SAST-Based Interface Security Detection Method and Device

Abstract

The present disclosure provides a SAST-based interface security detection method and apparatus. Among them, the method includes: performing static application security testing (SAST) processing on the source code of a target application program, and generating an abstract syntax tree (AST) corresponding to the target application program based on the processing result; based on the AST, determining a target unit object representing an application programming interface (API) in the target application program, and a first unit object content corresponding to the target unit object; based on the symbol table corresponding to the AST, complementing the first unit object content to obtain a second unit object content corresponding to the target unit object; based on the second unit object content, performing risk detection on the target unit object to obtain a risk API of the target application program. This method can use the source code to implement the risk detection of the API, improve the accuracy of the risk detection, and reduce false positives and false negatives.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular, to a SAST-based interface security detection method and device. Background Art

[0002] With the rapid development and wide application of Internet technology, Application Programming Interfaces (APIs) have become an indispensable part of modern software systems. APIs are not only used for data interaction and function calls between applications, but also provide a way for third-party developers to access system resources. However, the widespread use of APIs also brings significant security risks. API vulnerabilities may lead to risk data leakage, unauthorized access and operations, and various security attacks.

[0003] Traditional API security detection methods mainly rely on dynamic analysis technology (Dynamic Application Security Testing, DAST), that is, detecting the security of APIs at runtime. Although the DAST method can effectively identify many real-time attacks and vulnerabilities, it depends on the actual running environment, with high detection costs and long detection cycles. In addition, the DAST method often shows certain limitations when faced with some deeply hidden logical vulnerabilities. Summary of the Invention

[0004] The embodiments of the present disclosure at least provide a SAST-based interface security detection method and device.

[0005] In a first aspect, the embodiments of the present disclosure provide a SAST-based interface security detection method, including:

[0006] Performing static application security testing (SAST) processing on the source code of the target application, and generating an Abstract Syntax Tree (AST) corresponding to the target application based on the processing result;

[0007] Based on the AST, determining a target unit object representing an Application Programming Interface (API) in the target application, and a first unit object content corresponding to the target unit object;

[0008] Based on the symbol table corresponding to the AST, respectively completing the first unit object content corresponding to each target unit object to obtain a second unit object content corresponding to each target unit object;

[0009] Based on the second unit object content, performing risk detection on the target unit object to obtain the risk APIs of the target application.

[0010] In an optional implementation manner, performing static application security testing (SAST) processing on the source code of the target application and generating an abstract syntax tree (AST) corresponding to the target application based on the processing result includes:

[0011] Performing SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code;

[0012] Performing lexical analysis on the code objects to generate an abstract syntax tree (AST) corresponding to the target application.

[0013] In an optional implementation manner, based on the AST, determining a target unit object representing an application programming interface (API) in the target application and first unit object content corresponding to the target unit object includes:

[0014] For a class unit object in the AST, when the class unit object has a first API feature, using the class unit object as a first API unit object and determining a method unit object corresponding to the first API unit object;

[0015] When the method unit object carries a second API feature, using the method unit object as a second API unit object;

[0016] Using the second API unit object as the target unit object and determining first unit object content corresponding to the target unit object.

[0017] In an optional implementation manner, the symbol table indicates the correspondence between classes or variables and the syntax structures in the source code;

[0018] Based on the symbol table corresponding to the AST, completing the first unit object content to obtain second unit object content corresponding to the target unit object includes:

[0019] For any kind of information in the first unit object content, based on the symbol table, determining a target syntax structure corresponding to the first unit object content from the syntax structures of the source code;

[0020] Parsing the target syntax structure to determine an information structure corresponding to the first unit object content;

[0021] Based on the information structure, determining the content to be supplemented for the first unit object content and using the content to be supplemented to complete the first unit object content to obtain the second unit object content.

[0022] In an optional implementation manner, based on the information structure, determining the content to be supplemented for the content of the first unit object, and using the content to be supplemented to complete the content of the first unit object to obtain the content of the second unit object includes:

[0023] Identifying a serialization flag from the information structure corresponding to the content of the first unit object;

[0024] Based on the serialization flag, performing deserialization correction on the information structure to determine the content to be supplemented for the content of the first unit object;

[0025] Based on the content to be supplemented obtained by deserialization correction, completing the content of the first unit object to obtain the content of the second unit object corresponding to the target unit object.

[0026] In an optional implementation manner, before performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application, the method further includes:

[0027] Based on the language type and standard information format corresponding to the content of the second unit object, performing standardization processing on the content of the second unit object to obtain the standardized content of the second unit object.

[0028] In an optional implementation manner, the performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application includes:

[0029] Based on a risk feature set, correcting the content of the second unit object to obtain the corrected content of the second unit object;

[0030] Based on the risk feature set, performing risk detection on the corrected content of the second unit object, and determining the risk API of the target application based on the risk detection result.

[0031] In an optional implementation manner, the method further includes:

[0032] Based on the content of the second unit object corresponding to the risk API and the risk detection result corresponding to the risk API, generating risk description information of the risk API.

[0033] In an optional implementation manner, the content of the first unit object includes at least one of the following at least:

[0034] The parameter information of the target unit object, the content information of the target unit object, the address information of the target unit object, the request method information of the target unit object, the protocol type information of the target unit object, the signature information of the target unit object, and the identification information of the class unit object corresponding to the target unit object.

[0035] In a second aspect, an SAST-based interface security detection device provided by an embodiment of the present disclosure includes:

[0036] A scanning module for performing static application security testing (SAST) processing on the source code of a target application and generating an abstract syntax tree (AST) corresponding to the target application based on the processing result;

[0037] A determination module for determining a target unit object representing an application programming interface (API) in the target application and the corresponding first unit object content of the target unit object based on the AST;

[0038] A correction module for respectively complementing the corresponding first unit object content of each target unit object based on the symbol table corresponding to the AST to obtain the corresponding second unit object content of each target unit object;

[0039] A detection module for performing risk detection on the target unit object based on the second unit object content to obtain the risk APIs of the target application.

[0040] In an optional implementation manner, the scanning module is specifically configured to:

[0041] Perform SAST processing on the source code of the target application to obtain a plurality of code objects corresponding to the source code;

[0042] Perform lexical analysis on the code objects to generate an abstract syntax tree (AST) corresponding to the target application.

[0043] In an optional implementation manner, the determination module is specifically configured to:

[0044] For a class unit object in the AST, when the class unit object has a first API feature, use the class unit object as a first API unit object and determine the method unit object corresponding to the first API unit object;

[0045] When the method unit object carries a second API feature, use the method unit object as a second API unit object;

[0046] Take the second API unit object as the target unit object, and determine the content of the first unit object corresponding to the target unit object.

[0047] In an optional implementation, the symbol table indicates the correspondence between classes or variables and the syntax structures in the source code;

[0048] The correction module is specifically configured to:

[0049] For any kind of information in the content of the first unit object, based on the symbol table, determine the target syntax structure corresponding to the content of the first unit object from the syntax structures of the source code;

[0050] Parse the target syntax structure to determine the information structure corresponding to the content of the first unit object;

[0051] Based on the information structure, determine the content to be supplemented for the content of the first unit object, and use the content to be supplemented to complete the content of the first unit object to obtain the content of the second unit object.

[0052] In an optional implementation, the correction module is specifically configured to:

[0053] Identify serialization flags from the information structure corresponding to the content of the first unit object;

[0054] Based on the serialization flags, perform deserialization correction on the information structure to determine the content to be supplemented for the content of the first unit object;

[0055] Based on the content to be supplemented obtained by deserialization correction, complete the content of the first unit object to obtain the content of the second unit object corresponding to the target unit object.

[0056] In an optional implementation, before performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application, the detection module is further configured to:

[0057] Based on the language type and standard information format corresponding to the content of the second unit object, perform standardization processing on the content of the second unit object to obtain the standardized content of the second unit object.

[0058] In an optional implementation, the detection module is specifically configured to:

[0059] Based on the risk feature set, correct the content of the second unit object to obtain the corrected content of the second unit object;

[0060] Based on the set of risk characteristics, perform risk detection on the corrected second unit object content, and determine the risk APIs of the target application based on the risk detection results.

[0061] In an optional implementation manner, the detection module is further configured to:

[0062] Generate risk description information of the risk API based on the second unit object content corresponding to the risk API and the risk detection result corresponding to the risk API.

[0063] In an optional implementation manner, the first unit object content at least includes at least one of the following:

[0064] The parameter information of the target unit object, the content information of the target unit object, the address information of the target unit object, the request method information of the target unit object, the protocol type information of the target unit object, the signature information of the target unit object, the identification information of the class unit object corresponding to the target unit object.

[0065] In a third aspect, an embodiment of the present disclosure further provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device runs, the processor communicates with the memory through the bus. When the machine-readable instructions are executed by the processor, the steps in the above first aspect or any possible implementation manner in the first aspect are executed.

[0066] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is run by a processor, the steps in the above first aspect or any possible implementation manner in the first aspect are executed.

[0067] The SAST-based interface security detection and device provided by the embodiments of the present disclosure can directly use the source code of the target application to implement risk detection of APIs through SAST processing, thereby identifying and locating potential security vulnerabilities in APIs at an early stage of application development, reducing the cost and risk of fixing vulnerabilities in the later stage; by generating an AST and analyzing based on the AST, the method can efficiently process large-scale source code, quickly identify unit objects related to APIs and the content corresponding to the unit objects, improve the detection efficiency, and moreover, by complementing the first unit object content based on the symbol table, the coverage rate of the unit object content can be improved, the accuracy of risk detection can be improved, and the situations of false positives and false negatives can be reduced.

[0068] To make the above objects, features, and advantages of the present disclosure more obvious and understandable, the following specifically enumerates preferred embodiments and, in conjunction with the accompanying drawings, makes a detailed description as follows. Brief Description of the Drawings

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the accompanying drawings required for use in the embodiments will be briefly introduced below. These accompanying drawings are incorporated into the specification and constitute a part of this specification. These drawings illustrate embodiments that comply with the present disclosure and are used together with the specification to explain the technical solutions of the present disclosure. It should be understood that the following accompanying drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For those of ordinary skill in the art, other related accompanying drawings can be obtained based on these drawings without creative efforts.

[0070] Figure 1 Shows a flowchart of a method for interface security detection based on SAST provided by an embodiment of the present disclosure;

[0071] Figure 2 Shows a schematic diagram of a device for interface security detection based on SAST provided by an embodiment of the present disclosure;

[0072] Figure 3 Shows a schematic diagram of an electronic device provided by an embodiment of the present disclosure. Detailed Embodiments

[0073] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only some, rather than all, of the embodiments of the present disclosure. The components of the embodiments of the present disclosure described and illustrated in the accompanying drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the accompanying drawings is not intended to limit the scope of the present disclosure to be protected, but only represents the selected embodiments of the present disclosure. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts fall within the scope of protection of the present disclosure.

[0074] It should be noted that similar reference numerals and letters denote similar items in the following accompanying drawings. Therefore, once an item is defined in one accompanying drawing, it does not need to be further defined and explained in subsequent accompanying drawings.

[0075] As used herein, the term "and / or" is merely used to describe an associated relationship, indicating that there can be three relationships. For example, A and / or B can represent three cases: A exists alone, A and B exist simultaneously, and B exists alone. Additionally, the term "at least one" as used herein means any one of multiple items or any combination of at least two of multiple items. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set composed of A, B, and C.

[0076] It has been found through research that traditional API security detection methods mainly rely on dynamic application security testing (DAST). DAST can discover many real-time attacks and vulnerabilities by performing security testing during the runtime of an application. However, the DAST method has some limitations. For example, it needs to rely on the actual running environment, the detection cost is relatively high, and it may not be able to discover deeply hidden logical vulnerabilities. In addition, DAST is usually carried out in the later stage of software development, and the cost of fixing vulnerabilities is relatively high. Static Application Security Testing (SAST) is a technology for code analysis without executing the program. By analyzing the source code or binary code, SAST can discover potential security problems in the early stage of software development, thereby reducing the cost and risk of fixing vulnerabilities. However, current SAST technologies face challenges such as high code complexity and strong interface diversity when dealing with API security detection, and it is difficult to comprehensively and accurately detect security problems in APIs.

[0077] Based on the above research, the present disclosure provides a SAST-based interface security detection method and device. Through SAST processing, it can directly use the source code of the target application to implement the risk detection of APIs without relying on the running environment, thereby being able to identify and locate potential security vulnerabilities in APIs in the early stage of application development, reducing the cost and risk of fixing vulnerabilities in the later stage. This method can efficiently process large-scale source code by generating an Abstract Syntax Tree (AST) and analyzing based on the AST, quickly identify the unit objects related to APIs and the content of the unit objects, improving the detection efficiency. Moreover, by complementing the content of the first unit object based on the symbol table, it can improve the coverage rate of the unit object content, enhance the accuracy of risk detection, and reduce the situations of false positives and false negatives.

[0078] To facilitate the understanding of this embodiment, first, a detailed introduction is given to a SAST-based interface security detection method disclosed in the embodiments of the present disclosure. The execution subject of the SAST-based interface security detection method provided in the embodiments of the present disclosure is generally a computer device with certain computing capabilities. In some possible implementation manners, this SAST-based interface security detection method can be implemented by a processor invoking computer-readable instructions stored in a memory.

[0079] See Figure 1 As shown, it is a flowchart of the SAST-based interface security detection method provided by an embodiment of the present disclosure. The method includes steps S101 to S104, where:

[0080] S101. Perform static application security testing (SAST) on the source code of the target application, and generate an Abstract Syntax Tree (AST) corresponding to the target application based on the processing result.

[0081] In this step, the source code of the target application can be obtained first. Then, SAST is used to scan the source code to obtain multiple code objects corresponding to the source code. Among them, when scanning, the source code can be split into multiple code objects (i.e., tokens) according to the content such as spaces, line breaks, and special symbols in the source code, and a token set corresponding to the source code file is obtained.

[0082] After obtaining the token set, the token set can be traversed, and lexical analysis is performed during the traversal to determine the type of each token, and an abstract syntax tree (Abstract Syntax Tree, AST) corresponding to the source code is generated by means of recursive descent, etc.

[0083] Lexical analysis is the first step in the front end of a compiler. Its main task is to convert the character stream of the source code into meaningful lexical units for further processing by the syntax analyzer.

[0084] AST is a tree-like data structure used to represent the syntax structure of the source code. Each unit object represents a structural element in the source code. AST is widely used in compilers and interpreters to facilitate code analysis and transformation.

[0085] Among them, the types of tokens can include plain text data, numbers or operators, special meaning marker symbols, etc.

[0086] The obtained AST can include multiple unit objects. The unit object represents a token node, and there can be connection edges between the unit objects, indicating a reference relationship or an inheritance relationship between the unit objects.

[0087] S102. Based on the AST, determine the target unit object representing the Application Programming Interface (API) in the target application, and the content of the first unit object corresponding to the target unit object.

[0088] After obtaining the AST, the target unit object representing the API in the target application and the content of the first unit object corresponding to the target unit object can be determined.

[0089] Specifically, for the class unit object in the AST, when the class unit object has the first API feature, the class unit object is used as the first API unit object, and the method unit object corresponding to the first API unit object is determined; when the method unit object carries the second API feature, the method unit object is used as the second API unit object; the second API unit object is used as the target unit object, and the first unit object content corresponding to the target unit object is determined.

[0090] When determining the target unit object, the class unit object and the method unit object in the AST can be traversed.

[0091] In an Abstract Syntax Tree (AST), the class unit object and the method unit object are unit objects representing classes and methods in object-oriented programming languages (such as Java, C++, Python, etc.). Each unit object contains relevant attributes and sub-unit objects for describing the structure and behavior of classes and methods.

[0092] The class unit object represents the class definition in the program, including the basic information of the class and its members (such as attributes, methods, etc.). The structure of the class unit object can include the unit object type, attributes (such as class name, access modifier, inheritance information, implemented interfaces), sub-unit object content (such as attribute unit object, method unit object, constructor unit object), etc.; the method unit object represents the method definition in the program, including information such as the method signature, parameters, and method body. The structure of the method unit object can include the unit object type, attributes (such as method name, return type, return modifier, static modifier), sub-unit object content (such as parameter unit object, method body unit object), etc.

[0093] Exemplarily, for the spring framework of Java, when determining the target unit object, two types of unit objects can be concerned: class declarations and method declarations. Other unit objects are skipped during traversal; when dealing with functional APIs configured in a hard-coded manner in Java, the unit objects that may be concerned are method calls and the parameter list of the method call, because functional APIs often expose API interfaces through hard-coded registration using register.

[0094] In a possible implementation manner, the class unit objects in the AST can be traversed first. When the currently traversed class unit object has the first API feature, the currently traversed class unit object is used as the first API unit object, and the method unit object corresponding to the first API unit object is traversed.

[0095] Among them, the above-mentioned first API feature may refer to carrying a preset string. For example, if the annotation information of a class unit object carries the @Controller annotation, it indicates that the class unit object carries relevant information of the API, and it can be used as the first API unit object.

[0096] The method unit object corresponding to the above-mentioned first API unit object may refer to the method unit object directly or indirectly connected to the first API unit object, and usually it can be the unit object under the hierarchy of the first API unit object.

[0097] When the currently traversed method unit object carries the second API feature, the currently traversed method unit object is used as the second API unit object. For example, if the annotation information of a method unit object carries annotations such as @GetMapping, it can be used as the second API unit object. Then, the second API unit object can be used as the target unit object.

[0098] If the currently traversed class unit object does not have the first API feature, the next class unit object can be traversed, skipping other irrelevant unit objects.

[0099] When determining the target unit object, the first unit object content of the target unit object can also be obtained, and the first unit object content can include at least one of the following:

[0100] The parameter information of the target unit object, the content information of the target unit object, the address information of the target unit object, the request method information of the target unit object, the protocol type information of the target unit object, the signature information of the target unit object, and the identification information of the class unit object corresponding to the target unit object.

[0101] Exemplarily, according to the annotation information of the target unit object, the address information of the target unit object (such as Uniform Resource Locator, URL) can be obtained, as well as the request method get / post of the URL, the protocol http, and the framework type spring.

[0102] When determining the first unit object content, the fields of the annotation information of the class unit object (the first API unit object corresponding to the second API unit object) and the annotation information of the method unit object can be used simultaneously. For example, the path or value field. Both the class and the method may contain URL fragments. The URL fragments contained in the path or value field are spliced and formatted (such as an error correction mechanism, removing redundant slashes or spaces) to obtain the URL.

[0103] Meanwhile, it is also possible to obtain basic method information, such as a method parameter list (parameter types and parameter names), unit object content, which includes annotations, as well as information about the unit object itself, and annotation information, such as the included method signature, framework type, etc.

[0104] S103. Based on the symbol table corresponding to the AST, complete the content of the first unit object to obtain the content of the second unit object corresponding to the target unit object.

[0105] After obtaining the target unit object and the content of the first unit object corresponding to it, it is possible to perform risk detection on the target unit object using the content of the first unit object. However, due to certain differences between the AST and the source code, the information extracted from the AST may be incorrect or missing information. Therefore, it is necessary to complete the content of the first unit object to obtain relatively correct and complete content of the second unit object.

[0106] Specifically, the symbol table corresponding to the AST can be obtained, and the content of the first unit object can be deserialized and corrected using the symbol table.

[0107] Among them, the symbol table corresponding to the AST can indicate the correspondence between classes or variables and the syntax structures in the source code. The symbol table can be constructed by establishing an index when performing SAST processing on the source code.

[0108] In a possible implementation, for any kind of information in the content of the first unit object, based on the symbol table, the target syntax structure corresponding to the content of the first unit object can be determined; then traverse the target syntax structure to determine the information structure corresponding to the content of the first unit object, and then based on the information structure, determine the content to be supplemented for the content of the first unit object, and use the content to be supplemented to complete the content of the first unit object to obtain the content of the second unit object, thereby correcting the incorrect information and completing the missing information.

[0109] In some serialization and deserialization scenarios, there are serialization field mappings, and the field mappings have a certain degree of complexity, which can cause the true meaning of the content of the first unit object to be hidden. Therefore, in the completion step, the content of the first unit object can be deserialized and corrected to ensure that the API request and response structures are correctly reconstructed.

[0110] Specifically, the serialization flag can be identified from the information structure corresponding to the content of the first unit object, and then based on the serialization flag, the information structure can be deserialized and corrected to obtain the content to be supplemented, and then based on the content to be supplemented obtained by the deserialization correction, the content of the first unit object can be completed to obtain the content of the second unit object corresponding to the target unit object.

[0111] Exemplarily, when determining the target grammar structure, information structures corresponding to the content of the first unit object can be identified from the target grammar structure. Different information types correspond to different information structures. After obtaining the information structure, it can be determined whether there is a serialization identifier in the information structure, such as carrying the @JsonProperty annotation. If the serialization identifier is carried, it indicates that the fields in the information structure are serialized, and then anti-serialization correction can be performed on it.

[0112] In specific implementation, in requests and responses, there are sometimes scenarios where JSON serializers and deserializers exist. In these scenarios, the fields recognized by the source code may not be exactly the same as the request-response fields, which may cause inaccurate API parameters and further lead to false positives and false negatives in the detection results. By identifying the serializers and their code, the actual requests and responses can be analyzed. By forming a mapping between the source code field list and the JSON list, it can better assist the engine in identifying the correct API parameter fields. For example, some field names are called f_passwd, but there is an annotation called @JsonProperty(”password') on it. At this time, the parameter name will be corrected to password to avoid inconsistency with the final request. At the same time, annotations such as @NotBlank and @Email will also be extracted to generate the description information of the parameter, such as the parameter name, whether it is mandatory, and the verification rules.

[0113] After obtaining the content of the second unit object, the content of the second unit object can be used to perform risk detection on the target unit object.

[0114] However, since different parts of the source code may be designed using different standards, different contents of the second unit object may have different annotations or structures, such as inconsistent languages used. Therefore, based on the language type and standard information format corresponding to the content of the second unit object, the content of the second unit object can be standardized to obtain the standardized content of the second unit object, and the standardized content of the second unit object with a unified language and consistent information format can be used for risk detection.

[0115] S104. Based on the content of the second unit object, perform risk detection on the target unit object to obtain the risk API of the target application program.

[0116] After obtaining the content of the second unit object, risk detection can be performed according to the content of the second unit object. When performing risk detection, the risk features indicated in the risk feature set can be used to match the content of the second unit object, so as to achieve the screening of the target unit object.

[0117] Since there may be some errors in the content of the second unit object (such as typographical errors in the source code), the risk feature set can be used to correct the content of the second unit object to obtain the corrected content of the second unit object. Then, the risk feature set is used to match the corrected content of the second unit object.

[0118] Exemplarily, an error correction algorithm (such as dictionary-based matching technology) can be used to capture and correct spelling errors of latent information identifiers, and automatically identify keywords with very similar or misspelled degrees of difference. For example, "passwerd" is automatically corrected to "password". By setting a reasonable matching threshold, it can be ensured that only when the similarity between the error and the correct word exceeds the preset value, it is regarded as the correction of information false alarm or missed report, and then the risk parameters are accurately marked.

[0119] Among them, the dictionary matching algorithm compares the wrong word with the words in the dictionary to find the most matching word. The specific operation steps are as follows: 1. Load the dictionary, which stores the correct words. Such as password, username, etc. 2. Compare the wrong word "passwerd" with the words in the dictionary and calculate the matching degree. 3. Select the word "password" with the highest matching degree as the error correction result.

[0120] In this way, error correction is only performed when the matching degree is greater than the preset threshold, which can improve the accuracy of error correction.

[0121] After that, when it is detected that the content of the second unit object matches the risk features in the risk feature set (such as the content of the second unit object contains at least one risk feature), the API corresponding to the second unit object can be used as a risk API.

[0122] After obtaining the risk API, the risk description information of the risk API can also be determined, and the risk description information can be determined according to the content of the second unit object of the risk API and the risk detection result.

[0123] Exemplarily, the risk description information may include at least one of the following contents:

[0124] Class name; framework type such as spring; current protocol type such as HTTP / 1.1; current request method such as GET; generate the current API address such as / API / v1 / chat / complete through the url in step 3; method signature such as public ChatResponse chat(ChatRequest chatRequest); the parameter names, parameter types, positions where the parameters appear (in the request body / url), risk information marks, nested parameter lists, and the tree structure of the method parameter list that are marked as risky in the method parameter list.

[0125] An interface security detection method based on static application security testing proposed by an embodiment of the present disclosure aims to efficiently and accurately identify and mark potential risk points related to APIs in the source code of an application, such as those involving risk information processing, authentication credentials, or other parts of data transmission. It can traverse and mark risks specifically, traverse the AST through a custom visitor pattern, and focus on the code structure related to APIs, such as class and method declarations with specific annotations (such as @Controller and @GetMapping in the Spring framework). In this step, the system marks the parts that may contain API parameters and avoids traversing irrelevant code, improving the detection efficiency. For the marked API risk classes and methods, the method parameters can be analyzed in depth, and the symbol table can be used for type reverse lookup to ensure the accuracy of parameter information. At the same time, it solves the inaccuracy of API parameters caused by inconsistent source code fields and request / response fields in the serialization and deserialization scenarios. And it unifies the data types between different programming languages into an OpenAPI-compatible standard format, enhancing cross-language applicability and accuracy. In the method parameter list, the system specifically identifies text-type parameters and marks and corrects potential spelling errors in API parameter identifiers through keyword matching and error correction algorithms, reducing false positives and false negatives.

[0126] Those skilled in the art can understand that in the above method of the specific implementation manner, the writing order of each step does not mean a strict execution order and does not constitute any limitation to the implementation process. The specific execution order of each step should be determined according to its function and possible internal logic.

[0127] Based on the same inventive concept, an embodiment of the present disclosure also provides a SAST-based interface security detection device corresponding to the SAST-based interface security detection method. Since the principle of solving problems by the device in the embodiment of the present disclosure is similar to the above SAST-based interface security detection method in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be elaborated.

[0128] Refer to Figure 2As shown in the figure, it is a schematic diagram of an interface security detection based on SAST provided by an embodiment of the present disclosure. The device includes:

[0129] A scanning module 210, configured to perform static application security testing (SAST) processing on the source code of a target application, and generate an abstract syntax tree (AST) corresponding to the target application based on the processing result;

[0130] A determination module 220, configured to determine a target unit object representing an application programming interface (API) in the target application and a first unit object content corresponding to the target unit object based on the AST;

[0131] A correction module 230, configured to complement the first unit object content corresponding to each target unit object respectively based on the symbol table corresponding to the AST, and obtain a second unit object content corresponding to each target unit object;

[0132] A detection module 240, configured to perform risk detection on the target unit object based on the second unit object content, and obtain a risk API of the target application.

[0133] In an optional implementation manner, the scanning module 210 is specifically configured to:

[0134] Perform SAST processing on the source code of the target application to obtain a plurality of code objects corresponding to the source code;

[0135] Perform lexical analysis on the code objects to generate an abstract syntax tree (AST) corresponding to the target application.

[0136] In an optional implementation manner, the determination module 220 is specifically configured to:

[0137] For a class unit object in the AST, when the class unit object has a first API feature, use the class unit object as a first API unit object, and determine a method unit object corresponding to the first API unit object;

[0138] When the method unit object carries a second API feature, use the method unit object as a second API unit object;

[0139] Use the second API unit object as the target unit object, and determine a first unit object content corresponding to the target unit object.

[0140] In an optional implementation manner, the symbol table indicates the correspondence between classes or variables and the syntax structures in the source code;

[0141] The correction module 230 is specifically configured to:

[0142] For any kind of information in the content of the first unit object, based on the symbol table, determine the target syntax structure corresponding to the content of the first unit object from the syntax structure of the source code;

[0143] Parse the target syntax structure to determine the information structure corresponding to the content of the first unit object;

[0144] Based on the information structure, determine the content to be supplemented for the content of the first unit object, and use the content to be supplemented to complete the content of the first unit object to obtain the content of the second unit object.

[0145] In an optional implementation manner, the correction module 230 is specifically configured to:

[0146] Identify the serialization flag from the information structure corresponding to the content of the first unit object;

[0147] Based on the serialization flag, perform deserialization correction on the information structure to determine the content to be supplemented for the content of the first unit object;

[0148] Based on the content to be supplemented obtained by deserialization correction, complete the content of the first unit object to obtain the content of the second unit object corresponding to the target unit object.

[0149] In an optional implementation manner, before performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application program, the detection module 240 is further configured to:

[0150] Based on the language type and standard information format corresponding to the content of the second unit object, perform standardization processing on the content of the second unit object to obtain the standardized content of the second unit object.

[0151] In an optional implementation manner, the detection module 240 is specifically configured to:

[0152] Based on the risk feature set, correct the content of the second unit object to obtain the corrected content of the second unit object;

[0153] Based on the risk feature set, perform risk detection on the corrected content of the second unit object, and determine the risk API of the target application program based on the risk detection result.

[0154] In an optional implementation manner, the detection module 240 is further configured to:

[0155] Generate risk description information for the risk API based on the content of the second unit object corresponding to the risk API and the risk detection result corresponding to the risk API.

[0156] In an optional implementation manner, the content of the first unit object at least includes at least one of the following:

[0157] Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, identification information of the class unit object corresponding to the target unit object.

[0158] Descriptions of the processing flows of each module in the device and the interaction flows between each module can refer to the relevant descriptions in the above method embodiments, and will not be elaborated here.

[0159] Corresponding to Figure 1 the SAST-based interface security detection method in, the embodiments of the present disclosure further provide an electronic device 300, as Figure 3 shown, which is a schematic structural diagram of the electronic device 300 provided by the embodiments of the present disclosure, including:

[0160] A processor 31, a memory 32, and a bus 33; the memory 32 is used to store execution instructions, including an internal memory 321 and an external memory 322; the internal memory 321 here is also called the main memory, and is used to temporarily store the operation data in the processor 31 and the data exchanged with the external memory 322 such as a hard disk. The processor 31 exchanges data with the external memory 322 through the internal memory 321. When the electronic device 300 runs, the processor 31 communicates with the memory 32 through the bus 33, so that the processor 31 executes the following instructions:

[0161] Perform static application security testing (SAST) processing on the source code of the target application program, and generate an abstract syntax tree (AST) corresponding to the target application program based on the processing result;

[0162] Based on the AST, determine a target unit object representing an application programming interface (API) in the target application program, and the content of the first unit object corresponding to the target unit object;

[0163] Based on the symbol table corresponding to the AST, respectively complete the content of the first unit object corresponding to each target unit object to obtain the content of the second unit object corresponding to each target unit object;

[0164] Based on the content of the second unit object, perform risk detection on the target unit object to obtain the risk APIs of the target application.

[0165] In an optional implementation, among the instructions executed by the processor 31, the static application security testing (SAST) process for the source code of the target application and generating the abstract syntax tree (AST) corresponding to the target application includes:

[0166] Perform SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code;

[0167] Perform lexical analysis on the code objects to generate the abstract syntax tree (AST) corresponding to the target application.

[0168] In an optional implementation, among the instructions executed by the processor 31, the determination of the target unit object representing the application programming interface (API) in the target application and the content of the first unit object corresponding to the target unit object includes:

[0169] For the class unit object in the AST, when the class unit object has the first API feature, use the class unit object as the first API unit object and determine the method unit object corresponding to the first API unit object;

[0170] When the method unit object carries the second API feature, use the method unit object as the second API unit object;

[0171] Use the second API unit object as the target unit object and determine the content of the first unit object corresponding to the target unit object.

[0172] In an optional implementation, among the instructions executed by the processor 31, the symbol table indicates the correspondence between classes or variables and the syntax structures in the source code;

[0173] The completion of the content of the first unit object based on the symbol table corresponding to the AST to obtain the content of the second unit object corresponding to the target unit object includes:

[0174] For any information in the content of the first unit object, based on the symbol table, determine the target syntax structure corresponding to the content of the first unit object;

[0175] Traverse the target syntax structure to determine the information structure corresponding to the content of the first unit object;

[0176] Based on the information structure, complete the content of the first unit object to obtain the content of the second unit object.

[0177] In an optional implementation, among the instructions executed by the processor 31, completing the content of the first unit object to obtain the content of the second unit object includes:

[0178] Identify the serialization flag from the information structure corresponding to the content of the first unit object;

[0179] Based on the serialization flag, perform deserialization correction on the information structure;

[0180] Based on the deserialization correction result, determine the content of the second unit object corresponding to the target unit object.

[0181] In an optional implementation, among the instructions executed by the processor 31, before performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application, it further includes:

[0182] Based on the language type and standard information format corresponding to the content of the second unit object, perform standardization processing on the content of the second unit object to obtain the standardized content of the second unit object.

[0183] In an optional implementation, among the instructions executed by the processor 31, the performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application includes:

[0184] Based on the risk feature set, perform error correction on the content of the second unit object to obtain the error-corrected content of the second unit object;

[0185] Based on the risk feature set, perform risk detection on the error-corrected content of the second unit object, and determine the risk API of the target application based on the risk detection result.

[0186] In an optional implementation, among the instructions executed by the processor 31, it further includes:

[0187] Based on the content of the second unit object corresponding to the risk API and the risk detection result corresponding to the risk API, generate the risk description information of the risk API.

[0188] In an optional implementation, among the instructions executed by the processor 31, the content of the first unit object includes at least one of the following at least:

[0189] The parameter information of the target unit object, the content information of the target unit object, the address information of the target unit object, the request method information of the target unit object, the protocol type information of the target unit object, the signature information of the target unit object, and the identification information of the class unit object corresponding to the target unit object.

[0190] The embodiments of the present disclosure also provide a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the SAST-based interface security detection method described in the above method embodiments. Among them, the storage medium can be a volatile or non-volatile computer-readable storage medium.

[0191] The embodiments of the present disclosure also provide a computer program product, which carries program codes. The instructions included in the program codes can be used to execute the steps of the SAST-based interface security detection method described in the above method embodiments. For details, please refer to the above method embodiments and will not be repeated here.

[0192] Among them, the above computer program product can be specifically implemented in the form of hardware, software, or a combination thereof. In an optional embodiment, the computer program product is specifically embodied as a computer storage medium. In another optional embodiment, the computer program product is specifically embodied as a software product, such as a Software Development Kit (SDK), etc.

[0193] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems and devices described above can refer to the corresponding processes in the foregoing method embodiments and will not be repeated here. In the several embodiments provided by the present disclosure, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces. The indirect coupling or communication connection of the devices or units can be in an electrical, mechanical, or other form.

[0194] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0195] In addition, each functional unit in various embodiments of the present disclosure may be integrated into one processing unit, may exist separately as individual physical units, or two or more units may be integrated into one unit.

[0196] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium executable by a processor. Based on such an understanding, the technical solution of the present disclosure, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present disclosure. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0197] Finally, it should be noted that: the above-described embodiments are only specific implementation manners of the present disclosure, used to illustrate the technical solutions of the present disclosure, rather than limiting them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: any person skilled in the art within the technical scope disclosed by the present disclosure can still modify the technical solutions recorded in the foregoing embodiments, or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes, or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be covered within the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be determined by the protection scope of the claims.

Claims

1. A SAST-based interface security detection method, characterized in that: include: Performing static application security testing (SAST) on the source code of the target application, and generating an abstract syntax tree (AST) corresponding to the target application based on the processing result; Based on the AST, determining a target unit object representing an application programming interface API in the target application, and a first unit object content corresponding to the target unit object; Based on the symbol table corresponding to the AST, the first unit object content corresponding to each target unit object is respectively completed to obtain the second unit object content corresponding to each target unit object; Based on the content of the second unit object, performing risk detection on the target unit object to obtain the risk API of the target application; The symbol table indicates the correspondence between classes or variables and grammatical structures in the source code; The method of completing the first unit object content based on the symbol table corresponding to the AST to obtain the second unit object content corresponding to the target unit object includes: For any information in the first unit object content, based on the symbol table, determining a target syntax structure corresponding to the first unit object content from the syntax structure of the source code; Parsing the target grammatical structure to determine the information structure corresponding to the first unit object content; Determining content to be supplemented of the first unit object content based on the information structure, and completing the first unit object content with the content to be supplemented to obtain the second unit object content; The determining, based on the information structure, content to be supplemented of the first unit object content, and using the content to be supplemented to complete the first unit object content to obtain the second unit object content, includes: Identifying a serialization flag from the information structure corresponding to the first unit object content; Based on the serialization flag, deserialize and modify the information structure to determine the content to be supplemented in the first unit object content; Based on the content to be supplemented obtained through deserialization correction, the content of the first unit object is supplemented to obtain the content of the second unit object corresponding to the target unit object.

2. The method according to claim 1, characterized in that The step of performing static application security testing (SAST) on the source code of the target application and generating an abstract syntax tree (AST) corresponding to the target application based on the processing result includes: Performing SAST processing on the source code of the target application to obtain multiple code objects corresponding to the source code; Perform lexical analysis on the code object to generate an abstract syntax tree (AST) corresponding to the target application.

3. The method according to claim 1, characterized in that The determining, based on the AST, a target unit object representing an application programming interface API in the target application and first unit object content corresponding to the target unit object includes: For a class unit object in the AST, if the class unit object has a first API feature, use the class unit object as a first API unit object, and determine a method unit object corresponding to the first API unit object; In the case where the method unit object carries the second API feature, using the method unit object as the second API unit object; The second API unit object is used as the target unit object, and the content of the first unit object corresponding to the target unit object is determined.

4. The method according to claim 1, wherein The step of performing risk detection on the target unit object based on the content of the second unit object to obtain the risk API of the target application program includes: Based on the risk feature set, correct the second unit object content to obtain corrected second unit object content; Based on the risk feature set, risk detection is performed on the corrected second unit object content, and the risk API of the target application is determined based on the risk detection result.

5. The method according to any one of claims 1 to 4, characterized in that: The first unit object content includes at least one of the following: Parameter information of the target unit object, content information of the target unit object, address information of the target unit object, request method information of the target unit object, protocol type information of the target unit object, signature information of the target unit object, and identification information of the class unit object corresponding to the target unit object.

6. An interface security detection device based on SAST, characterized in that: include: A scanning module is used to perform static application security testing (SAST) on the source code of the target application and generate an abstract syntax tree (AST) corresponding to the target application based on the processing result; a determination module, configured to determine, based on the AST, a target unit object representing an application programming interface API in the target application, and first unit object content corresponding to the target unit object; A correction module, configured to complete the first unit object content corresponding to each target unit object based on the symbol table corresponding to the AST, to obtain the second unit object content corresponding to each target unit object; a detection module, configured to perform risk detection on the target unit object based on the content of the second unit object, and obtain a risk API of the target application; The symbol table indicates the correspondence between classes or variables and grammatical structures in the source code; The correction module is specifically used for: For any information in the first unit object content, based on the symbol table, determining a target syntax structure corresponding to the first unit object content from the syntax structure of the source code; Parsing the target grammatical structure to determine the information structure corresponding to the first unit object content; Identifying a serialization flag from the information structure corresponding to the first unit object content; Based on the serialization flag, deserialize and modify the information structure to determine the content to be supplemented in the first unit object content; Based on the content to be supplemented obtained through deserialization correction, the content of the first unit object is supplemented to obtain the content of the second unit object corresponding to the target unit object.

Images