Code analysis method and related equipment
By building a DSL-based stain knowledge base and model adaptation technology, the problems of high cost and low efficiency of stain analysis in the existing technology are solved, and efficient stain analysis and automated safety inspection are achieved.
Patent Information
- Application Number
- CN202410081787.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2023-10-18
- Filing Date
- 2024-01-19
- Publication Date
- 2025-04-18
AI Technical Summary
Existing static analysis tools rely on custom taint models in taint analysis, resulting in high development costs and inefficiency, especially when handling tripartite components in a process program.
By building a domain-specific language (DSL)-based taint knowledge base, obtain the taint sub-base corresponding to the three-party components in the program to be analyzed, and perform model adaptation, providing model support for taint analysis.
It improves the efficiency and ability of stain analysis, reduces the probability of stain missed or false alarms, realizes automatic inspection of safety issues, simplifies the testing process and improves development efficiency.
Smart Images
Figure CN119848841A_ABST
Abstract
Description
[0001] This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office on October 18, 2023, with application number 202311359967.4 and invention name “A code analysis method and related equipment”, the entire contents of which are incorporated by reference in this application. Technical Field
[0002] The present application relates to the technical field of code analysis, and in particular to a code analysis method, a code management platform, a computing device cluster, a computer-readable storage medium, and a computer program product. Background Art
[0003] In recent years, as the digitization of information technology (IT) has become a national development strategy, more and more industries have begun to build their own IT programs (such as IT software, which can also be referred to as software or programs). As the scale and complexity of software and other programs continue to increase, programs in different industries face the same security challenges.
[0004] At present, the industry widely uses static analysis tools for program security protection. Static analysis tools can detect security issues during the development phase. They are low-cost and highly reliable, and thus gradually become a universal solution for security protection. Static analysis tools can build control flow graphs and use taint analysis on control flow graphs to check security issues, such as injection issues and null pointer issues.
[0005] However, taint analysis relies on taint models. For third-party components referenced or relied upon by a program, it is usually necessary to upload a custom taint model for taint analysis. The cumbersome custom model development increases the cost of taint analysis and reduces the efficiency of taint analysis. Summary of the invention
[0006] The present application provides a code analysis method, which constructs a taint knowledge base based on domain-specific language (DSL) code, obtains a taint knowledge sub-base (project-level taint knowledge sub-base) corresponding to the three-party components in the program to be analyzed from the taint knowledge base, performs model adaptation of the three-party components, provides model support for taint analysis, and improves the efficiency and capability of taint analysis. The present application also provides a code management platform, a computing device cluster, a computer-readable storage medium, and a computer program product corresponding to the above code analysis method.
[0007] In the first aspect, the present application provides a code analysis method. The method can be executed by a code management platform. The code management platform is used to perform taint analysis on the code of the program. The code management platform can be a software system, which can be used as an independent component, such as a DSL-based code analysis engine, deployed on the cloud as a value-added service for code inspection, and continuously enhance the security inspection capability by docking with the code inspection tool on the cloud. The software system can also be provided to users together with the code inspection engine (such as a code analysis engine and a taint analysis engine) as an extended knowledge base of the code inspection tool. The above-mentioned software system is deployed in a computing device cluster, and the computing device cluster executes the program code of the software system, thereby executing the code analysis method of the present application. In some possible implementations, the code analysis system can also be a hardware system, such as a computing device cluster with code analysis functions (such as taint analysis). When the computing device cluster is running, the code analysis method of the present application is executed.
[0008] Specifically, the code management platform can identify the third-party components in the program to be analyzed, and according to the third-party components in the program to be analyzed, obtain the taint sub-library corresponding to the third-party components from the taint knowledge base, where the taint knowledge base is a knowledge base that records the third-party components and the taint models corresponding to the third-party components based on the DSL code. Then, the code management platform can convert the general taint model into the taint model corresponding to the third-party components according to the taint sub-library corresponding to the third-party components, where the taint model includes at least one of a taint method, an outbreak point method, or a propagation method. Then, the code management platform can use the taint model corresponding to the third-party components for taint analysis.
[0009] This method builds a taint knowledge base in DSL format and proposes a taint sub-base generation technology for the project level. Based on the taint sub-base, the model of the third-party component is adapted to provide model support for taint analysis, reducing the problem of taint omissions or false positives caused by taint analysis tools not recognizing component versions, and improving the efficiency and capability of taint analysis. In addition, this method does not require users to manually analyze the third-party components in the program to be analyzed and learn the usage of customized taint models. It can realize automated inspection of security issues, simplify the testing process, and improve development efficiency.
[0010] In some possible implementations, DSL can describe syntax nodes, such as method parameters, method declarations, annotations, and other code nodes. These code structures have clear definitions. The taint knowledge base provides the ability to query code nodes based on DSL. Based on this, the code management platform can query the code structure through DSL query statements according to the application programming interface API of the taint sub-library corresponding to the third-party component. The code structure is universal. Therefore, the code management platform can convert the universal taint model into the taint model corresponding to the third-party component according to the code structure.
[0011] This method converts the general taint model into a taint model adapted to the third-party components by establishing the conversion of DSL syntax->code structure->taint model, without the need for manual generation by the user. In addition, the above DSL taint conversion technology is universal. In theory, model-based static analysis tools can all apply the above method to obtain performance improvement or benefits.
[0012] In some possible implementations, the code management platform can also update the taint knowledge base according to the program to be analyzed, so that the taint knowledge base can be synchronized with the actual business, and the taint knowledge base can provide the latest knowledge for model conversion, thereby improving the accuracy of model conversion.
[0013] In some possible implementations, the code management platform can identify the entry method referenced by the third-party component from the program to be analyzed, and then the code management platform can detect the accessibility of the entry method and the taint model corresponding to the third-party component. When the entry method and the taint model are reachable, it means that the entry method also has the properties of the taint model. Based on this, the code management platform can update the entry method and the taint model to the taint knowledge base.
[0014] This method updates the taint knowledge base by adopting the entry retrieval method, and can mine potential taints as much as possible. Accordingly, when performing taint analysis based on the taint knowledge base, by identifying the third-party components, the taint sub-library corresponding to the third-party components is extracted from the taint knowledge base, and the general taint model is converted into a taint model adapted to the third-party components based on the taint sub-library, thereby improving the security inspection capability of the taint analysis tool, thereby identifying new security issues and reducing the probability of taint omissions or false positives.
[0015] In some possible implementations, the code management platform can convert the code of the program to be analyzed into a graph database node, wherein the graph database node is used to form a graph database. The code management platform also converts a DSL query statement into a graph database query statement, and then queries the graph database through the graph database query statement to obtain a code snippet. For the code snippet queried by the DSL query statement, the code management platform can extract the characteristics of the code snippet, input the characteristics of the code snippet into the language model, and generate a taint model corresponding to the code snippet. The code management platform can update the taint knowledge base based on the code snippet and the taint model corresponding to the code snippet.
[0016] Since the taint knowledge base is in DSL format, this method uses DSL to query code snippets and extracts the characteristics of the code snippets and inputs them into the language model to generate a taint model. The taint model has a strong affinity with the taint knowledge base, which can simplify the difficulty of taint knowledge base management and improve the efficiency of taint knowledge base update.
[0017] In some possible implementations, the characteristics of the code snippet include one or more of annotations, method parameters, return values, comments, and class declarations. The taint model includes at least one of a taint method, a burst point method, or a propagation method. By taking the characteristics of the code snippet such as annotations, method parameters, return values, comments, and class declarations as input, the taint method, burst point method, or propagation method can be generated by making full use of the generation capability of the language model, and then the taint model is generated. Since the characteristics of annotations and comments are closer to natural language, the taint model generated by the language model such as LLM has a higher acceptance.
[0018] In some possible implementations, when the taint analysis results indicate a security issue, the code management platform can also send an alert to the user, so that the user can be reminded to promptly confirm and repair the detected security issues, avoid the expansion of security risks, and ensure overall reliability.
[0019] In a second aspect, the present application provides a code management platform. The code management platform is used to perform taint analysis on the code of a program, and the code management platform includes:
[0020] An identification module, used to identify third-party components in the program to be analyzed;
[0021] A sub-library acquisition module is used to acquire a taint sub-library corresponding to the tripartite component in the program to be analyzed from a taint knowledge base, wherein the taint knowledge base is a knowledge base that records the tripartite component and the taint model corresponding to the tripartite component based on a domain-specific language DSL code;
[0022] A model conversion module, configured to convert a general taint model into a taint model corresponding to the tripartite component according to the taint sub-library corresponding to the tripartite component, wherein the taint model includes at least one of a taint method, an outbreak point method or a propagation method;
[0023] The taint analysis module is used to perform taint analysis using a taint model corresponding to the tripartite component.
[0024] In some possible implementations, the model conversion module is specifically used to:
[0025] According to the application programming interface API of the tainted sub-library corresponding to the third-party component, query the code structure through the DSL query statement;
[0026] The general taint model is converted into a taint model corresponding to the tripartite component according to the code structure.
[0027] In some possible implementations, the code management platform further includes:
[0028] The knowledge management module is used to update the stain knowledge base according to the program to be analyzed.
[0029] In some possible implementations, the code management platform further includes:
[0030] A retrieval module, used to identify an entry method referenced by the third-party component from the program to be analyzed;
[0031] A reachability detection module, used to detect the reachability of the entry method and the taint model corresponding to the tripartite component;
[0032] The knowledge management module is specifically used for:
[0033] When the entry method and the taint model are reachable, the entry method and the taint model are updated to the taint knowledge base.
[0034] In some possible implementations, the code management platform further includes:
[0035] A conversion module, used to convert the code of the program to be analyzed into a graph database node, wherein the graph database node is used to form a graph database, and to convert a DSL query statement into a graph database query statement;
[0036] A query module, used to query the graph database through the graph database query statement to obtain a code snippet;
[0037] A generating module, configured to extract characteristics of the code snippet, input the characteristics of the code snippet into a language model, and generate a taint model corresponding to the code snippet;
[0038] The knowledge management module is specifically used for:
[0039] The taint knowledge base is updated according to the code snippet and the taint model corresponding to the code snippet.
[0040] In some possible implementations, the characteristics of the code snippet include one or more of annotations, method parameters, return values, comments, and class declarations.
[0041] In some possible implementations, the code management platform further includes:
[0042] The taint alarm module is used to send an alarm to the user when the taint analysis results indicate a security issue.
[0043] In a third aspect, the present application provides a computing device cluster. The computing device cluster includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory. The at least one processor and the at least one memory communicate with each other. The at least one processor is used to execute instructions stored in the at least one memory, so that the computing device or the computing device cluster performs the code analysis method as described in the first aspect or any one of the implementations of the first aspect.
[0044] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and the instructions instruct a computing device or a computing device cluster to execute the code analysis method described in the above-mentioned first aspect or any one of the implementations of the first aspect.
[0045] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computing device or a computing device cluster, enables the computing device or the computing device cluster to execute the code analysis method described in the first aspect or any one of the implementations of the first aspect.
[0046] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS
[0047] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.
[0048] Figure 1 A schematic diagram of a stain analysis process provided for this application;
[0049] Figure 2 A schematic diagram of the system architecture of a code management platform provided for this application;
[0050] Figure 3 A flowchart of a code analysis method provided for this application;
[0051] Figure 4 A schematic diagram of an application scenario for updating a taint knowledge base provided by this application;
[0052] Figure 5 A schematic diagram of an application scenario for taint analysis based on a taint knowledge base provided in this application;
[0053] Figure 6 A schematic diagram of the structure of a computing device provided for this application;
[0054] Figure 7 A schematic diagram of the structure of a computing device cluster provided for this application;
[0055] Figure 8 A schematic diagram of the structure of another computing device cluster provided for this application;
[0056] Fig. 9 A schematic diagram of the structure of another computing device cluster provided in this application. DETAILED DESCRIPTION
[0057] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.
[0058] First, some technical terms involved in the embodiments of the present application are introduced.
[0059] Taint analysis is a technique that tracks and analyzes the flow of taint information in a program (e.g., a software program, referred to as software or program). In vulnerability analysis, taint analysis technology is used to mark the data of interest (usually external input from the program) as tainted data (also called taint, pollution source, or source point), and then by tracking the flow of information related to the taint, it can be determined whether the taint will affect certain key program operations (e.g., sensitive operations), thereby mining program vulnerabilities. In this way, the question of whether a program has a certain vulnerability can be transformed into the question of whether the taint will be used by operations at the taint convergence point (also called the burst point, or Sink point).
[0060] Taint refers to the external input (external data) of a program, which represents the direct introduction of untrusted data sources or sensitive data. Among them, untrusted data sources or sensitive data can be files, environment variables, network packets, command line parameters, user space to kernel space memory, etc. In a program, taints can be divided into the following types: input parameter taint, output parameter taint, or return value taint. Among them, input parameter taint is the untrusted parameter passed in before the function call in the program, output parameter taint is the untrusted parameter used after the function call in the program, and return value taint is the untrusted return value returned after the function is called in the program.
[0061] A flash point refers to a method in the program code where a problem may occur, which means directly generating security-sensitive operations (such as violating data integrity) or leaking private data to the outside world (such as violating data confidentiality). Common flash points include but are not limited to command execution, Structured Query Language (SQL) operations, copy length, loop conditions, array indexes, etc.
[0062] After the taint is introduced, it can be propagated internally (or called taint transmission, denoted as Transitive). Common propagation methods include but are not limited to: function parameter passing, variable assignment, copying, and calculation. The path where the taint propagates to the outbreak point is called the taint propagation path. There are generally two types of taint propagation paths: one is the path that propagates on the source code, and the other is the path that propagates on the external component. Among them, the external component refers to a code snippet or code library that does not belong to the current project (or called this project, this program) and must be relied on during the code compilation or running phase. Taint analysis tools usually customize the taint, outbreak point, and external component propagation path into a taint model to solve the problem of the current program's code relying on external components.
[0063] Traditional taint analysis tools rely on the tool's taint model and do not identify component versions, which can lead to false positives and false negatives. Figure 1 As shown in the figure, for customized third-party components, it is usually necessary to upload a customized taint model to solve the problem of missed or false positives. The cumbersome custom model development and the unpredictability of external components have led to missed detection of security issues. For this reason, some taint analysis tools provide customized taint models. Developers can learn taint models, adapt to the third-party components of the project, and write taint models corresponding to the third-party components to complete the inspection of security issues.
[0064] However, although the above-mentioned taint analysis tools provide the documentation of the customized taint model and the usage of customized rules, developers need to learn the usage of the customized taint model and manually analyze the third-party components of the project to complete the model adaptation of the third-party components. The entire testing process is very cumbersome, the development efficiency is low, and the inspection of security issues is affected.
[0065] In view of this, the present application provides a code analysis method. The method can be performed by a code management platform. The code management platform can also be called a code management system, which is mainly used to perform taint analysis on the code of the program. The code management platform can be a software system, which can be deployed on the cloud as an independent component as a value-added service for code inspection, docking with the code inspection tool on the cloud, and continuously enhancing the security inspection capability. The software system can also be provided to users together with the code inspection engine (such as code analysis engine, taint analysis engine) as an extended knowledge base of the code inspection tool. The above software system is deployed in a computing device cluster, and the computing device cluster executes the program code of the software system, thereby executing the code analysis method of the present application. In some possible implementations, the code analysis system can also be a hardware system, for example, a computing device cluster with code analysis functions (such as taint analysis). When the computing device cluster is running, the code analysis method of the present application is executed.
[0066] Specifically, the code management platform identifies the third-party components in the program to be analyzed, and then obtains the taint sub-library corresponding to the third-party components from the taint knowledge base based on the third-party components in the program to be analyzed, wherein the taint knowledge base is a knowledge base based on domain-specific language (DSL) code to record the third-party components and the taint models corresponding to the third-party components. The code management platform can convert the general taint model into the taint model corresponding to the third-party components based on the taint sub-library corresponding to the third-party components, wherein the taint model includes at least one of a taint method, an outbreak point method or a propagation method, and then the code management platform can use the taint model corresponding to the third-party component to perform taint analysis.
[0067] This method constructs a taint knowledge base in DSL format, obtains the taint knowledge sub-base (project-level taint knowledge sub-base) corresponding to the third-party components in the program to be analyzed from the taint knowledge base, performs model adaptation of the third-party components, provides model support for taint analysis, reduces the problem of taint omissions or false positives caused by taint analysis tools not recognizing component versions, and improves the efficiency and capability of taint analysis. Moreover, this method does not require users to manually analyze the third-party components in the program to be analyzed and learn the usage of customized taint models, and can realize automated inspection of security issues, simplify the testing process, and improve development efficiency.
[0068] In order to make the technical solution of the present application clearer and easier to understand, the code analysis method of the present application is introduced below in conjunction with the accompanying drawings.
[0069] See also Figure 2 The schematic diagram of the architecture of a code management platform shown in the figure, the code management platform 200 includes an analysis subsystem 202, and further, the code management platform 200 may also include a knowledge base management subsystem 204. The knowledge base management subsystem 204 is used to create or update a taint knowledge base 206. Among them, the taint knowledge base 206 can also be called a taint general library, and the taint knowledge base is a knowledge base that records tripartite components and taint models corresponding to the tripartite components through DSL code. That is, the taint knowledge base 206 is in DSL format. Among them, DSL refers to a computer language specifically for a specific application field, which is exactly the opposite of a general programming language (General Purpose Language, GPL) that can be used in a variety of fields. Domain-specific languages can also be classified according to the language used, for example, they can be divided into domain-specific markup languages, domain-specific modeling languages (or more general specification languages). In this example, the taint knowledge base 206 can use a domain-specific modeling language to record tripartite components and taint models corresponding to tripartite components.
[0070] The input of the analysis subsystem 202 may be a program to be analyzed (such as a project to be analyzed), and the output of the analysis subsystem 202 may be a code analysis result, which may be a security issue in the program code. The analysis subsystem 202 is used to identify the third-party components in the program to be analyzed, and obtain the taint sub-library corresponding to the third-party components from the taint knowledge base according to the third-party components in the program to be analyzed. Among them, the taint knowledge base is a knowledge base that records (or saves) the third-party components and the taint models corresponding to the third-party components, and the taint sub-library can be regarded as a subset of the taint knowledge base. The analysis subsystem 202 is also used to convert the general taint model into a taint model corresponding to the third-party component according to the taint sub-library corresponding to the third-party component, and the taint model includes at least one of the taint method, the outbreak point method or the propagation method, and then use the taint model corresponding to the third-party component to perform taint analysis.
[0071] The analysis subsystem 202 may include an identification module 2022, a sub-library acquisition module 2024, a model conversion module 2026, and a taint analysis module 2028. The identification module 2022 is used to identify the third-party components in the program to be analyzed, the sub-library acquisition module 2024 is used to obtain the taint sub-library corresponding to the third-party components from the taint knowledge base 206 according to the third-party components in the program to be analyzed, the model conversion module 2026 is used to convert the general taint model into the taint model corresponding to the third-party components according to the taint sub-library corresponding to the third-party components, and the taint analysis module 2028 is used to perform taint analysis using the taint model corresponding to the third-party components. The taint analysis module 2028 inputs the taint model adapted to the third-party components into the taint analysis tool for taint analysis. Further, the analysis subsystem 202 may also include a taint alarm module 2029. The taint alarm module 2029 is used to issue an alarm when a security problem is detected through taint analysis.
[0072] In this embodiment, the key to the taint analysis by the analysis subsystem 202 is to automatically construct a taint knowledge base 206 of an external component (such as a third-party component). The taint knowledge base 206 can be constructed by the knowledge base management subsystem 204. Specifically, the input of the knowledge base management subsystem 204 can include programs, third-party components, such as open source programs (projects) or open source third-party components, and the output of the knowledge base management subsystem 204 can be the taint knowledge base 206. Furthermore, the knowledge base management subsystem 204 can also update the taint knowledge base, for example, updating the taint knowledge base according to the program to be analyzed.
[0073] The knowledge base management subsystem 204 can create or update the taint knowledge base in a variety of ways. One implementation method is entry retrieval. Specifically, the knowledge base management subsystem 204 uses entry retrieval to identify the entry method (for example: non-private method, interface method, Main method) of the referenced third-party component, and detects the accessibility of the entry method and taint model (including taint method, burst point method, propagation method) of the referenced third-party component. For example, the accessibility analysis algorithm is used to analyze whether the entry method and the taint model are reachable (have reachability). Being reachable (or having reachability) means that the entry method also has the properties of the taint model, and the entry method and the taint model can be added to the taint knowledge base. Another implementation method is DSL query. Specifically, the format of the taint knowledge base can be based on DSL code, and the knowledge base management subsystem 204 can query code snippets from the taint knowledge base through DSL query statements. The process of DSL query is as follows. First, the knowledge base management subsystem 204 converts the code (such as the code of the program to be analyzed and the third-party component) into a graph database node, wherein the graph database node is used to form a graph database, and converts the DSL query statement into a graph database query statement, such as a structured query language (SQL) statement, queries the graph database based on the graph database query statement, identifies the code snippet, and for the code snippet, the knowledge base management subsystem 204 extracts the characteristics of the code snippet, wherein the characteristics of the code snippet include but are not limited to annotations, method parameters, return values, comments, class declarations, and then inputs the characteristics of the code snippet into the language model, for example, inputs the characteristics of the code snippet into the large language model (LLM), generates a taint model corresponding to the code snippet, and updates the taint knowledge base according to the code snippet and the taint model corresponding to the code snippet.
[0074] The knowledge base management subsystem 204 includes a retrieval module 2042, a reachability detection module 2044, and a knowledge management module 2046. The retrieval module 2042 is used to identify the entry method of the referenced third-party component from the program to be analyzed, the reachability detection module 2044 is used to detect the accessibility of the entry method of the referenced third-party component and the taint model corresponding to the third-party component, and the knowledge management module 2046 is used to update the entry method and the taint model to the taint knowledge base when the entry method and the taint model are reachable. The knowledge base management subsystem 204 may also include a conversion module 2041, a query module 2043, a generation module 2045, and a knowledge management module 2046. Among them, the conversion module 2041 is used to convert the code of the program to be analyzed into a graph database node, wherein the graph database node is used to form a graph database, and to convert the DSL query statement into a graph database query statement. The query module 2043 is used to query the graph database through the graph database query statement to obtain the code snippet. The generation module 2045 is used to extract the characteristics of the code snippet for the code snippet, input the characteristics of the code snippet into the language model (for example, LLM), and generate a taint model corresponding to the code snippet. The knowledge management module 2046 is used to update the taint knowledge base 206 according to the code snippet and the taint model corresponding to the code snippet.
[0075] Based on the aforementioned code management platform 200, the present application further provides a code analysis method. The code analysis method of the present application is introduced below in conjunction with an embodiment.
[0076] See also Figure 3 The flowchart of a code analysis method shown in FIG. 1 is a flowchart of a code analysis method, which can be executed by a code management platform 200. The code management platform 200 is used to perform taint analysis on the code. The method includes the following steps:
[0077] S302: The code management platform 200 identifies third-party components in the program to be analyzed.
[0078] Third-party components, also known as external components, refer to code snippets or code libraries that do not belong to the project and must be relied upon during the code compilation or running phase. Third-party components play a very important role in project development and are also an important part of the software supply chain. Introducing third-party components during project development can improve R&D efficiency, shorten the time to project launch, and effectively reduce development costs.
[0079] During software development or project development, developers can use specific keywords in code files to introduce third-party components. For example, developers can use "import" to introduce third-party components, and the code management platform 200 can detect statements including "import" in the code of the program to be analyzed through text matching, or perform semantic analysis on the code of the program to be analyzed, thereby identifying the third-party components in the program to be analyzed.
[0080] S304: The code management platform 200 obtains a taint sub-library corresponding to the third-party component from the taint knowledge base according to the third-party component in the program to be analyzed.
[0081] The taint knowledge base is a knowledge base that records the tripartite components and the taint models corresponding to the tripartite components. In the present application, the taint knowledge base is in DSL format, and the tripartite components and the taint models corresponding to the tripartite components are recorded through DSL code. Among them, the taint sub-library is a subset of the taint knowledge base, and the taint sub-library records the tripartite components in the program to be analyzed and the taint models corresponding to the tripartite components. It can be seen that the taint knowledge base is actually a general library that can provide a taint analysis tool to obtain a taint sub-library. The taint sub-library downloaded from the taint knowledge base is a knowledge base that describes the tripartite components and the taint models corresponding to the tripartite components. The taint model includes at least one of a taint method, an outbreak point method, or a propagation method. Among them, the taint method can be a method of inputting external data into the program to be analyzed, the outbreak point method can be a method of causing problems in the program to be analyzed, and the propagation method can be a method of propagating taint to the outbreak point.
[0082] The code management platform 200 can match the tripartite components in the program to be analyzed with the tripartite components recorded in the taint knowledge base, so as to obtain the taint model corresponding to the tripartite components in the program to be analyzed. Based on the tripartite components in the program to be analyzed and the taint model corresponding to the tripartite components, a taint sub-library corresponding to the tripartite components can be obtained.
[0083] The taint knowledge base can store the index of the third-party component, such as the hash value of the third-party component, and the code management platform 200 can query the taint knowledge base by hash query to obtain the taint sub-library corresponding to the third-party component in the program to be analyzed, thereby improving the efficiency of downloading the taint sub-library.
[0084] S306. The code management platform 200 converts the general taint model into a taint model corresponding to the third-party component according to the taint sub-library corresponding to the third-party component.
[0085] The general taint model can be a model customized by the taint analysis tool. The code management platform 200 can perform model conversion on the general taint model according to the taint sub-library corresponding to the third-party component, so as to obtain the taint model corresponding to the third-party component. Among them, the code management platform 200 can realize model conversion (adapting the general taint model to the third-party component) through a model converter (Model Converter). The input of the model converter can be the taint sub-library corresponding to the third-party component, and the output of the model converter can be the taint model corresponding to the third-party component.
[0086] In specific implementation, the code management platform 200 can use a DSL-based model conversion, such as a DSL model converter, according to the taint sub-library corresponding to the third-party component to convert the general taint model into a taint model corresponding to the third-party component. DSL can describe syntax nodes, such as code nodes such as method parameters, method declarations, and annotations. The code structure of the above code nodes is clearly defined, and the taint knowledge base provides a DSL query code node capability. First, the code management platform 200 can use the application programming interface (application programming interface, API) provided by the taint knowledge base, such as the API provided by the taint sub-library, to query the code structure through DSL, and the code structure has universality. The code management platform 200 can generate a taint model of the current taint analysis tool based on the above code structure. For example, the code management platform 200 can convert the general taint model into a taint model corresponding to the third-party component according to the code structure as the taint model of the current taint analysis tool. In this way, the conversion of DSL syntax->code structure->taint model can be achieved. This method can be applied to most taint analysis tools and has high availability.
[0087] S308. The code management platform 200 performs taint analysis using the taint model corresponding to the third-party component.
[0088] Specifically, the code management platform 200 can provide the taint model corresponding to the third-party component to the taint analysis tool, such as the taint analysis engine, and the code management platform 200 can use the taint analysis tool to identify the taints and outbreak points in the program to be analyzed, including the taints and outbreak points related to the third-party component, to reduce missed reports or false reports. Then the code management platform 200 can perform taint propagation analysis based on the identified taints.
[0089] Among them, taint propagation analysis refers to analyzing the propagation path of taints in the program. According to the different program dependencies that are concerned in the analysis process, taint propagation analysis can be divided into explicit flow analysis and implicit flow analysis. Among them, explicit flow analysis specifically analyzes how taints propagate along the data dependencies between variables in the program, and implicit flow analysis specifically analyzes how taints propagate along the control dependencies between variables in the program, that is, analyzing how taints propagate from conditional instructions to the statements they control.
[0090] Based on the above description, the present application provides a code analysis method. In this method, the code management platform 200 constructs a taint knowledge base, obtains the taint knowledge sub-base (project-level taint knowledge sub-base) corresponding to the third-party components in the program to be analyzed from the taint knowledge base, and then performs model adaptation of the third-party components based on the taint sub-base. Without the need for complex custom model development work, the taint model for taint analysis can be efficiently provided to the taint analysis tool, providing model support for taint analysis, thereby improving the efficiency and capability of taint analysis. Moreover, this method does not require the user to manually analyze the third-party components in the program to be analyzed and learn the usage of the custom taint model, and can realize automated inspection of security issues, simplify the testing process, and improve development efficiency.
[0091] The code analysis method of the present application can be applied to scenarios where program analysis tools rely on taint models for security checks. In this scenario, a taint knowledge base can be used to solve problems that cannot be discovered by security issues. The taint analysis method of the present application is introduced below in conjunction with specific application scenarios.
[0092] First, the method supports generating code features by identifying the existing taint knowledge base, for example, obtaining code snippets based on DSL queries, extracting corresponding code features from the code snippets, and then further generating taint models through large models to update the taint knowledge base. The following is a detailed description of the process of updating the taint knowledge base with examples.
[0093] In this example, the web service can generate interface code through a YAML file, where the implementation class is the real external interface, and the generated interface code can be introduced in the form of a third-party component. It is difficult for the taint analysis tool to automatically identify the interface code introduced in the form of the above third-party component as a taint, resulting in taint omissions. For example, see Figure 4 The InvMirrirTimelineService method is an external interface marked by the POST tag. Since it is referenced through a third-party component, it causes missed reports. This application can update the taint knowledge base through a DSL query method to avoid the above-mentioned taint missed reports.
[0094] like Figure 4As shown, the current taint knowledge base stores taint models (usually in DSL format, also called DSL taint models), and the code management platform 200 can obtain code snippets from the program code based on DSL queries. Then, the code management platform 200 can extract code features (i.e., code features, code features obtained through DSL are also called DSL features) from the code snippets. The above code features may include: DSL-based annotation features and method-based parameter features. Based on these two code features, a taint model can be generated for the project's third-party components, where the method name is rollbackTimeline and the class name is InvMirrorTimelineService. In this way, the taint knowledge base can be updated, and the updated taint knowledge base stores the third-party component invmirrirservice-model-1.0.0.99 and its corresponding taint model.
[0095] Then, the method supports the use of the taint knowledge base to enhance the capabilities of the taint analysis tool. Specifically, the code management platform 200 can identify the third-party components of the program, thereby obtaining a list of third-party components referenced by the program. Based on the list of third-party components, the code management platform 200 can download the taint sub-library corresponding to the third-party components in the list of third-party components from the taint knowledge base, and use the taint sub-library to convert the general taint model into a taint model adapted to the third-party components, thereby enhancing the security inspection capability of the taint analysis tool, thereby identifying new security issues.
[0096] like Figure 5 As shown, the code management platform 200 identifies the third-party components of the program and obtains a list of third-party components, including the following: component InvMirrirTimelineService, version 1.0.0.99. The code management platform 200 downloads the taint sub-library based on the information of the third-party components in the third-party component list, such as the component name and version number. The taint sub-library includes the above-mentioned third-party components and the taint model corresponding to the third-party components. Among them, the taint model includes the rollbackTimeline method, and the implementation class is InvMirrorTimelineService.
[0097] The code management platform 200 can perform model conversion based on the taint sub-library corresponding to the above-mentioned third-party component to obtain the taint model corresponding to the third-party component. The code management platform 200 can perform taint analysis through the taint model corresponding to the third-party component to check the security issues in the program, such as security issues in the propagation path of the third-party component.
[0098] Based on the aforementioned code analysis method, the present application also provides a code management platform 200. Figure 2 As shown, the code management platform 200 includes:
[0099] Identification module 2022, used to identify third-party components in the program to be analyzed;
[0100] The sub-library acquisition module 2024 is used to acquire, according to the third-party component in the program to be analyzed, a taint sub-library corresponding to the third-party component from the taint knowledge base, wherein the taint knowledge base is a knowledge base that records the third-party component and the taint model corresponding to the third-party component based on the domain specific language DSL code;
[0101] A model conversion module 2026, configured to convert a general taint model into a taint model corresponding to the tripartite component according to the taint sub-library corresponding to the tripartite component, wherein the taint model includes at least one of a taint method, an outbreak point method or a propagation method;
[0102] The taint analysis module 2028 is used to perform taint analysis using the taint model corresponding to the tripartite component.
[0103] Exemplarily, the above-mentioned identification module 2022, sub-library acquisition module 2024, model conversion module 2026, and stain analysis module 2028 can be implemented by hardware, or can be implemented by software.
[0104] When implemented by software, the identification module 2022, the sub-library acquisition module 2024, the model conversion module 2026, and the stain analysis module 2028 can be applications running on a computing device, such as a computing engine, etc. Among them, the application can also be virtualized and run in the form of a virtualized service. Virtualization services may include virtual machine (VM) services, bare metal server (BMS) services, and container services. Among them, the VM service can be a service that virtualizes a virtual machine (VM) resource pool on multiple physical hosts through virtualization technology to provide users with VMs on demand for use. The BMS service is a service that virtualizes a BMS resource pool on multiple physical hosts to provide users with BMS on demand for use. The container service is a service that virtualizes a container resource pool on multiple physical hosts to provide users with containers on demand for use. VM is a simulated virtual computer, that is, a logical computer. BMS is a high-performance computing service that can be elastically scalable, and its computing performance is no different from that of a traditional physical machine, and it has the characteristics of secure physical isolation. Container is a kernel virtualization technology that can provide lightweight virtualization to achieve the purpose of isolating user space, processes and resources. It should be understood that the VM service, BMS service and container service in the above virtualization services are only used as specific examples. In actual applications, virtualization services can also be other lightweight or heavyweight virtualization services, which are not specifically limited here.
[0105] When implemented by hardware, the identification module 2022, the sub-library acquisition module 2024, the model conversion module 2026, and the taint analysis module 2028 may include at least one computing device, such as a server, etc. Alternatively, the identification module 2022, the sub-library acquisition module 2024, the model conversion module 2026, and the taint analysis module 2028 may also be implemented by using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), etc. The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
[0106] In some possible implementations, the model conversion module 2026 is specifically used to:
[0107] According to the application programming interface API of the tainted sub-library corresponding to the third-party component, query the code structure through the DSL query statement;
[0108] The general taint model is converted into a taint model corresponding to the tripartite component according to the code structure.
[0109] In some possible implementations, the code management platform 200 further includes:
[0110] The knowledge management module 2046 is used to update the stain knowledge base according to the program to be analyzed.
[0111] The code management platform 200 may include multiple subsystems, the knowledge management module 2046 may be a module in the knowledge base management subsystem 204, and the identification module 2022, the sub-base acquisition module 2024, the model conversion module 2026, and the taint analysis module 2028 may be modules in the analysis subsystem 202. The knowledge base management subsystem 204 is used to provide knowledge support for taint model adaptation.
[0112] Similar to the aforementioned identification module 2022, etc., the knowledge management module 2046 can be implemented through software or hardware.
[0113] When implemented by software, the knowledge management module 2046 may be an application running on a computing device, such as a computing engine, etc. The application may also be virtualized and run in the form of a virtualized service. Virtualized services may include VM services, BMS services, and container services. When implemented by hardware, the knowledge management module 2046 may include at least one computing device, such as a server, etc. Alternatively, the knowledge management module 2046 may also be a device implemented using an application specific integrated circuit ASIC, or a programmable logic device PLD, etc.
[0114] In some possible implementations, the code management platform 200 further includes:
[0115] A retrieval module 2042, used to identify an entry method referenced by the third-party component from the program to be analyzed;
[0116] A reachability detection module 2044, used to detect the reachability of the entry method and the taint model corresponding to the tripartite component;
[0117] The knowledge management module 2046 is specifically used for:
[0118] When the entry method and the taint model are reachable, the entry method and the taint model are updated to the taint knowledge base.
[0119] Among them, the retrieval module 2042 and the reachability detection module 2044 can be modules in the knowledge base management subsystem 204. The retrieval module 2042 and the reachability detection module 2044 can be implemented by software or by hardware. When implemented by software, it can be an application running on a computing device, such as a computing engine, etc. Among them, the application can also be virtualized and run as a virtualized service. Virtualized services may include VM services, BMS services, and container services. When implemented by hardware, the retrieval module 2042 and the reachability detection module 2044 may include at least one computing device, such as a server, etc. Alternatively, the retrieval module 2042 and the reachability detection module 2044 may also be a device implemented using ASIC or PLD, etc.
[0120] In some possible implementations, the code management platform 200 further includes:
[0121] A conversion module 2041, used to convert the code of the program to be analyzed into a graph database node, the graph database node is used to form a graph database, and convert a DSL query statement into a graph database query statement;
[0122] A query module 2043 is used to query the graph database through the graph database query statement to obtain a code snippet;
[0123] A generating module 2045 is used to extract the characteristics of the code snippet, input the characteristics of the code snippet into a language model, and generate a taint model corresponding to the code snippet;
[0124] The knowledge management module 2046 is specifically used for:
[0125] The taint knowledge base is updated according to the code snippet and the taint model corresponding to the code snippet.
[0126] Among them, the conversion module 2041, the query module 2043, and the generation module 2045 can be modules in the knowledge base management subsystem 204. The conversion module 2041, the query module 2043, and the generation module 2045 can be implemented by software or by hardware. When implemented by software, it can be an application running on a computing device, such as a computing engine, etc. Among them, the application can also be virtualized and run in the form of a virtualized service. Virtualized services can include VM services, BMS services, and container services. When implemented by hardware, the conversion module 2041, the query module 2043, and the generation module 2045 can include at least one computing device, such as a server, etc. Alternatively, the conversion module 2041, the query module 2043, and the generation module 2045 can also be a device implemented using ASIC or PLD, etc.
[0127] In some possible implementations, the characteristics of the code snippet include one or more of annotations, method parameters, return values, comments, and class declarations.
[0128] In some possible implementations, the code management platform 200 further includes:
[0129] The taint warning module 2029 is used to send a warning to the user when the taint analysis result indicates that there is a security problem.
[0130] The stain alarm module 2029 may be a module in the analysis subsystem 202. The stain alarm module 2029 may be implemented by software or by hardware. When implemented by software, it may be an application running on a computing device, such as a computing engine, etc. Among them, the application may also be virtualized and run as a virtualized service. Virtualized services may include VM services, BMS services, and container services. When implemented by hardware, the stain alarm module 2029 may include at least one computing device, such as a server, etc. Alternatively, the stain alarm module 2029 may also be a device implemented using ASIC or PLD, etc.
[0131] The present application also provides a computing device 600. Figure 6 As shown, computing device 600 includes: bus 602, processor 604, memory 606 and communication interface 608. Processor 604, memory 606 and communication interface 608 communicate through bus 602. Computing device 600 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 600.
[0132] The bus 602 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 The bus 602 may include a path for transmitting information between various components of the computing device 600 (eg, the memory 606, the processor 604, and the communication interface 608).
[0133] The processor 604 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).
[0134] The memory 606 may include a volatile memory, such as a random access memory (RAM). The memory 606 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD). The memory 606 stores executable program code, and the processor 604 executes the executable program code to implement the aforementioned code analysis method. Specifically, the memory 606 stores instructions for the code management platform 200 to execute the code analysis method.
[0135] The communication interface 608 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 600 and other devices or communication networks.
[0136] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.
[0137] like Figure 7 As shown, the computing device cluster includes at least one computing device 600. The memory 606 in one or more computing devices 600 in the computing device cluster may store the same code management platform 200 for executing instructions of the code analysis method.
[0138] In some possible implementations, one or more computing devices 600 in the computing device cluster may also be used to execute some instructions of the code management platform 200 for executing the code analysis method. In other words, a combination of one or more computing devices 600 may jointly execute instructions of the code management platform 200 for executing the code analysis method.
[0139] It should be noted that the memory 606 in different computing devices 600 in the computing device cluster may store different instructions for executing part of the functions of the code management platform 200 .
[0140] Figure 8 A possible implementation is shown. Figure 8 As shown, two computing devices 600A and 600B are connected via a communication interface 608. The memory in computing device 600A stores instructions for executing the functions of identification module 2022 and sub-library acquisition module 2024. The memory in computing device 600B stores instructions for executing the functions of model conversion module 2026 and taint analysis module 2028. In other words, the memories 606 of computing devices 600A and 600B jointly store instructions for the code management platform 200 to execute the code analysis method.
[0141] Optionally, the memory 606 of the computing device 600A may also store instructions for the functions of the conversion module 2041, the query module 2043, the generation module 2045 and the knowledge management module 2046, and the memory 606 of the computing device 600B may also store instructions for the functions of the retrieval module 2042 and the reachability detection module 2044, wherein the modules for updating the taint knowledge base in different ways are dispersedly stored in different devices, which can improve the overall reliability. Further, the memory of the computing device 600B may also store instructions for the functions of the taint warning module 2029.
[0142] Figure 8 The connection mode between the computing device clusters shown can be that considering that the code analysis method provided by the present application requires a large amount of network resources to obtain sub-libraries, and requires a large amount of computing resources to perform model conversion and taint analysis, the functions of the identification module 2022 and the sub-library acquisition module 2024 are implemented by the computing device 600A, and the functions of the model conversion module 2026 and the taint analysis module 2028 are implemented by the computing device 600B. In this way, the isolation of different functions can be achieved.
[0143] It should be understood that Figure 8 The functions of the computing device 600A shown in FIG. 6A may also be completed by multiple computing devices 600. Similarly, the functions of the computing device 600B may also be completed by multiple computing devices 600.
[0144] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig. 9 A possible implementation is shown. Fig. 9 As shown, two computing devices 600C and 600D are connected via a network. Specifically, they are connected to the network via communication interfaces in each computing device. In this type of possible implementation, the memory 606 in the computing device 600C stores instructions for executing the functions of the identification module 2022 and the sub-library acquisition module 2024. At the same time, the memory 606 in the computing device 600D stores instructions for executing the functions of the model conversion module 2026 and the taint analysis module 2028.
[0145] Fig. 9 The connection method between the computing device clusters shown can be considered to be that the code analysis method provided in this application requires a large amount of computing resources for model conversion and taint analysis, so it is considered to entrust the functions implemented by the model conversion module 2026 and the taint analysis module 2028 to be executed by an independent computing device 600D.
[0146] It should be understood that Fig. 9The functions of the computing device 600C shown in FIG. 6A may also be completed by multiple computing devices 600. Similarly, the functions of the computing device 600D may also be completed by multiple computing devices 600.
[0147] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned code management platform 200 for executing the code analysis method.
[0148] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the above-mentioned code analysis method.
[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.
Claims
1. A code analysis method, characterized in that: Applied to a code management platform, the code management platform is used to perform taint analysis on the code of a program, the method includes: Identify the tripartite components in the program to be analyzed; According to the tripartite component in the program to be analyzed, a taint sub-library corresponding to the tripartite component is obtained from a taint knowledge base, wherein the taint knowledge base is a knowledge base that records the tripartite component and the taint model corresponding to the tripartite component based on a domain specific language DSL code; According to the taint sub-library corresponding to the tripartite component, converting the general taint model into a taint model corresponding to the tripartite component, the taint model including at least one of a taint method, an outbreak point method or a propagation method; A taint analysis is performed using a taint model corresponding to the tripartite component.
2. The method according to claim 1, characterized in that The converting the general taint model into the taint model corresponding to the tripartite component according to the taint sub-library corresponding to the tripartite component comprises: According to the application programming interface API of the tainted sub-library corresponding to the third-party component, query the code structure through the DSL query statement; The general taint model is converted into a taint model corresponding to the tripartite component according to the code structure.
3. The method according to claim 1 or 2, characterized in that: The method further comprises: The stain knowledge base is updated according to the program to be analyzed.
4. The method according to claim 3, characterized in that The updating of the taint knowledge base according to the program to be analyzed and the third-party components in the program to be analyzed includes: Identify, from the program to be analyzed, an entry method referenced by the third-party component; detecting the accessibility of the entry method and the taint model corresponding to the tripartite component; When the entry method and the taint model are reachable, the entry method and the taint model are updated to the taint knowledge base.
5. The method according to claim 3, characterized in that: The updating of the stain knowledge base according to the program to be analyzed includes: Converting the code of the program to be analyzed into graph database nodes, wherein the graph database nodes are used to form a graph database, and converting the DSL query statements into graph database query statements; Query the graph database through the graph database query statement to obtain the code snippet; For the code snippet, extract the characteristics of the code snippet, input the characteristics of the code snippet into a language model, and generate a taint model corresponding to the code snippet; The taint knowledge base is updated according to the code snippet and the taint model corresponding to the code snippet.
6. The method according to claim 5, characterized in that The characteristics of the code snippet include one or more of annotations, method parameters, return values, comments, and class declarations.
7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: When the taint analysis results indicate a security issue, an alert is sent to the user.
8. A code management platform, characterized in that: The code management platform is used to perform taint analysis on the code of the program, and the code management platform includes: An identification module, used to identify third-party components in the program to be analyzed; A sub-library acquisition module is used to acquire a taint sub-library corresponding to the tripartite component in the program to be analyzed from a taint knowledge base, wherein the taint knowledge base is a knowledge base that records the tripartite component and the taint model corresponding to the tripartite component based on a domain-specific language DSL code; A model conversion module, configured to convert a general taint model into a taint model corresponding to the tripartite component according to the taint sub-library corresponding to the tripartite component, wherein the taint model includes at least one of a taint method, an outbreak point method or a propagation method; The taint analysis module is used to perform taint analysis using a taint model corresponding to the tripartite component.
9. The code management platform according to claim 8, characterized in that: The model conversion module is specifically used for: According to the application programming interface API of the tainted sub-library corresponding to the third-party component, query the code structure through the DSL query statement; The general taint model is converted into a taint model corresponding to the tripartite component according to the code structure.
10. The code management platform according to claim 8 or 9, characterized in that: The code management platform also includes: The knowledge management module is used to update the stain knowledge base according to the program to be analyzed.
11. The code management platform according to claim 10, characterized in that: The code management platform also includes: A retrieval module, used to identify an entry method referenced by the third-party component from the program to be analyzed; A reachability detection module, used to detect the reachability of the entry method and the taint model corresponding to the tripartite component; The knowledge management module is specifically used for: When the entry method and the taint model are reachable, the entry method and the taint model are updated to the taint knowledge base.
12. The code management platform according to claim 10, characterized in that: The code management platform also includes: A conversion module, used to convert the code of the program to be analyzed into a graph database node, wherein the graph database node is used to form a graph database, and to convert a DSL query statement into a graph database query statement; A query module, used to query the graph database through the graph database query statement to obtain a code snippet; A generating module, configured to extract characteristics of the code snippet, input the characteristics of the code snippet into a language model, and generate a taint model corresponding to the code snippet; The knowledge management module is specifically used for: The taint knowledge base is updated according to the code snippet and the taint model corresponding to the code snippet.
13. The code management platform according to claim 12, characterized in that: The characteristics of the code snippet include one or more of annotations, method parameters, return values, comments, and class declarations.
14. The code management platform according to any one of claims 8 to 13, characterized in that: The code management platform also includes: The taint alarm module is used to send an alarm to the user when the taint analysis results indicate a security issue.
15. A computing device cluster, characterized in that: The computing device cluster includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory, wherein the at least one memory stores computer-readable instructions; the at least one processor executes the computer-readable instructions so that the computing device cluster performs the code analysis method as described in any one of claims 1 to 7.
16. A computer-readable storage medium, characterized in that: The method comprises computer-readable instructions; the computer-readable instructions are used to implement the code analysis method according to any one of claims 1 to 7.
17. A computer program product, characterized in that The method comprises computer-readable instructions; the computer-readable instructions are used to implement the code analysis method according to any one of claims 1 to 7.
Citation Information
Cited By
Enhance codegen efficiency by eliminating redundant contexts in lossless manifold optimization
US12393405B1