Static code analysis method and device based on data source white list

Abstract

The invention discloses a static code analysis method and device based on a data source white list. The static code analysis method comprises the steps that configuration information of all reliable data sources in collected codes is established into the data source white list; configuring the data source white list in a static code analysis tool; identifying data source reference information in the code by using a static code tool, and storing the data source reference information as code vulnerability information in a static code analysis report; and judging whether data source reference information exists in the data source white list or not, and if the data source reference information exists, deleting the corresponding code vulnerability information from the static code analysis report. According to the static code analysis method based on the data source white list, false alarms from trusted data sources can be accurately recognized and eliminated, the false alarm problem in the static code analysis process is effectively solved, and the accuracy and efficiency of static code analysis are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of static code analysis, and in particular to a static code analysis method and device based on a data source whitelist. Background Art

[0002] In the process of software development, static code analysis is an important means to ensure code quality and security. However, when detecting potential security vulnerabilities in the code, existing static code analysis tools often generate false positives because they cannot accurately determine the reliability of the source of the data read by the code. In particular, when the code is identified to read data from external data sources such as configuration files and environment variables, static code analysis tools often report it as a potential risk because they cannot directly verify the security of these data. For example, when the code directly uses these read data to perform SQL queries, the existing static code analysis tools can only see that the code uses external input when executing SQL queries, but cannot accurately determine whether the read data is safe, and usually report potential SQL injection vulnerability risks; however, the data read from external data sources such as configuration files and environment variables is safe, which will cause the existing static code analysis tools to generate too many false positives, affecting the efficiency of static code analysis and increasing the burden on developers. Summary of the invention

[0003] The purpose of the present invention is to provide a static code analysis method and device based on a data source whitelist, which can accurately identify and eliminate false positives from trusted data sources, effectively solve the false positive problem in the static code analysis process, and improve the accuracy and efficiency of static code analysis.

[0004] In order to achieve the above object, the present invention discloses a static code analysis method based on a data source whitelist, which comprises:

[0005] Establishing the configuration information of all reliable data sources in the collected code as a data source whitelist, wherein the configuration information includes a whitelist name, a data source type, a data source file name, an associated code language, and a vulnerability type;

[0006] Configuring the data source whitelist in a static code analysis tool;

[0007] Using the static code tool to identify data source reference information in the code, and save it as code vulnerability information in a static code analysis report, the data source reference information including a data source type and a data source file name;

[0008] It is determined whether the data source reference information exists in the data source whitelist; if the data source reference information exists, the corresponding code vulnerability information is deleted from the static code analysis report.

[0009] Furthermore, the data source types include configuration files, databases, environment variables, command line parameters, web forms and Json strings.

[0010] Furthermore, after “determining whether the data source reference information exists in the data source whitelist”, the method further includes:

[0011] Marking the vulnerabilities confirmed in the static code analysis report as false positive vulnerabilities;

[0012] Using the static code analysis tool to identify the associated code language and vulnerability type of the false positive vulnerability;

[0013] A new configuration information is created in the data source whitelist according to the code vulnerability information of the false alarm vulnerability, the identified associated code language and the vulnerability type.

[0014] Furthermore, before “using the static code tool to identify the data source reference information in the code”, the method further includes:

[0015] Add or delete configuration information in the data source whitelist based on the newly collected configuration information.

[0016] In order to achieve the above object, the present invention discloses a static code analysis device based on a data source whitelist, which comprises:

[0017] Establish a module for establishing the configuration information of all reliable data sources in the collected code as a data source whitelist;

[0018] A configuration module, used to configure the data source whitelist in a static code analysis tool;

[0019] An identification module, used to use the static code tool to identify data source reference information in the code, and save it as code vulnerability information in the static code analysis report;

[0020] The judgment module is used to judge whether the data source reference information exists in the data source whitelist, and if the data source reference information exists, delete the corresponding code vulnerability information from the static code analysis report.

[0021] In order to achieve the above object, the present invention discloses an electronic device, which includes:

[0022] one or more processors;

[0023] One or more memories are used to store one or more programs. When one or more of the programs are executed by the processor, the processor implements the static code analysis method based on the data source whitelist as described above.

[0024] In order to achieve the above-mentioned purpose, the present invention discloses a computer-readable storage medium, on which a program is stored, and when the program is executed by a processor, the static code analysis method based on the data source whitelist as mentioned above is implemented.

[0025] The present invention identifies the trusted data sources in the code by setting a data source whitelist, establishes the configuration information of all reliable data sources in the collected code as a data source whitelist, and configures it in a static code analysis tool, then uses the static code tool to identify the data source reference information in the code, and saves it as code vulnerability information in a static code analysis report, and determines whether to delete the corresponding code vulnerability information from the static code analysis report by judging whether the data source reference information exists in the data source whitelist, thereby accurately identifying and eliminating false positives from trusted data sources, effectively solving the false positive problem in the static code analysis process, and improving the accuracy and efficiency of static code analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 The present invention is a flowchart of a static code analysis method based on a data source whitelist according to an embodiment of the present invention.

[0027] Figure 2 This is a module diagram of a static code analysis device based on a data source whitelist according to an embodiment of the present invention.

[0028] Figure 3 4 is a system diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to explain the technical content, structural features, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the implementation methods and the accompanying drawings.

[0030] Embodiment 1

[0031] See also Figure 1 The present invention discloses a static code analysis method based on a data source whitelist, which comprises:

[0032] 101. Establish the configuration information of all reliable data sources in the collected code as a data source whitelist, where the configuration information includes whitelist name, data source type, data source file name, associated code language, and vulnerability type;

[0033] 102. Configure the data source whitelist in the static code analysis tool;

[0034] By introducing a data source whitelist mechanism and listing trusted data sources, it is helpful to improve the accuracy and reliability of static code analysis, while promoting the management of data source security and further enhancing the security of software code.

[0035] Furthermore, data source types include configuration files, databases, environment variables, command line parameters, web forms, and Json strings.

[0036] It should be noted that it is necessary to manually collect all trusted data sources used in the code, and the types of data sources collected include but are not limited to the data sources listed above. According to the data source type, data source file name, associated code language and vulnerability type of these data sources, a data source whitelist is defined in the configuration of the project code, and configured in the static code analysis tool. The configuration information of the data source is saved in the data of the static code analysis tool in JSON format to facilitate the analysis tool to read and parse the code during the static code analysis process, but not limited to this.

[0037] Furthermore, before “using static code tools to identify data source reference information in the code”, it also includes:

[0038] 1031. Add or delete configuration information in the data source whitelist based on the newly collected configuration information.

[0039] It is understandable that as the code project develops and the external environment of the code changes, the code will use new data sources. Therefore, before performing static code analysis, it is necessary to manually collect the configuration information of the new data source to dynamically update and expand the data source whitelist to adapt to new security requirements and maintain the continued effectiveness of the static code analysis tool.

[0040] It is understandable that operations 101 and 102 only need to be performed once to establish a data source whitelist, and then static code tools are used to perform static analysis on the code to directly perform operation 1031 to achieve dynamic update and expansion of the data source whitelist, but this is not limited to this.

[0041] 103. Use static code tools to identify data source reference information in the code and save it as code vulnerability information in the static code analysis report. The data source reference information includes the data source type and the data source file name.

[0042] By defining a set of trusted data sources, static code analysis tools can automatically identify and eliminate false positives generated by these trusted data sources based on the data source whitelist, effectively improving the accuracy and efficiency of static code analysis.

[0043] It can be explained that, compared with existing static code tools, the static code analysis tool in the present invention can identify the code's reference information to the data source, such as identifying that the code references data in the configuration file config.properties or database.properties, specifically including identifying the data source type and data source file name of the data source, and will first regard the reference to the data source as a code vulnerability, and save the corresponding reference information in the form of code vulnerability information in the static code analysis report.

[0044] 104. Determine whether there is data source reference information in the data source whitelist. If there is data source reference information, delete the corresponding code vulnerability information from the static code analysis report.

[0045] By comparing, the number of false positives about data source problems in static code analysis reports can be reduced, and the time for subsequent processing of false positives can be reduced, making static code analysis more efficient.

[0046] It is understandable that when a reference to a data source is identified and saved as a vulnerability, the static code analysis tool will compare its reference information with the configuration information in the data source whitelist. If the same configuration information exists in the data source whitelist, the vulnerability can be ignored and deleted from the static code analysis report, thereby filtering out false positive vulnerabilities using the data source whitelist and reducing the occurrence of false positive vulnerabilities about data sources in the report. Otherwise, the code vulnerability information in the static code analysis report will continue to be saved.

[0047] For example, when the code reads database connection information from a configuration file, since a data source whitelist including the configuration file is defined, the static code analysis tool can identify that the database connection information comes from a trusted data source. Therefore, even if the code directly uses this information for SQL queries, the analysis tool will no longer report the potential risk of SQL injection vulnerabilities, but this is not limited to this.

[0048] Furthermore, after “determining whether there is data source reference information in the data source whitelist”, it also includes:

[0049] 105. Mark the vulnerabilities confirmed in the static code analysis report as false positive vulnerabilities;

[0050] It is understandable that manual analysis is required for code vulnerabilities in static code analysis reports. For example, the parameters in the data flow of a vulnerability come from a database or configuration file, and both the database and the configuration file are strictly configured for security. Therefore, it can be determined that the parameters read from the referenced data source are safe, and the report on the vulnerability in the static code analysis tool report is a false positive.

[0051] 106. Use static code analysis tools to identify the associated code languages ​​and vulnerability types of false positive vulnerabilities;

[0052] 107. Create a new configuration information in the data source whitelist based on the code vulnerability information of the false positive vulnerability, the identified associated code language and the vulnerability type.

[0053] Through the false alarm handling mechanism, the data source corresponding to the confirmed false alarm vulnerability is added to the whitelist to avoid subsequent false alarms.

[0054] It is understandable that for false positive vulnerabilities caused by data sources, the corresponding data sources need to be added to the data source whitelist. The static code analysis tool can automatically extract the code language and vulnerability type of the current vulnerability, and use this to confirm the associated detection language and associated detection rules in the configuration information of the data whitelist. For false positive vulnerabilities caused by data sources, the code vulnerability information records information such as the vulnerability type, the file where it is located, the number of code lines, and the data flow node name, as well as the data source type and data source file name. Based on the above information about the data source, the configuration information about the data source is added to the data source whitelist, but is not limited to this.

[0055] The present invention identifies the trusted data sources in the code by setting a data source whitelist, establishes the configuration information of all reliable data sources in the collected code as a data source whitelist, and configures it in a static code analysis tool, then uses the static code tool to identify the data source reference information in the code, and saves it as code vulnerability information in a static code analysis report, and determines whether to delete the corresponding code vulnerability information from the static code analysis report by judging whether the data source reference information exists in the data source whitelist, thereby accurately identifying and eliminating false positives from trusted data sources, effectively solving the false positive problem in the static code analysis process, and improving the accuracy and efficiency of static code analysis.

[0056] Embodiment 2

[0057] See also Figure 1 and Figure 2 The present invention discloses a static code analysis device based on a data source whitelist, which comprises:

[0058] Establishing module 201, used to establish the configuration information of all reliable data sources in the collected code as a data source whitelist;

[0059] Configuration module 202, used to configure the data source whitelist in the static code analysis tool;

[0060] Identification module 203, used to identify data source reference information in the code using a static code tool, and save it as code vulnerability information in a static code analysis report;

[0061] The judgment module 204 is used to judge whether there is data source reference information in the data source whitelist. If there is data source reference information, the corresponding code vulnerability information is deleted from the static code analysis report.

[0062] Embodiment 3

[0063] See also Figure 1 and Figure 3 , the present invention discloses an electronic device, comprising:

[0064] One or more processors 301;

[0065] One or more memories 302 are used to store one or more programs. When the one or more programs are executed by the processor, the processor implements the static code analysis method based on the data source whitelist as described above.

[0066] Embodiment 4

[0067] An embodiment of the present application discloses a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the static code analysis method based on the data source whitelist as described above is implemented.

[0068] Embodiment 5

[0069] The embodiment of the present application discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of an electronic device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the electronic device performs the above-mentioned static code analysis method based on a data source whitelist.

[0070] It should be understood that in the embodiments of the present application, the processor referred to may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0071] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by hardware related to computer program instructions, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

[0072] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. Therefore, equivalent changes made according to the scope of the patent application of the present invention are still within the scope covered by the present invention.

Claims

1. A static code analysis method based on a data source whitelist, characterized in that: include: Establishing the configuration information of all reliable data sources in the collected code as a data source whitelist, wherein the configuration information includes a whitelist name, a data source type, a data source file name, an associated code language, and a vulnerability type; Configuring the data source whitelist in a static code analysis tool; Using the static code tool to identify data source reference information in the code, and save it as code vulnerability information in a static code analysis report, the data source reference information including a data source type and a data source file name; It is determined whether the data source reference information exists in the data source whitelist; if the data source reference information exists, the corresponding code vulnerability information is deleted from the static code analysis report.

2. The static code analysis method based on data source whitelist according to claim 1 is characterized in that: The data source types include configuration files, databases, environment variables, command line parameters, web forms, and Json strings.

3. The static code analysis method based on data source whitelist according to claim 1 is characterized in that: After "determining whether the data source reference information exists in the data source whitelist", the method further includes: Marking the vulnerabilities confirmed in the static code analysis report as false positive vulnerabilities; Using the static code analysis tool to identify the associated code language and vulnerability type of the false positive vulnerability; A new configuration information is created in the data source whitelist according to the code vulnerability information of the false alarm vulnerability, the identified associated code language and the vulnerability type.

4. The static code analysis method based on data source whitelist according to claim 1 is characterized in that: Before the step of "using the static code tool to identify the data source reference information in the code", the method further includes: Add or delete configuration information in the data source whitelist based on the newly collected configuration information.

5. A static code analysis device based on a data source whitelist, characterized in that: include: Establish a module for establishing the configuration information of all reliable data sources in the collected code as a data source whitelist; A configuration module, used to configure the data source whitelist in a static code analysis tool; An identification module, used to use the static code tool to identify data source reference information in the code, and save it as code vulnerability information in the static code analysis report; The judgment module is used to judge whether the data source reference information exists in the data source whitelist, and if the data source reference information exists, delete the corresponding code vulnerability information from the static code analysis report.

6. An electronic device, characterized in that: include: one or more processors; One or more memories are used to store one or more programs. When one or more of the programs are executed by the processor, the processor implements the static code analysis method based on the data source whitelist as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the static code analysis method based on a data source whitelist as described in any one of claims 1 to 4 is implemented.

Images