Test case selection method, computing device and computer program product

Abstract

The invention provides a test case selection method, computing equipment and a computer program product. In an embodiment, the method comprises the steps of determining a to-be-tested code; determining at least one test label matched with the function of the to-be-tested code from a plurality of test labels; determining a test case for testing the to-be-tested code based on at least one test label matched with the function of the to-be-tested code; wherein each test label is associated with at least one test case, and the test label is used for indicating the test content of the associated at least one test case. According to the method, the code function associated with the test case is replaced with the test label, the test label is used for summarizing the test content of the test case, the adaptation degree of the test content and the to-be-tested code is considered, the influence of code function change on test case selection does not need to be considered, and the possibility that the test case cannot be matched is reduced.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a test case selection method, a computing device, and a computer program product. Background Art

[0002] In software security testing, code execution is triggered manually or through business automation, code execution is monitored, and a correspondence between test cases and code functions is established. If any code function is changed later, the affected test cases can be reversely associated and executed through automated or manual execution.

[0003] However, when the code function changes significantly, there may be problems with not being able to match the test cases. Summary of the invention

[0004] The embodiments of the present application provide a test case selection method, a computing device, and a computer program product, which replace the code function associated with the test case with a test tag, and the test tag is used to summarize the test content of the test case, taking into account the adaptability of the test content and the code to be tested. There is no need to consider the impact of code function changes on the selection of test cases, thereby reducing the possibility of failing to match test cases.

[0005] In a first aspect, an embodiment of the present application provides a test case selection method, which is applied to a computing device, comprising:

[0006] Determine the code to be tested; determine at least one test tag that matches the function of the code to be tested from multiple test tags; determine a test case for testing the code to be tested based on at least one test tag that matches the function of the code to be tested; wherein each test tag is associated with at least one test case, and the test tag is used to indicate the test content of the associated at least one test case.

[0007] In this solution, the code function associated with the test case is replaced with a test tag. The test tag is used to summarize the test content of the test case, considering the adaptability of the test content and the code to be tested. There is no need to consider the impact of code function changes on the selection of test cases, reducing the possibility of failing to match test cases.

[0008] In a possible implementation, determining at least one test tag matching the function of the code to be tested from a plurality of test tags includes:

[0009] Based on the code to be tested, at least one question is determined, and the at least one question is used to inquire about the test tag that matches the code to be tested; the at least one question is input into the AI ​​model respectively to obtain the answer to at least one question output by the AI ​​model; based on the answer to the at least one question, at least one test tag that matches the code to be tested is determined.

[0010] In this solution, through the question-and-answer method, the AI ​​model can analyze the relationship between the code to be tested and the test label, which can more conveniently, quickly and accurately determine the test label that matches the code to be tested.

[0011] In a possible implementation, at least one problem is determined based on the code to be tested, including:

[0012] At least one question is determined based on the code to be tested, multiple test tags and supplementary description content of each test tag in the multiple test tags; the supplementary description content is used to explain the explanation of each test tag.

[0013] In this solution, the process of determining the question takes into account the supplementary description of the test label, making the question clearer and improving the reference value of the answer to the question output by the AI ​​model.

[0014] In a possible implementation, at least one question includes a first question; the first question is used to inquire about a test tag that matches a first fill content of a first fill field, the first fill content being a code to be tested; and / or,

[0015] The at least one question includes a second question corresponding to each test label in the plurality of test labels, the second question is used to inquire whether the first fill content of the first fill field matches the second fill content of the second fill field, and the second fill content is the test label corresponding to the second question and / or the supplementary description content of the test label corresponding to the second question;

[0016] At least one question includes a third question corresponding to each test label in multiple test labels, and the third question is used to inquire whether the first fill content of the first fill field does not match the third fill content of the third fill field, and the third fill content is the test label corresponding to the third question and / or the supplementary description content of the test label corresponding to the third question.

[0017] In this solution, by constructing multiple questions, the AI ​​model outputs answers to multiple questions, thereby improving the reference value of the answers to the questions output by the AI ​​model.

[0018] In one possible implementation, the test label is used to indicate a security risk, the supplementary description content is used to describe the security risk classification of each test label, and the first question is used to inquire about the test label and security risk classification that match the first fill content of the first fill field.

[0019] In this solution, security risk classification is added to the question to improve the reference value of the answer to the first question output by the AI ​​model.

[0020] In a possible implementation, determining at least one test tag that matches the code to be tested based on the answer to at least one question includes:

[0021] For each test tag among the multiple test tags, when the answer to the first question is at least used to indicate the test tag, the answer to the second question corresponding to the test tag is yes, and the answer to the third question corresponding to the test tag is no, it is determined that the code to be tested and the test tag match.

[0022] In this solution, when the answers to multiple questions unanimously agree that the test tag matches, it is determined that the code to be tested and the test tag match, thereby improving the reference value of the test tag that matches the code to be tested.

[0023] In a possible implementation, the method further includes:

[0024] The test case to be associated is obtained, and at least one keyword in the test case to be associated is extracted; and at least one keyword is matched with a plurality of test tags to obtain at least one test tag associated with the test case to be associated.

[0025] In this solution, by extracting keywords from the test cases and matching the keywords with the test tags, the adaptability of the test cases and the test tags is improved.

[0026] In a possible implementation, at least one test tag matched by the code to be tested is used to illustrate the security risk generated by using the function of the code to be tested.

[0027] In a possible implementation, the code to be tested is used to indicate the code that is changed after the application version is changed.

[0028] In a possible implementation, the code to be tested is a function in the application code.

[0029] In the second aspect, the embodiment of the present application provides a test case selection device, which includes several modules, each of which is used to execute each step in the test case selection method provided in the first aspect of the embodiment of the present application, and the division of the modules is not limited here. For the specific functions performed by each module of the test case selection device and the beneficial effects achieved, please refer to the functions of each step of the test case selection method provided in the first aspect of the embodiment of the present application, which will not be repeated here.

[0030] For example, the test case selection device includes:

[0031] A code determination module, used to determine the code to be tested;

[0032] A matching module, used to determine at least one test tag matching the function of the code to be tested from multiple test tags;

[0033] A selection module is used to determine a test case for testing the code to be tested based on at least one test tag that matches the function of the code to be tested; wherein each test tag is associated with at least one test case, and the test tag is used to indicate the test content of the associated at least one test case.

[0034] In this solution, the code function associated with the test case is replaced with a test tag. The test tag is used to summarize the test content of the test case, considering the adaptability of the test content and the code to be tested. There is no need to consider the impact of code function changes on the selection of test cases, reducing the possibility of failing to match test cases.

[0035] In a possible implementation, the matching module includes: a question determination unit, an answer unit and a matching unit; wherein,

[0036] A question determination unit, configured to determine at least one question based on the code to be tested, wherein the at least one question is used to inquire about a test tag that matches the code to be tested;

[0037] An answering unit, used to input at least one question into the AI ​​model respectively, and obtain an answer to at least one question output by the AI ​​model;

[0038] The matching unit is used to determine at least one test tag that matches the code to be tested based on the answer to the at least one question.

[0039] In this solution, through the question-and-answer method, the AI ​​model can analyze the relationship between the code to be tested and the test label, which can more conveniently, quickly and accurately determine the test label that matches the code to be tested.

[0040] In a possible implementation, the problem determination unit is used to determine at least one problem based on the code to be tested, multiple test tags and supplementary description content of each test tag in the multiple test tags; the supplementary description content is used to explain the explanation of each test tag.

[0041] In this solution, the process of determining the question takes into account the supplementary description of the test label, making the question clearer and improving the reference value of the answer to the question output by the AI ​​model.

[0042] In a possible implementation, at least one question includes a first question; the first question is used to inquire about a test tag that matches a first fill content of a first fill field, the first fill content being a code to be tested; and / or,

[0043] The at least one question includes a second question corresponding to each test label in the plurality of test labels, the second question is used to inquire whether the first fill content of the first fill field matches the second fill content of the second fill field, and the second fill content is the test label corresponding to the second question and / or the supplementary description content of the test label corresponding to the second question;

[0044] At least one question includes a third question corresponding to each test label in multiple test labels, and the third question is used to inquire whether the first fill content of the first fill field does not match the third fill content of the third fill field, and the third fill content is the test label corresponding to the third question and / or the supplementary description content of the test label corresponding to the third question.

[0045] In this solution, by constructing multiple questions, the AI ​​model outputs answers to multiple questions, thereby improving the reference value of the answers to the questions output by the AI ​​model.

[0046] In one possible implementation, the test label is used to indicate a security risk, the supplementary description content is used to describe the security risk classification of each test label, and the first question is used to inquire about the test label and security risk classification that match the first fill content of the first fill field.

[0047] In this solution, security risk classification is added to the question to improve the reference value of the answer to the first question output by the AI ​​model.

[0048] In one possible implementation, a matching unit is used to determine, for each test tag among a plurality of test tags, that the code to be tested matches the test tag when an answer to a first question at least indicates the test tag, an answer to a second question corresponding to the test tag is yes, and an answer to a third question corresponding to the test tag is no.

[0049] In this solution, when the answers to multiple questions unanimously agree that the test tag matches, it is determined that the code to be tested and the test tag match, thereby improving the reference value of the test tag that matches the code to be tested.

[0050] In a possible implementation, the device further includes:

[0051] The association module is used to obtain the test case to be associated, extract at least one keyword in the test case to be associated; match the at least one keyword with multiple test tags to obtain at least one test tag associated with the test case to be associated.

[0052] In this solution, by extracting keywords from the test cases and matching the keywords with the test tags, the adaptability of the test cases and the test tags is improved.

[0053] In a possible implementation, at least one test tag matched by the code to be tested is used to illustrate the security risk generated by using the function of the code to be tested.

[0054] In a possible implementation, the code to be tested is used to indicate the code that is changed after the application version is changed.

[0055] In a possible implementation, the code to be tested is a function in the application code.

[0056] In a third aspect, an embodiment of the present application provides a test case selection device, comprising: at least one memory for storing programs; and at least one processor for executing the programs stored in the memory, wherein when the programs stored in the memory are executed, the processor is used to execute the method provided in the first aspect.

[0057] In a fourth aspect, an embodiment of the present application provides a test case selection device, which runs computer program instructions to execute the method provided in the first aspect. Exemplarily, the device may be a chip or a processor.

[0058] In one example, the device may include a processor, which may be coupled to a memory, read instructions in the memory and execute the method provided in the first aspect according to the instructions. The memory may be integrated in a chip or a processor, or may be independent of the chip or the processor.

[0059] In a fifth aspect, an embodiment of the present application provides a computer storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the method provided in the first aspect.

[0060] In a sixth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a schematic diagram of the framework of the test case selection method provided in the embodiment of the present application;

[0062] Figure 2 is a structural diagram of a test system provided in an embodiment of the present application;

[0063] Figure 3 It is a flowchart of the test case selection method provided in the embodiment of the present application;

[0064] Figure 4a This is a schematic diagram of a solution for determining the association between the code to be tested and the test tag provided in an embodiment of the present application. Figure 1 ;

[0065] Figure 4b This is a schematic diagram of a solution for determining the association between the code to be tested and the test tag provided in an embodiment of the present application. Figure 2 ;

[0066] Figure 5 It is a schematic diagram of a test case scheme for selecting a code to be tested associated with an embodiment of the present application;

[0067] Figure 6 It is an application diagram of the test case selection method provided in an embodiment of the present application;

[0068] Figure 7 It is a structural diagram of a test case selection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0070] In the description of the embodiments of the present application, words such as "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a concrete way.

[0071] In the description of the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, B exists alone, and A and B exist at the same time. In addition, unless otherwise specified, the term "multiple" means two or more. For example, multiple systems refers to two or more systems, and multiple terminals refers to two or more terminals.

[0072] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprises", "has" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0073] Below, some terms in this embodiment are explained. It should be noted that these explanations are for the convenience of understanding by those skilled in the art and do not constitute a limitation on the scope of protection claimed in this application.

[0074] Precision testing: It uses specific algorithms, technical means and tools to analyze the code, program running process, test cases, etc. and the relationship between them, so as to obtain relevant information and knowledge, accurately locate and optimize the test scope (such as streamlining test cases), and use accurate data to evaluate test results and product quality, making the entire testing process more efficient, accurate and reliable, while effectively reducing the risk of missed tests and minimizing testing costs.

[0075] Test case: A set of test inputs, execution conditions, and expected results used to verify whether a specific software requirement is met.

[0076] Software testing: refers to the verification and validation of software systems during the software development process to ensure its quality, reliability and integrity. The purpose of software testing is to find defects, problems or errors in the software and ensure that the software meets the expected requirements and specifications.

[0077] Common Weakness Enumeration (CWE): is a list of common software and hardware security weaknesses, sponsored by MITRE, to help identify and mitigate security risks in software. This list includes more than 600 categories, covering a variety of security weaknesses, such as buffer overflows, cross-site scripting attacks, and insecure random number generation. CWE is not only a dictionary of security vulnerabilities, but also provides a common standard for identifying, mitigating, and preventing software defects.

[0078] Common Vulnerabilities & Exposures (CVE): It is like a dictionary table that gives a common name to widely recognized information security vulnerabilities or weaknesses that have been exposed. Using a common name can help users share data in various independent vulnerability databases and vulnerability assessment tools, although these tools are difficult to integrate together. This makes CVE a "keyword" for sharing security information. If a vulnerability specified in a vulnerability report has a CVE name, you can quickly find the corresponding patch information in any other CVE-compatible database to solve the security problem.

[0079] Test Point: refers to the specific functions or features that need to be verified or focused on in the test case.

[0080] Artificial Intelligence (AI) model: refers to a system that can simulate human intelligent behavior through computer algorithms and data training. AI model refers to a mathematical model that uses methods from mathematics, statistics, computer science, and machine learning to analyze, process, predict, and optimize data with certain regularity and predictability. Simply put, an AI model is a mathematical model that converts "data" into "intelligence."

[0081] Prompt: In Chinese, it means "prompt word". In the AI ​​model, the main function of Prompt is to give the AI ​​model the context of input information and parameter information of the input model.

[0082] Structured Query Language (SQL): is a special-purpose programming language, a database query and programming language used to access data and query, update and manage relational database systems.

[0083] Artificial Intelligence (AI) is a branch of computer science that attempts to understand the essence of intelligence and produce a new type of intelligent machine that can respond in a similar way to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems.

[0084] like Figure 1 As shown, an embodiment of the present application proposes a test case selection method.

[0085] This method pre-configures multiple test cases and n test tags, each of which is associated with several test cases ( Figure 1 Multiple test cases are shown in ), in other words, each test case is associated with at least some of the n test tags; each of the n test tags is used to describe the test content of the test case associated with it; for the code to be tested, several test tags matching the code to be tested are determined from the multiple test tags, and the test tags matching the code to be tested are used to describe the content that needs to be tested for the code to be tested, and the code to be tested is tested by the test case associated with each test tag among the several test tags matching the code to be tested. In summary, by establishing an association between test cases and test tags, the test tags are used to summarize the test content of the test cases, and then, the test case screening is implemented by considering the adaptability of the test content and the code to be tested, thereby reducing the possibility of redundant tests, missing tests or unmatched test cases. This is just a brief description of the method, and please refer to the description below for details of the method.

[0086] Next, a test system to which the test case selection method provided in the embodiment of the present application may be applied is introduced. Figure 2 The present invention provides a test case selection method which can be applied to the following examples: Figure 2 As shown in the system architecture diagram. Figure 2 As shown, the test system includes a management device 201 and a server 202; wherein the server 202 is used to implement the execution of test cases, and the management device 201 deploys an automated test platform. The server 202 and the management device 201 can communicate with each other, such as through network communication, so that the automated test platform is used to manage and control the test of the server 202. The management device 201 can run an automated test platform, and the automated test platform can be a desktop application, a Web application, a command line terminal, etc. In addition, the tester can configure the code to be tested, test cases, test tags, the association between test cases and test tags, etc. through the automated test platform run by the management device 201, so as to perform test configuration. In one example, the management device 201 can be a device that exchanges with a terminal, and the user can access the automated test platform through the terminal to configure the code to be tested, test cases, test tags, the association between test cases and test tags, etc.

[0087] Among them, server 202 can be a single-node server, such as a rack server; it can also be a computing node in a multi-node server. The multi-node server can be a blade server, a high-density server or a whole cabinet server (an independent product formed by integrating the original architecture that separates the rack and the machine, such as the server node).

[0088] For example, Figure 2 As shown, the server 202 may include a power supply 121 and a mainboard 110 , wherein the power supply 121 is electrically connected to the mainboard 110 and is used to supply power to devices connected to the mainboard 110 .

[0089] In some possible embodiments, the devices connected to the motherboard 110 may include a processor 111, a memory 112, a programmable logic device (PLD) 113, a baseboard management controller (BMC) 114, a PCIE slot 115, a network card 122, a disk 123, and a fan 124.

[0090] The processor 111 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 201 may also be a controller with computing capabilities.

[0091] Among them, the memory 112 can be inserted into a memory slot to connect to the motherboard 110. The memory 112 can be a random access memory (RAM). By way of example but not limitation, many forms of RAM are available. Exemplarily, the memory 112 includes at least two types of memories, for example, the memory can be either a random access memory (RAM) or a read-only memory (ROM). For example, the RAM can include a dynamic random access memory (DRAM) or a storage class memory (SCM) and other memories.

[0092] The programmable logic device 113 may be a complex logic device (CPLD, which is a digital integrated circuit whose logic functions are constructed by users according to their own needs) or a field programmable gate array (FPGA).

[0093] Among them, the PCIE slot 115 is suitable for expanding at least one of a GPU card, a network card, a video capture card, an HBA (Host Bus Adapter) card, a RAID (redundant arrays of independent disks) card, and an SSD, and can also support the expansion of various adapter cards.

[0094] The network card 124 is used to communicate with the management device 201 .

[0095] The disk 123 may be a mechanical hard disk HDD or a solid state disk SSD. It should be understood that the disk 123 is only an example of a non-volatile memory and does not constitute a specific limitation. In actual applications, a non-volatile memory may be selected in combination with actual conditions.

[0096] It should be noted that Figure 2 This is only an example of the server 202 and does not constitute a specific limitation. In practical applications, the server 202 may include Figure 2 More or fewer devices.

[0097] The structure of the management device 201 can refer to the server 202 and will not be repeated here. It should be noted that the management device 201 can be a single-node server, such as a rack server; it can also be a computing node in a multi-node server, and the multi-node server can be a blade server, a high-density server or a whole cabinet server.

[0098] Next, in combination with the test system provided above, a test case selection method provided in an embodiment of the present application is described in detail.

[0099] Figure 3 2 is a flow chart of a test case selection method provided in an embodiment of the present application. This embodiment can be applied to the management device 201. Figure 3 As shown, the test case selection method provided in the embodiment of the present application includes at least the following steps:

[0100] Step 301: The management device 201 determines a code to be tested.

[0101] In the embodiment of the present application, the code to be tested is used to describe the function, which can be the application code, or the code changed after the application version is changed, or the function in the application code, which is used to describe the function, such as the function where the code after the application version is changed is located. In some possible implementations, the automated testing platform can be accessed through the terminal, and the code to be tested can be uploaded on the automated testing platform; in other possible implementations, the code to be tested is a function in the application code; then the method for determining the code to be tested can be: accessing the automated testing platform through the terminal, uploading the software package of the application on the automated testing platform, the software package includes the code and function description of the application, and the automated testing platform divides the code of the application into functions based on the function description to obtain multiple codes to be tested. The terminal may include but is not limited to various personal computers, laptops, smart phones, and tablet computers. Exemplary embodiments of the terminal devices involved in this solution include but are not limited to electronic devices equipped with iOS, android, Windows, Harmony OS or other operating systems. The embodiment of the present application does not specifically limit the type of electronic device.

[0102] Step 302: The management device 201 determines at least one test tag that matches the function of the code to be tested from n test tags, each of the n test tags is associated with at least one test case, and the test tag is used to indicate the test content of the associated at least one test case.

[0103] Test tags are used to describe the test content of test cases; test content can be understood as the content that can be tested by test cases. For example, the test content can be security risks, functions, performance, etc.; in the case where the test content is security risks, the test tag can be a general defect enumeration, such as software defects and hardware defects. For example, software defects can be insufficient data verification, buffer overflow, code injection, path manipulation, sensitive information leakage, session information leakage, etc. For example, hardware defects can be core and computing issues related to CPU, GPU, AI, FPGA, privilege separation and access control issues related to identity and policy, shared resources, locking controls, registers and other functions and mechanisms, power, clock and reset issues related to voltage, current, temperature, clock control and state preservation / recovery.

[0104] For each test case, there may be one or more test tags associated with the test case, and the test case is used to implement the test of the test contents indicated by the multiple test tags. For example, there may be one or more test tags.

[0105] Among them, for each test tag, there can be one or more test cases associated with the test tag. For example, there can be one, or for another example, there can be more than one. It should be noted that when there are multiple test cases associated with a test tag, for the multiple test cases associated with the test tag, each test case can be used to implement the test content indicated by the test tag. In addition, it is worth noting that the test case is used to illustrate the test plan of the test content.

[0106] In the embodiment of the present application, there may be multiple ways for the management device 201 to determine the test tag associated with the test case.

[0107] In implementation mode 1, the management device 201 extracts at least one keyword in the test case; matches the at least one keyword with n test tags to obtain at least one test tag associated with the test case. The keyword is a word in the test case that reflects the test content. Considering that the keyword can be a word with the same semantics as the test tag but with a different expression, in order to standardize and unify, the test tag matched by the keyword is determined. The test tag matched by the keyword can be the same test tag as the keyword, or can be the same test tag as the keyword with the same semantics but with a different expression, and the test tag matched by the keyword is associated with the test case.

[0108] In implementation method 2, a test tag may be marked on a test case through a terminal to obtain an association record between the test tag and the test case.

[0109] Implementation method 3, for each test case, the management device 201 can input the test case into the label prediction model, and determine the test label of the test case based on the output of the label prediction model. In the case where the test label is a security risk, the label prediction model can be an open source security model. In an example, the output of the label prediction model can be the probability value of all test labels, and the test label with the largest probability value is used as the test label of the test case. It should be noted that the label prediction model can be flexibly selected in combination with the actual test scenario, and the embodiments of the present application do not specifically limit this.

[0110] In some possible implementations, the test case may be located in a database (for ease of description and distinction, it may be referred to as a first database), the associated record of the test tag and the test case may be located in a database (for ease of description and distinction, it may be referred to as a second database), and the associated record may be an identifier of the test tag and the test case, such as a number. The first database and the second database may be the same or different, and the embodiments of the present application do not intend to limit the storage method of the test case, the test tag, and the associated record of the test case, and the specific method may be designed in combination with the actual situation.

[0111] Exemplarily, the second database may be located in the management device 201 or in a device outside the management device 201. When the second database is located in a device outside the management device 201, the management device 201 needs to obtain n test tags from the device where the second database is located.

[0112] It should be noted that the test tag that matches the function of the code to be tested is used to indicate the test content that needs to be tested for the function of the code to be tested. The meaning of matching can be understood as matching and adapting. The test tag that matches the function of the code to be tested is also the test tag that matches the code to be tested.

[0113] In some possible implementations, such as Figure 4a As shown, the management device 201 determines at least one question based on the code to be tested, where the question is used to inquire about the test tag that matches the code to be tested; inputs the at least one question into the AI ​​model to obtain the answer to at least one question output by the AI ​​model; and determines at least one test tag that matches the code to be tested based on the answer to the at least one question.

[0114] In the embodiment of the present application, there may be one question or multiple questions.

[0115] In the scenario where there is only one question, the question can be an open-ended question (for ease of description and distinction, it can be called the first question), and the first question is used to inquire about the test tag that matches the code to be tested. Exemplarily, the first question is used to inquire about the test tag that matches the first filling content of the first filling field, and the first filling content is the code to be tested. Correspondingly, the answer to the first question indicates the test tag that matches the code to be tested.

[0116] In the case of multiple scenarios, such as Figure 4a As shown, the several questions may include the first question, and each of the n test tags corresponds to a positive question (for ease of description and distinction, it may be referred to as the second question) and / or a negative question (for ease of description and distinction, it may be referred to as the third question). It should be noted that in a scenario where there are multiple questions, for each of the n test tags, when the answers to multiple questions are consistent and all indicate that the code to be tested matches the test tag, it is determined that the code to be tested matches the test tag.

[0117] The second question is used to inquire whether the code to be tested matches the test tag. For example, the second question is used to inquire whether the first filling content of the first filling field matches the second filling content of the second filling field. The second filling content can be the test tag corresponding to the second question. The third question is used to inquire whether the code to be tested does not match the test tag. For example, the third question is used to inquire whether the first filling content of the first filling field matches the third filling content of the third filling field. The third filling content can be the test tag corresponding to the third question. For example, Figure 4a As shown, in the scenario where the test tag corresponds to the second question and the third question, the management device 201 determines, for each of the n test tags, that the code to be tested and the test tag match when the answer to the first question is used to indicate that the test tag exists in the code to be tested, the answer to the second question corresponding to the test tag is yes, and the answer to the third question corresponding to the test tag is no. In addition, in the scenario where the test tag corresponds to the second question or the third question, the management device 201 determines, for each of the n test tags, that the code to be tested and the test tag match when the answer to the first question is used to indicate that the test tag exists in the code to be tested, the answer to the second question corresponding to the test tag is yes, or the answer to the third question corresponding to the test tag is no.

[0118] In some possible implementations, questions can be constructed based on question templates, which include fields to be filled in.

[0119] In one example, the first question can be constructed based on a first question template, which includes a first field to be filled in, and the first question template is used to inquire about a test tag that matches the filled content of the first filled field; the management device 201 can fill the code to be tested into the first filled field in the first question template to obtain a first question, and the first question is used to inquire about a test tag that matches the first filled content of the first filled field, and the first filled content is the code to be tested.

[0120] In another example, the second question can be constructed based on a second question template, which includes a first field to be filled and a second field to be filled. The second question template is used to inquire whether the filled content of the first fill field matches the filled content of the second fill field; in some optional implementations, the management device 201 can fill the code to be tested into the first fill field in the second question template for each test tag, and fill the test tag into the second fill field in the second question template to obtain the second question, and the second question is used to inquire whether the first filled content of the first fill field matches the second filled content of the second fill field, the first filled content is the code to be tested, and the second filled content can be the test tag corresponding to the second question.

[0121] In another example, the third question can be constructed based on a third question template, which includes a first field to be filled and a third field to be filled. The third question template is used to inquire whether the filling content of the first filling field does not match the filling content of the third filling field; in some optional implementations, the management device 201 can fill the code to be tested into the first filling field in the third question template for each test tag, and fill the test tag into the third filling field in the third question template to obtain the third question. The third question is used to inquire whether the first filling content of the first filling field matches the third filling content of the third filling field. The first filling content is the code to be tested, and the third filling content can be the test tag corresponding to the third question.

[0122] In an example, a question template may be constructed as follows:

[0123] Capacity and Role: Tell the AI ​​what role you want it to play, such as teacher, translator, etc.

[0124] Insight (background): Tell the AI ​​the background of the role you want it to play, such as playing the role of a teacher to teach your 10-year-old son, etc.

[0125] Statement (task): Tell the AI ​​what task you want it to do;

[0126] Personality (format): Tell the AI ​​what style, method, and format to use to answer;

[0127] Experiment: Request the AI ​​to reply with multiple examples for you (optional if not necessary).

[0128] For example, the first question template may be: As a security expert, what security risks exist in analyzing the following source code? Answer in JSON format; first fill in the field.

[0129] For example, the second question template may be: As a security expert, does the following source code contain security risks for the second fill-in field? Directly answer yes or no: first fill-in field.

[0130] For example, the third question template may be: As a security expert, analyze the following source code. Does this code contain the problem of the third filling field? Directly answer yes or no; first filling field.

[0131] It should be noted that when training the AI ​​model, the question samples determined by the AI ​​model based on the first question template can realize the classification of test labels; the question samples determined by the AI ​​model based on the second question template can learn specific knowledge points; and the question samples determined by the AI ​​model based on the third question template can learn other knowledge.

[0132] To make the question more specific, avoid questions that contain less information, such as Figure 4b As shown, the management device 201 can determine at least one question based on the code to be tested, n test tags, and the supplementary description content of each test tag in the n test tags. In a scenario where at least one question includes a first question, a second question, and a third question, the second filling content in the second question can be at least part of the test tag corresponding to the second question and / or the supplementary description content of the test tag corresponding to the second question; the third filling content in the third question can be at least part of the test tag corresponding to the third question and / or the supplementary description content of the test tag corresponding to the third question. Subsequently, as Figure 4b As shown, for each test tag among n test tags, the management device 201 determines that the code to be tested and the test tag match when the answer to the first question is used to indicate that the test tag exists in the code to be tested, the answer to the second question corresponding to the test tag is yes, and the answer to the third question corresponding to the test tag is no.

[0133] The supplementary description content may be an explanation, which may be a synonym of the test tag (a word with the same semantics but different expressions), or may be the specific content of the test tag; in some possible scenarios, the test tag is used to indicate security risks, and the management device 201 may refer to CWE to add supplementary description content to the test tag; Figure 4bAs shown, the supplementary description content of the test label may include explanations, risk points, and security risk classifications such as CWE numbers; wherein the explanations may be synonyms of the test label (words with the same semantics but different expressions), or may be the specific content of the test label; risk points are used to describe actions that present security risks; and CEW numbers are used to describe the CEW to which the test label belongs. In a specific implementation, the management device 201 includes a label library, which includes labels and supplementary description content of the labels. In an embodiment of the present application, the construction method of the labels and the supplementary description content may be a manually designed configuration. Exemplarily, the label library may refer to the following Table 1.

[0134]

[0135] Table 1

[0136] It should be noted that, in actual applications, the labels and supplementary descriptions in the label library can be maintained, for example, adding new labels, deleting labels, adding supplementary descriptions to labels, etc.

[0137] In a scenario where a test tag is used to indicate a security risk, and the supplementary description of the test tag includes a security risk classification such as a CWE number, the first question can be used to inquire about the test tag and security risk classification (which can be a CWE number) that match the code to be tested. Exemplarily, the first question is used to inquire about the test tag and security risk classification (which can be a CWE number) that match the first fill content of the first fill field. It is worth noting that the CWE number is only used as an example and does not constitute a specific limitation. In some possible scenarios, the security risk classification can be a CVE number.

[0138] The second question and the third question can be constructed in the following manner: for each test label, the management device 201 can fill the code to be tested into the first filling field in the second question template, fill the test label and / or at least part of the supplementary description content of the test label into the second filling field in the second question template, and obtain the second question; the code to be tested can be filled into the first filling field in the second question template, and fill the test label and / or at least part of the supplementary description content of the test label into the third filling field in the third question template, and obtain the third question. Exemplarily, for sensitive information leakage, the second filling content or the third filling content can be sensitive information leakage, and can also be sensitive information leakage: personal data, bank account number, password, etc. printed or unencrypted transmission. It should be noted that the second filling content and the third filling content can be the same or different, and can be determined in combination with actual conditions. For example, the second filling content and the third filling content are different, the second filling content is sensitive information leakage: personal data, bank account number, password, etc. printed or unencrypted transmission, and the third filling content is sensitive information leakage.

[0139] It should be noted that, in the scenario where the supplementary description content of the test label includes risk points, when constructing the second question corresponding to the test label, each risk point in the supplementary description content of the test label can construct a second question, so that the risk point can be located more accurately, which is convenient for subsequent problem analysis; the third question type will not be repeated. In specific implementation, for each risk point of any test label, the management device 201 can fill in the code to be tested into the first filling field in the second question template, fill in the test label, explanation and the risk point into the second filling field in the second question template, and obtain the second question; the code to be tested can be filled in the first filling field in the second question template, and the test label, explanation and the risk point can be filled in the third filling field in the third question template to obtain the third question. For example, for the risk point of sensitive information leakage: printing, the second filling content or the third filling content can be sensitive information leakage: printing of personal data, bank account number, password, etc. It should be noted that the second filling content and the third filling content can be the same or different, which can be determined in combination with actual conditions. For example, the second filling content and the third filling content are different. The second filling content is sensitive information leakage: printing of personal data, bank account number, password, etc., and the third filling content is printing of sensitive information leakage. Step 303: The management device 201 determines a test case for testing the code to be tested based on at least one test tag matched by the function of the code to be tested.

[0140] In a specific implementation, the management device 201 associates at least one test case with at least one test tag that matches the function of the code to be tested as a test case for testing the code to be tested. In the case where the test tag is used to indicate a security risk, at least one test tag that matches the function of the code to be tested is used to illustrate the security risk that may be generated by using the function of the code to be tested.

[0141] Subsequently, the management device 201 may send a test instruction to the server 202 so that the server 202 tests the code to be tested through a test case associated with each test tag matched by the code to be tested.

[0142] In the specific implementation, Figure 5 As shown, a test case-code relationship library can be constructed, and the test case-code relationship library is used to store the association relationship between code, test tags, and test cases. Later, when it is necessary to test a code, such as code 1, the test case associated with code 1 is determined from the test case-code relationship library, and code 1 is tested. The user can modify the relationship between the test case, test tag, and code according to the test results, for example, delete the relationship between a test case and a test tag, and for another example, delete the association relationship between the test tag and code 1.

[0143] In this solution, an association is established between test cases and test tags. The test tags are used to summarize the test content of the test cases. After that, the test cases are screened considering the adaptability of the test content and the code to be tested, thereby reducing the possibility of redundant tests, missing tests, or unmatched test cases.

[0144] Based on the test case selection method provided above, the specific content of the test case selection method for achieving accurate testing is explained. Here, the problem is described by Prompt, and the test label is described by the security label. Figure 6 A flowchart of a specific application of a test case selection method provided for the implementation of this application. Figure 6 The specific contents include:

[0145] 1. Label the test case. For example, for the following test case, extract the test points in the test case as security labels.

[0146] For example, the test case may be:

[0147] Use case name: Check whether there is plain text sensitive information in log or printed information

[0148] Use case steps:

[0149] 1. Based on the specific scenarios of the product, sort out and maintain the list of sensitive information scenarios and sensitive words involved in this product;

[0150] 2. Log in to the system using an administrator account and turn on the system debug, error and other printing information switches;

[0151] 3. Attempt to use various system functions to trigger all business scenario functions involving sensitive information and access non-existent system pages;

[0152] 4. Check whether there is sensitive information such as passwords, session IDs, etc. in debug, error, configuration files, databases, and log information. You can use tools such as seninfo and Eagle Eye to check in combination with the sensitive word list compiled by the product.

[0153] Inspection results: There is no sensitive information such as passwords, passcodes, or session identifiers in debug, error, or log information.

[0154] Then, the test points in the test case are extracted as security labels, and the security labels of the test case are obtained: sensitive information leakage, log printing password.

[0155] Among them, security labels can be marked manually or by AI. The marked security labels may contain less information and are not clear enough, so necessary supplementary explanations are required; it should be noted that if the information of the security label is relatively clear, no supplementary explanation is required, such as the security label is a log printing password. In the specific implementation, the security labels can be supplemented with reference to the general security defect enumeration types given in CWE. In the embodiment of the present application, a security label table is used for supplementation, and the label security table is summarized and output with reference to CWE or security experience, such as explain and risk as supplementary explanations of security labels, which are used to generate clearer prompts. The security label table is as follows:

[0156]

[0157] Safety Label Sheet

[0158] 2. Obtain the code snippet to be analyzed. The code snippet to be analyzed may be an expanded code snippet of the changed code. In specific implementation, the changed code is expanded forward and backward by 1 to 5 segments (which may be expanded according to the analysis situation) to increase the context information of the code. An example of a code snippet is as follows.

[0159] Code snippet 1:

[0160]

[0161]

[0162] Code snippet 2:

[0163]

[0164] 3. Generate prompts. Use security tags, tag libraries, and code snippets to generate open, forward, and reverse prompts. It should be noted that for each tag in the tag library, both forward and reverse prompts need to be generated.

[0165] For code snippet 1:

[0166] Open Prompt:

[0167] As a security expert, what security risks and CWE numbers does the following source code contain? Please answer in JSON format.

[0168]

[0169] The positive prompt of the security label is explained by taking the security label as a sensitive information leak as an example:

[0170] For risk points: print; positive prompt is:

[0171] As a security expert, are there any sensitive information leaks in the following source code: personal data, bank account numbers, passwords, etc. Printing security risks? Answer directly yes or no.

[0172]

[0173] For risk points: unencrypted transmission; the positive prompt is:

[0174] As a security expert, are there any sensitive information leaks in the following source code: personal data, bank account numbers, passwords, etc., which are not transmitted in an encrypted manner? Answer yes or no directly.

[0175]

[0176]

[0177] Negative Prompt for Security Label:

[0178] As a security expert, after analyzing the following source code, is there any leakage of sensitive information in this code: Is there any problem with printing personal data, bank account number, password, etc.?

[0179]

[0180] For code snippet 2:

[0181] Open Prompt:

[0182] As a security expert, what security risks and CWE numbers does the following source code contain? Please answer in JSON format.

[0183]

[0184] The positive prompt of the security label is explained by taking the security label as a sensitive information leak as an example:

[0185] For risk points: print; positive prompt is:

[0186] As a security expert, are there any sensitive information leaks in the following source code: personal data, bank account numbers, passwords, etc. Printing security risks? Answer directly yes or no.

[0187]

[0188]

[0189] For risk points: unencrypted transmission; the positive prompt is:

[0190] As a security expert, are there any sensitive information leaks in the following source code: personal data, bank account numbers, passwords, etc., which are not transmitted in an encrypted manner? Answer yes or no directly.

[0191]

[0192] Negative Prompt for Security Label:

[0193] For risk point: Print, the negative prompt is:

[0194] As a security expert, after analyzing the following source code, is there any leakage of sensitive information in this code: Is there any problem with printing personal data, bank account number, password, etc.?

[0195]

[0196] For the risk point: unencrypted transmission, the negative prompt is:

[0197] As a security expert, after analyzing the following source code, is there any leakage of sensitive information in this code: Is there any problem of unencrypted transmission of personal data, bank account numbers, passwords, etc.?

[0198]

[0199]

[0200] 4. For each security label, three prompts are sent to the AI ​​big model, and AI is used to perform security analysis. Each code snippet gets the answer to the open prompt, as well as the answers to the positive prompt and negative prompt for each security label. It should be noted that for each code snippet, the open prompt, positive prompt, and negative prompt need to be answered independently, and historical questions cannot be used. For each security label, if the answers in the three ways are consistent, the AI ​​analysis results are considered reliable.

[0201] For code snippet 1: For each security label, if the three answers are consistent, it is considered that code snippet 1 has the security label. For example, if the answer to the open prompt contains the security label, the answer to any positive prompt is yes, and the answer to any negative prompt is no, then code snippet 1 is considered to have the security label.

[0202] For code snippet 2: For each security label, if the three answers are consistent, it is considered that code snippet 2 has the security label. For example, if the answer to the open prompt contains the security label, the answer to any positive prompt is yes, and the answer to any negative prompt is no, then code snippet 2 is considered to have the security label.

[0203] Traverse all code snippets and all security tags, perform analysis, obtain analysis results, and establish an association between code and security tags.

[0204] 5. Establish corresponding relationships in the test case-code relationship library

[0205]

[0206] Safety Label Sheet

[0207] codeID Codepath funName StartLine context 1 src / xxx / cust.c FuncitionA 267 … 2 src / xxx / Fua.py FuncitionX 2502 … … … … … …

[0208] Code Information Table

[0209]

[0210]

[0211] Code and safety label relationship table

[0212] For each codeID, the labelID associated with the codeID and the test case ID associated with the labelID can be queried through the joint query of the three tables. For example, based on the codeID of code 1, the test case associated with code 1 is filtered out, code 1 is tested, and then manual feedback is provided to correct the relationship between code 1, security labels, and test cases.

[0213] Based on the same concept as the embodiment of the present application method, the embodiment of the present application also provides a test case selection device. The test case selection device includes several modules, each module is used to execute each step in the test case selection method provided in the embodiment of the present application, and the division of the modules is not limited here. The technicians in the relevant field can clearly understand that in practical applications, the various steps in the test case selection method provided in the embodiment of the present application can be assigned to different modules as needed, that is, the internal structure of the device is divided into different modules to complete all or part of the functions described above. Each module in the embodiment can be integrated in a processing unit, or each unit can exist physically alone, or two or more modules can be integrated in one unit, and the above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of each module are only for the convenience of distinguishing from each other, and are not used to limit the scope of protection of the present application. The specific working process of the module in the above-mentioned device can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0214] For example, the test case selection device is used to execute the test case selection method provided in the embodiment of the present application, Figure 7Schematic diagram of the structure of the test case selection device provided in the embodiment of the present application. Figure 7 As shown, the test case selection device provided in the embodiment of the present application includes:

[0215] The code determination module 701 is used to determine the code to be tested;

[0216] A matching module 702, configured to determine at least one test tag matching the function of the code to be tested from a plurality of test tags;

[0217] The selection module 703 is used to determine the test case for testing the code to be tested based on at least one test tag that matches the function of the code to be tested; wherein each test tag is associated with at least one test case, and the test tag is used to indicate the test content of the associated at least one test case.

[0218] Based on the same concept as the embodiment of the method of the present application, the embodiment of the present application also provides a computing device. The computing device can be a server 202 or a terminal. The structure of the computing device can be seen in Figure 2 In the server 202, when the computing device is a terminal, it may also include Figure 2 The server 202 in the embodiment may include more devices, such as a display screen, a microphone, a speaker, a virtual keyboard, a camera, etc.

[0219] In a specific application, the computing device may include a memory, and the memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a hard disk 123. The volatile memory may be a memory 112. Specifically, the memory of the computing device, such as the hard disk 123 and the memory 112, may store a computer program. When the computing device is running, the processor 111 may read the computer program stored in the memory, such as reading the computer program stored in the hard disk 123 to the memory 112, and read the computer program from the memory 112, to implement the steps in the above test case selection method, such as Figure 3 Step 301, step 302, and step 303 in .

[0220] Exemplarily, the computer program may be divided into one or more modules / units, which may be a series of computer program instruction segments capable of completing specific functions, and the one or more modules / units are stored in a memory such as hard disk 123 and executed by CPU 111 to complete the present application. For example, the computer program may be divided into a code determination module 701, a matching module 702, and a selection module 703, and the specific functions of each module are described above.

[0221] In addition to the above methods, devices and electronic devices, the embodiments of the present application may also provide a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to perform the steps in the test case selection method of various embodiments of the present application described in the "Method" section of this specification. Wherein, the computer program product can be written in any combination of one or more programming languages ​​to perform computer program code for performing the operation of the embodiments of the present application, and the programming language includes an object-oriented programming language, such as Java, C++, etc., and also includes a conventional procedural programming language, such as "C" language or similar programming language. Wherein, the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer program code can be executed completely on the user computing device, partially on the user device, as an independent software package, partially on the user computing device, partially on the remote computing device, or completely on the remote computing device or server.

[0222] In addition, the embodiment of the present application may also provide a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions, when executed by the processor, cause the processor to perform the steps in the test case selection method according to various embodiments of the present disclosure described in the above "Method" section of this specification. The computer-readable storage medium may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may, for example, include but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0223] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0224] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0225] The basic principles of the present application are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present application are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, rather than limitation, and the above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0226] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, referring to "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise. The word "such as" used herein refers to the phrase "such as but not limited to," and can be used interchangeably therewith.

[0227] It should also be noted that in the apparatus, device and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0228] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0229] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

Claims

1. A test case selection method, characterized in that: Applied to computing devices, including: Identify the code to be tested; Determine at least one test tag that matches the function of the code to be tested from a plurality of test tags; Based on at least one test tag that matches the function of the code to be tested, a test case for testing the code to be tested is determined; wherein each test tag is associated with at least one test case, and the test tag is used to indicate the test content of the associated at least one test case.

2. The method according to claim 1, characterized in that The step of determining at least one test tag matching the function of the code to be tested from a plurality of test tags includes: Based on the code to be tested, determining at least one question, wherein the at least one question is used to inquire about a test tag matching the code to be tested; Inputting the at least one question into the AI ​​model respectively, and obtaining an answer to the at least one question output by the AI ​​model; At least one test tag matching the code to be tested is determined based on the answer to the at least one question.

3. The method according to claim 2, characterized in that The step of determining at least one problem based on the code to be tested includes: At least one question is determined based on the code to be tested, the multiple test labels and the supplementary description content of each test label in the multiple test labels; the supplementary description content is used to explain the interpretation of each test label.

4. The method according to any one of claims 2 or 3, characterized in that: The at least one question includes a first question; the first question is used to inquire about a test tag that matches a first filling content of a first filling field, and the first filling content is the code to be tested; and / or, The at least one question includes a second question corresponding to each test label in the multiple test labels, the second question is used to inquire whether the first fill content of the first fill field matches the second fill content of the second fill field, the second fill content is the test label corresponding to the second question and / or the supplementary description content of the test label corresponding to the second question; and / or, The at least one question includes a third question corresponding to each test label among the multiple test labels, and the third question is used to inquire whether the first fill content of the first fill field does not match the third fill content of the third fill field, and the third fill content is the test label corresponding to the third question and / or the supplementary description content of the test label corresponding to the third question.

5. The method according to claim 4, characterized in that The test label is used to indicate a security risk, the supplementary description content is used to explain the security risk classification of each test label, and the first question is used to inquire about the test label and security risk classification that match the first fill content of the first fill field.

6. The method according to any one of claims 4 or 5, characterized in that: The step of determining at least one test tag that matches the code to be tested based on the answer to the at least one question includes: For each test tag among the multiple test tags, when the answer to the first question is at least used to indicate the test tag, the answer to the second question corresponding to the test tag is yes, and the answer to the third question corresponding to the test tag is no, it is determined that the code to be tested and the test tag match.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: Acquire a test case to be associated, and extract at least one keyword from the test case to be associated; The at least one keyword is matched with the multiple test tags to obtain at least one test tag associated with the test case to be associated.

8. The method according to any one of claims 1 to 7, characterized in that: The at least one test tag is used to illustrate the security risk generated by using the function of the code to be tested.

9. A computing device, characterized in that comprising a processor and a memory; wherein, The memory is used to store programs; The processor is used to execute the program stored in the memory. When the program stored in the memory is executed, the method described in any one of claims 1 to 8 is performed.

10. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 8.

Images