Vulnerability repairing method and device for low-code application, server and storage medium

Abstract

The invention relates to the field of data processing, and discloses a vulnerability repair method and device for low-code applications, a server and a storage medium. The method comprises the steps of obtaining application information of a low-code application, wherein the application information comprises an application structure, application logic and configuration data; matching known vulnerability information corresponding to the application information; analyzing to obtain potential vulnerability information corresponding to the known vulnerability information according to the known vulnerability information; and according to the potential vulnerability information and the known vulnerability information, executing vulnerability repair operation. In the embodiment of the invention, not only is known vulnerabilities paid attention to, but also potential vulnerabilities can be analyzed, so that the application still keeps higher security in rapid iteration.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a vulnerability repair method, device, server and storage medium for low-code applications. Background Art

[0002] With the rapid development of information technology, low-code application development platforms have become popular due to their rapid iteration, ease of use, and efficient deployment. Such platforms reduce programming complexity and allow non-professional developers to participate in development. However, low-code development also brings new security challenges. Users may inadvertently introduce vulnerabilities due to their lack of programming and security knowledge.

[0003] Conventional technologies usually directly reference third-party libraries, plug-ins, and services integrated into low-code platforms. If a component has a known security vulnerability, the entire application will be threatened, which may lead to security issues such as data leakage and privilege escalation. It can be seen that applications developed based on low-code application development platforms have low security. A new technical means is needed to solve the above technical problems. Summary of the invention

[0004] The main purpose of this invention is to solve the technical problem of low security of applications developed based on a low-code application development platform.

[0005] A first aspect of the present invention provides a method for repairing vulnerabilities in a low-code application, the method comprising:

[0006] Obtain application information of the low-code application, the application information including application structure, application logic, and configuration data;

[0007] Matching known vulnerability information corresponding to the application information;

[0008] Analyze and obtain potential vulnerability information corresponding to the known vulnerability information according to the known vulnerability information;

[0009] A vulnerability repair operation is performed according to the potential vulnerability information and the known vulnerability information.

[0010] Optionally, in a first implementation of the first aspect of the present invention, the step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes:

[0011] According to the potential vulnerability information and the known vulnerability information, select target vulnerabilities that can be automatically repaired from known vulnerabilities and potential vulnerabilities;

[0012] A vulnerability repair operation is performed according to the target vulnerability information corresponding to the target vulnerability.

[0013] Optionally, in a second implementation manner of the first aspect of the present invention, the step of performing a vulnerability repair operation according to the target vulnerability information corresponding to the target vulnerability includes:

[0014] Performing a risk level assessment on the target vulnerability according to the target vulnerability information to obtain a first risk level;

[0015] The vulnerability repair operation is performed according to the first risk level and the target vulnerability information.

[0016] Optionally, in a third implementation of the first aspect of the present invention, the step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes:

[0017] Performing a risk level assessment on the known vulnerability according to the known vulnerability information to obtain a second risk level;

[0018] The vulnerability repair operation is performed according to the second risk level, the potential vulnerability information and the known vulnerability information.

[0019] Optionally, in a fourth implementation manner of the first aspect of the present invention, the step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes:

[0020] Perform risk level assessment on known vulnerabilities and potential vulnerabilities according to the potential vulnerability information and the known vulnerability information to obtain a third risk level;

[0021] The vulnerability repair operation is performed according to the third risk level, the potential vulnerability information and the known vulnerability information.

[0022] Optionally, in a fifth implementation of the first aspect of the present invention, the step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes:

[0023] Generate a repair plan based on the potential vulnerability information and the known vulnerability information;

[0024] According to the repair plan, perform the vulnerability repair operation.

[0025] Optionally, in a sixth implementation of the first aspect of the present invention, the step of obtaining application information of the low-code application includes:

[0026] Scan the source code and third-party libraries of the low-code application to obtain the application information.

[0027] A second aspect of the present invention provides a low-code application vulnerability repair device, comprising a memory and a processor, wherein the processor is used to execute program instructions stored in the memory so that the low-code application vulnerability repair device performs the above-mentioned low-code application vulnerability repair method.

[0028] A third aspect of the present invention provides a server, characterized in that it includes a memory and a processor, and the processor is used to execute program instructions stored in the memory so that the server executes the above-mentioned low-code application vulnerability repair method.

[0029] A fourth aspect of the present invention provides a computer-readable storage medium, which stores instructions that, when executed on a computer, enable the computer to execute the above-mentioned low-code application vulnerability repair method.

[0030] In an embodiment of the present invention, application information of a low-code application is obtained, and the application information includes application structure, application logic, and configuration data; known vulnerability information corresponding to the application information is matched; based on the known vulnerability information, potential vulnerability information corresponding to the known vulnerability information is analyzed; and vulnerability repair operations are performed based on the potential vulnerability information and the known vulnerability information. By obtaining the structure, logic, and configuration data of the low-code application and matching the known vulnerability information, potential security risks can be effectively identified and repaired. Through automated matching and analysis processes, the process of vulnerability identification and repair can be more efficient, especially for non-professional developers, while ensuring security, and reducing complexity and operational difficulty. This method not only focuses on known vulnerabilities, but also analyzes potential vulnerabilities, so that the application still maintains higher security during rapid iterations. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A schematic diagram of an embodiment of a method for repairing vulnerabilities in a low-code application in an embodiment of the present invention;

[0032] Figure 2 A schematic diagram of a specific embodiment of step 104 of the method for repairing a vulnerability in a low-code application in an embodiment of the present invention;

[0033] Figure 3 A schematic diagram of a specific embodiment of step 1042 of the vulnerability repair method for low-code applications in an embodiment of the present invention;

[0034] Figure 4 A schematic diagram of an embodiment of a vulnerability repair device for a low-code application in an embodiment of the present invention;

[0035] Figure 5 FIG. 1 is a schematic diagram of an embodiment of a server in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] Embodiments of the present invention provide a method, device, server, and storage medium for repairing vulnerabilities in low-code applications.

[0037] The embodiments disclosed in the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments disclosed in the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments disclosed in the present invention are only for exemplary purposes and are not intended to limit the scope of protection disclosed in the present invention.

[0038] In the description of the embodiments disclosed in the present invention, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0039] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 , an embodiment of a method for repairing a vulnerability in a low-code application in an embodiment of the present invention includes:

[0040] 101. Obtain application information of the low-code application, where the application information includes application structure, application logic, and configuration data;

[0041] Specifically, initialize the tool and configure permissions and parameters for accessing the low-code platform. Among them, start the tool and check the dependent environment, such as database connection and network settings. Enter the API key, OAuth token or other authentication information of the low-code platform for secure access. Configure the scanning parameters, including selecting the scope (such as a specific module or the entire application) and depth (such as static analysis or dynamic analysis) of the scan. Set the output format and storage location. Perform a preliminary configuration test to successfully connect to the low-code platform.

[0042] Specifically, perform source code and third-party library scans to collect application structure information, application logic, and configuration data. Among them, obtain the application's page structure through the API and record all view components and data flows. Scan all third-party libraries used in the application and record their names, versions, licenses, and sources. Parse the source code to extract key business logic, API interface definitions, and database interaction information. Collect configuration files and environment variables so that all security settings and credentials are identified. Organize the collected information and perform preliminary structured storage.

[0043] Specifically, the collected application information is stored in an internal model for subsequent analysis. Specifically, a data model is designed to store application information, including structure, logic, and configuration data. Scan results are converted to a target format, such as JSON or database records. The organized data is stored in an internal database or data warehouse. The stored data is made available for quick retrieval for subsequent analysis and query.

[0044] Optionally, perform source code and third-party library scanning operations on the low-code application to obtain the application information. Among them, use a static code analysis tool to scan the source code of the low-code application to extract the code structure and logic information. Including identifying components such as functions, classes, and modules. Call the tool to scan the third-party libraries that the application depends on, identify the version of the library and its known vulnerabilities. Relevant information can be obtained in conjunction with a public vulnerability database (such as CVE). Integrate the information obtained from the source code and third-party library scans to generate an application information report. This report may include:

[0045] Application structure: dependencies between modules.

[0046] Application logic: description of business logic and key functions.

[0047] Configuration data: environment configuration, database connection information, etc.

[0048] The generated application information is stored in a database or file for subsequent vulnerability matching and analysis.

[0049] 102. Match known vulnerability information corresponding to the application information;

[0050] Specifically, extract known vulnerability information from the vulnerability database, including vulnerability descriptions, impact scope, and remediation suggestions. Extract detailed information about known vulnerabilities, including vulnerability IDs, descriptions, affected components, and remediation suggestions. Parse the acquired application information to identify components and configurations that may match known vulnerabilities. Match component information with known vulnerabilities to identify components that may be affected. Record matching results and organize them into a preliminary risk assessment list. Associate the matched vulnerability information with specific instances of the application to generate a preliminary list of security issues, including vulnerability descriptions, affected components, and possible impacts.

[0051] 103. Analyze and obtain potential vulnerability information corresponding to the known vulnerability information according to the known vulnerability information;

[0052] Specifically, analyze each known vulnerability to determine its attack vector and impact range. Identify security issues related to the vulnerability, such as data leakage, privilege escalation, etc. Analyze the potential vulnerability information that may exist based on the known vulnerabilities. Integrate known and potential vulnerabilities to form a comprehensive list of security issues. Label each issue with priority and severity. Among them, attack vector refers to the way an attacker uses specific means or channels to successfully penetrate a system or network and carry out an attack. It describes the path of how an attacker enters the target system or network, including but not limited to the following types:

[0053] Cyber ​​attacks: attacks through network protocol vulnerabilities, malware, phishing, etc.

[0054] Physical attacks: Direct access to a device, such as implanting malware.

[0055] Social Engineering: Obtaining sensitive information, such as impersonating an identity or tricking a user into clicking a malicious link.

[0056] Application layer attacks: attacks targeting vulnerabilities in software applications, such as SQL injection and cross-site scripting (XSS).

[0057] 104. Perform vulnerability repair operations according to the potential vulnerability information and the known vulnerability information.

[0058] Specifically, analyze the difficulty of fixing each vulnerability, identify the vulnerabilities that can be automatically fixed, and prioritize vulnerabilities with a wide impact.

[0059] Specifically, we conduct risk assessment on target vulnerabilities based on their impact and repair costs, and determine the repair priority for each vulnerability to guide subsequent operations.

[0060] Specifically, detailed remediation steps are generated for each target vulnerability, including code modification suggestions. Specific code examples and configuration changes are provided for developers' reference.

[0061] Specifically, the code is modified and updated according to the repair plan.

[0062] In an embodiment of the present invention, application information of a low-code application is obtained, and the application information includes application structure, application logic, and configuration data; known vulnerability information corresponding to the application information is matched; based on the known vulnerability information, potential vulnerability information corresponding to the known vulnerability information is analyzed; and vulnerability repair operations are performed based on the potential vulnerability information and the known vulnerability information. By obtaining the structure, logic, and configuration data of the low-code application and matching the known vulnerability information, potential security risks can be effectively identified and repaired. Through automated matching and analysis processes, the process of vulnerability identification and repair can be more efficient, especially for non-professional developers, while ensuring security, and reducing complexity and operational difficulty. This method not only focuses on known vulnerabilities, but also analyzes potential vulnerabilities, so that the application still maintains higher security during rapid iterations.

[0063] Automated security detection and repair tools have gradually developed, but there is still a lack of specialized solutions for low-code applications. Based on this, the present invention proposes an optional embodiment.

[0064] Reference Figure 2 , Figure 2 This is a schematic diagram of a specific embodiment of step 104 of the vulnerability repair method for low-code applications in an embodiment of the present invention. Step 104 also includes the following specific implementation methods:

[0065] 1041. Filter out target vulnerabilities that can be automatically repaired from known vulnerabilities and potential vulnerabilities according to the potential vulnerability information and the known vulnerability information;

[0066] Specifically, collect information about potential vulnerabilities and known vulnerabilities. Establish a rule base for automatic repair and define the conditions for automatic repair of vulnerabilities. Traverse known vulnerabilities and potential vulnerabilities and use the rule base to filter out target vulnerabilities that meet the conditions for automatic repair.

[0067] 1042. Perform a vulnerability repair operation according to the target vulnerability information corresponding to the target vulnerability.

[0068] Specifically, obtain detailed information corresponding to the selected target vulnerabilities, including vulnerability locations, affected components, and repair suggestions. According to the target vulnerability information, call the corresponding repair program or tool to automatically implement the repair. Record detailed logs of the repair process, including status changes before and after the repair.

[0069] In the embodiment of the present invention, manual intervention is reduced through automated screening and repair, and the time required to repair vulnerabilities is reduced. Risk assessment prioritizes critical vulnerabilities, reducing potential attack surfaces.

[0070] The rise of low-code platforms has greatly increased the speed of application development and deployment. However, the accompanying security risks are also increasing. Many developers lack sufficient security awareness and expertise, resulting in frequent security vulnerabilities. Based on this, the present invention proposes an optional embodiment.

[0071] Reference Figure 3 , Figure 3 This is a schematic diagram of a specific embodiment of step 1042 of the vulnerability repair method for low-code applications in an embodiment of the present invention. Step 1042 also includes the following specific implementation methods:

[0072] 10421. Perform risk level assessment on the target vulnerability according to the target vulnerability information to obtain a first risk level;

[0073] Specifically, the vulnerability description, impact scope, and repair suggestions of the selected target vulnerabilities are analyzed to determine the possible impact and attack vector.

[0074] 10422. Perform the vulnerability repair operation according to the first risk level and the target vulnerability information.

[0075] Specifically, a risk assessment model is used to assess the risk level of each target vulnerability to obtain a first risk level. This model can assess risk based on the degree of impact (such as data leakage, system crash, etc.) and the difficulty of exploitation (such as whether there is a known attack method).

[0076] Determine the priority of repair based on the first risk level obtained from the assessment. Invoke automatic repair tools or perform repairs manually. Specific measures may include code modification, configuration changes, or library updates. Record the repair process, including the target vulnerabilities repaired, repair measures, and their effectiveness evaluation.

[0077] In the embodiment of the present invention, the most threatening vulnerabilities are repaired first through risk level assessment, which can effectively reduce security risks.

[0078] The popularity of low-code platforms has greatly increased the speed of application development, but it also brings security risks. Many developers may not be aware of potential security risks, which leads to the occurrence and spread of vulnerabilities. Based on this, the present invention proposes an optional embodiment.

[0079] Step 104 also includes the following specific implementations:

[0080] 1043. Perform risk level assessment on the known vulnerability according to the known vulnerability information to obtain a second risk level;

[0081] Specifically, analyze the characteristics of known vulnerabilities, including their scope of impact (such as system components, user data, etc.). Evaluate the difficulty of exploiting the vulnerability, including whether there are publicly exploitable attack methods. Calculate the second risk level based on the vulnerability impact and the difficulty of exploitation (for example, using the CVSS scoring system).

[0082] 1044. Perform the vulnerability repair operation according to the second risk level, the potential vulnerability information and the known vulnerability information.

[0083] Specifically, based on the second risk level and known vulnerability information, select high-risk vulnerabilities that need to be repaired first. For the selected high-risk vulnerabilities, formulate corresponding repair plans, which may include code repair, configuration adjustment, or update dependency. Implement repair operations and perform regression testing to verify the repair effect.

[0084] In the embodiment of the present invention, by performing risk level assessment on known vulnerabilities, high-risk vulnerabilities can be quickly identified and processed with priority.

[0085] With the popularity of low-code platforms, security issues have gradually become a focus of attention. Low-code applications usually rely on multiple third-party components, which may have known vulnerabilities. Developers are not aware of potential risks, leading to security risks. Based on this, the present invention proposes an optional embodiment.

[0086] Step 104 also includes the following specific implementations:

[0087] 1045. Perform risk level assessment on the known vulnerability according to the known vulnerability information to obtain a second risk level;

[0088] Specifically, potential vulnerability information is extracted from the operating environment of the low-code application, and known vulnerability information related to the application is retrieved at the same time.

[0089] Perform feature analysis on the acquired potential vulnerabilities and known vulnerability information, including the scope of impact, attack complexity, and existing repair measures.

[0090] The risk level of each vulnerability is calculated using a risk assessment model (such as CVSS) to obtain a third risk level.

[0091] 1046. Perform the vulnerability repair operation according to the third risk level, the potential vulnerability information and the known vulnerability information.

[0092] Specifically, based on the third risk level, prioritize the vulnerabilities to be addressed, especially those with higher risk levels. Develop a detailed repair plan for each identified vulnerability, which may include code revisions, configuration updates, or third-party library upgrades. Implement vulnerability repair operations.

[0093] In the embodiment of the present invention, through comprehensive risk assessment, high-risk vulnerabilities can be more effectively identified and repaired, reducing the possibility of application attacks.

[0094] In information technology and software development, especially with the increasing popularity of low-code applications, security issues have gradually become prominent. Although low-code platforms have lowered the development threshold, the components they use often come from multiple sources, leading to potential security risks. Traditional manual vulnerability detection and repair methods are inefficient and prone to missing high-risk vulnerabilities. Based on this, the present invention proposes an optional embodiment.

[0095] Step 104 also includes the following specific implementations:

[0096] 1047. Generate a repair plan based on the potential vulnerability information and the known vulnerability information;

[0097] Specifically, potential vulnerability information related to the application is extracted from the low-code application environment, and known vulnerability information matching the application is obtained through a database or security tool.

[0098] Analyze the characteristics of each vulnerability based on the nature of known and potential vulnerabilities (such as the scope of impact, difficulty of repair, etc.). Develop a repair plan, such as code modification, configuration update, and third-party library version upgrade. Each repair plan can be assigned a corresponding priority to facilitate subsequent implementation.

[0099] 1048. Perform vulnerability repair operations according to the repair plan.

[0100] In the embodiment of the present invention, by generating a repair plan, the vulnerability repair process can be systematized and standardized, effectively reducing human errors.

[0101] It is easy to understand that the terms involved in the vulnerability repair method of low-code applications include but are not limited to:

[0102] Low-code applications: refers to applications created using low-code development platforms. It allows users to quickly develop and deploy applications through a graphical interface and a small amount of code without in-depth programming knowledge.

[0103] Vulnerability: A security weakness or flaw in a system, application, or network that could be exploited by an attacker, leading to data leakage, corruption, or other security issues.

[0104] Application information: refers to various types of data about low-code applications, including application structure, application logic, and configuration data.

[0105] Application structure: refers to the components of an application and their relationships, including modules, components, and data flows.

[0106] Application logic: refers to the implementation of application functions and business rules, including user interaction, data processing, and function calls.

[0107] Configuration data: refers to the various settings required by the application at runtime, such as database connection strings, API keys, and environment variables.

[0108] Known vulnerability information: Known vulnerability information refers to information about existing security vulnerabilities, which can be derived from security databases.

[0109] Potential vulnerability information: Potential vulnerability information refers to possible vulnerabilities inferred by analyzing known vulnerability information. It helps prevent and repair security risks that have not yet been discovered.

[0110] Risk level assessment: The process of evaluating the impact and ease of exploitation of a vulnerability. Vulnerabilities are usually classified into different levels to guide the priority of repair.

[0111] Automatic repair: refers to the ability of a system or tool to automatically take measures to repair a vulnerability after it is discovered, without the need for human intervention.

[0112] Repair plan: It is the specific repair steps and strategies formulated for the discovered vulnerabilities, aiming to effectively solve security problems.

[0113] Reference Figure 4, the embodiment of the present disclosure provides a low-code application vulnerability repair device 400, including a low-code application vulnerability repair device body, and a low-code application vulnerability repair device 405. The low-code application vulnerability repair device 405 includes a processor (processor) 404 and a memory (memory) 401 storing program instructions. Optionally, the device may also include a communication interface (Communication Interface) 402 and a bus 403. Among them, the processor 404, the communication interface 402, and the memory 401 can complete mutual communication through the bus 403. The communication interface 402 can be used for information transmission. The processor 404 can call the program instructions in the memory 401 to execute the vulnerability repair method of the low-code application of the above-mentioned embodiment. In addition, the logical instructions in the above-mentioned memory 401 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. The memory 401, as a computer-readable storage medium, can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 404 executes the functional application and data processing by running the program instructions / modules stored in the memory 401, that is, the vulnerability repair method of the low-code application in the above embodiment is implemented. The memory 401 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 401 may include a high-speed random access memory and may also include a non-volatile memory.

[0114] Reference Figure 5 , the embodiment of the present disclosure provides a server 500, including a processor (processor) 504 and a memory (memory) 501 storing program instructions. Optionally, the server may also include a communication interface (CommunicationInterface) 502 and a bus 503. Among them, the processor 504, the communication interface 502, and the memory 501 can communicate with each other through the bus 503. The communication interface 502 can be used for information transmission. The processor 504 can call the program instructions in the memory 501 to execute the vulnerability repair method of the low-code application of the above embodiment.

[0115] In addition, the logic instructions in the above-mentioned memory 501 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. The memory 501, as a computer-readable storage medium, can be used to store software programs, computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor 504 executes functional applications and data processing by running the program instructions / modules stored in the memory 501, that is, implements the vulnerability repair method of the low-code application in the above-mentioned embodiment. The memory 501 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 501 may include a high-speed random access memory and may also include a non-volatile memory.

[0116] The technical solution of the embodiment of the present disclosure can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present disclosure. The aforementioned storage medium may be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes, or a transient storage medium.

[0117] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of listings containing one or more associated ones. In addition, when used in the present application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical elements in the process, method or device comprising the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0118] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods for each specific application to implement the described functions, but such implementations should not be considered to exceed the scope of the embodiments of the present disclosure. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0119] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present disclosure may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0120] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A method for repairing vulnerabilities in low-code applications, characterized in that: The vulnerability repair method of the low-code application includes: Obtain application information of the low-code application, the application information including application structure, application logic, and configuration data; Matching known vulnerability information corresponding to the application information; Analyze and obtain potential vulnerability information corresponding to the known vulnerability information according to the known vulnerability information; A vulnerability repair operation is performed according to the potential vulnerability information and the known vulnerability information.

2. The method for repairing vulnerabilities in low-code applications according to claim 1, characterized in that: The step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes: According to the potential vulnerability information and the known vulnerability information, select target vulnerabilities that can be automatically repaired from known vulnerabilities and potential vulnerabilities; A vulnerability repair operation is performed according to the target vulnerability information corresponding to the target vulnerability.

3. The method for repairing vulnerabilities in low-code applications according to claim 2, characterized in that: The step of performing a vulnerability repair operation according to the target vulnerability information corresponding to the target vulnerability includes: Performing a risk level assessment on the target vulnerability according to the target vulnerability information to obtain a first risk level; The vulnerability repair operation is performed according to the first risk level and the target vulnerability information.

4. The method for repairing vulnerabilities in low-code applications according to claim 1, characterized in that: The step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes: Performing a risk level assessment on the known vulnerability according to the known vulnerability information to obtain a second risk level; The vulnerability repair operation is performed according to the second risk level, the potential vulnerability information and the known vulnerability information.

5. The method for repairing vulnerabilities in low-code applications according to claim 1, characterized in that: The step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes: Perform risk level assessment on known vulnerabilities and potential vulnerabilities according to the potential vulnerability information and the known vulnerability information to obtain a third risk level; The vulnerability repair operation is performed according to the third risk level, the potential vulnerability information and the known vulnerability information.

6. The method for repairing vulnerabilities in low-code applications according to claim 1, characterized in that: The step of performing a vulnerability repair operation according to the potential vulnerability information and the known vulnerability information includes: Generate a repair plan based on the potential vulnerability information and the known vulnerability information; According to the repair plan, perform the vulnerability repair operation.

7. The method for repairing vulnerabilities in low-code applications according to claim 1, characterized in that: The step of obtaining application information of the low-code application includes: Scan the source code and third-party libraries of the low-code application to obtain the application information.

8. A low-code application vulnerability repair device, characterized in that: It includes a memory and a processor, and the processor is used to execute program instructions stored in the memory to implement the vulnerability repair method for low-code applications as described in any one of claims 1 to 7.

9. A server, characterized in that: It includes a memory and a processor, and the processor is used to execute program instructions stored in the memory to implement the vulnerability repair method for low-code applications as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the vulnerability repair method for the low-code application as described in any one of claims 1-7.

Images