SAST-based interface security detection method and device

Abstract

The invention provides an interface security detection method and device based on SAST, and the method comprises the steps: carrying out the SAST processing of a source code of a target application program, and generating an abstract syntax tree AST corresponding to the target application program based on a processing result; based on the AST, determining a target unit object representing an application programming interface (API) in the target application program and first unit object content corresponding to the target unit object; complementing the content of the first unit object based on a symbol table corresponding to the AST to obtain the content of a second unit object corresponding to the target unit object; and performing risk detection on the target unit object based on the content of the second unit object to obtain a risk API of the target application program. According to the method, the API risk detection can be realized by using the source code, the accuracy of the risk detection is improved, and the false alarm and the missing report are reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a SAST-based interface security detection method and device. Background Art

[0002] With the rapid development and widespread application of Internet technology, Application Programming Interface (API) has become an indispensable part of modern software systems. API is not only used for data interaction and function calls between applications, but also provides a way for third-party developers to access system resources. However, the widespread use of API also brings significant security risks. API vulnerabilities may lead to risky data leakage, unauthorized access and operation, and various security attacks.

[0003] Traditional API security detection methods mainly rely on dynamic analysis technology (Dynamic Application Security Testing, DAST), that is, to detect the security of APIs at runtime. Although the DAST method can effectively identify many real-time attacks and vulnerabilities, it depends on the actual operating environment, has high detection costs and a long detection cycle. In addition, the DAST method often shows certain limitations when facing some deeply hidden logical vulnerabilities. Summary of the invention

[0004] The embodiments of the present disclosure at least provide a SAST-based interface security detection method and device.

[0005] In a first aspect, an embodiment of the present disclosure provides an interface security detection method based on SAST, including:

[0006] Performing static application security test SAST processing on the source code of the target application, and generating an abstract syntax tree AST corresponding to the target application based on the processing result;

[0007] Based on the AST, determine a target unit object representing an application programming interface API in the target application, and a first unit object content corresponding to the target unit object;

[0008] Based on the symbol table corresponding to the AST, the first unit object content corresponding to each target unit object is completed respectively to obtain the second unit object content corresponding to each target unit object;

[0009] Based on the content of the second unit object, risk detection is performed on the target unit object to obtain the risk API of the target application.

[0010] In an optional implementation, the static application security test SAST processing is performed on the source code of the target application, and an abstract syntax tree AST corresponding to the target application is generated based on the processing result, including:

[0011] Performing SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code;

[0012] Perform lexical analysis on the code object to generate an abstract syntax tree AST corresponding to the target application.

[0013] In an optional implementation manner, determining, based on the AST, a target unit object representing an application programming interface API in the target application and a first unit object content corresponding to the target unit object includes:

[0014] For a class unit object in the AST, if the class unit object has a first API feature, use the class unit object as a first API unit object, and determine a method unit object corresponding to the first API unit object;

[0015] In the case where the method unit object carries the second API feature, using the method unit object as the second API unit object;

[0016] The second API unit object is used as the target unit object, and the first unit object content corresponding to the target unit object is determined.

[0017] In an optional implementation manner, the symbol table indicates a correspondence between a class or a variable and a grammatical structure in the source code;

[0018] The method of completing the first unit object content based on the symbol table corresponding to the AST to obtain the second unit object content corresponding to the target unit object includes:

[0019] For any information in the first unit object content, based on the symbol table, determine the target syntax structure corresponding to the first unit object content from the syntax structure of the source code;

[0020] Parsing the target grammatical structure to determine the information structure corresponding to the first unit object content;

[0021] Based on the information structure, content to be supplemented of the first unit object content is determined, and the first unit object content is supplemented with the content to be supplemented to obtain the second unit object content.

[0022] In an optional implementation manner, determining the content to be supplemented of the first unit object content based on the information structure, and completing the first unit object content with the content to be supplemented to obtain the second unit object content includes:

[0023] Identify a serialization flag from the information structure corresponding to the first unit object content;

[0024] Based on the serialization mark, the information structure is deserialized and modified to determine the content to be supplemented of the first unit object content;

[0025] Based on the content to be supplemented obtained through deserialization correction, the content of the first unit object is supplemented to obtain the content of the second unit object corresponding to the target unit object.

[0026] In an optional implementation manner, before performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application, the method further includes:

[0027] Based on the language type and the standard information format corresponding to the second unit object content, the second unit object content is standardized to obtain the standardized second unit object content.

[0028] In an optional implementation, the performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application program includes:

[0029] Based on the risk feature set, correct the second unit object content to obtain the corrected second unit object content;

[0030] Based on the risk feature set, risk detection is performed on the corrected second unit object content, and the risk API of the target application is determined based on the risk detection result.

[0031] In an optional implementation manner, the method further includes:

[0032] Based on the second unit object content corresponding to the risk API and the risk detection result corresponding to the risk API, risk description information of the risk API is generated.

[0033] In an optional implementation manner, the first unit object content includes at least one of the following:

[0034] Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, and identification information of the class unit object corresponding to the target unit object.

[0035] In a second aspect, the embodiment of the present disclosure further provides an interface security detection device based on SAST, including:

[0036] A scanning module, used to perform static application security test SAST processing on the source code of the target application, and generate an abstract syntax tree AST corresponding to the target application based on the processing result;

[0037] A determination module, configured to determine, based on the AST, a target unit object representing an application programming interface API in the target application and a first unit object content corresponding to the target unit object;

[0038] A correction module, used for completing the first unit object content corresponding to each target unit object based on the symbol table corresponding to the AST, to obtain the second unit object content corresponding to each target unit object;

[0039] A detection module is used to perform risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application.

[0040] In an optional implementation manner, the scanning module is specifically used for:

[0041] Performing SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code;

[0042] Perform lexical analysis on the code object to generate an abstract syntax tree AST corresponding to the target application.

[0043] In an optional implementation manner, the determining module is specifically configured to:

[0044] For a class unit object in the AST, if the class unit object has a first API feature, use the class unit object as a first API unit object, and determine a method unit object corresponding to the first API unit object;

[0045] In the case where the method unit object carries the second API feature, using the method unit object as the second API unit object;

[0046] The second API unit object is used as the target unit object, and the first unit object content corresponding to the target unit object is determined.

[0047] In an optional implementation manner, the symbol table indicates a correspondence between a class or a variable and a grammatical structure in the source code;

[0048] The correction module is specifically used for:

[0049] For any information in the first unit object content, based on the symbol table, determine the target syntax structure corresponding to the first unit object content from the syntax structure of the source code;

[0050] Parsing the target grammatical structure to determine the information structure corresponding to the first unit object content;

[0051] Based on the information structure, content to be supplemented of the first unit object content is determined, and the first unit object content is supplemented with the content to be supplemented to obtain the second unit object content.

[0052] In an optional implementation manner, the correction module is specifically used to:

[0053] Identify a serialization flag from the information structure corresponding to the first unit object content;

[0054] Based on the serialization mark, the information structure is deserialized and modified to determine the content to be supplemented of the first unit object content;

[0055] Based on the content to be supplemented obtained through deserialization correction, the content of the first unit object is supplemented to obtain the content of the second unit object corresponding to the target unit object.

[0056] In an optional implementation manner, before performing risk detection on the target unit object based on the second unit object content to obtain the risk API of the target application, the detection module is further configured to:

[0057] Based on the language type and the standard information format corresponding to the second unit object content, the second unit object content is standardized to obtain the standardized second unit object content.

[0058] In an optional implementation manner, the detection module is specifically used to:

[0059] Based on the risk feature set, correct the second unit object content to obtain the corrected second unit object content;

[0060] Based on the risk feature set, risk detection is performed on the corrected second unit object content, and the risk API of the target application is determined based on the risk detection result.

[0061] In an optional implementation manner, the detection module is further used to:

[0062] Based on the second unit object content corresponding to the risk API and the risk detection result corresponding to the risk API, risk description information of the risk API is generated.

[0063] In an optional implementation manner, the first unit object content includes at least one of the following:

[0064] Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, and identification information of the class unit object corresponding to the target unit object.

[0065] In a third aspect, an embodiment of the present disclosure further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the above-mentioned first aspect, or any possible implementation of the first aspect are performed.

[0066] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect or any possible implementation of the first aspect are executed.

[0067] The SAST-based interface security detection and device provided by the embodiments of the present disclosure can directly use the source code of the target application to implement API risk detection through SAST processing, thereby identifying and locating potential security vulnerabilities in the API in the early stages of application development, reducing the cost and risk of repairing vulnerabilities in the later stage; the method can efficiently process large-scale source code by generating AST and performing analysis based on AST, quickly identify API-related unit objects and the corresponding contents of the unit objects, thereby improving the efficiency of detection, and by completing the first unit object content based on the symbol table, it can improve the coverage of the unit object content, improve the accuracy of risk detection, and reduce false positives and negatives.

[0068] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0070] Figure 1 A flow chart of a SAST-based interface security detection method provided by an embodiment of the present disclosure is shown;

[0071] Figure 2 A schematic diagram of a SAST-based interface security detection method and device provided in an embodiment of the present disclosure is shown;

[0072] Figure 3 A schematic diagram of an electronic device provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0074] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0075] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0076] Research has found that traditional API security detection methods mainly rely on dynamic application security testing (DAST). DAST can discover many real-time attacks and vulnerabilities by performing security tests while the application is running. However, the DAST method has some limitations, such as relying on the actual operating environment, high detection costs, and may not be able to discover deeply hidden logical vulnerabilities. In addition, DAST is usually performed in the later stages of software development, and the cost of fixing vulnerabilities is high. Static Application Security Testing (SAST) is a technology that performs code analysis without executing the program. SAST can detect potential security issues in the early stages of software development by analyzing source code or binary code, thereby reducing the cost and risk of fixing vulnerabilities. However, the current SAST technology faces challenges such as high code complexity and strong interface diversity when dealing with API security detection, making it difficult to comprehensively and accurately detect security issues in APIs.

[0077] Based on the above research, the present disclosure provides a SAST-based interface security detection method and device. Through SAST processing, the source code of the target application can be directly used to implement API risk detection without relying on the operating environment, so that potential security vulnerabilities in the API can be identified and located in the early stages of application development, reducing the cost and risk of repairing vulnerabilities in the later stage; the method generates AST and performs analysis based on AST, so as to efficiently process large-scale source code, quickly identify API-related unit objects and the contents of unit objects, thereby improving the efficiency of detection, and, by completing the content of the first unit object based on the symbol table, the coverage of the unit object content can be improved, the accuracy of risk detection is improved, and false positives and negatives are reduced.

[0078] To facilitate understanding of this embodiment, a SAST-based interface security detection method disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the SAST-based interface security detection method provided in the embodiment of the present disclosure is generally a computer device with certain computing capabilities. In some possible implementations, the SAST-based interface security detection method can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0079] See also Figure 1 As shown, it is a flowchart of a SAST-based interface security detection method provided by an embodiment of the present disclosure, and the method includes steps S101 to S104, wherein:

[0080] S101. Perform static application security test SAST processing on the source code of the target application, and generate an abstract syntax tree AST corresponding to the target application based on the processing result.

[0081] In this step, the source code of the target application can be obtained first. Then, the source code is scanned using SAST to obtain multiple code objects corresponding to the source code. During the scanning, the source code can be split into multiple code objects (i.e., tokens) according to spaces, line breaks, special symbols, etc. in the source code to obtain a token set corresponding to the source code file.

[0082] After obtaining the token set, the token set can be traversed, lexical analysis can be performed during the traversal process to determine the type of each token, and an Abstract Syntax Tree (AST) corresponding to the source code can be generated through recursive descent and other methods.

[0083] Lexical analysis is the first step of the compiler front end. Its main task is to convert the character stream of the source code into meaningful lexical units for further processing by the syntax analyzer.

[0084] AST is a tree-like data structure used to represent the grammatical structure of source code. Each unit object represents a structural element in the source code. AST is widely used in compilers and interpreters to facilitate code analysis and transformation.

[0085] The token type may include plain text data, numbers or operators, special meaning symbols, etc.

[0086] The obtained AST may include multiple unit objects, each of which represents a token node. Unit objects may have connecting edges, indicating that there is a reference relationship or inheritance relationship between the unit objects.

[0087] S102. Based on the AST, determine a target unit object representing an application programming interface API in the target application, and a first unit object content corresponding to the target unit object.

[0088] After obtaining the AST, the target unit object representing the API in the target application and the first unit object content corresponding to the target unit object can be determined.

[0089] Specifically, for the class unit object in the AST, when the class unit object has a first API feature, the class unit object can be used as the first API unit object, and the method unit object corresponding to the first API unit object can be determined; when the method unit object carries a second API feature, the method unit object can be used as the second API unit object; the second API unit object can be used as the target unit object, and the content of the first unit object corresponding to the target unit object can be determined.

[0090] When determining the target unit object, the class unit objects and method unit objects in the AST may be traversed.

[0091] In the Abstract Syntax Tree (AST), class unit objects and method unit objects are unit objects that represent classes and methods in object-oriented programming languages ​​such as Java, C++, Python, etc. Each unit object contains related attributes and sub-unit objects to describe the structure and behavior of classes and methods.

[0092] The class unit object represents the class definition in the program, including the basic information of the class and its members (such as properties, methods, etc.). The structure of the class unit object can include the unit object type, properties (such as class name, access modifier, inheritance information, implemented interface), sub-unit object content (such as property unit object, method unit object, constructor unit object), etc.; the method unit object represents the method definition in the program, including the method signature, parameters, method body and other information. The structure of the method unit object can include the unit object type, properties (such as method name, return type, return modifier, static modifier), sub-unit object content (such as parameter unit object, method body unit object), etc.

[0093] For example, in the Java Spring framework, when determining the target unit object, two types of unit objects can be focused on: class declaration and method declaration. Other unit objects are skipped during traversal. If the target is a functional API configured in a hard-coded manner in Java, the unit objects of interest may be method calls and parameter lists of method calls, because functional APIs often use register hard-coded registration to open API interfaces to the outside world.

[0094] In a possible implementation, the class unit objects in the AST can be traversed first. When the currently traversed class unit object has the first API feature, the currently traversed class unit object is used as the first API unit object, and the method unit object corresponding to the first API unit object is traversed.

[0095] The first API feature may refer to a preset string. For example, if the annotation information of a class unit object carries the @Controller annotation, it means that the class unit object carries API related information and can be used as the first API unit object.

[0096] The method unit object corresponding to the first API unit object may refer to a method unit object directly or indirectly connected to the first API unit object, and may generally be a unit object below the level of the first API unit object.

[0097] In the case where the currently traversed method unit object carries the second API feature, the currently traversed method unit object is used as the second API unit object. For example, if the annotation information of a method unit object carries annotations such as @GetMapping, it can be used as the second API unit object. Then, the second API unit object can be used as the target unit object.

[0098] If the currently traversed class unit object does not have the first API feature, the next class unit object may be traversed, and other irrelevant unit objects may be skipped.

[0099] When determining the target unit object, the first unit object content of the target unit object may also be obtained, and the first unit object content may include at least one of the following:

[0100] Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, and identification information of the class unit object corresponding to the target unit object.

[0101] Exemplarily, the address information (such as Uniform Resource Locator, URL) of the target unit object, as well as the request method get / post, protocol http, and framework type spring of the URL can be obtained according to the annotation information of the target unit object.

[0102] When determining the content of the first unit object, you can simultaneously use the annotation information of the class unit object (the first API unit object corresponding to the second API unit object) and the fields of the annotation information of the method unit object, such as the path or value field. Both classes and methods may contain URL fragments. The URL fragments contained in the path or value field are spliced ​​and formatted (such as error correction mechanism, removal of redundant slashes or spaces) to obtain the URL.

[0103] At the same time, you can also get basic method information, such as method parameter list (parameter type and parameter name), unit object content, unit object content including annotations, as well as information about the unit object itself, and annotation information, such as method signatures, framework types, etc.

[0104] S103. Based on the symbol table corresponding to the AST, the first unit object content is completed to obtain the second unit object content corresponding to the target unit object.

[0105] After obtaining the target unit object and its corresponding first unit object content, the first unit object content can be used to perform risk detection on the target unit object. However, due to certain differences between AST and source code, the information extracted from AST may contain errors or missing information. Therefore, it is necessary to complete the first unit object content to obtain relatively correct and complete second unit object content.

[0106] Specifically, the symbol table corresponding to the AST may be obtained, and the symbol table may be used to deserialize and correct the content of the first unit object.

[0107] The symbol table corresponding to the AST may indicate the correspondence between the class or variable and the grammatical structure in the source code. The symbol table may be constructed by indexing when the source code is processed by SAST.

[0108] In a possible implementation, for any information in the first unit object content, the target grammatical structure corresponding to the first unit object content can be determined based on the symbol table; then the target grammatical structure is traversed to determine the information structure corresponding to the first unit object content, and then based on the information structure, the content to be supplemented of the first unit object content is determined, and the first unit object content is completed using the content to be supplemented to obtain the second unit object content, thereby correcting the erroneous information and completing the missing information.

[0109] In some serialization and deserialization scenarios, there is serialization field mapping. The field mapping is complex and may cause the true meaning of the first unit object content to be hidden. Therefore, in the completion step, the first unit object content can be deserialized and corrected to ensure that the API request and response structure are correctly reconstructed.

[0110] Specifically, the serialization mark can be identified from the information structure corresponding to the first unit object content, and then the information structure is deserialized and corrected based on the serialization mark to obtain the content to be supplemented, and then the first unit object content is completed based on the content to be supplemented obtained by deserialization correction to obtain the second unit object content corresponding to the target unit object.

[0111] Exemplarily, when determining the target syntax structure, the information structure corresponding to the content of the first unit object can be identified from the target syntax structure. Different information types correspond to different information structures. After obtaining the information structure, it can be determined whether there is a serialization identifier in the information structure, such as if it carries the @JsonProperty annotation. If it carries a serialization identifier, it means that the fields in the information structure are serialized, and then it can be deserialized and corrected.

[0112] During specific implementation, in requests and responses, there are sometimes scenarios where json serializers and deserializers exist. In these scenarios, the fields identified by the source code may not be exactly the same as the request response fields, which will cause inaccurate API parameters and lead to false positives and false negatives in the detection results. By identifying the serializer and the serializer code, the actual request and response can be analyzed. By mapping the source code field list and the json list, the engine can be better assisted in identifying the correct API parameter fields. For example, some fields are named f_passwd, but there is an annotation called @JsonProperty("password') on it. At this time, the parameter name will be corrected to password to avoid inconsistency with the final request. At the same time, some annotations such as @NotBlank and @Email will also be extracted to generate description information for the parameter, such as parameter name, whether it is required, verification rules, etc.

[0113] After obtaining the second unit object content, the second unit object content can be used to perform risk detection on the target unit object.

[0114] However, since different parts of the code in the source code may be designed using different standards, different second unit object contents may have different annotations or structures, such as using different languages. Therefore, the second unit object content can be standardized based on the language type and standard information format corresponding to the second unit object content to obtain the standardized second unit object content, and the standardized second unit object content with a unified language and consistent information format can be obtained, and the standardized second unit object content can be used for risk detection.

[0115] S104: Based on the content of the second unit object, perform risk detection on the target unit object to obtain a risk API of the target application.

[0116] After obtaining the second unit object content, risk detection can be performed based on the second unit object content. When performing risk detection, the risk features indicated in the risk feature set can be used to match the second unit object content, thereby implementing screening of the target unit object.

[0117] Since there may be some errors in the second unit object content (such as typos in the source code), the risk feature set can be used to correct the second unit object content to obtain the corrected second unit object content, and then the risk feature set can be used to match the corrected second unit object content.

[0118] For example, an error correction algorithm (such as dictionary-based matching technology) can be used to capture and correct spelling errors in potential information identifiers, and automatically identify keywords that are very similar or misspelled. For example, "passwerd" is automatically corrected to "password". By setting a reasonable matching threshold, it can be ensured that only when the similarity between the error and the correct word exceeds a preset value, it is regarded as a correction of information false positives or false negatives, thereby accurately marking risk parameters.

[0119] The dictionary matching algorithm compares the wrong word with the words in the dictionary to find the best matching word. The specific steps are as follows: 1. Load the dictionary, which stores the correct words, such as password, username, etc. 2. Compare the wrong word password with the words in the dictionary and calculate the matching degree. 3. Select the word password with the highest matching degree as the error correction result.

[0120] In this way, error correction is performed only when the matching degree is greater than a preset threshold, which can improve the accuracy of error correction.

[0121] Afterwards, when it is detected that the second unit object content matches the risk feature in the risk feature set (eg, the second unit object content includes at least one risk feature), the API corresponding to the second unit object content may be used as the risk API.

[0122] After obtaining the risk API, risk description information of the risk API may also be determined. The risk description information may be determined based on the second unit object content of the risk API and the risk detection result.

[0123] Exemplarily, the risk description information may include at least one of the following:

[0124] Class name; framework type, such as spring; current protocol type, such as HTTP / 1.1; current request method, such as GET; current API address generated by the url in step 3, such as / API / v1 / chat / complete; method signature, such as publicChatResponse chat(ChatRequest chatRequest); parameter name, parameter type, location (in the request body / url), risk information tag, nested parameter list, and tree structure of the method parameter list marked with risks in the method parameter list.

[0125] The interface security detection method based on static application security testing proposed in the embodiment of the present disclosure aims to efficiently and accurately identify and mark potential risk points related to API in the source code of the application program, such as those involving risk information processing, authentication credentials or other data transmission, and can be traversed and risk-marked in a targeted manner. The AST can be traversed through a custom visitor mode, focusing on the code structure related to the API, such as class and method declarations with specific annotations (such as @Controller and @GetMapping in the Spring framework). In this step, the system will mark the part that may contain API parameters, while avoiding the traversal of irrelevant code, thereby improving the detection efficiency. For the marked API risk classes and methods, the method parameters can be deeply analyzed, and the type can be reversed using the symbol table to ensure the accuracy of the parameter information. At the same time, the inaccurate API parameters caused by the inconsistency between the source code field and the request response field in the serialization and deserialization scenarios are solved. And the data types between different programming languages ​​are unified into a standard format compatible with OpenAPI, which enhances the cross-language applicability and accuracy. In the method parameter list, the system specifically identifies text parameters, and marks and corrects potential spelling errors of API parameter identifiers through keyword matching and error correction algorithms to reduce false positives and false negatives.

[0126] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0127] Based on the same inventive concept, the embodiment of the present disclosure also provides a SAST-based interface security detection device corresponding to the SAST-based interface security detection method. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned SAST-based interface security detection method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0128] Reference Figure 2As shown, it is a schematic diagram of a SAST-based interface security detection provided by an embodiment of the present disclosure, and the device includes:

[0129] The scanning module 210 is used to perform a static application security test SAST process on the source code of the target application, and generate an abstract syntax tree AST corresponding to the target application based on the processing result;

[0130] A determination module 220, configured to determine, based on the AST, a target unit object representing an application programming interface API in the target application, and first unit object content corresponding to the target unit object;

[0131] A correction module 230 is used to complete the first unit object content corresponding to each target unit object based on the symbol table corresponding to the AST, so as to obtain the second unit object content corresponding to each target unit object;

[0132] The detection module 240 is used to perform risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application.

[0133] In an optional implementation manner, the scanning module 210 is specifically used for:

[0134] Performing SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code;

[0135] Perform lexical analysis on the code object to generate an abstract syntax tree AST corresponding to the target application.

[0136] In an optional implementation manner, the determining module 220 is specifically configured to:

[0137] For a class unit object in the AST, if the class unit object has a first API feature, use the class unit object as a first API unit object, and determine a method unit object corresponding to the first API unit object;

[0138] In the case where the method unit object carries the second API feature, using the method unit object as the second API unit object;

[0139] The second API unit object is used as the target unit object, and the first unit object content corresponding to the target unit object is determined.

[0140] In an optional implementation manner, the symbol table indicates a correspondence between a class or a variable and a grammatical structure in the source code;

[0141] The correction module 230 is specifically used for:

[0142] For any information in the first unit object content, based on the symbol table, determine the target syntax structure corresponding to the first unit object content from the syntax structure of the source code;

[0143] Parsing the target grammatical structure to determine the information structure corresponding to the first unit object content;

[0144] Based on the information structure, content to be supplemented of the first unit object content is determined, and the first unit object content is supplemented with the content to be supplemented to obtain the second unit object content.

[0145] In an optional implementation manner, the correction module 230 is specifically used to:

[0146] Identify a serialization flag from the information structure corresponding to the first unit object content;

[0147] Based on the serialization mark, the information structure is deserialized and modified to determine the content to be supplemented of the first unit object content;

[0148] Based on the content to be supplemented obtained through deserialization correction, the content of the first unit object is supplemented to obtain the content of the second unit object corresponding to the target unit object.

[0149] In an optional implementation, before performing risk detection on the target unit object based on the second unit object content to obtain the risk API of the target application, the detection module 240 is further configured to:

[0150] Based on the language type and the standard information format corresponding to the second unit object content, the second unit object content is standardized to obtain the standardized second unit object content.

[0151] In an optional implementation manner, the detection module 240 is specifically configured to:

[0152] Based on the risk feature set, correct the second unit object content to obtain the corrected second unit object content;

[0153] Based on the risk feature set, risk detection is performed on the corrected second unit object content, and the risk API of the target application is determined based on the risk detection result.

[0154] In an optional implementation, the detection module 240 is further configured to:

[0155] Based on the second unit object content corresponding to the risk API and the risk detection result corresponding to the risk API, risk description information of the risk API is generated.

[0156] In an optional implementation manner, the first unit object content includes at least one of the following:

[0157] Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, and identification information of the class unit object corresponding to the target unit object.

[0158] For descriptions of the processing flow of each module in the device and the interaction flow between each module, reference may be made to the relevant descriptions in the above method embodiment, which will not be described in detail here.

[0159] Corresponds to Figure 1 The interface security detection method based on SAST in the present disclosure also provides an electronic device 300, such as Figure 3 FIG. 1 is a schematic diagram of the structure of an electronic device 300 provided in an embodiment of the present disclosure, including:

[0160] Processor 31, memory 32, and bus 33; memory 32 is used to store execution instructions, including memory 321 and external memory 322; memory 321 here is also called internal memory, which is used to temporarily store operation data in processor 31 and data exchanged with external memory 322 such as hard disk. Processor 31 exchanges data with external memory 322 through memory 321. When the electronic device 300 is running, the processor 31 communicates with the memory 32 through bus 33, so that the processor 31 executes the following instructions:

[0161] Performing static application security test SAST processing on the source code of the target application, and generating an abstract syntax tree AST corresponding to the target application based on the processing result;

[0162] Based on the AST, determine a target unit object representing an application programming interface API in the target application, and a first unit object content corresponding to the target unit object;

[0163] Based on the symbol table corresponding to the AST, the first unit object content corresponding to each target unit object is completed respectively to obtain the second unit object content corresponding to each target unit object;

[0164] Based on the content of the second unit object, risk detection is performed on the target unit object to obtain the risk API of the target application.

[0165] In an optional implementation, the instructions executed by the processor 31 include performing static application security test SAST processing on the source code of the target application, and generating an abstract syntax tree AST corresponding to the target application based on the processing result, including:

[0166] Performing SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code;

[0167] Perform lexical analysis on the code object to generate an abstract syntax tree AST corresponding to the target application.

[0168] In an optional implementation manner, in the instructions executed by the processor 31, determining, based on the AST, a target unit object representing an application programming interface API in the target application, and a first unit object content corresponding to the target unit object, includes:

[0169] For a class unit object in the AST, if the class unit object has a first API feature, use the class unit object as a first API unit object, and determine a method unit object corresponding to the first API unit object;

[0170] In the case where the method unit object carries the second API feature, using the method unit object as the second API unit object;

[0171] The second API unit object is used as the target unit object, and the first unit object content corresponding to the target unit object is determined.

[0172] In an optional implementation, in the instruction executed by the processor 31, the symbol table indicates a correspondence between a class or a variable and a grammatical structure in the source code;

[0173] The method of completing the first unit object content based on the symbol table corresponding to the AST to obtain the second unit object content corresponding to the target unit object includes:

[0174] For any information in the first unit object content, based on the symbol table, determine the target grammatical structure corresponding to the first unit object content;

[0175] Traversing the target grammatical structure to determine the information structure corresponding to the first unit object content;

[0176] Based on the information structure, the first unit object content is completed to obtain the second unit object content.

[0177] In an optional implementation manner, the instructions executed by the processor 31 include completing the first unit object content to obtain the second unit object content, including:

[0178] Identify a serialization flag from the information structure corresponding to the first unit object content;

[0179] Based on the serialization mark, deserialize and correct the information structure;

[0180] Based on the deserialization correction result, the second unit object content corresponding to the target unit object is determined.

[0181] In an optional implementation manner, the instructions executed by the processor 31, before performing risk detection on the target unit object based on the second unit object content to obtain the risk API of the target application, further include:

[0182] Based on the language type and the standard information format corresponding to the second unit object content, the second unit object content is standardized to obtain the standardized second unit object content.

[0183] In an optional implementation manner, in the instructions executed by the processor 31, the risk detection is performed on the target unit object based on the content of the second unit object to obtain the risk API of the target application, including:

[0184] Based on the risk feature set, correct the second unit object content to obtain the corrected second unit object content;

[0185] Based on the risk feature set, risk detection is performed on the corrected second unit object content, and the risk API of the target application is determined based on the risk detection result.

[0186] In an optional implementation manner, the instructions executed by the processor 31 further include:

[0187] Based on the second unit object content corresponding to the risk API and the risk detection result corresponding to the risk API, risk description information of the risk API is generated.

[0188] In an optional implementation manner, in the instruction executed by the processor 31, the first unit object content includes at least one of the following:

[0189] Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, and identification information of the class unit object corresponding to the target unit object.

[0190] The present disclosure also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the interface security detection method based on SAST described in the above method embodiment are executed. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0191] The embodiments of the present disclosure also provide a computer program product, which carries a program code. The instructions included in the program code can be used to execute the steps of the SAST-based interface security detection method described in the above method embodiment. Please refer to the above method embodiment for details, which will not be repeated here.

[0192] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is implemented as a computer storage medium. In another optional embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0193] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here. In the several embodiments provided in the present disclosure, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the device or unit can be electrical, mechanical or other forms.

[0194] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0195] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0196] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0197] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A SAST-based interface security detection method, characterized in that: include: Performing static application security test SAST processing on the source code of the target application, and generating an abstract syntax tree AST corresponding to the target application based on the processing result; Based on the AST, determine a target unit object representing an application programming interface API in the target application, and a first unit object content corresponding to the target unit object; Based on the symbol table corresponding to the AST, the first unit object content corresponding to each target unit object is completed respectively to obtain the second unit object content corresponding to each target unit object; Based on the content of the second unit object, risk detection is performed on the target unit object to obtain the risk API of the target application.

2. The method according to claim 1, characterized in that The static application security test SAST is performed on the source code of the target application, and an abstract syntax tree AST corresponding to the target application is generated based on the processing result, including: Performing SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code; Perform lexical analysis on the code object to generate an abstract syntax tree AST corresponding to the target application.

3. The method according to claim 1, characterized in that The step of determining, based on the AST, a target unit object representing an application programming interface API in the target application and first unit object content corresponding to the target unit object comprises: For a class unit object in the AST, if the class unit object has a first API feature, use the class unit object as a first API unit object, and determine a method unit object corresponding to the first API unit object; In the case where the method unit object carries the second API feature, using the method unit object as the second API unit object; The second API unit object is used as the target unit object, and the first unit object content corresponding to the target unit object is determined.

4. The method according to claim 1, characterized in that The symbol table indicates the correspondence between classes or variables and grammatical structures in the source code; The method of completing the first unit object content based on the symbol table corresponding to the AST to obtain the second unit object content corresponding to the target unit object includes: For any information in the first unit object content, based on the symbol table, determine the target syntax structure corresponding to the first unit object content from the syntax structure of the source code; Parsing the target grammatical structure to determine the information structure corresponding to the first unit object content; Based on the information structure, content to be supplemented of the first unit object content is determined, and the first unit object content is supplemented with the content to be supplemented to obtain the second unit object content.

5. The method according to claim 4, characterized in that The determining, based on the information structure, the content to be supplemented of the first unit object content, and using the content to be supplemented to complete the first unit object content to obtain the second unit object content, includes: Identify a serialization flag from the information structure corresponding to the first unit object content; Based on the serialization mark, the information structure is deserialized and modified to determine the content to be supplemented of the first unit object content; Based on the content to be supplemented obtained through deserialization correction, the content of the first unit object is supplemented to obtain the content of the second unit object corresponding to the target unit object.

6. The method according to claim 1, characterized in that The step of performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application program includes: Based on the risk feature set, correct the second unit object content to obtain the corrected second unit object content; Based on the risk feature set, risk detection is performed on the corrected second unit object content, and the risk API of the target application is determined based on the risk detection result.

7. The method according to any one of claims 1 to 6, characterized in that: The first unit object content includes at least one of the following: Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, and identification information of the class unit object corresponding to the target unit object.

8. An interface security detection device based on SAST, characterized in that: include: A scanning module, used to perform static application security test SAST processing on the source code of the target application, and generate an abstract syntax tree AST corresponding to the target application based on the processing result; A determination module, configured to determine, based on the AST, a target unit object representing an application programming interface API in the target application and a first unit object content corresponding to the target unit object; A correction module, used for completing the first unit object content corresponding to each target unit object based on the symbol table corresponding to the AST, to obtain the second unit object content corresponding to each target unit object; A detection module is used to perform risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application.

Images