Go language dependent packet security vulnerability protection method and system based on DevOps platform

Abstract

The invention discloses a Go language dependent package security vulnerability protection method and system based on a DevOps platform, and the method comprises the steps: receiving a submitted initial software code; the method comprises the following steps: automatically analyzing a submitted initial software code based on a Go source code analyzer, identifying a go.mod file, reading the go.mod file, and obtaining all Go language dependent packages on which the initial software code depends and version numbers of the Go language dependent packages; whether security vulnerabilities exist or not is inquired according to the version number of each Go language dependency package, if yes, the Go language dependency package with the security vulnerabilities is repaired and replaced, and a repaired software code is obtained and submitted again. According to the Go language dependency package security vulnerability protection method based on the DevOps platform, by achieving the purposes, the compiling security of a Go language project on the DevOps platform can be effectively improved, the production environment risk caused by the security vulnerability of the dependency package is reduced, meanwhile, the repair cost of research and development personnel is reduced, and the overall efficiency of software development is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and specifically provides a Go language dependency package security vulnerability protection method and system based on a DevOps platform. Background Art

[0002] In the Go language (Golang) project, Go language dependency package management is implemented through the go.mod file, which records all external packages and their version numbers that the project depends on. However, these Go language dependency packages often come from open source versions, some of which may have security vulnerabilities that may be exploited by attackers and threaten the security of the software system.

[0003] In the prior art, the Go language dependency package security detection for Go language projects mainly has the following technical defects:

[0004] R&D personnel need to manually check the security of Go language dependency packages, such as checking GitHub to see if the version has security vulnerabilities and whether there is a fixed version. This process is time-consuming and labor-intensive, and is prone to omissions. At the same time, once a Go language dependency package has a security vulnerability, R&D personnel need to manually intervene to upgrade the dependency package version, and automatic replacement cannot be achieved. In addition, even if the Go language dependency package is replaced with a secure version, existing tools often do not provide unit test verification after compilation, and cannot ensure the stability of the code after replacement. R&D personnel are required to conduct testing to ensure the quality of the software.

[0005] In summary, since Go language projects frequently use third-party open source Go language dependency packages during development, and the security of these Go language dependency packages cannot be effectively guaranteed, there are potential security risks. The inefficiency of manual detection and semi-automated tools makes it difficult to detect and handle these risks in a timely manner. The lack of post-compilation verification and insufficient integration of CICD platforms further exacerbate these problems, which may cause code with security vulnerabilities to be deployed to the production environment, thereby causing security incidents.

[0006] In view of this, this invention patent is proposed to solve the following technical problems:

[0007] First, how to effectively review and analyze the software dependencies in the Go language program source code in real time and determine their versions. When there are security vulnerabilities in the dependent packages, automatically identify and replace them with versions that fix the vulnerabilities to prevent the code with security risks from being compiled or deployed.

[0008] Furthermore, how to effectively integrate the above process into the process of devops continuous integration and continuous deployment platform to achieve automated operation, and prevent compilation from passing if compilation and unit tests fail, while providing clear prompts for developers to manually upgrade the corresponding code;

[0009] Furthermore, how to reduce the repair costs caused by vulnerabilities in software dependency packages and improve development efficiency and the security of software products. Summary of the invention

[0010] In view of the above technical problems, the present invention proposes a Go language dependency package security vulnerability protection method and system based on a DevOps platform. Specifically, the following technical solutions are adopted:

[0011] In a first aspect, the present invention provides a Go language dependency package security vulnerability protection method based on a DevOps platform, comprising:

[0012] receiving initial software code submissions;

[0013] Automatically analyze the submitted initial software code based on the Go source code analyzer, identify the go.mod file, read the go.mod file, and obtain all the Go language dependency packages and their version numbers that the initial software code depends on;

[0014] Check whether there are security vulnerabilities based on the version numbers of each Go language dependency package. If so, repair and replace the Go language dependency package with the security vulnerability, obtain the repair software code, and resubmit it.

[0015] As an optional implementation of the present invention, in a Go language dependency package security vulnerability protection method based on a DevOps platform of the present invention, querying whether there is a security vulnerability according to the version number of each Go language dependency package includes:

[0016] Submit all Go language dependency packages and their version numbers that the acquired software code depends on to the vulnerability management platform;

[0017] The vulnerability management and control platform has a version number database of Go language dependency packages with security vulnerabilities;

[0018] The vulnerability control platform performs a query and match in a database of Go language dependency packages with security vulnerabilities based on the version number of the Go language dependency package on which the submitted software code depends to determine whether there is a security vulnerability;

[0019] If the match is successful, there is a security vulnerability; if the match is unsuccessful, there is no security vulnerability.

[0020] As an optional implementation of the present invention, in a Go language dependency package security vulnerability protection method based on a DevOps platform of the present invention, if present, the Go language dependency package with a security vulnerability is repaired and replaced to obtain a repair software code, including:

[0021] The vulnerability management and control platform has a Go language dependency package repair version number database corresponding to the version number of the Go language dependency package with security vulnerabilities;

[0022] If a security vulnerability is found according to the version number query of the Go language dependency package, the Go language dependency package repair version number database will select the corresponding Go language dependency package repair version number for automatic replacement to obtain the repair software code.

[0023] As an optional implementation of the present invention, in a Go language dependency package security vulnerability protection method based on a DevOps platform of the present invention, the selecting a corresponding Go language dependency package repair version number from a Go language dependency package repair version number database for automatic replacement includes:

[0024] When a version number of a Go language dependency package with a security vulnerability corresponds to multiple Go language dependency package repair version numbers, a Go language dependency package repair version number close to the version number of the Go language dependency package with a security vulnerability is selected for automatic replacement;

[0025] Optionally, a repaired version number of a Go language dependency package that is close to and lower than the version number of the Go language dependency package with the security vulnerability is selected for automatic replacement.

[0026] As an optional implementation of the present invention, in a Go language dependency package security vulnerability protection method based on a DevOps platform of the present invention, the selecting a corresponding Go language dependency package repair version number from a Go language dependency package repair version number database for automatic replacement includes:

[0027] When a Go language dependency package version number having a security vulnerability does not have a corresponding Go language dependency package repair version number, a prompt is generated that the Go language dependency package on which the software code depends has a security vulnerability, prompting the R&D personnel to manually repair the security vulnerability of the Go language dependency package.

[0028] As an optional implementation of the present invention, a Go language dependency package security vulnerability protection method based on a DevOps platform of the present invention includes:

[0029] Resubmit the repair software code of the Go language dependency package manually repaired by the R&D staff;

[0030] When the repaired software code passes the Go language dependency package security vulnerability detection, the version number of the Go language dependency package manually repaired by the R&D personnel is added to the Go language dependency package repair version number database, and the Go language dependency package manually repaired by the R&D personnel is added to the Go language dependency package database of the vulnerability management and control platform.

[0031] As an optional implementation of the present invention, a Go language dependency package security vulnerability protection method based on a DevOps platform of the present invention includes:

[0032] Repair and replace the repair software code of the Go language dependency package with security vulnerabilities, and resubmit it for compilation;

[0033] If the compilation fails, the developer is prompted that the cause of the compilation failure may be a compatibility issue caused by the replacement of the Go language dependency package version. At the same time, the version number replacement record of the Go language dependency package on which the software code depends is sent to the developer for manual repair;

[0034] If the compilation passes, the unit testing phase of the software code begins.

[0035] As an optional implementation of the present invention, in a Go language dependency package security vulnerability protection method based on a DevOps platform of the present invention, the unit testing phase includes:

[0036] Receive successfully compiled software code, execute the go test command, and perform unit tests to verify the functionality and stability of the code;

[0037] If the test passes, when the software code performs a Go language dependency package security vulnerability repair and replacement, the developer is prompted that the Go language dependency package of the initial software code has a security vulnerability problem and has been automatically repaired and replaced or manually repaired and replaced by the developer;

[0038] If the test fails, compilation is blocked and the developer is prompted that the Go language dependency package on which the current software code depends has a security vulnerability. The developer needs to manually change the code to a secure version and resubmit the repaired software code.

[0039] In a second aspect, the present invention provides a Go language dependency package security vulnerability protection system based on a DevOps platform, comprising:

[0040] A software code receiving module receives the submitted initial software code;

[0041] Go language dependency package analysis module, which automatically analyzes the submitted initial software code based on the Go source code analyzer, identifies the go.mod file, reads the go.mod file, and obtains all Go language dependency packages and their version numbers that the initial software code depends on;

[0042] The Go language dependency package vulnerability repair module queries whether there are security vulnerabilities based on the version numbers of each Go language dependency package. If so, the Go language dependency package with the security vulnerability is repaired and replaced to obtain the repair software code and resubmit it.

[0043] In a third aspect, the present invention provides a computer-readable recording medium storing a computer executable program, which, when executed, implements a Go language dependency package security vulnerability protection method based on a DevOps platform.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] Advantage 1: Improve detection efficiency

[0046] Since the present invention automatically analyzes the Go language source code and detects security vulnerabilities of the Go language dependent packages during the code compilation stage, no manual intervention by R&D personnel is required, thus significantly improving the detection efficiency and coverage and ensuring the security of the dependent packages.

[0047] Advantage 2: Automated repair process

[0048] When a security vulnerability is detected, the present invention can automatically replace the version of the Go language dependency package to a security repair version, and perform compilation and unit testing. This automated process reduces the workload of R&D personnel and reduces errors caused by manual operations.

[0049] Advantage 3: Real-time feedback and integration

[0050] By providing real-time feedback of security vulnerability information on the CICD platform, the present invention enables R&D personnel to understand the security status of the project in a timely manner and take corresponding measures. This integrated processing method helps to quickly respond to security incidents and ensure the security of software delivery.

[0051] Advantage 4: Preventing unsafe code deployment

[0052] The present invention prevents compilation generation when compilation and unit testing fail, thereby ensuring that codes with security vulnerabilities will not be deployed to the production environment, thereby protecting the data and system security of end users.

[0053] Advantage 5: Reduce maintenance costs

[0054] Since the automated process reduces manual intervention, the present invention helps to reduce long-term maintenance costs. R&D personnel can invest more time and resources in the development of core functions rather than fixing security vulnerabilities.

[0055] Advantage 6: Improve software development quality

[0056] By ensuring the security of Go language dependency packages and automatically repairing known vulnerabilities, the present invention helps to improve the overall quality of software and reduce software failures and downtime caused by security issues.

[0057] In summary, the Go language dependency package security vulnerability protection method based on the DevOps platform of the present invention provides a more efficient and reliable security guarantee for the Go language project through an automated security detection and repair process combined with the integration of the CICD platform, thereby bringing many advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A flowchart of a method for protecting Go language dependency packages from security vulnerabilities based on a DevOps platform according to a first embodiment of the present invention;

[0059] Figure 2 A schematic structural diagram of an electronic device according to a second embodiment of the present invention;

[0060] Figure 3 A schematic diagram of a computer-readable recording medium according to a second embodiment of the present invention. DETAILED DESCRIPTION

[0061] To make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be described clearly and completely in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them.

[0062] Therefore, the following detailed description of the embodiments of the present invention is not intended to limit the scope of the invention claimed for protection, but merely represents some embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0064] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0065] In the description of the present invention, it should be noted that the orientation or positional relationship indicated by the terms "upper", "lower", etc. is based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invention product is usually placed when in use, or the orientation or positional relationship commonly understood by those skilled in the art. Such terms are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0066] Embodiment 1

[0067] See also Figure 1 As shown, a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment includes:

[0068] receiving initial software code submissions;

[0069] Automatically analyze the submitted initial software code based on the Go source code analyzer, identify the go.mod file, read the go.mod file, and obtain all the Go language dependency packages and their version numbers that the initial software code depends on;

[0070] Check whether there are security vulnerabilities based on the version numbers of each Go language dependency package. If so, repair and replace the Go language dependency package with the security vulnerability, obtain the repair software code, and resubmit it.

[0071] The DevOps platform of this embodiment refers to a tool set and platform environment for supporting and implementing the DevOps methodology. The DevOps platform usually integrates various automation tools, deployment tools, monitoring tools, collaboration tools, etc. to achieve automation and collaboration of the entire process of software development, testing, deployment and operation and maintenance.

[0072] The Go language dependency package security vulnerability protection method based on the DevOps platform of this embodiment has the following characteristics:

[0073] Automated detection: After the initial software code is submitted, the Go language source code is automatically analyzed during the code compilation phase to identify the Go language dependency packages and their version numbers in the go.mod file.

[0074] Real-time vulnerability query: Automatically query Go language dependency packages and their versions for security vulnerabilities to promptly identify potential security risks.

[0075] Automatic replacement and verification: When a security vulnerability is discovered, the Go language dependency package version is automatically replaced with the security fix version, and the code is resubmitted for compilation and unit testing to verify code stability.

[0076] CICD platform integration: The combination of CI (Continuous Integration) and CD (Continuous Deployment) is a practice of automated software development and deployment processes, which achieves frequent code integration and delivery through continuous integration and automated testing. Real-time feedback of security vulnerability information and repair status is provided on the CICD platform to guide R&D personnel to make necessary interventions.

[0077] Prevent unsafe compilation: If compilation and unit tests fail, prevent compilation and generation to ensure that unsafe code is not deployed to the production environment.

[0078] The present embodiment provides a Go language dependency package security vulnerability protection method based on a DevOps platform. By achieving the above-mentioned purpose, it can effectively improve the compilation security of Go language projects on the DevOps platform, reduce the production environment risks caused by dependency package security vulnerabilities, and at the same time reduce the repair costs of R&D personnel and improve the overall efficiency of software development.

[0079] As an optional implementation of this embodiment, in a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment, querying whether there is a security vulnerability according to the version number of each Go language dependency package includes:

[0080] Submit all Go language dependency packages and their version numbers that the acquired software code depends on to the vulnerability management platform;

[0081] The vulnerability management and control platform has a version number database of Go language dependency packages with security vulnerabilities;

[0082] The vulnerability control platform performs a query and match in a database of Go language dependency packages with security vulnerabilities based on the version number of the Go language dependency package on which the submitted software code depends to determine whether there is a security vulnerability;

[0083] If the match is successful, there is a security vulnerability; if the match is unsuccessful, there is no security vulnerability.

[0084] The vulnerability management and control platform of this embodiment integrates a database of version numbers of Go language dependency packages with security vulnerabilities. In this way, by querying and matching the version numbers of the Go language dependency packages on which the submitted software code depends in the database of version numbers of the Go language dependency packages with security vulnerabilities, it can be determined whether there is a security vulnerability.

[0085] The data source of the Go language dependency package version number database with security vulnerabilities of the vulnerability management and control platform of this embodiment can be github. At the same time, the Go language dependency package version number database with security vulnerabilities supports adding updates to ensure that the data of the Go language dependency package version number database with security vulnerabilities is more comprehensive.

[0086] Furthermore, in a Go language dependency package security vulnerability protection method based on a DevOps platform of this embodiment, if any, the Go language dependency package with the security vulnerability is repaired and replaced to obtain the repair software code, including:

[0087] The vulnerability management and control platform has a Go language dependency package repair version number database corresponding to the version number of the Go language dependency package with security vulnerabilities;

[0088] If a security vulnerability is found according to the version number query of the Go language dependency package, the Go language dependency package repair version number database will select the corresponding Go language dependency package repair version number for automatic replacement to obtain the repair software code.

[0089] The Go language dependency package security vulnerability protection method based on the DevOps platform in this embodiment directly obtains the corresponding repair version number through the Go language dependency package repair version number database when there is a security vulnerability in the Go language dependency package on which the software code depends, thereby realizing automatic replacement of the Go language dependency package with the security vulnerability.

[0090] In a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment, the selecting a corresponding Go language dependency package repair version number from a Go language dependency package repair version number database for automatic replacement includes:

[0091] When a Go language dependency package version number with a security vulnerability corresponds to multiple Go language dependency package repair version numbers, a Go language dependency package repair version number close to the Go language dependency package version number with the security vulnerability is selected for automatic replacement. In this way, by replacing the Go language dependency package with a version number as close as possible, the similarity between the two can be ensured to be high, and incompatibility issues can be avoided as much as possible.

[0092] Optionally, when replacing a Go language dependency package with a security vulnerability, a Go language dependency package repair version number that is close to and lower than the Go language dependency package with a security vulnerability is selected for automatic replacement. In this way, the compatibility problem of the Go language dependency package can generally be met.

[0093] As an optional implementation of this embodiment, in a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment, the selecting a corresponding Go language dependency package repair version number from a Go language dependency package repair version number database for automatic replacement includes:

[0094] When a Go language dependency package version number having a security vulnerability does not have a corresponding Go language dependency package repair version number, a prompt is generated that the Go language dependency package on which the software code depends has a security vulnerability, prompting the R&D personnel to manually repair the security vulnerability of the Go language dependency package.

[0095] The present embodiment provides a Go language dependency package security vulnerability protection method based on a DevOps platform. When a security vulnerability is automatically identified in a Go language dependency package, the Go language dependency package cannot be automatically replaced because there is no corresponding Go language dependency package repair version number. Therefore, the security vulnerability of the Go language dependency package is repaired manually by R&D personnel.

[0096] Furthermore, a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment includes:

[0097] Resubmit the repair software code of the Go language dependency package manually repaired by the R&D staff;

[0098] When the repaired software code passes the Go language dependency package security vulnerability detection, the version number of the Go language dependency package manually repaired by the R&D personnel is added to the Go language dependency package repair version number database, and the Go language dependency package manually repaired by the R&D personnel is added to the Go language dependency package database of the vulnerability management and control platform.

[0099] In this way, a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment can automatically identify that a Go language dependency package with the same version number has a security vulnerability next time. It can obtain the Go language dependency package manually repaired by the R&D personnel according to the version number of the Go language dependency package manually repaired by the R&D personnel, and automatically replace it.

[0100] A Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment includes:

[0101] Repair and replace the repair software code of the Go language dependency package with security vulnerabilities, and resubmit it for compilation;

[0102] If the compilation fails, the developer is prompted that the cause of the compilation failure may be a compatibility issue caused by the replacement of the Go language dependency package version. At the same time, the version number replacement record of the Go language dependency package on which the software code depends is sent to the developer for manual repair;

[0103] If the compilation passes, the unit testing phase of the software code begins.

[0104] The present embodiment provides a Go language dependency package security vulnerability protection method based on a DevOps platform. When a security vulnerability is found in a Go language dependency package, the Go language dependency package version is automatically replaced with a security repair version, and compilation and unit testing are performed to verify code stability.

[0105] Specifically, in a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment, the unit testing phase includes:

[0106] Receive successfully compiled software code, execute the go test command, and perform unit tests to verify the functionality and stability of the code;

[0107] If the test passes, when the software code performs a Go language dependency package security vulnerability repair and replacement, the developer is prompted that the Go language dependency package of the initial software code has a security vulnerability problem and has been automatically repaired and replaced or manually repaired and replaced by the developer;

[0108] If the test fails, compilation is blocked and the developer is prompted that the Go language dependency package on which the current software code depends has a security vulnerability. The developer needs to manually change the code to a secure version and resubmit the repaired software code.

[0109] The present embodiment provides a Go language dependency package security vulnerability protection method based on a DevOps platform. If the compilation and unit test fail, the compilation generation is blocked to ensure that the unsafe code will not be deployed to the production environment.

[0110] See also Figure 1 As shown, a Go language dependency package security vulnerability protection method based on a DevOps platform in this embodiment, the technical solution is described in detail as follows:

[0111] Step 1: R&D personnel submit the initial software code to the version control system. The code submission action triggers the automated tasks of the CICD process. The first step in the CICD process is to use the Go source code analyzer to automatically analyze the submitted code, identify the go.mod file, read the go.mod file, and extract all the Go language dependency packages and their version numbers that the project depends on.

[0112] Step 2: Submit a query to the vulnerability control platform to query the Go language dependency package and version number to see if there is a security vulnerability. If there is no vulnerability, execute code compilation. If there is a vulnerability, get the version affected by the vulnerability and the fixed version. For the vulnerable version, automatically replace the version in go.mod with the version number of the security fix. Then compile.

[0113] Step 3: Check whether the compilation is successful. If the compilation fails, the process is terminated and the CICD platform prompts the developer that the compilation failed. This may be due to a compatibility issue caused by version replacement. The developer needs to manually fix the problem version and submit the fixed code. Go to step 1. If the compilation is successful, enter the unit test.

[0114] Step 4: Execute the go test command to perform unit tests to verify the functionality and stability of the code. Check whether the unit test passes. If the test passes, the devops CICD platform prompts the developer that a Go language dependency package has a security issue and has been automatically replaced. If the test fails, the compilation is blocked and the developer is prompted on the CICD platform that a Go language dependency package has a security issue and needs to manually change the code to upgrade to a secure version and submit the fixed code. Go to step 1.

[0115] Through the above process, the present invention ensures the security of the dependency packages of the Go language project on the DevOps platform, while reducing the intervention of R&D personnel and improving the efficiency of software development and deployment.

[0116] In summary, the Go language dependency package security vulnerability protection method based on the DevOps platform in this embodiment has the following key points:

[0117] Automated analysis mechanism: The present invention provides a technical mechanism for automatically analyzing Go language source code, identifying go.mod files, and extracting Go language dependent packages and their version numbers on a DevOps platform during the code compilation phase.

[0118] Security vulnerability detection: The present invention implements the function of performing security vulnerability query on the extracted Go language dependency packages and their versions, and can interact with existing security vulnerability databases or services to detect potential security risks.

[0119] Automatic replacement and verification: After detecting a security vulnerability, the present invention can automatically replace the dependent package version in the go.mod file with the security fix version, and perform compilation and unit testing (go test) to verify the stability of the code.

[0120] CICD platform integration: The present invention integrates the security detection and repair process into the CICD platform, realizes real-time feedback of security vulnerability information in the CICD process, and decides whether to continue compilation and deployment based on the test results.

[0121] Compilation blocking mechanism: If the compilation and unit test fail, the present invention can block the compilation generation to ensure that the code with security vulnerabilities will not be deployed to the production environment.

[0122] The Go language dependency package security vulnerability protection method based on the DevOps platform of this embodiment has the following advantages:

[0123] Advantage 1: Improve detection efficiency

[0124] Since this embodiment automatically analyzes the Go language source code and detects security vulnerabilities of the Go language dependent packages during the code compilation stage, no manual intervention by R&D personnel is required, thus significantly improving the detection efficiency and coverage and ensuring the security of the dependent packages.

[0125] Advantage 2: Automated repair process

[0126] When a security vulnerability is detected, this embodiment can automatically replace the version of the Go language dependency package to the security fix version, and perform compilation and unit testing. This automated process reduces the workload of R&D personnel and reduces errors caused by manual operations.

[0127] Advantage 3: Real-time feedback and integration

[0128] By providing real-time feedback of security vulnerability information on the CICD platform, this embodiment enables R&D personnel to understand the security status of the project in a timely manner and take corresponding measures. This integrated processing method helps to quickly respond to security incidents and ensure the security of software delivery.

[0129] Advantage 4: Preventing unsafe code deployment

[0130] This embodiment prevents compilation generation when compilation and unit testing fail, thereby ensuring that code with security vulnerabilities will not be deployed to the production environment, thereby protecting end-user data and system security.

[0131] Advantage 5: Reduce maintenance costs

[0132] Since the automated process reduces manual intervention, this embodiment helps to reduce long-term maintenance costs. R&D personnel can invest more time and resources in the development of core functions rather than fixing security vulnerabilities.

[0133] Advantage 6: Improve software development quality

[0134] By ensuring the security of Go language dependency packages and automatically repairing known vulnerabilities, this embodiment helps to improve the overall quality of the software and reduce software failures and downtime caused by security issues.

[0135] In summary, the Go language dependency package security vulnerability protection method based on the DevOps platform in this embodiment provides a more efficient and reliable security guarantee for the Go language project through an automated security detection and repair process combined with the integration of the CICD platform, thereby bringing many advantages.

[0136] This embodiment also provides a Go language dependency package security vulnerability protection system based on a DevOps platform, including:

[0137] A software code receiving module receives the submitted initial software code;

[0138] Go language dependency package analysis module, which automatically analyzes the submitted initial software code based on the Go source code analyzer, identifies the go.mod file, reads the go.mod file, and obtains all Go language dependency packages and their version numbers that the initial software code depends on;

[0139] The Go language dependency package vulnerability repair module queries whether there are security vulnerabilities based on the version numbers of each Go language dependency package. If so, the Go language dependency package with the security vulnerability is repaired and replaced to obtain the repair software code and resubmit it.

[0140] The Go language dependency package security vulnerability protection system based on the DevOps platform of this embodiment has the following characteristics:

[0141] Automated detection: After the initial software code is submitted, the Go language source code is automatically analyzed during the code compilation phase to identify the Go language dependency packages and their version numbers in the go.mod file.

[0142] Real-time vulnerability query: Automatically query Go language dependency packages and their versions for security vulnerabilities to promptly identify potential security risks.

[0143] Automatic replacement and verification: When a security vulnerability is discovered, the Go language dependency package version is automatically replaced with the security fix version, and the code is resubmitted for compilation and unit testing to verify code stability.

[0144] CICD platform integration: The combination of CI (Continuous Integration) and CD (Continuous Deployment) is a practice of automated software development and deployment processes, which achieves frequent code integration and delivery through continuous integration and automated testing. Real-time feedback of security vulnerability information and repair status is provided on the CICD platform to guide R&D personnel to make necessary interventions.

[0145] Prevent unsafe compilation: If compilation and unit tests fail, prevent compilation and generation to ensure that unsafe code is not deployed to the production environment.

[0146] The present embodiment provides a Go language dependency package security vulnerability protection system based on a DevOps platform. By achieving the above-mentioned purpose, it can effectively improve the compilation security of Go language projects on the DevOps platform, reduce the production environment risks caused by dependency package security vulnerabilities, and at the same time reduce the repair costs of R&D personnel and improve the overall efficiency of software development.

[0147] Embodiment 2

[0148] The following describes an electronic device embodiment of the present invention, which can be regarded as a specific physical implementation of the method and device embodiments of the present invention. The details described in the electronic device embodiment of the present invention should be regarded as a supplement to the above method or device embodiments; details not disclosed in the electronic device embodiment of the present invention can be implemented with reference to the above method or device embodiments.

[0149] Figure 2 It is a structural schematic diagram of an electronic device of an embodiment of the present invention, which includes a processor and a memory, wherein the memory is used to store a computer executable program, and when the computer program is executed by the processor, the processor executes a Go language dependency package security vulnerability protection method based on a DevOps platform of embodiment 1.

[0150] like Figure 2 As shown, the electronic device is presented in the form of a general computing device. The processor may be one or more and work in coordination. The present invention does not exclude distributed processing, that is, the processor may be dispersed in different physical devices. The electronic device of the present invention is not limited to a single entity, but may also be the sum of multiple physical devices.

[0151] The memory stores a computer executable program, which is usually a machine-readable code. The computer-readable program can be executed by the processor to enable the electronic device to perform the method of the present invention, or at least part of the steps in the method.

[0152] The memory includes a volatile memory, such as a random access memory unit (RAM) and / or a cache memory unit, and may also be a non-volatile memory, such as a read-only memory unit (ROM).

[0153] Optionally, in this embodiment, the electronic device further includes an I / O interface, which is used for the electronic device to exchange data with an external device. The I / O interface can represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0154] It should be understood that Figure 2 The electronic device shown is only an example of the present invention, and the electronic device of the present invention may also include elements or components not shown in the above examples. For example, some electronic devices also include display units such as display screens, and some electronic devices also include human-computer interaction elements such as buttons, keyboards, etc. As long as the electronic device can execute the computer-readable program in the memory to implement the method of the present invention or at least part of the steps of the method, it can be considered as an electronic device covered by the present invention.

[0155] Figure 3 Schematic diagram of a computer readable recording medium according to an embodiment of the present invention. Figure 3 As shown, a computer executable program is stored in a computer-readable recording medium, and when the computer executable program is executed, a Go language dependent package security vulnerability protection method based on a DevOps platform according to an embodiment of the present invention is implemented. The computer-readable recording medium may include a data signal propagated in a baseband or as part of a carrier, which carries a readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable recording medium may also be any readable medium other than a readable recording medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, device, or device. The program code contained on the readable recording medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0156] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0157] Through the above description of the implementation mode, it is easy for those skilled in the art to understand that the present invention can be implemented by hardware capable of executing a specific computer program, such as the system of the present invention, and the electronic processing unit, server, client, mobile phone, control unit, processor, etc. contained in the system. The present invention can also be implemented by computer software that executes the method of the present invention, such as control software executed by a microprocessor, an electronic control unit, a client, a server, etc. However, it should be noted that the computer software that executes the method of the present invention is not limited to being executed by one or a specific hardware entity, and it can also be implemented in a distributed manner by unspecified specific hardware. For computer software, the software product can be stored in a computer-readable recording medium (which can be a CD-ROM, a USB flash drive, a mobile disk, etc.), and can also be distributed and stored on the network, as long as it enables the electronic device to execute the method according to the present invention.

[0158] The above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Although the present invention has been described in detail with reference to the above embodiments, the present invention is not limited to the above specific implementation methods. Therefore, any modification or equivalent replacement of the present invention; and all technical solutions and improvements thereof that do not depart from the spirit and scope of the invention are included in the scope of the claims of the present invention.

Claims

1. A Go language dependency package security vulnerability protection method based on a DevOps platform, characterized in that: include: receiving initial software code submissions; Automatically analyze the submitted initial software code based on the Go source code analyzer, identify the go.mod file, read the go.mod file, and obtain all the Go language dependency packages and their version numbers that the initial software code depends on; Check whether there are security vulnerabilities based on the version numbers of each Go language dependency package. If so, repair and replace the Go language dependency package with the security vulnerability, obtain the repair software code, and resubmit it.

2. According to a DevOps platform-based Go language dependency package security vulnerability protection method according to claim 1, it is characterized in that: The querying of whether there is a security vulnerability based on the version number of each Go language dependency package includes: Submit all Go language dependency packages and their version numbers that the acquired software code depends on to the vulnerability management platform; The vulnerability management and control platform has a version number database of Go language dependency packages with security vulnerabilities; The vulnerability control platform performs a query and match in a database of Go language dependency packages with security vulnerabilities based on the version number of the Go language dependency package on which the submitted software code depends to determine whether there is a security vulnerability; If the match is successful, there is a security vulnerability; if the match is unsuccessful, there is no security vulnerability.

3. According to a DevOps platform-based Go language dependency package security vulnerability protection method according to claim 1, it is characterized in that: If it exists, the Go language dependency package with the security vulnerability is repaired and replaced, and the repair software code obtained includes: The vulnerability management and control platform has a Go language dependency package repair version number database corresponding to the version number of the Go language dependency package with security vulnerabilities; If a security vulnerability is found according to the version number query of the Go language dependency package, the Go language dependency package repair version number database will select the corresponding Go language dependency package repair version number for automatic replacement to obtain the repair software code.

4. According to a DevOps platform-based Go language dependency package security vulnerability protection method according to claim 3, it is characterized in that: The selecting the corresponding Go language dependency package repair version number from the Go language dependency package repair version number database for automatic replacement includes: When a version number of a Go language dependency package with a security vulnerability corresponds to multiple Go language dependency package repair version numbers, a Go language dependency package repair version number close to the version number of the Go language dependency package with a security vulnerability is selected for automatic replacement; Optionally, a repaired version number of a Go language dependency package that is close to and lower than the version number of the Go language dependency package with the security vulnerability is selected for automatic replacement.

5. According to a DevOps platform-based Go language dependency package security vulnerability protection method according to claim 3, it is characterized in that: The selecting the corresponding Go language dependency package repair version number from the Go language dependency package repair version number database for automatic replacement includes: When a Go language dependency package version number having a security vulnerability does not have a corresponding Go language dependency package repair version number, a prompt is generated that the Go language dependency package on which the software code depends has a security vulnerability, prompting the R&D personnel to manually repair the security vulnerability of the Go language dependency package.

6. According to a DevOps platform-based Go language dependency package security vulnerability protection method according to claim 5, it is characterized in that: include: Resubmit the repair software code of the Go language dependency package manually repaired by the R&D staff; When the repaired software code passes the Go language dependency package security vulnerability detection, the version number of the Go language dependency package manually repaired by the R&D personnel is added to the Go language dependency package repair version number database, and the Go language dependency package manually repaired by the R&D personnel is added to the Go language dependency package database of the vulnerability management and control platform.

7. According to a DevOps platform-based Go language dependency package security vulnerability protection method according to claim 1, it is characterized in that: include: Repair and replace the repair software code of the Go language dependency package with security vulnerabilities, and resubmit it for compilation; If the compilation fails, the developer is prompted that the cause of the compilation failure may be a compatibility issue caused by the replacement of the Go language dependency package version. At the same time, the version number replacement record of the Go language dependency package on which the software code depends is sent to the developer for manual repair; If the compilation passes, the unit testing phase of the software code begins.

8. According to a DevOps platform-based Go language dependency package security vulnerability protection method according to claim 7, it is characterized in that: The unit testing phase includes: Receive successfully compiled software code, execute the go test command, and perform unit tests to verify the functionality and stability of the code; If the test passes, when the software code performs a Go language dependency package security vulnerability repair and replacement, the developer is prompted that the Go language dependency package of the initial software code has a security vulnerability problem and has been automatically repaired and replaced or manually repaired and replaced by the developer; If the test fails, compilation is blocked and the developer is prompted that the Go language dependency package on which the current software code depends has a security vulnerability. The developer needs to manually change the code to a secure version and resubmit the repaired software code.

9. A Go language dependency package security vulnerability protection system based on a DevOps platform, characterized in that: include: A software code receiving module receives the submitted initial software code; Go language dependency package analysis module, which automatically analyzes the submitted initial software code based on the Go source code analyzer, identifies the go.mod file, reads the go.mod file, and obtains all Go language dependency packages and their version numbers that the initial software code depends on; The Go language dependency package vulnerability repair module queries whether there are security vulnerabilities based on the version numbers of each Go language dependency package. If so, the Go language dependency package with the security vulnerability is repaired and replaced to obtain the repair software code and resubmit it.

10. A computer-readable recording medium storing a computer-executable program, characterized in that: When the computer executable program is executed, a Go language dependency package security vulnerability protection method based on a DevOps platform as described in any one of claims 1 to 8 is implemented.

Images