Code auditing method, storage medium, electronic equipment and product

Abstract

The invention relates to the technical field of code security, and particularly provides a code auditing method, a storage medium, electronic equipment and a product, and the method comprises the steps: auditing a source code in to-be-audited code information when it is confirmed that the to-be-audited code information submitted this time needs to be audited, and obtaining a first auditing result; the current revised version number in the code information to be audited is compared with a revised version corresponding to a preset revised version number, difference data is generated, and the difference data comprises a difference code containing the first audit result, a patch file and a routing address; obtaining a second audit result after the difference data is artificially audited; and generating a code auditing report of the to-be-audited code information at least based on the first auditing result and the second auditing result. Some embodiments of the application can improve the efficiency and quality of code auditing.

Description

Technical Field

[0001] The present application relates to the field of code security technology, and in particular to a code auditing method, storage medium, electronic device and product. Background Art

[0002] With the rapid development of software development technology, the scale and complexity of software are increasing. In this context, the quality and security of source code are particularly important in the process of software development and maintenance. Although development teams generally follow certain coding standards, if there is no systematic code review process, the consistency and quality of the code will gradually decline over time.

[0003] At present, in the scheme of code audit, source code audit is usually conducted on the basis of two consecutively released code versions. However, due to the long time span and wide range of source code changes, the amount of new or modified code that auditors need to deal with has increased significantly, which has significantly increased the workload of a single audit. And after the source code audit is completed, a large number of problems are distributed in multiple modules or functions, making the modification and verification process of the problems more complicated and time-consuming, extending the modification cycle, and thus increasing the maintenance cost of the project.

[0004] Therefore, how to provide a technical solution for an efficient code auditing method has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The purpose of some embodiments of the present application is to provide a code auditing method, storage medium, electronic device and product. The technical solutions of the embodiments of the present application can improve the efficiency and quality of source code auditing, and reduce maintenance costs and the workload of manual auditing.

[0006] In a first aspect, some embodiments of the present application provide a code auditing method, comprising: when confirming that the code information to be audited submitted this time needs to be audited, auditing the source code in the code information to be audited to obtain a first audit result; comparing the current revision number in the code information to be audited with the revision corresponding to the preset revision number to generate difference data, wherein the difference data includes: difference code, patch file and routing address containing the first audit result; obtaining a second audit result after the difference data is manually audited; and generating a code audit report for the code information to be audited based at least on the first audit result and the second audit result.

[0007] Some embodiments of the present application audit the source code to obtain a first audit result by confirming that the code information to be audited needs to be audited, then determine the difference data between the current revision number and the preset revision number and perform a manual audit to obtain a second audit result, and finally generate a code audit report based on at least the first audit result and the second audit result. Some embodiments of the present application can realize automatic audit of source code, improve the efficiency of source code audit, and at the same time compare the code between the current revision number and any preset revision number, which can expand the audit scope, improve the quality of code audit, and timely discover potential vulnerabilities in the code.

[0008] In some embodiments, the confirmation that the code information to be audited submitted this time needs to be audited includes: confirming that the code information to be audited does not contain a review request mark; or confirming that the code information to be audited does not contain an unpublished mark.

[0009] Some embodiments of the present application determine whether the code information to be audited needs to be audited by whether it contains a review request identifier and the type of the review request identifier, which can achieve intelligent judgment on whether to audit with high efficiency.

[0010] In some embodiments, before confirming that the code information to be audited submitted this time needs to be audited, the method further includes: adding the review request identifier to the description information of the code to be audited to obtain the code information to be audited; wherein the review request identifier includes: the unpublished identifier, the revised version identifier and the updated version identifier; or, not adding the review request identifier to the description information of the code to be audited, wherein not adding the review request identifier indicates that the preset revision number is the previous revision number corresponding to the current revision number.

[0011] Some embodiments of the present application can achieve accurate processing of subsequent code audits by adding a review request identifier to the code to be audited or obtaining the code information to be audited by default without adding it.

[0012] In some embodiments, auditing the source code in the code information to be audited to obtain the first audit result includes: determining a code rule library based on the type of the source code; and automatically auditing the source code using the code rule library to generate the first audit result.

[0013] Some embodiments of the present application implement automatic auditing of source code after determining a code rule base based on the type of source code, thereby improving the auditing efficiency and auditing quality of source code.

[0014] In some embodiments, obtaining the second audit result after the difference data is manually audited includes: using the routing address to view the difference data; and obtaining the second audit result in response to the operating instructions of the reviewer.

[0015] Some embodiments of the present application obtain a second audit result by performing a manual audit after checking the difference data, which can solve the problem of duplication of manual audit work in the audit process and improve audit efficiency.

[0016] In some embodiments, before generating a code audit report for the code information to be audited based at least on the first audit result and the second audit result, the method further includes: when confirming a static detection analysis of the entire project source code corresponding to any revision number, selecting a target source code corresponding to the arbitrary revision number, wherein the arbitrary revision number includes the current revision number; and performing static code analysis on the target source code to generate a third audit result.

[0017] Some embodiments of the present application obtain the third audit result by performing static detection and analysis on the entire project source code, which can timely discover low-performance, logically complex code blocks and potential code vulnerabilities in the entire project source code and improve the quality of code auditing.

[0018] In some embodiments, the code audit report includes a single code audit report and a project code audit report.

[0019] Some embodiments of the present application can generate single code audit reports and project code audit reports, and have a wide range of applications.

[0020] In some embodiments, the code audit report of the code information to be audited is generated based at least on the first audit result and the second audit result, including: generating the single code audit report based on the first audit result and the second audit result; or generating the project code audit report of the entire project source code based on the first audit result, the second audit result and the third audit result.

[0021] Some embodiments of the present application generate a single code audit report through the first audit result and the second audit result, or generate a project code audit report through the first audit result, the second audit result and the third audit result, thereby improving the entire code audit process and having a wide range of applications.

[0022] In a second aspect, some embodiments of the present application provide a code auditing device, comprising: a first auditing module, for confirming that the code information to be audited submitted this time needs to be audited, and then auditing the source code in the code information to be audited to obtain a first audit result; a comparison module, for comparing the current revision number in the code information to be audited with the revision corresponding to the preset revision number, and generating difference data, wherein the difference data includes: difference code, patch file and routing address containing the first audit result; a second audit module, for obtaining a second audit result after the difference data is manually audited; an audit report generation module, for generating a code audit report for the code information to be audited based at least on the first audit result and the second audit result.

[0023] In a third aspect, some embodiments of the present application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the method described in any embodiment of the first aspect.

[0024] In a fourth aspect, some embodiments of the present application provide an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor can implement a method as described in any embodiment of the first aspect when executing the program.

[0025] In a fifth aspect, some embodiments of the present application provide a computer program product, wherein the computer program product comprises a computer program, wherein the computer program, when executed by a processor, can implement the method described in any embodiment of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of some embodiments of the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0027] Figure 1 A system diagram of a code audit provided for some embodiments of the present application;

[0028] Figure 2 One of the flowcharts of the code audit method provided for some embodiments of the present application;

[0029] Figure 3 A second flowchart of a method for code auditing provided for some embodiments of the present application;

[0030] Figure 4A block diagram of a code auditing device provided in some embodiments of the present application;

[0031] Figure 5 A schematic diagram of an electronic device is provided for some embodiments of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in some embodiments of the present application will be described below in conjunction with the drawings in some embodiments of the present application.

[0033] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0034] In the related art, although the scale of software continues to expand, the phenomenon of diversified code styles and uneven quality is difficult to avoid, and the security risks and vulnerabilities in the code may be exploited by malicious attackers, causing serious data leakage or service interruption. In the current existing scheme, when conducting code audits, the difference code or file between the latest version and the previous version of the project to be audited is obtained from the source code repository of the project, and then the auditor conducts manual audits on this difference code or file, so as to achieve the purpose of reducing workload and improving code audit efficiency. However, due to the long time span and the wide range of source code changes, the amount of new or modified code that auditors need to deal with has increased significantly, which significantly increases the workload of a single audit. When conducting code audits, some unified and standardized code audit issues still need to be reviewed manually, which will lead to duplication of auditors' work and fail to improve audit efficiency. In addition, the current scheme only conducts code audits of the difference code or files of the project version, and does not perform overall static or dynamic code defect detection on the source code of the entire project. It is difficult to find some hidden code vulnerabilities, resulting in some potential security issues in the source code.

[0035] It can be seen from the above-mentioned related technologies that the existing technologies have problems of low efficiency and poor quality in the process of code auditing.

[0036] In view of this, some embodiments of the present application provide a code auditing method, in which the code information to be audited can be audited twice, once through the code rule library to audit the source code, and once through manual audit to compare the difference data; after that, the entire project source code can be statically audited to obtain a third audit result. Auditing through the above three methods can ultimately generate a single code audit report or a project code audit report. Some embodiments of the present application can improve the efficiency of code auditing, solve the problem of repeated work in manual auditing, improve the process of the entire project code audit, improve the quality of code auditing, and can promptly discover low-performance, logically complex code blocks and potential code vulnerabilities, thereby improving code security.

[0037] The following is combined with Figure 1 The overall composition structure of the code auditing system provided by some embodiments of the present application is exemplified.

[0038] like Figure 1 As shown, some embodiments of the present application provide a system for code auditing, which may include: a terminal 100 and an audit server 200. A user may fill in the completed code information to be audited on the version control system (svn or git) of the terminal 100. After receiving the code information to be audited, the audit server 200 automatically audits the source code of the submitted code information to be audited for some unified and standardized code auditing problems by introducing a custom code rule library (referred to as the rule library) to obtain a first audit result; then generates a diff, patch file (as a specific example of the difference code and patch file) and web routing address containing the difference between the current revision number of the code submitted this time and the revision version of any submitted code in the selected historical record (as a specific example of the preset revision number), and then obtains the second audit result by manual audit. At the same time, the target source code of the entire project corresponding to any historical revision number (as a specific example of any revision number) can be selected later to perform overall static detection to obtain a third audit result. Finally, a single code audit report or a project code audit report can be generated in a targeted manner.

[0039] In some embodiments of the present application, the terminal 100 may be a mobile terminal or a non-portable computer terminal, which is not specifically limited in the embodiments of the present application.

[0040] The following is combined with Figure 2 The implementation process of code auditing performed by the audit server 200 provided in some embodiments of the present application is exemplified.

[0041] Please see attached Figure 2 , Figure 2A flowchart of a code audit method provided for some embodiments of the present application, the code audit method may include:

[0042] S210: When it is confirmed that the code information to be audited submitted this time needs to be audited, the source code in the code information to be audited is audited to obtain a first audit result.

[0043] For example, in some embodiments of the present application, after the code information to be audited is submitted through the version database, it is determined that the code information to be audited this time needs to be audited, and then the source code in the code information to be audited is automatically audited to obtain audit result 1 (as a specific example of the first audit result). If it is confirmed that the code information to be audited this time does not need to be audited, the current process ends.

[0044] In some embodiments of the present application, before executing S210, the code audit method may further include: adding the review request identifier to the description information of the code to be audited to obtain the code information to be audited; wherein the review request identifier includes: the unpublished identifier, the revised version identifier and the updated version identifier; or, not adding the review request identifier to the description information of the code to be audited, wherein not adding the review request identifier indicates that the preset revision number is the previous revision number corresponding to the current revision number.

[0045] For example, in some embodiments of the present application, before submitting the code in the version control system, fill in the submission information in the prescribed format to obtain the code information to be audited. Specifically, after adding the descriptive information related to the code to be audited, add the specified review request identification mark (as a specific example of the review request identification mark) in the last line. Among them, the review request identification mark includes at least the following:

[0046] To set the code information submitted this time (that is, the code information to be audited) not to generate a review request, you only need to add the notPublish mark (as a specific example of the unpublished mark) in the last line of the description information, then this code submission will not be reviewed (or audited).

[0047] To set the submission of this code to generate a review request and compare the difference with the specified historical revision (as a specific example of the preset revision number), you only need to add the revision: num (num represents the generated revision number) identifier (as a specific example of the revision identifier) ​​in the last line of the description information.

[0048] To set this code submission to update a specified review request, you only need to add the update review:id after revision:num (id represents the generated review request id, num represents the generated revision number) identifier in the last line of the description information (as a specific example of an update version identifier).

[0049] To set the default for generating a review request for this code submission and comparing it with the previous revision (as a specific example of a preset revision number), just do not add any valid identifiers in the last line of the description information.

[0050] In some embodiments of the present application, S210 may include: confirming that the code information to be audited does not contain a review request mark; or confirming that the code information to be audited does not contain an unpublished mark.

[0051] For example, in some embodiments of the present application, the description information in the code information to be audited is parsed to determine whether it contains a review request identifier, and if not, an audit is required. If it does, it is necessary to determine which type of the review request identification identifier belongs to, so as to confirm whether to perform the corresponding audit operation.

[0052] In some embodiments of the present application, S210 may include: determining a code rule library based on the type of the source code; and automatically auditing the source code using the code rule library to generate the first audit result.

[0053] For example, in some embodiments of the present application, when it is confirmed that the code information to be audited needs to be audited, by obtaining all the source code paths in the code information to be audited submitted this time, different custom rule libraries (as a specific example of the code rule library) are introduced according to the type of source code file to analyze the source code to be detected, and the first automatic code audit is achieved, and audit result 1 is generated, and audit result 1 is saved in the audit database. Among them, the rule library can be expanded according to the actual application scenario, and the embodiments of the present application are not specifically limited here. By introducing the rule library, automatic auditing of standardized codes can be achieved, reducing the repetitive workload of auditors.

[0054] S220, comparing the current revision number in the code information to be audited with the revision corresponding to the preset revision number to generate difference data, wherein the difference data includes: a difference code containing the first audit result, a patch file and a routing address.

[0055] For example, in some embodiments of the present application, the revision number 1 submitted this time (as a specific example of this revision number) and the revision number 2 to be compared (as a specific example of the preset revision number) are obtained, and by comparing the data in revision number 1 and revision number 2, a diff (as a specific example of the difference code), a patch file (as a specific example of the patch file) and a web routing address are generated and saved in the audit database. Subsequently, the auditor can log in to the web interface of this system and view the review request generated by this code submission through the web routing address.

[0056] S230, obtaining a second audit result after the difference data is manually audited.

[0057] For example, in some embodiments of the present application, the auditor may perform a second manual code audit on the difference code and the newly added patch file, and obtain audit result 2 (as a specific example of the second audit result).

[0058] In some embodiments of the present application, S230 may include: using the routing address to view the difference data; and obtaining the second audit result in response to the operating instruction of the reviewer.

[0059] For example, in some embodiments of the present application, the auditor can log in to the web interface of the system and view a list of all review requests (i.e., relevant information for code auditing). By clicking on the review request generated by this code submission, the auditor can see the difference code and patch files between revision number 1 and revision number 2, as well as the audit result 1 marked at the beginning of the corresponding line of code. After auditing the difference code and patch files, the auditor can enter the corresponding audit result 2 on the terminal 100 so that the audit server 200 can obtain the audit result 2.

[0060] In some embodiments of the present application, before executing S240, the code auditing method may also include: when confirming the static detection and analysis of the entire project source code corresponding to any revision number, selecting the target source code corresponding to the arbitrary revision number, wherein the arbitrary revision number includes the current revision number; performing static code analysis on the target source code to generate a third audit result.

[0061] For example, in some embodiments of the present application, the audit server 200 can also confirm whether to perform static detection analysis on the entire project source code. If necessary, a specified arbitrary revision number can be selected, and a third-party static code audit tool can be used to perform static code analysis on the target source code corresponding to the arbitrary revision number, and generate audit result 3 (as a specific example of the third audit result) and save it to the audit database. For example, the difference between the source code corresponding to the current revision number and the specified historical revision number is compared to obtain audit result 3.

[0062] Among them, any revision version number can be the current revision version number and any specified historical revision version number, and the embodiment of the present application does not make specific limitations here.

[0063] S240: Generate a code audit report for the code information to be audited based at least on the first audit result and the second audit result, wherein the code audit report includes a single code audit report and a project code audit report.

[0064] For example, in some embodiments of the present application, a corresponding code audit report can be generated based on the above-mentioned audit results.

[0065] In some embodiments of the present application, S240 may include: generating the single code audit report based on the first audit result and the second audit result.

[0066] For example, in some embodiments of the present application, a result report of a single review request (as a specific example of a single code audit report) can be generated through the above-mentioned audit result 1 and audit result 2. The result report of the single review request can be exported.

[0067] In some other embodiments of the present application, S240 may include: generating the project code audit report of the entire project source code based on the first audit result, the second audit result, and the third audit result.

[0068] For example, in some other embodiments of the present application, a code audit result report 2 (as a specific example of a project code audit report) for the entire project source code can be generated through the above-mentioned audit result 1, audit result 2, and audit result 3. The code audit result report 2 for the entire project source code can also be exported.

[0069] It is understandable that the type of the code audit report finally generated can be determined according to the actual application scenario, and the embodiment of the present application is not specifically limited here.

[0070] The following is combined with Figure 3 The specific process of code auditing provided by some embodiments of the present application is exemplified.

[0071] Please see attached Figure 3 , Figure 3 A flow chart of a code auditing method provided for some embodiments of the present application.

[0072] The above process is explained below as an example.

[0073] S301, submit the code information to be audited that has been filled in according to the prescribed format in the version control system.

[0074] S302, parse the code information to be audited, and determine whether there is a review request identifier. If so, execute S303, otherwise execute S304.

[0075] S303, judging whether to generate a review request based on the review request identifier, if so, executing S304, otherwise ending.

[0076] The review request means whether to audit the audit code information.

[0077] S304, using a code rule library determined by the type of source code, automatically auditing the source code, generating a first audit result, and saving it to an audit database.

[0078] S305, comparing the current revision number in the code information to be audited with the revision corresponding to the preset revision number, generating a difference code, a patch file and a routing address, and saving them to the audit database.

[0079] S306, using the routing address, checking the difference code and patch file; and responding to the reviewer's operation instruction, obtaining the second audit result and saving it to the audit database.

[0080] S307, determine whether to perform static detection and analysis on the entire project source code corresponding to the current revision number, if so, execute S308, otherwise end.

[0081] S308, use a third-party static code audit tool to perform static detection and analysis on the entire project source code corresponding to the current revision number and the specified historical revision number, obtain a third audit result, and save it to the audit database.

[0082] S309: Generate a code audit report based on the audit results.

[0083] Among them, the audit results can be the above-mentioned first audit results and second audit results, in which case a single code audit report is generated; or the audit results can be the above-mentioned first audit results, second audit results and third audit results, in which case a project code audit report is generated.

[0084] S310, export the code audit report.

[0085] It should be noted that the specific implementation process of S301 to S310 can refer to the method embodiment provided above, and in order to avoid repetition, the detailed description is appropriately omitted here.

[0086] Through some of the embodiments of the present application described above, it can be seen that the present application realizes user customization of whether to conduct code audit for a single code submission through the review request identifier, solving the problem of huge workload of a single manual audit due to a long time span and a wide range of source code changes. In the present application, the content of the rule base can be customized and expanded, so that some standardized code audit problems can be discovered by automatically detecting the submitted source code through scripts, reducing the repetitive work of auditors. Moreover, the present application can also select the entire project source code corresponding to any existing revision number, and perform static code analysis on the entire project source code to discover some hidden code vulnerabilities, thereby improving the security and quality of code audits.

[0087] Please refer to Figure 4 , Figure 4 The following is a block diagram of the composition of the code auditing device provided by some embodiments of the present application. It should be understood that the code auditing device corresponds to the above method embodiment and can execute the various steps involved in the above method embodiment. The specific functions of the code auditing device can be found in the description above. To avoid repetition, the detailed description is appropriately omitted here.

[0088] Figure 4 The code auditing device includes at least one software function module that can be stored in a memory in the form of software or firmware or solidified in the code auditing device, and the code auditing device includes: a first audit module 410, which is used to audit the source code in the code information to be audited when confirming that the code information to be audited submitted this time needs to be audited, and obtain a first audit result; a comparison module 420, which is used to compare the current revision number in the code information to be audited with the revision corresponding to the preset revision number to generate difference data, wherein the difference data includes: difference code, patch file and routing address containing the first audit result; a second audit module 430, which is used to obtain a second audit result after the difference data is manually audited; an audit report generation module 440, which is used to generate a code audit report for the code information to be audited based on at least the first audit result and the second audit result.

[0089] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method, and will not be described in detail here.

[0090] Some embodiments of the present application further provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, can implement the operations of the method corresponding to any of the above methods provided in the above embodiments.

[0091] Some embodiments of the present application further provide a computer program product, which includes a computer program, wherein when the computer program is executed by a processor, it can implement the operations corresponding to any of the above methods provided in the above embodiments.

[0092] like Figure 5 As shown, some embodiments of the present application provide an electronic device 500, which includes: a memory 510, a processor 520, and a computer program stored in the memory 510 and executable on the processor 520, wherein the processor 520 can implement a method as described in any of the above embodiments when reading the program from the memory 510 through a bus 530 and executing the program.

[0093] Processor 520 can process digital signals and can include various computing structures, such as complex instruction set computer structure, reduced instruction set computer structure, or a structure that implements a combination of multiple instruction sets. In some examples, processor 520 can be a microprocessor.

[0094] The memory 510 may be used to store instructions executed by the processor 520 or data related to the execution of instructions. These instructions and / or data may include codes for implementing some or all functions of one or more modules described in the embodiments of the present application. The processor 520 of the disclosed embodiment may be used to execute instructions in the memory 510 to implement the method shown above. The memory 510 includes a dynamic random access memory, a static random access memory, a flash memory, an optical memory, or other memory known to those skilled in the art.

[0095] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0096] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0097] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A code audit method, characterized in that: include: If it is confirmed that the code information to be audited submitted this time needs to be audited, the source code in the code information to be audited is audited to obtain a first audit result; Compare the current revision number in the code information to be audited with the revision corresponding to the preset revision number to generate difference data, wherein the difference data includes: a difference code containing the first audit result, a patch file and a routing address; Obtaining a second audit result after the difference data is manually audited; A code audit report for the code information to be audited is generated based at least on the first audit result and the second audit result.

2. The method according to claim 1, characterized in that The confirmation that the code information to be audited submitted this time needs to be audited includes: Confirm that the code information to be audited does not contain a review request identifier; or, Confirm that the code information to be audited does not contain an unpublished mark.

3. The method according to claim 2, characterized in that Before confirming that the code information to be audited submitted this time needs to be audited, the method further includes: Add the review request identifier to the description information of the code to be audited to obtain the code information to be audited; wherein the review request identifier includes: the unpublished identifier, the revised version identifier and the updated version identifier; or, The review request identifier is not added to the description information of the code to be audited, wherein the not adding the review request identifier indicates that the preset revision number is the previous revision number corresponding to the current revision number.

4. The method according to any one of claims 1 to 3, characterized in that The auditing of the source code in the code information to be audited to obtain a first audit result includes: Based on the type of the source code, determining a code rule base; The source code is automatically audited using the code rule library to generate the first audit result.

5. The method according to any one of claims 1 to 3, characterized in that The obtaining of a second audit result after the difference data is manually audited includes: Using the routing address, viewing the difference data; In response to the reviewer's operating instruction, the second audit result is obtained.

6. The method according to any one of claims 1 to 3, characterized in that Before generating a code audit report for the code information to be audited based at least on the first audit result and the second audit result, the method further includes: When confirming to perform static detection and analysis on the entire project source code corresponding to any revision number, selecting the target source code corresponding to the any revision number, wherein the any revision number includes the current revision number; Static code analysis is performed on the target source code to generate a third audit result.

7. The method according to claim 6, characterized in that The code audit report includes a single code audit report and a project code audit report.

8. The method according to claim 7, characterized in that The generating a code audit report for the code information to be audited based at least on the first audit result and the second audit result includes: generating the single code audit report based on the first audit result and the second audit result; or, Based on the first audit result, the second audit result and the third audit result, the project code audit report of the entire project source code is generated.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program executes the method according to any one of claims 1 to 8 when executed by a processor.

10. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the computer program executes the method according to any one of claims 1 to 8 when being run by the processor.

11. A computer program product, characterized in that The computer program product comprises a computer program, wherein the computer program executes the method according to any one of claims 1 to 8 when executed by a processor.

Images