Small program risk detection method and device, computer readable storage medium, electronic equipment and computer program product

Abstract

The embodiment of the invention discloses an applet risk detection method and device, a computer readable storage medium, electronic equipment and a computer program product. The applet risk detection method comprises the steps that after a target program file in a packaged file of an applet is obtained, the target program file is stored in the packaged file of the applet; risk injection point detection can be carried out on the target program file to obtain a risk injection point of the applet; and performing taint propagation analysis on the risk injection point to obtain a taint propagation path corresponding to the risk injection point, and generating a risk detection result for the applet based on the taint propagation path.

Description

Technical Field

[0001] This specification relates to the field of mini-program technology, and in particular to a mini-program risk detection method, device, computer-readable storage medium, electronic device, and computer program product. Background Art

[0002] Mini programs are lightweight applications that can be launched and run in a specific host application for user use without the need for user download and installation. The emergence of mini programs provides users with a more convenient service experience, and has been rapidly promoted and applied due to its lightweight and convenient features. While mini programs provide various services, they are often accompanied by many security risks. For example, developers can exploit potential security vulnerabilities in the mini program framework, or inject malicious code into the mini program, posing serious threats to the mini program's availability, controllability, and data privacy. However, there is currently a lack of solutions for effectively identifying risks in compiled and packaged mini program files, which affects the security of mini programs. Based on this, how to effectively identify the risks in compiled and packaged mini program files has become a technical problem that needs to be solved urgently. Summary of the Invention

[0003] The embodiments of this specification provide a mini-program risk detection method, device, computer-readable storage medium, electronic device and computer program product, which can effectively identify the risks existing in compiled and packaged mini-program files to improve the security of the mini-program.

[0004] The embodiments of this specification provide a method for detecting mini-program risks, the method comprising:

[0005] Get the target program file in the package file of the applet;

[0006] Performing risk injection point detection on the target program file to obtain the risk injection point of the mini program;

[0007] Performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point;

[0008] Based on the taint propagation path, a risk detection result for the mini program is generated.

[0009] The embodiments of this specification also provide a mini-program risk detection device, including:

[0010] The acquisition module is used to obtain the target program file in the package file of the mini program;

[0011] A detection module, configured to detect risk injection points for the target program file and obtain risk injection points for the mini-program;

[0012] An analysis module, configured to perform taint propagation analysis on the risk injection point to obtain a taint propagation path corresponding to the risk injection point;

[0013] A generation module is used to generate a risk detection result for the mini program based on the taint propagation path.

[0014] The embodiments of this specification also provide a computer-readable storage medium having a computer program stored thereon, and the computer program implements the steps of the above method when executed by a processor.

[0015] An embodiment of this specification further provides an electronic device, comprising: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the steps of the above method.

[0016] The embodiments of this specification also provide a computer program product having at least one instruction stored thereon, wherein the at least one instruction implements the steps of the above method when executed by a processor.

[0017] In an embodiment of the present specification, after obtaining the target program file in the packaged file of the mini-program, risk injection point detection can be performed on the target program file to conveniently and quickly obtain a more comprehensive risk injection point of the mini-program; after performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point, a more comprehensive and reliable risk detection result for the mini-program can be generated based on the taint propagation path, thereby conveniently and quickly identifying the risks existing in the compiled and packaged mini-program file, which is conducive to improving the security of the mini-program. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of an application scenario of a mini-program risk detection solution provided in an embodiment of this specification;

[0019] Figure 2 A flowchart of a method for detecting risk in a mini-program provided in an embodiment of this specification;

[0020] Figure 3 A schematic diagram of the structure of a mini-program risk detection device provided in an embodiment of this specification;

[0021] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0022] To make the objectives, technical solutions, and advantages of this specification more clear, the following will clearly and completely describe the technical solutions of this specification in conjunction with the specific embodiments of this specification and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this specification.

[0023] Before describing in detail the mini-program risk detection solution provided in the embodiments of this specification, the relevant technical background is first described.

[0024] With the widespread adoption of mini-programs, the complex and diverse security issues they face have gradually emerged. Currently, attackers may exploit potential security vulnerabilities in the mini-program framework or inject malicious code to obtain the private data of mini-program users, tamper with data involved in the mini-program's operation, or manipulate the mini-program to perform unauthorized operations, posing a serious threat to the security of the mini-program's operation.

[0025] However, since the mini-program framework includes a variety of security-related operations such as JSBridge calls, blacklist and whitelist settings, sensitive information processing, and permission checks, these operations often cause the compiled and packaged mini-program files to face diverse security risks, thereby increasing the difficulty of comprehensively detecting the various risks existing in the mini-program. In addition, since the compiled and packaged mini-program files themselves have characteristics such as code obfuscation and complex business logic, this further increases the complexity of detecting the various risks existing in the mini-program. In addition, when people conduct research on mini-program security issues, they are usually more concerned about specific risks such as sensitive data leakage, account hijacking, etc. at the business level of mini-programs. Therefore, there is still a lack of methods that can easily and comprehensively detect the risks of compiled and packaged mini-program files.

[0026] See Figure 1 , which is a schematic diagram of an application scenario of a mini-program risk detection solution provided in an embodiment of this specification.

[0027] like Figure 1As shown, the target device 101 of the service provider can obtain the packaged file 103 of the mini-program from the device 102 of the mini-program developer, thereby enabling the target device 101 to obtain the target program file in the packaged file 103 of the mini-program; and, perform risk injection point detection on the target program file, thereby obtaining the risk injection point of the mini-program. After performing taint propagation analysis on the risk injection point, the target device 101 can generate a comprehensive risk detection result 104 for the mini-program based on the taint propagation path corresponding to the risk injection point, so as to comprehensively, accurately and conveniently identify the risks existing in the compiled and packaged mini-program file, which is conducive to improving the security of the mini-program.

[0028] See Figure 2 , is a flowchart of a method for detecting mini-program risks provided by an embodiment of this specification. The execution subject of this process can be an application for identifying mini-program risks, or a device equipped with an application for identifying mini-program risks. Figure 2 The process shown in the figure is described in detail. The mini program risk detection method may specifically include the following steps:

[0029] Step 202: Obtain the target program file in the package file of the mini program.

[0030] In the embodiments of this specification, a mini-program's packaged file generally refers to a client-runnable code package generated by compiling and packaging the mini-program's source code. Because a mini-program's packaged file may contain security vulnerabilities caused by design flaws in the mini-program framework or malicious code injected by the mini-program developer, thereby affecting the mini-program's security, it is necessary to perform risk detection on the target program files within the packaged file.

[0031] Step 204: perform risk injection point detection on the target program file to obtain the risk injection point of the mini program.

[0032] In the embodiments of this specification, injection may refer to the process of passing a value or object to another object in some way. An injection point may refer to a specific location in a software program where injection can be performed. Based on this, a risk injection point may refer to an injection point that may bring preset risks to the mini-program, thereby affecting the security of the mini-program. Among them, there may be many types of preset risks, such as data privacy leakage risk, interface authentication risk, compliance risk, fraud risk, software virus invasion risk, program jamming, crash risk, etc., which are not specifically limited.

[0033] An object in JavaScript is a composite data type that can be a collection of related properties and methods. Properties can be associated with "keys" and "values." Keys can be strings or symbols, while values can be any JavaScript value. Furthermore, properties with functions as their values are called methods. Functions are code snippets that can be called by other code or themselves.

[0034] In actual applications, since the target program file obtained in step 202 is often a JavaScript file, an attacker can bring security risks to the program running process by tampering with the object information, or the methods of the object may also cause security vulnerabilities due to design defects or malicious tampering. On this basis, the objects contained in the target program file of the mini program and the properties and methods of the object can be used as risk injection points in the target program file.

[0035] Step 206: Perform taint propagation analysis on the risk injection point to obtain a taint propagation path corresponding to the risk injection point.

[0036] In the embodiments of this specification, taint propagation analysis (Taint Analysis), also known as taint analysis, is a technology that can track and analyze the propagation path of tainted data in a program to determine whether the tainted data will affect certain key program operations, thereby mining program vulnerabilities and identifying the risks brought by tainted data. It is widely used in the field of security assurance technology for software systems.

[0037] In taint propagation analysis, a taint source can represent untrusted input received by a program from the outside world, while a taint sink can typically be a set of security-sensitive functions. Based on this, the taint propagation path derived from taint propagation analysis can be specifically the propagation path between taint sources and taint sinks, based on data and control dependencies within the mini-program.

[0038] In the embodiments of this specification, since the risk injection point in the mini-program contains at least one of the objects, attributes, and methods that may cause security vulnerabilities in the mini-program, the data that may cause risks when the above-mentioned objects, attributes, or methods are used can be used as a taint source. Then, by tracking and analyzing the flow of information related to the above-mentioned taint source in the mini-program, the taint propagation path containing the taint source can be obtained, which serves as the taint propagation path corresponding to the risk injection point.

[0039] Step 208: Generate a risk detection result for the mini program based on the taint propagation path.

[0040] In the embodiments of this specification, since the taint propagation path can reflect the various sensitive data and security-sensitive operations in the mini-program that the risk injection point may affect, the various risks that the risk injection point may bring to the mini-program can be conveniently identified based on the taint propagation path. This helps ensure the comprehensiveness of the risk detection results for the mini-program.

[0041] In actual applications, since the mini program may also take some hazard removal operations to avoid the vulnerabilities that the risk injection point may bring to the mini program, so that the risk injection point will not cause substantial harm to the security of the mini program, it is also possible to detect and verify the various risks that the risk injection point may bring to the mini program to determine whether the risk injection point really brings substantial risks to the security of the mini program; this is conducive to improving the accuracy and effectiveness of the risk detection results for the mini program.

[0042] Figure 2 According to the method, after obtaining the target program file in the packaged file of the mini program, risk injection point detection can be performed on the target program file to quickly and easily obtain a more comprehensive risk injection point of the mini program; after performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point, a more comprehensive and reliable risk detection result for the mini program can be generated based on the taint propagation path, thereby quickly and easily identifying the risks existing in the compiled and packaged mini program file, which is beneficial to improving the security of the mini program.

[0043] based on Figure 2 The method in this specification also provides some specific implementation plans of the method, which are described below.

[0044] In the embodiment of this specification, step 202, obtaining the target program file in the package file of the mini-program, may include:

[0045] Obtain a package file obtained by compiling and packaging the source code of the applet.

[0046] Obtain a target program file for implementing the preset business logic of the mini program from the packaged file; wherein the target program file includes at least one of a mini program backend code file and a mini program front-end framework code file.

[0047] In the embodiments of this specification, compilation and packaging are two key steps in the software development process, wherein the compilation process can convert the source code into executable code, and the packaging process can package the compiled code and resources into a format that can be published and deployed to obtain a packaged file.

[0048] In the embodiments of this specification, the package file of the mini program can generally include all the code, resources and configuration information of the mini program. Among them, the code contained in the package file can generally include a part responsible for the view display of the mini program (for example, the Render part), and a part responsible for the business logic implementation, view update, etc. of the mini program (for example, the Worker part). In actual applications, the Render part and the Worker part usually include code files obtained by compiling the source code written by the developer, as well as code files obtained by compiling the source code of the mini program front-end framework, which will not be elaborated on.

[0049] In practice, business logic vulnerabilities are difficult to detect because they have few attack signatures and are difficult to detect with tools. This can easily impact the security of mini-programs, making attackers more likely to exploit them. Therefore, the code files within the mini-program's packaged files, which implement the mini-program's pre-set business logic, can be used as target program files for risk detection.

[0050] In actual applications, the target program file may include at least one of the mini-program backend code file and the mini-program front-end framework code file involved in the Worker portion, thereby enabling a more comprehensive detection of potential risks in the mini-program. Of course, due to the different requirements of different mini-program publishing platforms for packaged files, the specific type and format of the target program file may also vary, so this is not specifically limited.

[0051] In the embodiment of this specification, step 204, performing risk injection point detection on the target program file to obtain the risk injection point of the mini-program, may include:

[0052] A program static analysis is performed on the target program file to obtain preset built-in properties that need to be read during the operation of the mini program.

[0053] After setting the preset built-in attribute as the attribute of the root object at the target program file, the target program file is run to obtain reading result information for the preset built-in attribute.

[0054] Based on the reading result information of the preset built-in attribute, at least one target attribute of the first target attribute and the second target attribute that can serve as a risk injection point is determined; wherein, the first target attribute includes the preset built-in attribute whose attribute value is undefined, and the second target attribute includes the preset built-in attribute whose attribute value is defined.

[0055] In the embodiments of this specification, program static analysis may refer to a method of analyzing or checking the syntax, structure, procedures, interfaces, etc. of a program without running the program code to check whether the software complies with programming standards and thereby discover deficiencies in the written program. Built-in properties may refer to predefined properties of an object provided by a programming language or applet framework. These properties are generally inherent properties of the object and are used to store the object's state or metadata.

[0056] Because attackers can tamper with or abuse the built-in properties of the JavaScript-based mini-program framework, causing the mini-program to perform some normally prohibited operations, steal confidential data, or excessively consume system resources, thereby affecting the secure operation of the mini-program. Based on this, program static analysis can be performed on the target program file to obtain the preset built-in properties that the mini-program needs to read during operation, and then to identify in detail whether the use of the preset built-in properties will affect the secure and stable operation of the mini-program.

[0057] In actual applications, when the attribute value of the preset built-in attribute is not defined, the attribute value of the preset built-in attribute can be modified to conveniently verify whether the preset built-in attribute will bring risks to the operation process of the mini program. When the attribute value of the preset built-in attribute has been correctly defined, it is usually impossible to directly modify the attribute value of the preset built-in attribute. At this time, you can first identify whether the preset built-in attribute will be passed into the preset native method as a parameter. If so, you can modify the parameter information of the preset native method to indirectly verify whether the preset built-in attribute will bring risks to the operation process of the mini program. Based on this, it is possible to combine the prototype chain pollution method to quickly and conveniently identify whether the various preset built-in attributes required by the mini program belong to built-in attributes whose attribute values are undefined, and then use the corresponding verification method to verify the risk of each preset built-in attribute.

[0058] In practice, every object in JavaScript can have a private property that points to another object called a prototype. A prototype object can also have its own prototype, and so on, until an object's prototype is null. This chain of structures is called a prototype chain. The object with a null prototype is called the root object of the prototype chain.

[0059] Prototype pollution is a technique used to attack JavaScript programs by modifying the prototype chain of JavaScript objects, allowing unauthorized operations and control of the application. Specifically, when accessing an object's property or method, JavaScript first searches the object's own properties. If the method is not found, it searches the object's prototype. If that still isn't found, it continues searching the prototype's prototype until it finds the method, or until it reaches the top of the prototype chain.

[0060] Based on this, the preset built-in property can be set as the property of the root object (usually Object.prototype) at the target program file. In the process of dynamically executing the target program file, the property value of the preset built-in property is usually read. If the read result information for the preset built-in property is "undefined" information, it can indicate that the property value of the preset built-in property has not been defined in the target program file, so that the preset built-in property can be used as the first target property; and if the read result information for the preset built-in property indicates that the corresponding property value has been successfully read, it can indicate that the property value of the preset built-in property has been defined in the target program file, so that the preset built-in property can be used as the second target property, which is convenient, fast and accurate.

[0061] In the embodiments of this specification, static taint propagation analysis (referred to as static taint analysis) can refer to a method of detecting whether data can be propagated from a taint source Source to a taint sink point Sink by analyzing the dependencies between program variables without running and modifying the code. Specifically, when performing static taint propagation analysis, the program code can first be parsed to obtain an intermediate representation of the program code, and then the program code can be subjected to auxiliary analysis processing such as data flow analysis, control flow analysis, model checking, theorem proving, etc. based on the intermediate representation, so as to identify the Source and Sink points in the program code in combination with the taint analysis rules during the auxiliary analysis process. Since static taint propagation analysis does not require the actual running of the program and can cover the entire program code file, it can efficiently and accurately detect more potential vulnerabilities and security issues in the program code. Based on this, the first target attribute and the second target attribute that can serve as risk injection points can be combined to construct a taint source, so as to efficiently and conveniently identify a more comprehensive taint propagation path containing the taint source by performing static taint propagation analysis on the target program file, which is conducive to improving the comprehensiveness and accuracy of the mini program risk detection results.

[0062] Specifically, for the first target attribute, step 206: performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point may include:

[0063] A program statement in the target program file for reading the first target attribute is determined as a taint source in the target program file.

[0064] Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

[0065] In the embodiments of this specification, the "basic block" in a program file may refer to a sequence of statements executed in sequence. After the program file is divided into basic blocks, if the basic block is regarded as a basic unit node, the predecessor and successor relationship between the basic blocks in the program execution process can be regarded as an edge between the two basic blocks, based on which the entire program file can be converted into a directed graph, which can be referred to as a control flow graph (CFG). Since the control flow graph can reflect the execution order between each program statement in the program file, it helps to understand the execution flow and structure of the program, and then facilitates a comprehensive analysis of program behavior to identify potential logical errors, security risks and performance issues.

[0066] Based on this, when performing static taint propagation analysis on the target program file, the program statement in the target program file used to read the first target attribute can be used as a taint source. This allows the target program file to generate a comprehensive control flow path containing the taint source based on the control flow graph generated during the taint analysis process, thereby analyzing the control flow contamination corresponding to the first target attribute. The taint sources and taint convergence points contained in the control flow path can generally be program statements, which will not be elaborated on here.

[0067] In the embodiment of this specification, for the first target attribute, step 206: performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point may also include:

[0068] The attribute information of the first target attribute in the target program file is determined as a stain source in the target program file.

[0069] Based on the taint source, a static taint propagation analysis is performed on the target program file to obtain a data flow path including the taint source.

[0070] In the embodiments of this specification, a data flow graph (DFG) may be a diagram that represents the data dependencies between multiple operations. Because a data flow graph can clearly represent the data dependencies between statements and variables, it can intuitively demonstrate the flow of data and help understand the data processing logic, thereby facilitating the accurate identification of security vulnerabilities in a program.

[0071] Based on this, when performing static taint propagation analysis on the target program file, the attribute information (e.g., attribute value) of the first target attribute in the target program file can be used as a taint source. This allows the static taint propagation analysis on the target program file to generate a comprehensive data flow path containing the taint source based on the data flow graph generated during the taint analysis process, thereby analyzing the data flow contamination corresponding to the first target attribute. Nodes in the data flow path other than the taint source can generally be program statements, which will not be described in detail.

[0072] In the embodiment of this specification, for the second target attribute, step 206: performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point may include:

[0073] A program statement in the target program file for reading the second target attribute is determined as a taint source in the target program file.

[0074] Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

[0075] In the embodiments of this specification, the principle of performing static taint propagation analysis on the second target attribute to generate the corresponding control flow path may be consistent with the principle of performing static taint propagation analysis on the first target attribute to generate the corresponding control flow path, and no further details are given.

[0076] In the embodiment of this specification, for the second target attribute, step 206: performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point may also include:

[0077] The attribute information of the second target attribute in the target program file is determined as an initial taint source in the target program file.

[0078] Based on the initial taint source, a static taint propagation analysis is performed on the target program file to obtain an initial data flow path including the initial taint source.

[0079] If the initial data flow path contains a taint convergence point for calling a preset native method, the parameter information of the preset parameters contained in the preset native method is used as the taint source, and a static taint propagation analysis is performed on the target program file to obtain a data flow path containing the taint source.

[0080] In the embodiments of this specification, since the attribute value of the second target attribute has been pre-defined, attackers cannot usually directly modify the attribute value of the second target attribute; however, since the parameter information of the native method at the mini program can be modified, when the second target attribute can be passed as a parameter to a native method, the attacker can achieve an attack effect similar to that corresponding to directly tampering with the attribute value of the second target attribute by tampering with the parameter information of the preset native method.

[0081] Based on this, when conducting a risk analysis for risk injection points such as the second target attribute, the attribute information of the second target attribute in the target program file can be used as the initial taint source to perform a static taint propagation analysis to obtain the initial data flow path containing the initial taint source. If the initial data flow path does not contain a taint convergence point for calling a preset native method, it can be said that the second target attribute will not be passed as a parameter to the native method during the operation of the mini program. At this time, the risk to the mini program brought by the attacker directly or indirectly using the second target attribute is usually weak.

[0082] If the initial data flow path contains a taint convergence point for calling a preset native method, the parameter information of the preset parameters contained in the preset native method can be used as a taint source to perform static taint propagation analysis again, thereby obtaining a data flow path containing the taint source. Subsequently, on the one hand, the type of risk that the second target attribute may bring can be identified by combining whether the taint convergence point in the data flow path is a security-sensitive function; on the other hand, the preset parameters contained in the preset native method can be tampered with to verify whether the second target attribute actually brings risks. This helps to improve the comprehensiveness and accuracy of the mini-program risk detection results.

[0083] In the embodiment of this specification, step 204, performing risk injection point detection on the target program file to obtain the risk injection point of the mini-program, may include:

[0084] Perform static program analysis on the target program file to obtain the preset native method that needs to be called during the operation of the mini program, and obtain the target method that can be used as a risk injection point.

[0085] In the embodiments of the present specification, when performing static program analysis on the target program file, the program statements for calling preset native methods contained in the target program file can be obtained, so that the preset native methods required to be called by these program statements can be used as target methods belonging to risk injection points, which is convenient and quick. Among them, the preset native method can refer to a predefined function or operation provided by a programming language or a mini-program framework, which can be called directly in the code without additional definition or introduction. Of course, the developer-defined method required to be called by the program statement in the target program file can also be used as the target method to improve the comprehensiveness of risk detection, and there is no specific limitation on this.

[0086] In the embodiment of this specification, for the target method, step 206, performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point, may include:

[0087] A program statement in the target program file for calling the target method is determined as a taint source in the target program file.

[0088] Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

[0089] In the embodiments of this specification, since the principles of static taint propagation analysis and the meaning and generation principles of control flow paths containing taint sources have been described in detail in the previous embodiments, they will not be repeated here. However, since the taint sources contained in the control flow paths are usually program statements, the program statements used to call the target method in the target program file can be used as taint sources. By performing static taint propagation analysis on the target program file, a comprehensive control flow path containing the taint source can be obtained, and the control flow contamination corresponding to the target method can be analyzed.

[0090] In the embodiment of this specification, for the target method, step 206, performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point, may also include:

[0091] The method information of the target method in the target program file is determined as a taint source in the target program file.

[0092] Based on the taint source, a static taint propagation analysis is performed on the target program file to obtain a data flow path including the taint source.

[0093] In the embodiments of this specification, since the principle of static taint propagation analysis and the meaning and generation principle of the data flow path containing the taint source have been described in detail in the previous embodiments, they will not be repeated here. However, since the taint source contained in the data flow path usually does not belong to the program statement, the method information (for example, the method name) of the target method in the target program file can be used as the taint source. By performing static taint propagation analysis on the target program file, a comprehensive data flow path containing the taint source can be obtained, and then the data flow pollution corresponding to the above target method can be analyzed.

[0094] In the embodiment of this specification, step 204, performing risk injection point detection on the target program file to obtain the risk injection point of the mini-program, may include:

[0095] Perform static analysis on the target program file to determine at least one of the global objects and local objects contained in the target program file, and obtain a target object that can serve as a risk injection point. Or,

[0096] Obtain a preset global object set to obtain a target object that can be used as a risk injection point; the preset global object set includes global objects that are allowed to be used by the mini program. Or,

[0097] During the execution of the target program file, global objects contained in the target program file are searched to obtain target objects that can serve as risk injection points.

[0098] In the embodiments of the present specification, the objects included in the target program file may include global objects and local objects; wherein, a global object may refer to an object declared outside a function, whose scope may be the entire program text, and whose life cycle may cover the entire program running period; and a local object may refer to an object declared inside a function or code block, whose scope is usually limited to the function or code block in which it is defined, and whose life cycle may start from the execution of the definition statement and end at the end of the scope.

[0099] In the embodiments of this specification, in order to obtain more comprehensive object information involved in the operation of the mini-program, a static analysis of the program can be performed on the target program file to determine the global objects and local objects contained in the target program file. Alternatively, a specified function can be used to obtain the global objects in the target program file during the dynamic operation of the target program file. In addition, the global objects allowed to be used in different mini-programs built based on the same mini-program framework can usually be consistent. Therefore, the program files of other mini-programs can also be analyzed in advance to obtain a preset global object set containing various global objects allowed to be used by the mini-program, and then the global objects in the preset global object set can be used as target objects; it is convenient and fast, and there is no specific limitation on this.

[0100] In the embodiment of this specification, for the target object, step 206, performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point, may include:

[0101] A program statement in the target program file that contains the object information of the target object is determined as a taint source in the target program file.

[0102] Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

[0103] In the embodiments of this specification, since the static taint propagation analysis principle and the meaning and generation principle of the control flow path containing the taint source have been introduced in detail in the previous embodiments, they will not be described in detail. In actual applications, since the taint source contained in the control flow path is usually a program statement, the program statement containing the object information of the target object (for example, the object name) in the target program file can be used as the taint source. By performing static taint propagation analysis on the target program file, a comprehensive control flow path containing the taint source can be obtained, and then the control flow pollution situation corresponding to the above-mentioned target object can be analyzed.

[0104] In the embodiment of this specification, for the target object, step 206, performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point, may also include:

[0105] If the target object is a global object, the object information of the target object in the target program file is determined as a taint source in the target program file.

[0106] Based on the taint source, a static taint propagation analysis is performed on the target program file to obtain a data flow path containing the taint source. Or,

[0107] If the target object is a local object, the object information of the target object in the target program file is determined as the initial taint source in the target program file.

[0108] Based on the initial taint source, a static taint propagation analysis is performed on the target program file to obtain an initial data flow path including the initial taint source.

[0109] If the initial data flow path contains a taint convergence point for calling a preset native method, the parameter information of the preset parameters contained in the preset native method is used as the taint source, and a static taint propagation analysis is performed on the target program file to obtain a data flow path containing the taint source.

[0110] In an embodiment of the present specification, if the target object is a global object, and the target object is used to represent a variable value, the object information (for example, the object name) of the target object in the target program file can be used as a taint source to perform static taint propagation analysis, thereby obtaining a more comprehensive data flow path containing the taint source. Subsequently, the risk type that the target object may be involved in can be further determined based on the type of function involved in the taint convergence point in the data flow path, which will not be elaborated on. In addition, it is also possible to directly modify the variable value corresponding to the target object in the target program file to verify whether the target object will bring risks to the applet running process, which has good flexibility.

[0111] In actual applications, if the target object is a global object and is used to represent a preset function, then when the preset function is a security-sensitive function that may cause security issues, it can be directly determined that the target object may bring security risks to the mini program, which is convenient and quick.

[0112] In an embodiment of the present specification, if the target object is a local object, it is necessary to first use the object information of the target object in the target program file as the initial taint source to perform a static taint propagation analysis to obtain an initial data flow path containing the initial taint source. If the initial data flow path does not contain a taint convergence point for calling a preset native method, it can be said that the risk that an attacker can bring by directly or indirectly using the target object is relatively weak. If the initial data flow path contains a taint convergence point for calling a preset native method, the parameter information of the preset parameters contained in the preset native method can be used as a taint source to perform a static taint propagation analysis again to obtain a data flow path containing the taint source. Subsequently, on the one hand, it can be combined with whether the taint convergence point in the data flow path is a security-sensitive function to identify the type of risk that the target object may bring; on the other hand, it can also be verified by tampering with the preset parameters contained in the preset native method to verify whether the target object really brings risks; this is conducive to improving the comprehensiveness and accuracy of the mini-program risk detection results.

[0113] In the embodiment of this specification, step 208, generating a risk detection result for the mini-program based on the taint propagation path, may include:

[0114] A target payload corresponding to the taint source is obtained; the target payload includes: a preset payload and at least one of other payloads generated based on the preset payload and meeting a preset data format.

[0115] Based on the target payload and a preset application programming interface at the applet involved in the data flow path, a risk test case corresponding to the taint source is generated.

[0116] According to the execution result of the risk test case, it is determined whether the risk injection point corresponding to the taint source has a risk, and a risk detection result for the mini program is obtained.

[0117] In the embodiments of this specification, in the computer field, payload can refer to the valid data portion carried in the transmission protocol. For example, when the data to be transmitted during data transmission includes multiple parts such as a data header and raw data, if the data header is used to ensure the accurate transmission of the raw data, then the raw data can be the payload. In the process of risk detection for mini-programs, the data required to verify the preset risks that may be caused by the risk injection point corresponding to the taint source can be the target payload corresponding to the taint source.

[0118] Specifically, the data flow paths involved in the taint source can be manually analyzed in advance to facilitate the manual compilation of high-quality preset payloads corresponding to the taint source, combined with the business flow context. Furthermore, a preset generation strategy for the payload corresponding to the taint source can be set according to actual needs. This allows the dynamic engine or other software program in the electronic device to analyze and learn the characteristics of the preset payload and then automatically generate a large number of other high-quality payloads that meet the preset data format according to the preset generation strategy, which is conducive to meeting the requirements for relevant payloads when conducting risk verification of the taint source.

[0119] The preset data format can be set according to actual needs. For example, when the taint source is the attribute value of the attribute order number, if the corresponding preset payload is ABC123456, then the preset data format can be: the first three digits are "ABC" and the last six digits are numbers; or, the preset data format can also be a total of 9 characters and / or numbers. Alternatively, when the taint source is the attribute value of the attribute name, if the corresponding preset payload is Zhang San or John Wilson, then the preset data format can be: all Chinese characters or all English characters, or it can also be a Chinese surname and a preset number of Chinese characters in sequence, etc.; this is conducive to improving the authenticity and availability of other payloads generated based on the preset payload, and further improving the accuracy and effectiveness of using the above payload to verify the risks brought by the risk injection point corresponding to the taint source.

[0120] In the embodiments of this specification, a test case can be a set of test inputs, execution conditions, and expected results, which is used to verify the correctness of specific software functions, scenarios, or requirements. Based on this, when it is necessary to verify whether the risk injection point corresponding to the taint source really brings security risks to the applet, the data flow path where the taint source is located can be analyzed to determine the preset application programming interface API at the applet involved in the propagation process of the data in the data flow path. By combining the above-mentioned preset application programming interface, target payload, and specific business flow context, a risk test case for verifying the risk of the taint source can be customized to improve the effectiveness of the risk test case.

[0121] Subsequently, the dynamic engine or other software program at the electronic device can call the preset application programming interface at the applet by executing the risk test case, and input the target payload into the applet, thereby obtaining a test result obtained by processing the target payload according to the preset business logic at the applet. Based on the consistency between the test result and the expected result of the risk test case, it can be easily identified whether the applet has been successfully attacked by the target payload; if so, it can be considered that the risk injection point corresponding to the taint source is at risk; if not, it can be considered that the risk injection point corresponding to the taint source is not at risk. This makes it possible to quickly discover and verify security vulnerabilities in applet, and improve the efficiency and comprehensiveness of risk testing for applet.

[0122] In actual applications, historical experience can be combined to screen out the data flow paths with higher risks or higher importance involved in the taint source, and target payloads and risk test cases can be generated only based on these data flow paths with higher risks or higher importance, without having to generate target payloads and risk test cases for all data flow paths. This is conducive to improving the pertinence and effectiveness of using risk test cases and related payloads to verify the risk of the taint source, and is also conducive to reducing the consumption of human resources.

[0123] In the embodiment of this specification, step 208, generating a risk detection result for the mini-program based on the taint propagation path, may include:

[0124] Obtain function information of the objective function corresponding to the taint convergence point included in the taint propagation path.

[0125] Based on the function information of the objective function, the preset risk involved in the risk injection point corresponding to the taint propagation path is determined to obtain the risk detection result for the mini program.

[0126] In the embodiments of the present specification, since the taint convergence points contained in the taint propagation path can usually be security-sensitive functions that may cause security problems, and if these security-sensitive functions are not used correctly, they may lead to various risks such as data leakage and injection attacks, therefore, the function information of the target function corresponding to the taint convergence point can be obtained to combine the function information of the target function to determine the preset risks that the corresponding risk injection point may bring to the mini program; by using the various preset risks that may be brought by each risk injection point as the risk detection result for the mini program, it is beneficial to improve the comprehensiveness and accuracy of the identification of risks existing in the compiled and packaged mini program files, and its versatility is good, which is beneficial to ensuring the security of the mini program.

[0127] Based on the above, it can be seen that the mini program risk detection solution provided in the embodiments of this specification can accurately locate native methods, built-in properties, and objects in the mini program framework that may introduce risks as risk injection points. Because native methods, built-in properties, and objects are widely used in various business logic of the mini program framework, the mini program risk detection solution provided in the embodiments of this specification is widely applicable and comprehensive.

[0128] Furthermore, static taint propagation analysis can precisely track the taint propagation path within the mini-program code corresponding to the taint source corresponding to the aforementioned risk injection point, effectively identifying the potential impact of the vulnerability. Furthermore, by classifying taint propagation paths into various types, such as control flow paths and data flow paths, it helps to accurately grasp the nature and impact of the vulnerability, improving the accuracy and depth of vulnerability analysis to effectively address the diverse risks that may exist in mini-programs.

[0129] Furthermore, by manually writing preset payloads and automatically generating other high-quality payloads based on these preset payloads, the diverse needs of the risk detection process for high-quality payloads can be met. Furthermore, by customizing risk test cases based on the aforementioned payloads, the preset application programming interface of the mini-program, and the specific business flow context, and simulating different attack scenarios against the mini-program through the execution of risk test cases, security vulnerabilities in the mini-program framework can be quickly and effectively verified, which is conducive to improving the efficiency and comprehensiveness of mini-program risk verification.

[0130] Based on the same idea, the embodiments of this specification also provide a device corresponding to the above method. Figure 3 , is a schematic diagram of the structure of a mini-program risk detection device provided in the embodiment of this specification. Figure 3As shown, the mini-program risk detection device 3 can be implemented as all or part of an electronic device through software, hardware, or a combination of both. According to some embodiments, the mini-program risk detection device 3 may include an acquisition module 31, a detection module 32, an analysis module 33, and a generation module 34, wherein:

[0131] The acquisition module 31 is used to acquire the target program file in the package file of the mini program.

[0132] The detection module 32 is used to perform risk injection point detection on the target program file to obtain the risk injection point of the mini program.

[0133] The analysis module 33 is configured to perform taint propagation analysis on the risk injection point to obtain a taint propagation path corresponding to the risk injection point.

[0134] The generation module 34 is used to generate a risk detection result for the mini program based on the taint propagation path.

[0135] Optionally, the acquisition module 31 may include:

[0136] The first acquisition unit is used to acquire a package file obtained by compiling and packaging the source code of the mini program.

[0137] The second acquisition unit is used to obtain a target program file for implementing the preset business logic of the mini program from the packaged file; wherein, the target program file includes at least one of a mini program backend code file and a mini program front-end framework code file.

[0138] Optionally, the detection module 32 may include:

[0139] The first program analysis unit is used to perform program static analysis on the target program file to obtain preset built-in properties that need to be read during the operation of the mini program.

[0140] The program running unit is used to set the preset built-in attribute as the attribute of the root object at the target program file, and then obtain reading result information for the preset built-in attribute by running the target program file.

[0141] A first determination unit is used to determine at least one of a first target attribute and a second target attribute that can serve as a risk injection point based on the reading result information of the preset built-in attribute; wherein the first target attribute includes the preset built-in attribute whose attribute value is undefined, and the second target attribute includes the preset built-in attribute whose attribute value is defined.

[0142] Optionally, the analysis module 33 may include:

[0143] The second determining unit is configured to determine a program statement in the target program file for reading the first target attribute as a taint source in the target program file.

[0144] The first analysis unit is configured to perform static taint propagation analysis on the target program file based on the taint source to obtain a control flow path including the taint source.

[0145] Optionally, the analysis module 33 may include:

[0146] The third determining unit is configured to determine the attribute information of the first target attribute in the target program file as a stain source in the target program file.

[0147] The second analysis unit is configured to perform static taint propagation analysis on the target program file based on the taint source to obtain a data flow path including the taint source.

[0148] Optionally, the analysis module 33 may include:

[0149] The fourth determining unit is configured to determine a program statement in the target program file for reading the second target attribute as a taint source in the target program file.

[0150] The third analysis unit is configured to perform static taint propagation analysis on the target program file based on the taint source to obtain a control flow path including the taint source.

[0151] Optionally, the analysis module 33 may include:

[0152] The fifth determining unit is configured to determine the attribute information of the second target attribute in the target program file as an initial taint source in the target program file.

[0153] The fourth analysis unit is configured to perform a static taint propagation analysis on the target program file based on the initial taint source to obtain an initial data flow path including the initial taint source.

[0154] The fifth analysis unit is used to, if the initial data flow path contains a taint convergence point for calling a preset native method, use the parameter information of the preset parameters contained in the preset native method as the taint source, perform static taint propagation analysis on the target program file, and obtain a data flow path containing the taint source.

[0155] Optionally, the detection module 32 may include:

[0156] The second program analysis unit is used to perform program static analysis on the target program file, obtain the preset native method that needs to be called during the operation of the mini program, and obtain the target method that can be used as a risk injection point.

[0157] Optionally, the analysis module 33 may include:

[0158] The sixth determining unit is configured to determine a program statement in the target program file for calling the target method as a taint source in the target program file.

[0159] The sixth analysis unit is configured to perform static taint propagation analysis on the target program file based on the taint source to obtain a control flow path including the taint source.

[0160] Optionally, the analysis module 33 may include:

[0161] The seventh determining unit is configured to determine the method information of the target method in the target program file as a taint source in the target program file.

[0162] The seventh analysis unit is configured to perform static taint propagation analysis on the target program file based on the taint source to obtain a data flow path including the taint source.

[0163] Optionally, the detection module 32 may include:

[0164] The third program analysis unit is used to perform a program static analysis on the target program file, determine at least one of the global objects and local objects contained in the target program file, and obtain a target object that can be used as a risk injection point. Or,

[0165] The third acquisition unit is used to acquire a preset global object set to obtain a target object that can be used as a risk injection point; the preset global object set includes global objects that are allowed to be used by the mini program. Or,

[0166] The search unit is used to search for global objects contained in the target program file during the execution of the target program file to obtain a target object that can be used as a risk injection point.

[0167] Optionally, the analysis module 33 may include:

[0168] An eighth determining unit is configured to determine a program statement in the target program file that contains object information of the target object as a taint source in the target program file.

[0169] An eighth analysis unit is configured to perform static taint propagation analysis on the target program file based on the taint source to obtain a control flow path including the taint source.

[0170] Optionally, the analysis module 33 may include:

[0171] The ninth determining unit is configured to determine, if the target object is a global object, the object information of the target object in the target program file as a taint source in the target program file.

[0172] a ninth analyzing unit, configured to perform static taint propagation analysis on the target program file based on the taint source to obtain a data flow path including the taint source; or

[0173] The tenth determining unit is configured to determine, if the target object is a local object, the object information of the target object in the target program file as an initial taint source in the target program file.

[0174] A tenth analysis unit is configured to perform a static taint propagation analysis on the target program file based on the initial taint source to obtain an initial data flow path including the initial taint source.

[0175] The eleventh analysis unit is used to, if the initial data flow path contains a taint convergence point for calling a preset native method, use the parameter information of the preset parameters contained in the preset native method as a taint source, perform static taint propagation analysis on the target program file, and obtain a data flow path containing the taint source.

[0176] Optionally, the generating module 34 may include:

[0177] The fourth acquisition unit is used to acquire a target payload corresponding to the taint source; the target payload includes: a preset payload and at least one of other payloads generated based on the preset payload and meeting a preset data format.

[0178] A test case generation unit is used to generate a risk test case corresponding to the taint source based on the target payload and a preset application programming interface at the applet involved in the data flow path.

[0179] The first risk identification unit is used to determine whether there is a risk at the risk injection point corresponding to the taint source based on the execution result of the risk test case, and obtain a risk detection result for the mini program.

[0180] Optionally, the generating module 34 may include:

[0181] The fifth acquisition unit is used to obtain function information of the objective function corresponding to the taint convergence point included in the taint propagation path.

[0182] The second risk identification unit is used to determine the preset risk involved in the risk injection point corresponding to the taint propagation path based on the function information of the objective function, and obtain the risk detection result for the mini program.

[0183] The above-mentioned device embodiments correspond to the method embodiments. For detailed descriptions, please refer to the description of the method embodiments, which will not be repeated here. The device embodiments are obtained based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments. For detailed descriptions, please refer to the corresponding method embodiments.

[0184] The embodiment of this specification also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above Figure 2 The specific execution process of the mini-program risk detection method shown can be found in the specific description of the relevant embodiments of the mini-program risk detection method, which will not be repeated here.

[0185] This specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 2 The specific execution process of the mini-program risk detection method shown can be found in the specific description of the relevant embodiments of the mini-program risk detection method, which will not be repeated here.

[0186] The embodiments of this specification also provide Figure 4 The structural diagram of the electronic device shown in FIG. Figure 4 At the hardware level, the electronic device may include a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 2 The specific execution process of the mini-program risk detection method shown can be found in the specific description of the relevant embodiments of the mini-program risk detection method, which will not be repeated here.

[0187] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0188] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for computer-readable storage media, computer program products and Figure 4 As for the electronic device shown, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0189] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD through their own programming, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0190] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0191] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0192] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0193] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0194] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0195] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0196] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0197] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0198] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0199] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0200] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0201] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Thus, this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0202] This specification may be described in the general context of computer-executable instructions, such as program modules, executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media, including storage devices.

[0203] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0204] The foregoing is merely an example of the present invention and is not intended to limit the present invention. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be included within the scope of the claims of the present invention.

Claims

1. A method for detecting mini-program risks, the method comprising: Get the target program file in the package file of the applet; Performing risk injection point detection on the target program file to obtain the risk injection point of the mini program; Performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point; Based on the taint propagation path, a risk detection result for the mini program is generated.

2. The method according to claim 1, wherein obtaining the target program file in the package file of the mini-program comprises: Obtaining a package file obtained by compiling and packaging the source code of the mini-program; Obtain a target program file for implementing the preset business logic of the mini program from the packaged file; wherein the target program file includes at least one of a mini program backend code file and a mini program front-end framework code file.

3. The method according to claim 1, wherein the step of detecting risk injection points for the target program file to obtain risk injection points for the mini-program comprises: Performing static analysis on the target program file to obtain preset built-in properties required to be read during the running of the mini program; After setting the preset built-in attribute as the attribute of the root object at the target program file, obtaining reading result information for the preset built-in attribute by running the target program file; Based on the reading result information of the preset built-in attribute, at least one of the first target attribute and the second target attribute that can serve as a risk injection point is determined; wherein, the first target attribute includes the preset built-in attribute whose attribute value is undefined, and the second target attribute includes the preset built-in attribute whose attribute value is defined.

4. The method according to claim 3, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: determining a program statement in the target program file for reading the first target attribute as a taint source in the target program file; Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

5. The method according to claim 3, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: determining the attribute information of the first target attribute in the target program file as a taint source in the target program file; Based on the taint source, a static taint propagation analysis is performed on the target program file to obtain a data flow path including the taint source.

6. The method according to claim 3, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: determining a program statement in the target program file for reading the second target attribute as a taint source in the target program file; Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

7. The method according to claim 3, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: determining the attribute information of the second target attribute in the target program file as an initial taint source in the target program file; Based on the initial taint source, static taint propagation analysis is performed on the target program file to obtain an initial data flow path including the initial taint source; If the initial data flow path contains a taint convergence point for calling a preset native method, the parameter information of the preset parameters contained in the preset native method is used as the taint source, and a static taint propagation analysis is performed on the target program file to obtain a data flow path containing the taint source.

8. The method according to claim 1, wherein the step of detecting risk injection points for the target program file to obtain risk injection points for the mini-program comprises: A program static analysis is performed on the target program file to obtain the preset native method that needs to be called during the operation of the mini program, and a target method that can be used as a risk injection point is obtained.

9. The method according to claim 8, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: determining a program statement in the target program file for calling the target method as a taint source in the target program file; Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

10. The method according to claim 8, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: determining the method information of the target method in the target program file as a taint source in the target program file; Based on the taint source, a static taint propagation analysis is performed on the target program file to obtain a data flow path including the taint source.

11. The method according to claim 1, wherein the step of detecting risk injection points for the target program file to obtain risk injection points for the mini-program comprises: Performing a program static analysis on the target program file to determine at least one of a global object and a local object contained in the target program file, and obtaining a target object that can serve as a risk injection point; or Obtain a preset global object set to obtain a target object that can be used as a risk injection point; the preset global object set includes global objects that are allowed to be used by the mini program; or, During the execution of the target program file, global objects contained in the target program file are searched to obtain target objects that can serve as risk injection points.

12. The method according to claim 11, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: determining a program statement in the target program file that contains object information of the target object as a taint source in the target program file; Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a control flow path containing the taint source.

13. The method according to claim 11, wherein the performing taint propagation analysis on the risk injection point to obtain the taint propagation path corresponding to the risk injection point comprises: If the target object is a global object, determining the object information of the target object in the target program file as a taint source in the target program file; Based on the taint source, static taint propagation analysis is performed on the target program file to obtain a data flow path including the taint source; or, If the target object is a local object, determining the object information of the target object in the target program file as an initial taint source in the target program file; Based on the initial taint source, static taint propagation analysis is performed on the target program file to obtain an initial data flow path including the initial taint source; If the initial data flow path contains a taint convergence point for calling a preset native method, the parameter information of the preset parameters contained in the preset native method is used as the taint source, and a static taint propagation analysis is performed on the target program file to obtain a data flow path containing the taint source.

14. The method according to claim 5, 7, 10 or 13, wherein generating a risk detection result for the mini-program based on the taint propagation path comprises: Obtaining a target payload corresponding to the taint source; The target payload includes: a preset payload and at least one of other payloads generated based on the preset payload and meeting a preset data format; Generating a risk test case corresponding to the taint source based on the target payload and a preset application programming interface at the applet involved in the data flow path; According to the execution result of the risk test case, it is determined whether the risk injection point corresponding to the taint source has a risk, and a risk detection result for the mini program is obtained.

15. The method according to any one of claims 4-7, 9-10, and 12-13, wherein generating a risk detection result for the mini-program based on the taint propagation path comprises: Obtaining function information of the objective function corresponding to the taint convergence point included in the taint propagation path; Based on the function information of the objective function, the preset risk involved in the risk injection point corresponding to the taint propagation path is determined to obtain the risk detection result for the mini program.

16. A mini-program risk detection device, comprising: The acquisition module is used to obtain the target program file in the package file of the mini program; A detection module, configured to detect risk injection points for the target program file and obtain risk injection points for the mini-program; An analysis module, configured to perform taint propagation analysis on the risk injection point to obtain a taint propagation path corresponding to the risk injection point; A generation module is used to generate a risk detection result for the mini program based on the taint propagation path.

17. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

18. An electronic device comprising: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the steps of the method according to any one of claims 1 to 15.

19. A computer program product having at least one instruction stored thereon, wherein when the at least one instruction is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

Images