional components with vulnerabilities that the code engineering directly depends on as shown in the vulnerability database, the code engineering that directly depends on the functional components is determined to have security vulnerabilities. In addition, the functional components with security vulnerabilities that the code engineering directly uses are upgraded to repair the vulnerabilities of the code engineering.

[0035] However, since the software structure is relatively large and the number of functional components it relies on is large, in this case, the amount of work required to upgrade the code engineering using the solutions provided by the relevant technologies is large, resulting in poor applicability of the relevant technologies.

[0036] In response to the problems of the above-mentioned related technologies, the embodiments of the present application provide a method for patching vulnerabilities, which can effectively avoid large-scale upgrades of functional components that code engineering relies on, and can upgrade functional components that actually have vulnerabilities, and has strong applicability.

[0037] Figure 1 A flowchart of a vulnerability repair method provided by an exemplary embodiment of the present application is shown, and the method includes:

[0038] Step 101, when there are vulnerabilities in the code project, based on the dependency relationship of the functional components in the code project, the functional components are checked level by level to obtain the test results.

[0039] Generally, if functional component A depends on functional component B, when there is a vulnerability in functional component B, the vulnerability database will record that functional component A also has a vulnerability, or when there is a vulnerability in the code of functional component A itself, functional component A has a vulnerability. Therefore, when a code project depends on functional component A with a vulnerability, the vulnerability database will also store that the code project has a vulnerability.

[0040] However, when it is determined that functional component A has a vulnerability, it will be a large amount of work to directly upgrade functional component A. Therefore, when there is no code vulnerability in the code of functional component A itself, the functional component to be upgraded that causes the dependency vulnerability in functional component A can be determined through a step-by-step inspection method.

[0041] The dependency relationship of functional components in a code project includes direct dependency and indirect dependency, where a direct dependency relationship is formed between a functional component directly called by a code project and the code project, or a direct dependency relationship is formed between a kinetic component and another functional component directly called, and an indirect dependency relationship is formed between the code project and another functional component called by the directly called kinetic component. For example, functional component A depends on functional component B, and functional component B depends on functional component C, then the dependency relationship of functional component A on functional component B and functional component B on functional component C becomes a direct dependency relationship, and the dependency relationship of functional component A on functional component C becomes an indirect dependency relationship.

[0042] Indicative, Figure 2 A schematic diagram of the functional component dependency relationship provided by an exemplary embodiment of the present application is shown, which includes three functional component dependency modes. In mode 1, code engineering 1 directly depends on functional component A1, functional component A2 and functional component A3. Among them, code engineering A1, functional component A2 and functional component A3 all have a direct dependency relationship with code structure 1. In mode 2, code engineering 2 directly depends on functional component A, functional component A directly depends on functional component B, and functional component B directly depends on functional component C. Among them, in functional component mode 3, code engineering 3 directly depends on functional component A, functional component A directly depends on functional component B, and functional component B directly depends on functional component C, and the functional components of subsequent levels depend on the functional components of the next level in turn, until the functional components of the X-1th level are directly dependent on the X-1th functional component. Among them, the code function has an indirect dependency relationship with other functional components except functional component A.

[0043] like Figure 2In mode 2, functional component A, functional component B and functional component C form a hierarchical relationship. It should be noted that in a code project, there may be multiple functional components of the next level that each functional component of each level depends on. The figure only illustrates the dependency relationship between functional components of different levels with one functional component in each level, and does not limit the number of functional components in each level.

[0044] The inspection results are used to indicate the presence of vulnerabilities in different functional components at each level.

[0045] Step 102, when the inspection result indicates that the first functional component has a vulnerability and the second functional component on which the first functional component depends does not have a vulnerability, or when the first functional component has a vulnerability and the first functional component does not have a second functional component on which it depends, determine that the first functional component is a component to be upgraded.

[0046] In the process of determining the components to be upgraded according to the inspection results, the computer device mainly continues to perform the next level of vulnerability inspection based on the situation that a functional component itself has a vulnerability.

[0047] Wherein, when the inspection result indicates that the first functional component has a vulnerability, and the second functional component on which the first functional component depends does not have a vulnerability, the first functional component is determined to be a component to be upgraded. In this case, it can be determined that the reason why the vulnerability occurs in the first functional component is not due to the dependency on the functional component with the vulnerability, but due to its own reasons. Therefore, it can be determined that the first functional component is an upgradeable functional component.

[0048] In another case, when the inspection result indicates that the first functional component has a vulnerability, and the first functional component does not have a dependent second functional component, it can be determined that the first functional component does not rely on other functional components, and it can be determined that the reason why the vulnerability occurs in the first functional component is not due to the dependency on the vulnerable functional component, but due to its own reasons. Therefore, the first functional component is determined to be the component to be upgraded.

[0049] Step 103: performing a version upgrade on the first functional component in the component code package, wherein the first functional component after the version upgrade has no vulnerability.

[0050] After determining that the component to be upgraded is a candidate for the first functional component, assuming that the current version of the first functional component is version 1.0, you can search for a version without vulnerabilities in other released versions of the first functional component, such as version 3.0, and replace it with version 1.0 of the first functional component in the component code package.

[0051] The component code package refers to the collection of codes of all functional components that the code project relies on during its operation. The code project together constitutes the running program package of the application.

[0052] In summary, in the embodiment of the present application, when there are vulnerabilities in the code engineering, the computer device checks the functional components step by step based on the dependency relationship of the functional components in the code engineering to check the vulnerabilities in the functional components, thereby determining the first functional component to be upgraded, and upgrading the first function. The vulnerability repair method proposed in the embodiment of the present application can determine the low-level dependent functional components that need to be repaired according to the dependency relationship, and repair the vulnerabilities in the code engineering by upgrading the functional components, thereby reducing the workload of vulnerability repair, and has stronger applicability.

[0053] Based on the dependency relationship of functional components in the code engineering, it is necessary to perform a level-by-level inspection on the functional components. During the inspection process, it is necessary to determine whether there are vulnerabilities in the functional components through the vulnerability database to obtain the inspection results. The following will illustrate the level-by-level inspection process through an exemplary embodiment:

[0054] Figure 3 A flowchart of a step-by-step inspection process provided by an exemplary embodiment of the present application is shown.

[0055] The process includes:

[0056] Step 301, obtaining a vulnerability database, wherein the vulnerability database contains functional components with vulnerabilities.

[0057] The vulnerability database is a platform for collecting, maintaining and sharing open source software with discovered vulnerabilities. To obtain the vulnerability database, you can call the vulnerability database stored locally or download it from the information published by the known vulnerability database platform.

[0058] The vulnerability database contains functional components that have been publicly disclosed to have vulnerabilities.

[0059] Step 302, based on the dependencies of the functional components in the code project, obtain the dependency list level by level.

[0060] The dependency list is used to indicate the functional components of the next level that the functional components of the previous level depend on. For example, if the code project directly depends on functional components A1, A2, and A3, each functional component has its own functional component identifier, and the functional component identifier is a unique identifier used by the computer device to distinguish different functional components. There are directly dependent functional components in the code project. For example, Table 1 shows a dependency list.

[0061] Table 1

[0062]

[0063] A1-AN are component identifiers of functional components A1 to AN. The code project directly depends on N functional components. Optionally, the dependency list also includes version numbers of the dependent code components to distinguish different versions of the same functional component.

[0064] Moreover, for code engineering, each functional component in each level corresponds to a dependency list, which is used to indicate the functional components of the next level on which the functional component depends. Optionally, the dependencies of different functional components are obtained by searching the functional components on the Anji device, or the dependency list of the functional group can be obtained from the open source software management platform, which is not limited in this embodiment.

[0065] Table 2 shows a list of dependencies for a functional component.

[0066] Table 2

[0067]

[0068] Among them, B1-BN are component identifiers of functional components B1 to functional components BN, and functional component A1 directly depends on N functional components.

[0069] Step 303, based on the dependency lists at different levels, query the vulnerability database to obtain the test results, which are used to indicate the vulnerability status of the functional components at different levels.

[0070] Different functional components in different levels have corresponding dependency lists. Based on the dependency lists corresponding to different working parts, the vulnerability database is queried, and the functional components in the dependency list are compared with the components with vulnerabilities in the vulnerability database to find out whether the functional components in the dependency list exist in the vulnerability database.

[0071] The search process is a step-by-step search process, that is, the dependency list of the upper layer is checked first to find the functional components with vulnerabilities, and then based on the dependency list of the functional components with vulnerabilities, the database is searched to obtain the test results.

[0072] In a possible implementation, there are n levels of dependency between the functional components that the code engineering depends on, and the code engineering directly depends on the functional components of the first level.

[0073] That is, the code engineering directly depends on the functional components of the first level, the functional components of the first level depend on the functional components of the second level, and so on.

[0074] Get the dependency list of the k-th functional component with a vulnerability in the k-th level.

[0075] The dependency list includes the functional component at the k+1th level that the kth functional component directly depends on, where k is greater than or equal to 1 and k is less than or equal to n;

[0076] For example, when k is equal to 4, the computer device obtains a dependency list of the fourth functional component in the fourth level, which includes all functional components that the fourth functional component directly depends on, and these functional components are functional components in the fifth level.

[0077] Then, the computer device determines the k+1th functional component with a vulnerability in the k+1th level by searching the vulnerability database. For example, the fourth functional component directly depends on functional component A, functional component B, and functional component C, and the functional component with a vulnerability among functional component A, functional component B, and functional component C is determined by searching the vulnerability database.

[0078] Please refer to Figure 4 , which shows a schematic diagram of a step-by-step inspection provided by an exemplary embodiment of the present application, in which the components in the code engineering directly depend on functional components A1, functional components A2, and functional components A3. By searching the vulnerability database, it is determined that functional components A1 and functional components A3 have vulnerabilities. Subsequently, the computer device obtains the dependency list corresponding to functional components A1 and functional components A3, and the dependency list indicates that functional component A1 directly depends on functional components B1 and functional components B2, and functional component A3 directly depends on functional components B4, functional components B3, and functional components B5. Subsequently, the computer device determines that functional components B5 and functional components B2 have vulnerabilities by searching the vulnerability database. The computer device loads the dependency list corresponding to functional components B5 and functional components B2 that do not have vulnerabilities, and performs inspections. Finally, the inspection determines that functional components C1 and functional components C4 are components to be upgraded. In the figure, functional components A1, functional components A2, and functional components A3 are functional components of the first level, and functional components B1, functional components B2, functional components B4, functional components B3, and functional components B5 are functional components of the second level. Functional component C1 , functional component C2 , functional component C3 and functional component C4 are functional components of the third level.

[0079] In the embodiment of the present application, the verification result is obtained by searching the vulnerability database based on the hierarchical dependency relationship. In this process, only the next-level functional components in the dependency list of the functional components with vulnerabilities are verified, which is beneficial to reduce the amount of data for verification, and can specifically search for the functional components that cause code engineering vulnerabilities, thereby more efficiently determining the components to be upgraded.

[0080] Generally, the vulnerability database includes functional components with vulnerabilities and the reasons for the vulnerabilities. Therefore, when determining to conduct an inspection, it is also necessary to determine whether the reason for the vulnerability in the functional component is a code vulnerability in the functional component itself, or a dependency vulnerability caused by a vulnerability in the functional component it depends on. If it is determined that the functional component has a code vulnerability, there is no need to continue to inspect the next-level functional components that the functional component depends on. The functional component in the component code package can be upgraded to resolve the code vulnerability in the functional component. The specific process is as follows:

[0081] In the process of querying the vulnerability database, the computer device queries the vulnerability database based on the dependency lists at different levels to obtain the test results.

[0082] The inspection results are used to indicate the vulnerability status of functional components at different levels and the reasons why the functional components have vulnerabilities. The reasons for the vulnerabilities include code vulnerabilities in the functional components and dependency vulnerabilities in the functional components.

[0083] After determining that there is a code vulnerability, in order to fix the vulnerability, the functional component with the code vulnerability needs to be upgraded so that the vulnerability does not exist.

[0084] Subsequently, when the inspection result indicates that the first functional component has a vulnerability, and the first functional component indicates that the functional component has a code vulnerability, the first functional component is determined to be a component to be upgraded.

[0085] Optionally, during the step-by-step inspection process, if it is determined that the cause of the vulnerability in the first functional component is a code vulnerability, there is no need to obtain the dependency component of the first functional component, and the first functional component can be directly determined as the component to be upgraded.

[0086] After detecting the first functional component that causes the vulnerability in the code project, the first functional component needs to be upgraded. However, during the application process, the upgraded first functional component may be incompatible with the third functional component that depends on the first functional component. In these cases, the third functional component also needs to be upgraded to ensure that the functional software after the version upgrade is compatible with the functional software of the upper level that depends on the functional software, thereby ensuring the normal operation of the code project.

[0087] Figure 5 A flowchart of a version upgrade process provided by an exemplary embodiment of the present application is shown, and the process includes:

[0088] Step 501: When a third functional component that depends on a first functional component is incompatible with the first functional component after the version upgrade, a target functional component is determined based on the dependency relationship.

[0089] The third functional component depends on the first functional component, which may be reflected in the calling of the first functional component during the running of the third functional component. Since the way the third functional component calls the first functional component cannot be modified in the code engineering, after the first functional component is upgraded, the rule of the third functional component calling the first functional component may not be applicable to the upgraded first functional component, resulting in the situation that the third functional component is incompatible with the upgraded first functional component. Therefore, the computer device needs to determine whether the third functional component is compatible with the upgraded first functional component.

[0090] Optionally, the computer device may determine whether the first functional component is compatible with the upgraded first functional component by searching a compatible component version list of the third functional component to find the version of the first functional component that the third functional component is compatible with. The compatible component version list may be obtained from an open source platform of the third functional component.

[0091] Specifically, in the case that the k-1th functional component that depends on the k-th functional component is incompatible with the k-th functional component after the version upgrade, the k-1th functional component after the version upgrade is queried.

[0092] For example, when k is equal to 4, if the third functional component that depends on the fourth functional component is not compatible with the fourth functional component after the version upgrade, the fourth functional component needs to be upgraded, and the computer device queries the third functional component after the version upgrade.

[0093] Subsequently, in a case where the k-2th functional component that depends on the k-1th functional component is compatible with the upgraded k-1th functional component, the k-1th functional component is determined as a target functional component.

[0094] For example, when the second functional component that depends on the third functional component is compatible with the upgraded third functional component, the second functional component is determined as the target functional component.

[0095] Optionally, in the case that the k-2th functional component on which it depends is incompatible with the upgraded k-1th functional component, the k-2th functional component after the upgraded version is queried.

[0096] Step 502: perform version upgrade on the target functional component in the component code package.

[0097] The fourth functional component that depends on the target functional component is compatible with the target functional component after the upgrade. The target functional component is the component to be upgraded.

[0098] The specific implementation of this step can refer to the above step 103, and this embodiment will not elaborate on it.

[0099] The k-1th functional component in the component code package is upgraded. The process of upgrading the version is to replace the k-1th functional component of the current version in the component code package with the k-1th functional component after the version upgrade. Moreover, the k-1th functional component after the version upgrade does not have a vulnerability.

[0100] Indicative, Figure 6 A schematic diagram of vulnerability repair provided by an exemplary embodiment of the present application is shown, wherein the code engineering directly depends on functional component A, functional component A directly depends on functional component B, and functional component B directly depends on functional component C. In addition, the current version of functional component A is 1.0, the current version of functional component B is 2.0, and the current version of functional component C is 1.0. The computer device determines that functional component C is a component to be upgraded through step-by-step inspection. After determining that C is the version to be upgraded, the computer device determines whether functional component B is compatible with version 2.0 of functional component C without vulnerabilities after the version upgrade. In the case that functional component B is not compatible with version 2.0 of functional component C, the computer device determines whether functional component A is compatible with version 4.0 of functional component B after the version upgrade. In the case that the computer device determines that functional component A is compatible with version 4.0 of functional component B after the version upgrade, functional component B is upgraded to version 4.0.

[0101] In an embodiment of the present application, during the process of upgrading the functional component to be upgraded, the computer device determines whether the upgraded version is compatible with the upper-level functional component with which it has a dependency, thereby avoiding the phenomenon of version incompatibility after upgrading a certain functional component and ensuring the normal operation of the code project after the vulnerability is repaired.

[0102] In a possible implementation, some functions that can be realized by the code engineering have not been put into use. In this case, if the functions provided by the functional components to be upgraded are functions that have not been applied by the code engineering, the functional components to be upgraded can be directly deleted from the component code package, which can improve the efficiency of vulnerability patching without affecting the application of the code engineering. The specific process is as follows:

[0103] First, based on the application function of the code engineering, the functional impact of the first functional component on the code engineering is determined.

[0104] The function impact is used to indicate whether the first function component is called when the code project provides application functions. In some cases, the first function component is a function component that the lower-level function components depend on. The entire code project may not need the support of the first function component in the process of providing application functions. Therefore, the first function component can be deleted without affecting the application functions of the entire code project.

[0105] Subsequently, when the function impact situation indicates that the first function component has not been called, the component to be upgraded is deleted from the component code package.

[0106] Optionally, when the functional impact situation is used to indicate that the code project provides application functions, the first functional component is called, and the first common functional component in the component code package needs to be upgraded. The specific upgrade process can refer to the version upgrade process in the above embodiment, which is not elaborated in this embodiment.

[0107] In an embodiment of the present application, based on the functional impact of the component to be upgraded on the code project, it is decided to delete the component to be upgraded from the component code package, and the component to be upgraded may not be upgraded, thereby reducing the operation steps and improving the efficiency of vulnerability patching.

[0108] Indicative, Figure 7 A flowchart for vulnerability inspection and repair provided by an exemplary embodiment of the present application is shown. After determining that there are vulnerabilities in the code project, a step-by-step inspection is performed based on the dependency relationship. In the step-by-step inspection process, the situation of open source components contained in component repositories such as Maven / PyPI and the vulnerability database are used to determine the components to be upgraded. In the process of repairing the vulnerability, the computer device needs to determine whether the component to be upgraded is a component that the code project directly depends on. If the component to be upgraded is a functional component that the code project directly depends on, the component is upgraded to a version without vulnerabilities. In the case that the component is not a component that the code project directly depends on, it is determined whether the functional component of the upper layer of the component to be upgraded is compatible with the upgraded component. If it is compatible, the component to be upgraded is upgraded to repair the vulnerability; in the case of incompatibility, the functional component of the upper layer is determined as the component to be upgraded, and the upgraded version of the component to be upgraded is searched, and it is confirmed again whether it is a directly dependent control, and this cycle is repeated until the vulnerability is repaired.

[0109] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0110] Figure 8 The following is a structural block diagram of a vulnerability repair device provided by an exemplary embodiment of the present application. The device may include:

[0111] The inspection module 801 is used to inspect the functional components level by level based on the dependency relationship of the functional components in the code project when there are vulnerabilities in the code project to obtain inspection results;

[0112] A determination module 802 is configured to determine that the first functional component is a component to be upgraded if the inspection result indicates that the first functional component has a vulnerability and the second functional component on which the first functional component depends does not have a vulnerability, or if the first functional component has a vulnerability and the first functional component does not have a second functional component on which it depends;

[0113] The upgrade module 803 is used to upgrade the version of the first functional component in the component code package, wherein the first functional component after the version upgrade has no vulnerability.

[0114] Optionally, the inspection module 801 is used to:

[0115] Obtaining a vulnerability database, wherein the vulnerability database contains the functional components having vulnerabilities;

[0116] Based on the dependency relationships of the functional components in the code project, a dependency list is obtained level by level, wherein the dependency list is used to indicate the functional components of the next level that the functional components of the previous level depend on;

[0117] Based on the dependency lists at different levels, the vulnerability database is queried to obtain the inspection results, and the inspection results are used to indicate the vulnerability conditions of the functional components at different levels.

[0118] Optionally, the functional components on which the code engineering depends have n-level dependencies, and the code engineering directly depends on the functional components of the first level;

[0119] The inspection module 801 is used to:

[0120] Obtain a dependency list of a kth functional component having a vulnerability in a kth level, wherein the dependency list includes the functional components of the k+1th level directly dependent on by the kth functional component, where k is greater than or equal to 1 and k is less than or equal to n;

[0121] By searching the vulnerability database, the k+1th functional component having a vulnerability in the k+1th level is determined.

[0122] Optionally, the vulnerability database includes the functional components with vulnerabilities and reasons for the vulnerabilities;

[0123] The inspection module 801 is used to query the vulnerability database based on the dependency lists at different levels to obtain the inspection results, wherein the inspection results are used to indicate the vulnerability conditions of the functional components at different levels and the reasons for the existence of the vulnerabilities in the functional components, and the reasons for the existence of the vulnerabilities include the existence of code vulnerabilities in the functional components and the existence of dependency vulnerabilities in the functional components;

[0124] The determination module 802 is further configured to determine that the first functional component is a component to be upgraded when the inspection result indicates that the first functional component has a vulnerability and the first functional component indicates that the functional component has a code vulnerability.

[0125] Optionally, the upgrade module 803 is used to:

[0126] In the case where a third functional component that depends on the first functional component is compatible with the first functional component after the version upgrade, performing a version upgrade on the first functional component in the component code package;

[0127] The determining module 802 is further configured to determine a target functional component based on the dependency relationship when a third functional component that depends on the first functional component is incompatible with the first functional component after the version upgrade;

[0128] The upgrade module 803 is further used to perform version upgrade on the target functional component in the component code package, wherein the fourth functional component that depends on the target functional component is compatible with the target functional component after the version upgrade.

[0129] Optionally, the functional components on which the code engineering depends have n-level dependencies, and the code engineering directly depends on the functional components of the first level;

[0130] The determining module 802 is used to:

[0131] In the case where the k-1th functional component that depends on the k-th functional component is incompatible with the k-th functional component after the version upgrade, querying the k-1th functional component after the version upgrade;

[0132] In a case where the k-2th functional component that depends on the k-1th functional component is compatible with the upgraded k-1th functional component, determining the k-1th functional component as the target functional component;

[0133] The upgrade module 803 is used to upgrade the version of the k-1th functional component in the component code package.

[0134] Optional,

[0135] The determining module 802 is further configured to determine, based on the application function of the code engineering, the functional impact of the first functional component on the code engineering, wherein the functional impact is used to indicate whether the first functional component is called when the code engineering provides the application function;

[0136] The upgrading module 803 is further configured to delete the component to be upgraded from the component code package when the function impact condition indicates that the first function component has not been called.

[0137] In the embodiment of the present application, when there are vulnerabilities in the code engineering, the computer device checks the functional components level by level based on the dependency relationship of the functional components in the code engineering to check the vulnerabilities in the functional components, thereby determining the first functional component to be upgraded, and upgrading the first function. The vulnerability repair method proposed in the embodiment of the present application can determine the low-level dependent functional component that needs to be repaired according to the dependency relationship, and repair the vulnerability of the code engineering by upgrading the functional component, thereby reducing the workload of vulnerability repair, and has stronger applicability.

[0138] Please refer to Fig. 9 , which shows a block diagram of a computer device provided by an exemplary embodiment of the present application. The computer device 900 can be implemented as the computer device in each of the above embodiments. The computer device 900 may include one or more of the following components: a processor 910 and a memory 920.

[0139] The processor 910 may include one or more processing cores. The processor 910 uses various interfaces and lines to connect the various parts of the entire computer device 900, and executes various functions and processes data of the computer device 900 by running or executing instructions, programs, code sets or instruction sets stored in the memory 920, and calling data stored in the memory 920. Optionally, the processor 910 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 910 can integrate one or more combinations of a central processing unit (Central Processing Unit, CPU), a graphics processor (Graphics Processing Unit, GPU), a neural network processor (Neural-network Processing Unit, NPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content required to be displayed on the touch display; the NPU is used to implement artificial intelligence (Artificial Intelligence, AI) functions; and the modem is used to process wireless communications. It is understandable that the above-mentioned modem may not be integrated into the processor 910, but may be implemented by a separate chip.

[0140] The memory 920 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 920 includes a non-transitory computer-readable storage medium. The memory 920 may be used to store instructions, programs, codes, code sets, or instruction sets. The memory 920 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc.; the data storage area may store data (such as audio data, a phone book), etc., created according to the use of the computer device 900.

[0141] In addition, those skilled in the art can understand that the structure of the computer device 900 shown in the above drawings does not constitute a limitation on the computer device, and the computer device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the computer device 900 also includes a display screen, a camera assembly, a microphone, a speaker, a radio frequency circuit, an input unit, a sensor (such as an acceleration sensor, an angular velocity sensor, a light sensor, etc.), an audio circuit, a WiFi module, a power supply, a Bluetooth module and other components, which will not be described in detail here.

[0142] An embodiment of the present application also provides a computer-readable storage medium, which stores at least one program code, and the program code is loaded and executed by a processor to implement the vulnerability repair method described in the above embodiments.

[0143] The embodiment of the present application provides a computer program product, which includes computer instructions, which are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the vulnerability repair method provided in various optional implementations of the above aspects.

[0144] It should be understood that the "multiple" mentioned in this article refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. In addition, the step numbers described in this article only illustrate a possible execution sequence between the steps. In some other embodiments, the above steps may not be executed in the order of the numbers, such as two steps with different numbers are executed at the same time, or two steps with different numbers are executed in the opposite order to the diagram. The embodiments of the present application are not limited to this.

[0145] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A vulnerability repair method, characterized in that: The method comprises: In the case where there are vulnerabilities in the code project, based on the dependency relationships of the functional components in the code project, the functional components are inspected level by level to obtain inspection results; When the inspection result indicates that the first functional component has a vulnerability, and the second functional component on which the first functional component depends does not have a vulnerability, or when the first functional component has a vulnerability, and the first functional component does not have a second functional component on which it depends, determining that the first functional component is a component to be upgraded; The first functional component in the component code package is upgraded to a version, wherein the first functional component after the version upgrade has no vulnerability.

2. The method according to claim 1, characterized in that The step of inspecting the functional components step by step based on the dependency relationship of the functional components in the code engineering to obtain inspection results includes: Obtaining a vulnerability database, wherein the vulnerability database contains the functional components having vulnerabilities; Based on the dependency relationships of the functional components in the code project, a dependency list is obtained level by level, wherein the dependency list is used to indicate the functional components of the next level that the functional components of the previous level depend on; Based on the dependency lists at different levels, the vulnerability database is queried to obtain the inspection results, and the inspection results are used to indicate the vulnerability conditions of the functional components at different levels.

3. The method according to claim 2, characterized in that The functional components on which the code project depends have an n-level dependency relationship, and the code project directly depends on the functional components of the first level; The querying of the vulnerability database based on the dependency lists at different levels to obtain the inspection result includes: Obtain a dependency list of a kth functional component having a vulnerability in a kth level, wherein the dependency list includes the functional components of the k+1th level directly dependent on by the kth functional component, where k is greater than or equal to 1 and k is less than or equal to n; By searching the vulnerability database, the k+1th functional component having a vulnerability in the k+1th level is determined.

4. The method according to claim 2, characterized in that: The vulnerability database includes the functional components with vulnerabilities and the reasons for the vulnerabilities; The querying of the vulnerability database based on the dependency lists at different levels to obtain the inspection result includes: Based on the dependency lists at different levels, query the vulnerability database to obtain the inspection results, where the inspection results are used to indicate the vulnerability conditions of the functional components at different levels and the reasons for the vulnerabilities of the functional components, where the reasons for the vulnerabilities include code vulnerabilities in the functional components and dependency vulnerabilities in the functional components; The determining that the first functional component is a component to be upgraded further includes: When the inspection result indicates that the first functional component has a vulnerability, and the first functional component indicates that the functional component has a code vulnerability, the first functional component is determined to be a component to be upgraded.

5. The method according to claim 1, characterized in that The performing version upgrade on the first functional component in the component code package includes: In the case where a third functional component that depends on the first functional component is compatible with the first functional component after the version upgrade, performing a version upgrade on the first functional component in the component code package; The method further comprises: In the case where a third functional component that depends on the first functional component is incompatible with the first functional component after the version upgrade, determining a target functional component based on the dependency relationship; The target functional component in the component code package is upgraded in version, wherein a fourth functional component that depends on the target functional component is compatible with the target functional component after the upgrade.

6. The method according to claim 4, characterized in that The functional components on which the code project depends have n-level dependencies, and the code project directly depends on the functional components of the first level; The step of determining a target functional component based on the dependency relationship includes: In the case where the k-1th functional component that depends on the k-th functional component is incompatible with the k-th functional component after the version upgrade, querying the k-1th functional component after the version upgrade; In a case where the k-2th functional component that depends on the k-1th functional component is compatible with the upgraded k-1th functional component, determining the k-1th functional component as the target functional component; The step of performing version upgrade on the target functional component in the component code package includes: The version of the k-1th functional component in the component code package is upgraded.

7. The method according to claim 1, characterized in that After determining that the first functional component is a component to be upgraded, the method further includes: Based on the application function of the code engineering, determining the functional impact of the first functional component on the code engineering, wherein the functional impact is used to indicate whether the first functional component is called when the code engineering provides the application function; When the function impact condition indicates that the first function component has not been called, the component to be upgraded is deleted from the component code package.

8. A vulnerability repair device, characterized in that: The device comprises: A test module, used to test the functional components level by level based on the dependency relationship of the functional components in the code project when there are vulnerabilities in the code project, and obtain test results; a determination module, configured to determine that the first functional component is a component to be upgraded if the inspection result indicates that the first functional component has a vulnerability and the second functional component on which the first functional component depends does not have a vulnerability, or if the first functional component has a vulnerability and the first functional component does not have a second functional component on which it depends; An upgrade module is used to upgrade the version of the first functional component in the component code package, wherein the first functional component after the version upgrade has no vulnerabilities.

9. A computer device, characterized in that: The computer device includes a processor and a memory, wherein the memory stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the vulnerability repair method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and the at least one instruction is loaded and executed by a processor to implement the vulnerability repair method according to any one of claims 1 to 7.

Images