Web application file transmission and operation and maintenance auditing system and method and medium

Abstract

The invention discloses a web application file transmission and operation and maintenance auditing system and method and a medium, the system comprises a web interface transmission module and a user input and output control module, the web interface transmission module is used for using rrweb recording and playing to carry out attribute rewriting and serialization on a DOM (Document Object Model) of a headless browser web page and a state of the DOM into a specific format, and the user input and output control module is used for carrying out user input and output control on the DOM. Transmitting to a user browser, and restoring the page in the user browser; the user input and output control module comprises a mouse and keyboard input module and a file uploading and downloading module, the mouse and keyboard input module is used for increasing event monitoring for all elements through js and transmitting the event monitoring to the bastion host server side through websocket, and simulation operation is conducted in a headless browser through a CDP protocol in agent service; and the file uploading and downloading module is used for bridging file read-write to an http request sent by a user browser through a user-defined file system based on the agent module. According to the invention, only the web page content is transmitted, so that the user cannot access the file system of the server through the browser, and the safety performance is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of operation and maintenance auditing, and specifically relates to a file transmission and operation and maintenance auditing system, method and medium for web applications. Background Art

[0002] The existing web application operation and maintenance technology uses RDP technology to output the application interface of the remote application center browser and render the browser interface on the user side through the RDP client. RDP technology is a proprietary protocol developed by Microsoft that supports multi-channel transmission and can transmit screen information, keyboard and mouse input, and other device communication data between the client and the server. It is widely used for remote fault diagnosis, management tasks, and access to resources, allowing users to work as if they were on-site. It is necessary to purchase an RDS license for use.

[0003] like Figure 1 As shown in the figure, in the existing operation and maintenance audit system, when operating and maintaining web applications, a chromium browser is generally deployed on the remote application center, and the browser interface and reverse control operations are transmitted using the RDP protocol. The RDP protocol is a remote desktop protocol, which belongs to the server / client architecture. The remote application center is used as the server, and the usage scenario is remote screen information transmission. During operation and maintenance, RDP only uses the browser as a session of an ordinary application, and can only provide some general control strategies, and cannot provide customized access control strategies for specific applications. The user side uses a specific application (remote desktop link (windows), MICROSOFT REMOTE DESKTOP (MacOS)) to access, and uses RemoteApp to achieve a usage effect similar to that of local applications. Usually, in order to lower the threshold for client use, guacamole is used as the js client, and users can access it through the browser.

[0004] Specifically, when a user uses an input method to input, the input method of the remote application center will be called, and the input method program needs to be installed and deployed during deployment; when the web application operation and maintenance uses an application browser or input program to provide the function of accessing the file system, the user can open the file system through the program, thereby accessing the file system of the remote application center, which has certain security issues. When it comes to file uploading and downloading, the access is also to the file system of the remote server. Users cannot directly save files to their own computers, which is not a good user experience. At present, the main defects of remote browser technology are as follows: ① Chrome DevTools technology, which transmits web page data back by taking screenshots of web pages. Image transmission consumes too much network resources, and does not implement file upload and download functions.

[0005] ② The Chromium rendering sequence used by CloudFlar uses a custom-developed Chromium program on the server to output rendering instructions, and uses Wasm on the user side to replay the rendering sequence. The entire process is difficult to develop.

[0006] In summary, the existing operation and maintenance audit system usually uses the remoteApp+browser control method of the Windows platform to implement operation and maintenance audit of web applications, and the audit usually uses the RDP screen to play back; while the Linux platform uses the VNC method. The solutions of these two different platforms mainly have the following problems: 1. Security: Since the browser actually runs on the remote end and transmits the program interface back to the user side through the rdp / vnc protocol, the user can access the disk of the remote machine through the browser's built-in functions (open files, open download folders, upload and download functions, etc.), which poses certain security risks; 2. Deployment cost: Windows RDP requires the purchase of an RDS license. RDP / VNC is a complex universal protocol that requires a specific client to access and support. Since the browser runs on the remote end, users will use input methods when accessing web applications, and the corresponding input methods need to be installed on the remote end for the users. 3. Access control granularity issue: The RDP protocol is not developed for specific applications and cannot provide access control. The tab events currently provided by the browser only support policy control in the access address dimension and cannot provide more fine-grained control over page content. Summary of the invention

[0007] The purpose of the present invention is to provide a file transmission and operation and maintenance audit system, method and medium for web applications, aiming to solve the above-mentioned problems.

[0008] The present invention is mainly achieved through the following technical solutions: A file transmission and operation and maintenance audit system for web applications, including a web interface transmission module and a user input and output control module; The web interface transmission module is used to use rrweb's recording and playback to rewrite the attributes of the DOM and its state of the headless browser web page and serialize them into a specific format, and transmit them to the user's browser. The user's browser uses the data to rebuild the DOM and restore the page; The user input and output control module includes a mouse and keyboard input module and a file upload and download module. The mouse and keyboard input module is used to add event monitoring to all elements through js, serialize the event data, and transmit it back to the bastion server through websocket, and simulate the operation in the headless browser through the CDP protocol in the agent service; the file upload and download module is used to bridge the file reading and writing to the http request issued by the user browser based on the agent module through a custom file system.

[0009] In order to better realize the present invention, further, it also includes a web rendering module set in the user browser; the web interface transmission module includes an agent module, a gateway module and a headless browser set in the bastion host; the agent module is connected to the headless browser, and is used to control the headless browser through the CDP protocol, open the user access page, inject the page based on the js script developed and recorded by rrweb, and modify the page web request; the agent module is connected to the fuse custom file system, and is used to combine the CDP protocol in the agent module, specify the upload and download operations to the file of the file system, and transmit the data directly to the user browser; the gateway module is respectively connected to the agent module, the web rendering module, the mouse and keyboard input module and the file upload and download module, and the gateway module is used to obtain all data of web application operation and maintenance through the agent module; the web rendering module is used to rebuild the DOM using the rrweb recorded data and restore the page in the user browser.

[0010] In order to better implement the present invention, further, the gateway module includes a recording forwarding unit and a control forwarding unit, the recording forwarding unit is respectively connected to the web rendering module and the agent module, and the control forwarding unit is respectively connected to the mouse and keyboard input module, the file upload and download module and the agent module; the recording forwarding unit is used to use rrweb's recording and playback, rewrite the attributes of the DOM and its state of the headless browser web page and serialize them into a specific format, obtain the rrweb recording data and transmit it to the web rendering module.

[0011] The present invention is mainly achieved through the following technical solutions: A file transfer and operation and maintenance audit method for a web application is based on the above-mentioned file operation and maintenance audit system for the web application, and includes the following steps: Step S1: Use a headless browser on the bastion server to provide a remote browser environment, and control the headless browser through the CDP protocol to implement network request filtering and operation interaction; Step S2: On the bastion server, the file operations of the web application are converted into local file operations through the fuse custom file system; in the agent module, the cdp protocol is combined to specify the upload and download operations to the files of the custom file system to transmit the data directly to the user browser; Step S3: Monitor the event data of the user browser and transmit it back to the bastion host through websocket, simulate the operation in the headless browser through the CDP protocol, and return the rrweb recording data of the simulated operation to the user browser; the user browser uses the rrweb recording data, based on the recording and playback of the web page, to restore the page in the user browser to complete the remote access of the web interface.

[0012] In order to better implement the present invention, further, the operation and maintenance of the web application includes the following steps: Step A1: The user browser initiates http application operation and maintenance to the agent module through the gateway module, and the agent module starts a headless browser; Step A2: The agent module uses the CDP protocol to connect to the headless browser, access the address of the http application operation and maintenance, and inject the page recording js; the agent module returns the access address to the user browser through the gateway module; Step A3: The user browser accesses the operation and maintenance page, the gateway module connects to the agent module through websocket, and starts page recording in the headless browser; then, the headless browser transmits the page recording data to the agent module, and the agent module forwards the recording data to the user browser through the gateway module; the web rendering module uses the page recording data for rendering; Step A4: The user performs a click or input operation in the user browser, and the user browser connects to the gateway module through the websocket to forward the operation to the agent module, and the agent module simulates the click or input operation in the headless browser through the CDP protocol.

[0013] In order to better implement the present invention, further, the file downloading of the web application includes the following steps: Step B1: The user's browser clicks to download and uploads the click event to the gateway module to forward it to the agent module; Step B2: the agent module controls the headless browser to perform a click operation, the headless browser triggers a download, the agent module processes the download event, specifies the download file path, and the agent module notifies the user browser to initiate a download request through the gateway module; Step B3: The user browser initiates a download request and forwards it to the agent module through the gateway module; the agent module searches for the corresponding download file, bridges the file write stream to the http response, and forwards it to the user browser through the gateway module.

[0014] In order to better implement the present invention, further, the file uploading of the web application includes the following steps: Step C1: The user's browser clicks upload and uploads the click event to the gateway module to forward it to the agent module; Step C2: the agent module controls the headless browser to perform a click operation, the headless browser triggers an upload event notification to the agent module, the agent module processes the upload event, and sends the processed upload notification to the user browser through the gateway module; Step C3: The user browser displays a file selection box, selects a file, obtains file information, and uploads the file information to the gateway module to forward it to the agent module; the agent module creates a file and sets the upload file path; the headless browser reads the file to the agent module, and the agent module initiates a read request to the gateway module to forward it to the user browser; Step C4: The user browser reads the file and uploads the file content to the gateway module to forward it to the agent module; the agent module parses the returned file content and returns the file content to the headless browser.

[0015] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned file transmission and operation and maintenance audit method of a web application.

[0016] The beneficial effects of the present invention are as follows: (1) The present invention solves the problems of RDS licensing, designated input methods and file system access in the prior art. The present invention does not use the Windows RDP protocol, and the interface transmission and rendering uses the open source rrweb protocol, which does not require the purchase of a license. In the present invention, only web pages are transmitted. When users access the web interface, all operations are performed locally by the user, and the text is input using the user's local input method, and the input text is transmitted to the remote end. In the present invention, only the content of the web page is transmitted, and the user cannot use the browser to open the file function to access the file system of the remote application. When the web page involves file upload and download, the CDP protocol will be used to forward the relevant operations and play them back locally on the user. What is opened is the user's local file system, which is no different from the user directly accessing a page to upload and download.

[0017] (2) The present invention uses rrweb to record and replay web pages. rrweb adopts the MIT open source protocol and does not require the purchase of a license. At the same time, rrweb is a web interface rendered based on a browser. It does not have a browser application window interface, and shields the user's browser operation to access the remote application center file system. The operation entry makes it impossible for the user to access the server's file system through the browser, thereby improving security performance.

[0018] (3) The present invention uses the CDP protocol to specify file upload and download to the custom file system mounted by the agent, and then triggers the file upload and download operations in the user's browser through event feedback to operate the user's local files. During the whole process, the user cannot perceive the existence of the remote application center. rrweb also uses js interface rendering on the web on the user side, so that users only need a browser to use it, without the need to install other dedicated clients. The user's operations are triggered in the local browser and then transmitted back to the bastion server. When processing text input, the user uses local input to complete the input result before it is transmitted to the browser of the bastion server. In this way, there is no need to install the input method on the bastion server, avoiding other security issues caused by invoking the input method. rrweb supports the use of js's jquery selector to shield some elements in the web page. During operation and audit, the page elements can be accurately shielded and desensitized to avoid the risk of privacy leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a structural diagram of the existing operation and maintenance audit system; Figure 2 It is a schematic diagram of the overall structure of the file operation and maintenance audit system of the web application of the present invention; Figure 3 This is an operation and maintenance flow chart of the web application of the present invention; Figure 4 A flowchart of file downloading for a web application of the present invention; Figure 5 The flowchart of file uploading of the web application of the present invention. DETAILED DESCRIPTION

[0020] Embodiment 1: A file transfer and operation and maintenance audit system for web applications, such as Figure 1 and Figure 2 As shown, the present invention does not rely on independent application center deployment, and the file operation and maintenance audit system mainly includes a web interface transmission module and a user input and output control module.

[0021] The web interface transmission module: uses rrweb's recording and playback to rewrite and serialize the DOM and its state of the headless browser web page into a specific format, and transmits it to the user's browser. The user's browser uses the data to rebuild the DOM and restore the page; The user input and output control module mainly includes the mouse and keyboard input module and the file upload and download module. The mouse and keyboard input module uses js to add event monitoring to all elements, serializes the event data, and transmits it back to the bastion server through websocket. In the agent service, the CDP protocol is used to simulate the operation in the headless browser. The file upload and download module uses the fuse custom file system to bridge the file reading and writing to the http request issued by the user browser. In the entire process, there is no need to use the storage space of the bastion server to dump the uploaded and downloaded files.

[0022] Preferably, if Figure 1 As shown in the figure, an agent module is added to the bastion server. The agent module is mainly responsible for providing control of the headless browser through the CDP protocol: opening the user access page, injecting the js script recorded by rrweb development into the page, and modifying the page web request. Use the fuse custom file system on the bastion server: combine the cdp protocol in the agent module, specify the upload and download operations to the files of the custom file system, and transmit the data directly to the user browser. The gateway module obtains all the data of web application operation and maintenance through the agent module. At the same time, the gateway module stores the operation and maintenance data in the audit data storage module according to the custom audit rules.

[0023] The present invention does not use the Windows RDP protocol, and the interface transmission and rendering uses the open source rrweb protocol, which does not require the purchase of a license. In the present invention, only web pages are transmitted. When users access the web interface, all operations are performed locally by the user, and the text is input using the user's local input method, and the input text is transmitted to the remote end. In the present invention, only the content of the web page is transmitted, and the user cannot use the browser to open the file function to access the file system of the remote application. When the web page involves file upload and download, the CDP protocol will be used to forward the relevant operations and play them back locally on the user. What is opened is the user's local file system, which is no different from the user directly accessing a page for upload and download.

[0024] Embodiment 2: A file transfer and operation and maintenance audit method for web applications. The chromium headless browser is used to provide a remote browser environment. The browser is controlled by the CDP protocol to implement network request filtering and operation interaction. The custom file system is implemented through FUSE to convert the file operations of web applications into local file operations. rrweb is used to complete remote access to the web interface based on web page recording and playback.

[0025] like Figure 3 As shown, the operation and maintenance of web applications includes the following steps: Step A1: The user browser initiates http application operation and maintenance to the agent module through the gateway module, and the agent module starts a headless browser; Step A2: The agent module uses the CDP protocol to connect to the headless browser, access the address of the http application operation and maintenance, and inject the page recording js; the agent module returns the access address to the user browser through the gateway module; Step A3: The user browser accesses the operation and maintenance page, the gateway module connects to the agent module through websocket, and starts page recording in the headless browser; then, the headless browser transmits the page recording data to the agent module, and the agent module forwards the recording data to the user browser through the gateway module; the web rendering module uses the page recording data for rendering; Step A4: The user performs a click or input operation in the user browser, and the user browser connects to the gateway module through the websocket to forward the operation to the agent module, and the agent module simulates the click or input operation in the headless browser through the CDP protocol.

[0026] like Figure 4 As shown, the file download of the web application includes the following steps: Step B1: The user's browser clicks to download and uploads the click event to the gateway module to forward it to the agent module; Step B2: the agent module controls the headless browser to perform a click operation, the headless browser triggers a download, the agent module processes the download event, specifies the download file path, and the agent module notifies the user browser to initiate a download request through the gateway module; Step B3: The user browser initiates a download request and forwards it to the agent module through the gateway module; the agent module searches for the corresponding download file, bridges the file write stream to the http response, and forwards it to the user browser through the gateway module.

[0027] like Figure 5 As shown, the file upload of the web application includes the following steps: Step C1: The user's browser clicks upload and uploads the click event to the gateway module to forward it to the agent module; Step C2: the agent module controls the headless browser to perform a click operation, the headless browser triggers an upload event notification to the agent module, the agent module processes the upload event, and sends the processed upload notification to the user browser through the gateway module; Step C3: The user browser displays a file selection box, selects a file, obtains file information, and uploads the file information to the gateway module to forward it to the agent module; the agent module creates a file and sets the upload file path; the headless browser reads the file to the agent module, and the agent module initiates a read request to the gateway module to forward it to the user browser; Step C4: The user browser reads the file and uploads the file content to the gateway module to forward it to the agent module; the agent module parses the returned file content and returns the file content to the headless browser.

[0028] The present invention uses the CDP protocol to specify file upload and download to the custom file system mounted by the agent, and then triggers the file upload and download operations in the user's browser through event feedback, operates the user's local files, and the user cannot perceive the existence of the remote application center during the whole process. rrweb also uses js interface rendering on the web on the user side, so that users only need a browser to use it, without the need to install other special clients. The user's operations are all triggered in the local browser and then transmitted back to the bastion server. When processing text input, the user uses local input to complete the input result before it is transmitted to the browser of the bastion server. In this way, there is no need to install the input method on the bastion server, avoiding other security issues caused by invoking the input method. rrweb supports the use of js's jquery selector to shield some elements in the web page. During operation and audit, the page elements can be accurately shielded and desensitized to avoid the risk of privacy leakage.

[0029] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A file transfer and operation and maintenance audit system for web applications, characterized in that: It includes a web interface transmission module and a user input and output control module; The web interface transmission module is used to use rrweb's recording and playback to rewrite the attributes of the DOM and its state of the headless browser web page and serialize them into a specific format, and transmit them to the user's browser. The user's browser uses the data to rebuild the DOM and restore the page; The user input and output control module includes a mouse and keyboard input module and a file upload and download module. The mouse and keyboard input module is used to add event monitoring to all elements through js, serialize the event data, and transmit it back to the bastion server through websocket, and simulate the operation in the headless browser through the CDP protocol in the agent service; the file upload and download module is used to bridge the file reading and writing to the http request issued by the user browser based on the agent module through a custom file system.

2. A web application file transfer and operation and maintenance audit system according to claim 1, characterized in that: It also includes a web rendering module set in the user browser; the web interface transmission module includes an agent module, a gateway module and a headless browser set in the bastion host; the agent module is connected to the headless browser, and is used to control the headless browser through the CDP protocol, open the user access page, inject the page based on the js script developed and recorded by rrweb, and modify the page web request; the agent module is connected to the fuse custom file system, and is used to combine the CDP protocol in the agent module, specify the upload and download operations to the file of the file system, and transmit the data directly to the user browser; the gateway module is respectively connected to the agent module, the web rendering module, the mouse and keyboard input module and the file upload and download module, and the gateway module is used to obtain all data of web application operation and maintenance through the agent module; the web rendering module is used to rebuild the DOM using the rrweb recorded data and restore the page in the user browser.

3. A web application file transfer and operation and maintenance audit system according to claim 2, characterized in that: The gateway module includes a recording forwarding unit and a control forwarding unit, the recording forwarding unit is connected to the web rendering module and the agent module respectively, and the control forwarding unit is connected to the mouse and keyboard input module, the file upload and download module and the agent module respectively; the recording forwarding unit is used to use rrweb's recording and playback to rewrite and serialize the DOM and its status of the headless browser web page into a specific format, obtain the rrweb recording data and transmit it to the web rendering module.

4. A method for file transfer and operation and maintenance audit of a web application, based on the file operation and maintenance audit system of a web application according to any one of claims 1 to 3, characterized in that: The following steps are involved: Step S1: Use a headless browser on the bastion server to provide a remote browser environment, and control the headless browser through the CDP protocol to implement network request filtering and operation interaction; Step S2: On the bastion server, the file operations of the web application are converted into local file operations through the fuse custom file system; in the agent module, the cdp protocol is combined to specify the upload and download operations to the files of the custom file system to transmit the data directly to the user browser; Step S3: Monitor the event data of the user browser and transmit it back to the bastion host through websocket, simulate the operation in the headless browser through the CDP protocol, and return the rrweb recording data of the simulated operation to the user browser; the user browser uses the rrweb recording data, based on the recording and playback of the web page, to restore the page in the user browser to complete the remote access of the web interface.

5. A method for file transmission and operation and maintenance audit of a web application according to claim 4, characterized in that: The operation and maintenance of web applications includes the following steps: Step A1: The user browser initiates http application operation and maintenance to the agent module through the gateway module, and the agent module starts a headless browser; Step A2: The agent module uses the CDP protocol to connect to the headless browser, access the address of the http application operation and maintenance, and inject the page recording js; the agent module returns the access address to the user browser through the gateway module; Step A3: The user browser accesses the operation and maintenance page, the gateway module connects to the agent module through websocket, and starts page recording in the headless browser; then, the headless browser transmits the page recording data to the agent module, and the agent module forwards the recording data to the user browser through the gateway module; the web rendering module uses the page recording data for rendering; Step A4: The user performs a click or input operation in the user browser, and the user browser connects to the gateway module through the websocket to forward the operation to the agent module, and the agent module simulates the click or input operation in the headless browser through the CDP protocol.

6. A method for file transmission and operation and maintenance audit of a web application according to claim 4, characterized in that: Downloading a file from a web application consists of the following steps: Step B1: The user's browser clicks to download and uploads the click event to the gateway module to forward it to the agent module; Step B2: the agent module controls the headless browser to perform a click operation, the headless browser triggers a download, the agent module processes the download event, specifies the download file path, and the agent module notifies the user browser to initiate a download request through the gateway module; Step B3: The user browser initiates a download request and forwards it to the agent module through the gateway module; the agent module searches for the corresponding download file, bridges the file write stream to the http response, and forwards it to the user browser through the gateway module.

7. A method for file transmission and operation and maintenance audit of a web application according to claim 4, characterized in that: File upload for web applications includes the following steps: Step C1: The user's browser clicks upload and uploads the click event to the gateway module to forward it to the agent module; Step C2: the agent module controls the headless browser to perform a click operation, the headless browser triggers an upload event notification to the agent module, the agent module processes the upload event, and sends the processed upload notification to the user browser through the gateway module; Step C3: The user browser displays a file selection box, selects a file, obtains file information, and uploads the file information to the gateway module to forward it to the agent module; the agent module creates a file and sets the upload file path; the headless browser reads the file to the agent module, and the agent module initiates a read request to the gateway module to forward it to the user browser; Step C4: The user browser reads the file and uploads the file content to the gateway module to forward it to the agent module; the agent module parses the returned file content and returns the file content to the headless browser.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the file transmission and operation and maintenance audit method of the web application described in any one of claims 4 to 7 is implemented.

Images