Structured query statement protection method and computer program product

Abstract

The invention relates to a structured query statement protection method and a computer program product. The method comprises the following steps: performing static program analysis on source code data of a network application program to obtain a static analysis result; extracting an interface parameter called by a database programming interface function in the source code data according to a static analysis result, and reversely querying definition data of the interface parameter in the source code data under the condition that the interface parameter is a variable, determining a structured query statement and the position of the structured query statement in the source code data according to the definition data of the interface parameters; and according to the structured query statement and the position of the structured query statement, adding a randomized tag to the keyword of the structured query statement so as to obtain the randomized structured query statement according to the randomized tag. By adopting the method, the problems of poor generality, low accuracy and low processing efficiency of SQL statement randomization can be solved at the same time.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a structured query statement protection method and a computer program product. Background Art

[0002] SQL (Structured Query Language) injection attacks are cyberattacks targeting web applications. They exploit security vulnerabilities in web application code, allowing attackers to insert or inject one or more SQL statements into the original query, thereby tricking the database server into executing unauthorized commands. This attack can be used to gain unauthorized access to the database, modify data, leak information, or even completely destroy the database. In the field of network security, SQL injection attack protection based on instruction set randomization is considered an effective defense. Without knowing the grammatical rules of randomized SQL, attackers cannot construct the corresponding SQL statements to carry out injection attacks. Accordingly, SQL statements in web applications must also meet the grammatical rules of randomized SQL to run content query operations in a randomized SQL environment.

[0003] Traditional SQL randomization techniques are critical for randomizing SQL statements within web applications. These techniques primarily involve writing randomized SQL statements directly for database operations during web application development. Alternatively, they involve performing secondary processing after web application development, primarily using regular expressions to match SQL statements within a file and replace them with randomized SQL statements. However, none of these approaches offer the simultaneous universality, accuracy, and efficiency of SQL statement randomization. Summary of the Invention

[0004] Based on this, it is necessary to provide a structured query language protection method and computer program product that can simultaneously meet the universality, accuracy and processing efficiency of SQL statement randomization to address the above technical problems.

[0005] In a first aspect, the present application provides a structured query statement protection method, comprising:

[0006] Perform static program analysis on source code data of network applications to obtain static analysis results;

[0007] Extracting interface parameters called by database programming interface functions in the source code data based on static analysis results, and in the case where the interface parameters are variables, reversely querying definition data of the interface parameters in the source code data, and determining structured query statements and the location of the structured query statements in the source code data based on the definition data of the interface parameters;

[0008] According to the structured query statement and the position of the structured query statement, a randomized tag is added to the keyword of the structured query statement to obtain a randomized structured query statement according to the randomized tag.

[0009] In one embodiment, the static analysis results include at least one basic block corresponding to the source code data, a definition usage chain, and a static single assignment intermediate representation structure within each basic block. When the number of basic blocks is at least two, the static analysis results also include a control flow graph corresponding to the basic block.

[0010] In one embodiment, extracting interface parameters called by database programming interface functions in source code data based on static analysis results, and if the interface parameters are variables, reversely querying definition data of the interface parameters in the source code data, and determining the structured query statement and the location of the structured query statement in the source code data based on the definition data of the interface parameters includes:

[0011] Identifying a database programming interface function in a static single-assignment intermediate representation structure within at least one basic block, and extracting interface parameters called by the database programming interface function;

[0012] In a case where the interface parameter is a variable and the number of basic blocks is at least two, reversely querying definition data of the interface parameter in a static single-assignment intermediate representation structure in at least two basic blocks according to the control flow graph and the definition usage chain;

[0013] In the case where the interface parameter is a variable and the number of basic blocks is one, definition data of the interface parameter is reversely queried in a static single-assignment intermediate representation structure within one basic block according to the definition usage chain.

[0014] In one embodiment, when the interface parameter is a variable and the number of basic blocks is at least two, reversely querying definition data of the interface parameter in a static single-assignment intermediate representation structure in at least one basic block according to a control flow graph and a definition usage chain includes:

[0015] For the current basic block, all successor blocks of the current basic block are determined according to the control flow graph, and the current propagation variable set of the current basic block is determined according to the undefined variable sets of all successor blocks of the current basic block; the variables in the current propagation variable set of the current basic block are interface parameters;

[0016] According to the definition use chain, reverse query the definition data of the interface parameters in the static single assignment intermediate representation structure in the current basic block;

[0017] If no definition data of the interface parameters is found in the current basic block, the interface parameters are added to the undefined variable set corresponding to the current basic block, and the undefined variable set corresponding to the current basic block is transferred to all predecessor blocks of the current basic block according to the control flow graph;

[0018] According to the query order of all predecessor blocks of the current basic block in the control flow graph, the predecessor blocks of the current basic block are updated to the current basic block in sequence, and the step of determining all successor blocks of the current basic block according to the control flow graph is returned, and the reverse query is continued until the definition data of the interface parameters are queried.

[0019] In one embodiment, determining the structured query statement and the location of the structured query statement in the source code data according to the definition data of the interface parameters includes:

[0020] In the case where a primary variable exists in the definition data of the interface parameter, the definition data of the primary variable is searched backward from the location of the primary variable in the static single-assignment intermediate representation structure in the first basic block where the definition data of the interface parameter is located according to the definition usage chain;

[0021] If definition data of a primary variable is not found in the first basic block, the primary variable is added to an undefined variable set corresponding to the first basic block, and the undefined variable set corresponding to the first basic block is transferred to all predecessor blocks of the first basic block according to the control flow graph, and each predecessor block of the first basic block is used as a second basic block.

[0022] Determine all successor blocks of each second basic block according to the control flow graph, and determine the current propagation variable set of each second basic block according to the undefined variable sets of all successor blocks of each second basic block; wherein the successor blocks of each second basic block include the first basic block, and the current propagation variable set of each second basic block includes the primary variables; and reversely query the definition data of the variables in the current propagation variable set of each second basic block in the static single-assignment intermediate representation structure within each second basic block according to the query order of each second basic block in the control flow graph;

[0023] If the definition data of the primary variable is not found in each second basic block, each second basic block is updated to the first basic block, and the process returns to the step of adding the primary variable to the undefined variable set corresponding to the first basic block, and the reverse search is continued until the definition data of the primary variable is found.

[0024] In the case where a constant value exists in the definition data of the primary variable, the constant value and the position of the constant value in the definition data of the primary variable are respectively determined as the structured query statement and the position of the structured query statement.

[0025] In one embodiment, after querying the definition data of the primary variable, the method further includes:

[0026] When a secondary variable exists in the definition data of a primary variable, the definition data of the secondary variable is queried backwards from the location of the secondary variable in the static single-assignment intermediate representation structure within the third basic block where the definition data of the primary variable is located according to the definition usage chain;

[0027] If no definition data of the secondary variable is found in the third basic block, the secondary variable is added to the undefined variable set corresponding to the third basic block, and the undefined variable set corresponding to the third basic block is transferred to all predecessor blocks of the third basic block according to the control flow graph, and each predecessor block of the third basic block is used as the fourth basic block;

[0028] Determine all successor blocks of each fourth basic block according to the control flow graph, and determine a current propagation variable set of each fourth basic block according to undefined variable sets of all successor blocks of each fourth basic block; wherein the successor blocks of each fourth basic block include the third basic block, and the current propagation variable set of each fourth basic block includes secondary variables; and reversely query the definition data of the variables in the current propagation variable set of each fourth basic block in a static single-assignment intermediate representation structure within each fourth basic block according to the query order of each fourth basic block in the control flow graph;

[0029] If the definition data of the secondary variable is not found in each fourth basic block, each fourth basic block is updated to the third basic block, and the step of adding the secondary variable to the undefined variable set corresponding to the third basic block is returned, and the reverse query is continued until the definition data of the secondary variable is found.

[0030] In one embodiment, the method further includes: when the interface parameter is a constant, determining the constant value of the interface parameter and the position of the constant value as the structured query statement and the position of the structured query statement respectively.

[0031] In one embodiment, determining the structured query statement and the location of the structured query statement in the source code data according to the definition data of the interface parameters includes:

[0032] In the case where the definition data of the interface parameter contains a constant value, the constant value and the position of the constant value in the definition data of the interface parameter are respectively determined as the structured query statement and the position of the structured query statement.

[0033] In one embodiment, the static analysis result includes at least one basic block corresponding to the source code data, a definition-use chain, and a static single-assignment intermediate representation structure within each basic block. When there are at least two basic blocks, the static analysis result also includes a control flow graph corresponding to the basic block.

[0034] Perform static program analysis on the source code data of the network application, and obtain the following static analysis results:

[0035] Perform lexical analysis and grammatical analysis on the source code data of the network application to obtain an abstract syntax tree;

[0036] Convert the abstract syntax tree into an initial intermediate representation structure;

[0037] Dividing the initial intermediate representation structure into at least one basic block;

[0038] In the case where there is only one basic block, data flow analysis and static single assignment form conversion are performed on each basic block to obtain a definition use chain corresponding to the basic block and a static single assignment intermediate representation structure in each basic block;

[0039] When the number of the basic blocks is at least two, control flow analysis, data flow analysis and static single assignment form conversion are performed on the at least two basic blocks respectively to obtain control flow graphs, definition use chains and static single assignment intermediate representation structures within each basic block corresponding to the at least two basic blocks.

[0040] In a second aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in any method embodiment in the first aspect when executing the computer program.

[0041] In a third aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of any method embodiment in the first aspect when the computer program is executed by a processor.

[0042] In a fourth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps in any method embodiment in the first aspect.

[0043] The above-mentioned structured query statement protection method, computer device, storage medium and computer program product obtain static analysis results by performing static program analysis on the source code data of the network application. Since the network application uses database programming interface functions to perform database operations, and the SQL statements in the source code data are passed to the database programming interface functions via interface parameters, starting from the database programming interface functions, the interface parameters called by the database programming interface functions in the source code data are extracted based on the static analysis results. When the interface parameters are variables, the definition data of the interface parameters are reversely queried in the source code data, which can more accurately and quickly find structured query statements scattered in various locations in the source code data. And only randomized tags are added to the keywords in the structured query statements, which can avoid the problem of tag leakage caused by the mistaken addition of keywords and the problem of application function abnormality caused by the lack of keywords. In addition, this method does not require pre-defined matching rules and has strong universality. It also solves the problems of poor universality, low accuracy and low processing efficiency of randomized SQL statements. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0045] Figure 1 A schematic diagram of a flow chart of a structured query statement protection method in one embodiment;

[0046] Figure 2 A schematic diagram of a process for extracting interface parameters called by database programming interface functions in source code data based on static analysis results, and reversely querying definition data of the interface parameters in the source code data when the interface parameters are variables, in one embodiment;

[0047] Figure 3 Schematic diagram of a sink propagation algorithm in one embodiment;

[0048] Figure 4 is a schematic diagram of a variable propagation algorithm in one embodiment;

[0049] Figure 5 is a schematic diagram of a reverse data flow propagation algorithm in one embodiment;

[0050] Figure 6 A schematic diagram of the overall framework of a structured query statement protection method in one embodiment;

[0051] Figure 7A schematic diagram of string concatenation SQL querying Web source code in one embodiment;

[0052] Figure 8 In one embodiment, Figure 7 Schematic diagram of SQL query in Web source code;

[0053] Figure 9 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0055] In traditional SQL randomization technology, randomizing SQL statements in web applications is a key issue. The main methods are as follows:

[0056] First, during the Web application development phase, internal statements involving database operations are directly written as randomized SQL statements. Although this method can adapt to the operating environment, it requires the addition of another set of development rules during development, resulting in poor versatility of the method.

[0057] The second method involves secondary processing after web application development. This primarily uses regular expressions to match SQL statements in files and replace them with randomized SQL statements. This method is highly versatile, but rule-based regular expression matching requires predefined matching rules. This can lead to significant mismatches and omissions for different web applications, and the low accuracy of randomization can lead to randomized tag leakage and web application malfunctions. Furthermore, regular expression processing becomes more time-consuming as file content increases.

[0058] Therefore, none of the above methods can simultaneously solve the problems of poor versatility, low accuracy, and low processing efficiency of SQL statement randomization. To address these issues, a structured query statement protection method is proposed. By performing reverse queries on variables in the source code data, this method addresses the problems of poor versatility, low accuracy, and low processing efficiency of SQL statement randomization.

[0059] In an exemplary embodiment, Figure 1 As shown, a structured query statement protection method is provided. This embodiment uses the method applied to a terminal as an example for illustration. It is understandable that the method can also be applied to a server, or to a system including a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0060] Step 102: Perform static program analysis on the source code data of the network application to obtain static analysis results.

[0061] Source code data refers to uncompiled text files written in a pre-set programming language specification. Static program analysis is a code analysis technique that scans source code data without running the code, using techniques such as lexical analysis, syntax analysis, control flow, and data flow analysis to verify whether the source code meets standards such as compliance, security, reliability, and maintainability.

[0062] Optionally, the source code data of the network application is obtained, and static program analysis is performed on the source code data to obtain static analysis results. The static analysis results may include at least one basic block corresponding to the source code data, a control flow graph corresponding to at least one basic block, a definition-use chain, and a static single-assignment intermediate representation structure within each basic block. A basic block is the smallest unit of code execution, with a single entry point, a single exit point, and no branches. The source code data within each basic block is executed sequentially without interruption. A control flow graph is a graphical representation used to display all possible execution paths within the source code data. A definition-use chain is used to track the definition and use of variables within the source code data. An intermediate representation structure is an intermediate representation between the source code data and the target machine code, used to transfer and process code between different compilation stages. The target machine code is the binary code generated by compiling the source code data and directly recognized by the CPU. In the static single-assignment intermediate representation structure, each variable definition is unique and can only be used after it is defined, facilitating code analysis during the compilation process.

[0063] Alternatively, you can use tools such as ANTLR (syntax analyzer) and LLVM (low-level virtual machine), or perform static program analysis based on a programming language interpreter.

[0064] Step 104, extracting the interface parameters called by the database programming interface function in the source code data based on the static analysis results, and in the case where the interface parameters are variables, reversely querying the definition data of the interface parameters in the source code data, and determining the structured query statement and the location of the structured query statement in the source code data based on the definition data of the interface parameters.

[0065] Database programming interface functions, also known as database API (Application Programming Interface) functions, are programming interfaces used to interact with databases. Interface parameters are the interface through which database programming interface functions interact with the external world. Interface parameters define the input data required by database programming interface functions and pass the actual data when the function is called, allowing the function to perform specific functions. Interface parameter definition data includes the interface parameter's definition location and definition content. The definition content, namely the value assigned to the interface parameter, represents the input data required by the database programming interface function. Reversely querying interface parameter definition data refers to querying interface parameter definition data in the opposite direction of data transmission. Structured query statements are high-level, non-procedural programming languages used for database operations such as database queries, updates, and management.

[0066] The source code data of a network application forms a complete SQL statement during top-down execution and is passed to the database programming interface function through the interface parameter. However, when the source code data is not running, the interface parameter is mostly a variable value. This embodiment reversely queries the definition and location of each SQL fragment that constitutes the complete SQL statement starting from the variable value.

[0067] Optionally, starting from the database programming interface function, reversely query the transmission status of the interface parameters called by the database programming interface function, find the structured query statements scattered in various locations in the source code data and perform random processing. The database programming interface function includes a database operation function, which can be defined as a sink function below. For example, the variable v defined at point p can be transmitted through the data stream to the parameters of the function at point q, which is a sink function and its parameters are used to operate the database. The goal of this embodiment is to find the definition data of the variable v and the constant value (structured query statement) contained in the definition data and the location of the constant value.

[0068] Specifically, based on the static analysis results, the interface parameters called by the database programming interface functions in the source code data are extracted. Whether the interface parameters are variables is identified. If so, the definition data of the interface parameters is reversely searched in the source code data based on the static analysis results. Based on the definition data of the interface parameters, the structured query statements and their locations in the source code data are determined, thereby obtaining the structured query statements distributed at various locations in the source code data.

[0069] Furthermore, in the case where the interface parameter is a constant, the constant value of the interface parameter and the position of the constant value are respectively determined as the structured query statement and the position of the structured query statement.

[0070] When the interface parameter is a constant, the constant value of the interface parameter is directly used as the structured query statement, and the position of the constant value is used as the position of the structured query statement.

[0071] Step 106 : adding random tags to the keywords of the structured query statement according to the structured query statement and the position of the structured query statement, so as to obtain a randomized structured query statement according to the random tags.

[0072] Optionally, a keyword randomization module adds randomization tags to keywords in the structured query statement based on the structured query statement and the position of the structured query statement, thereby obtaining a randomized structured query statement based on the randomization tags, and outputting a web application containing the randomized structured query statement. The web application can be run in a randomized structured query statement agent / interpreter environment.

[0073] In the above-mentioned structured query statement protection method, static analysis results are obtained by performing static program analysis on the source code data of the network application. Since the network application uses the database programming interface function to perform database operations, and the SQL statements in the source code data are passed to the database programming interface function through interface parameters, starting from the database programming interface function, the interface parameters called by the database programming interface function in the source code data are extracted according to the static analysis results. When the interface parameters are variables, the definition data of the interface parameters are reversely queried in the source code data, which can more accurately and quickly find the structured query statements scattered in various locations in the source code data. And only randomized tags are added to the keywords in the structured query statements, which can avoid the problem of label leakage caused by the mistaken addition of keywords and the problem of application function abnormality caused by insufficient addition of keywords. In addition, this method does not require pre-defined matching rules and has strong universality. At the same time, it solves the problems of poor universality, low accuracy and low processing efficiency of randomized SQL statements.

[0074] The following describes the reverse query process for the definition data of interface parameters.

[0075] In an exemplary embodiment, Figure 2 As shown, the static analysis results include at least one basic block corresponding to the source code data, a definition use chain, and a static single assignment intermediate representation structure within each basic block. When there are at least two basic blocks, the static analysis results also include a control flow graph corresponding to the basic block. In step 104, the interface parameters called by the database programming interface function in the source code data are extracted based on the static analysis results, and when the interface parameters are variables, the definition data of the interface parameters are reversely searched in the source code data, including steps 202 to 206. Among them:

[0076] Step 202: Identify a database programming interface function in a static single-valued intermediate representation structure within at least one basic block, and extract interface parameters called by the database programming interface function.

[0077] Step 204 : when the interface parameter is a variable and the number of basic blocks is at least two, reversely query the definition data of the interface parameter in a static single assignment intermediate representation structure in at least one basic block according to the control flow graph and the definition usage chain.

[0078] Step 206 : When the interface parameter is a variable and the number of basic blocks is one, reversely query the definition data of the interface parameter in a static single-assignment intermediate representation structure in one basic block according to the definition usage chain.

[0079] Among them, when the source code data corresponds to one basic block, the static analysis results include the definition use chain and the static single assignment intermediate representation structure within each basic block, but do not include the control flow graph. When the source code data corresponds to multiple basic blocks, the static analysis results include not only the definition use chain and the static single assignment intermediate representation structure within each basic block, but also the control flow graph. The control flow graph includes the jump relationship between multiple basic blocks and the reverse query order between multiple basic blocks. The jump relationship between multiple basic blocks is used to determine the variables that need to be queried and the variables that need to be transferred in each basic block. The reverse query order is a linear query order, and reverse queries are performed in each basic block in turn according to the reverse query order. The definition use chain includes the definition data of the internal variables of each basic block, the use location of the definition data, and the connection relationship between the definition data of the internal variables and the use location of the definition data.

[0080] Optionally, during the reverse query process, the reverse data flow propagation algorithm is called to reversely traverse the static single-assignment intermediate representation structure in each basic block, identify the sink function called by the source code data, extract the interface parameters called by the sink function, and determine whether the interface parameters are constants or variables.

[0081] When the interface parameter is a variable and the number of basic blocks is at least two, based on the jump relationship between multiple basic blocks in the control flow graph and the reverse query order between multiple basic blocks, as well as the connection relationship between the definition data of the variable in the definition usage chain and the usage location of the definition data, the definition data of the interface parameter is reversely queried in the static single assignment intermediate representation structure within at least one basic block, thereby determining the structured query statement and the location of the structured query statement based on the definition data of the interface parameter.

[0082] In the case where the interface parameter is a variable and the number of basic blocks is one, definition data of the interface parameter is reversely queried in a static single-assignment intermediate representation structure within one basic block according to the definition usage chain.

[0083] Exemplarily, the reverse data flow propagation algorithm includes a sink propagation algorithm and a variable propagation algorithm. The sink propagation algorithm is used to reversely traverse the static single-assignment intermediate representation structure in each basic block, identify the sink function called by the source code data, extract the interface parameters called by the sink function, and determine whether the interface parameters are constants or variables. The variable propagation algorithm is used to reversely query the definition data of the interface parameters in the static single-assignment intermediate representation structure in at least one basic block according to the control flow graph and the definition use chain when the interface parameters are variables. Among them, the sink propagation algorithm (sink_propagationsink) is as follows Figure 3 As shown, the code is explained as follows: sink_propagationsink takes basic block B as input and outputs the constant value and line number of the interface parameter of the sink function call. The following is an explanation of each line of code: 1: Reversely traverse the IR of basic block B; IR refers to SSA IR, which is a static single assignment intermediate representation; 2: If it is a sink function call; 3: Get the sink function name; 4: If the sink function name is in the sink function list; 5: Get the sink function interface parameter; 6: If the interface parameter is a constant; 7: Print the line number and constant value; 8: If the interface parameter is a variable; 9: Call the VARS_PROPAGATION algorithm (variable propagation algorithm); 10-13: End.

[0084] In this embodiment, when an interface parameter is a variable and there are at least two basic blocks, the definition data of the interface parameter is reversely queried in a static single-assignment intermediate representation structure within at least two basic blocks based on the control flow graph and the definition-use chain. When an interface parameter is a variable and there is only one basic block, the definition data of the interface parameter is reversely queried in a static single-assignment intermediate representation structure within one basic block based on the definition-use chain. Because each variable definition in the static single-assignment intermediate representation structure is unique and a variable can only be used after being defined, the problem of non-unique definition locations caused by multiple definitions of the same variable can be avoided, and the definition data of the variable can be accurately queried. According to the control flow graph, variable definition queries can be performed according to the jump relationships between multiple basic blocks and the reverse query order between multiple basic blocks. Based on the connection relationship between the variable definition data and the definition data usage location in the definition-use chain, the location of the variable definition data can be quickly determined, achieving accurate and rapid tracking of variable data transmission within each basic block. This allows for rapid and accurate retrieval of interface parameter definition data.

[0085] In an optional manner of the above embodiment, when the interface parameter is a variable and the number of basic blocks is at least two, reversely querying definition data of the interface parameter in a static single-assignment intermediate representation structure in at least one basic block according to the control flow graph and the definition usage chain includes:

[0086] For the current basic block, all successor blocks of the current basic block are determined according to the control flow graph, and the current propagation variable set of the current basic block is determined according to the undefined variable sets of all successor blocks of the current basic block; the variables in the current propagation variable set of the current basic block are interface parameters;

[0087] According to the definition use chain, reverse query the definition data of the interface parameters in the static single assignment intermediate representation structure in the current basic block;

[0088] If no definition data of the interface parameters is found in the current basic block, the interface parameters are added to the undefined variable set corresponding to the current basic block, and the undefined variable set corresponding to the current basic block is transferred to all predecessor blocks of the current basic block according to the control flow graph;

[0089] According to the query order of all predecessor blocks of the current basic block in the control flow graph, the predecessor blocks of the current basic block are updated to the current basic block in sequence, and the step of determining all successor blocks of the current basic block according to the control flow graph is returned, and the reverse query is continued until the definition data of the interface parameters are queried.

[0090] All successor blocks of the current basic block refer to the basic blocks that are reverse-queried before the current basic block and have a direct jump relationship with the current basic block. The undefined variable set of the successor block refers to the set of variables whose definition data is not found in the successor block. The current propagated variable set of the current basic block refers to the set of variables that are reverse-queried to the current basic block. All predecessor blocks of the current basic block refer to the basic blocks that are reverse-queried after the current basic block and have a direct jump relationship with the current basic block.

[0091] Optionally, since there may be conditional branches in the source code data, different conditional branches will be divided into different basic blocks, and the basic blocks corresponding to different conditional branches are in a parallel relationship, and data will not be propagated between the basic blocks corresponding to different conditional branches. Therefore, each basic block may have multiple successor blocks or multiple predecessor blocks. In order to avoid missing variables, for the current basic block that needs to be reversely queried, all successor blocks of the current basic block are determined according to the control flow graph through the variable propagation algorithm. Then, the undefined variable sets of all successor blocks of the current basic block are obtained, and the union of the undefined variable sets of all successor blocks of the current basic block is calculated to obtain the current propagation variable set of the current basic block; the variables in the current propagation variable set of the current basic block are interface parameters.

[0092] Next, the interface parameter definition data is reversely queried within the static single-assignment intermediate representation structure within the current basic block based on the definition usage chain. Specifically, the definition data of the variables in the current propagated variable set of the current basic block are reversely queried. If the interface parameter definition data is not found within the current basic block, the interface parameter is added to the undefined variable set corresponding to the current basic block. Considering that the current basic block may have multiple predecessor blocks, all predecessor blocks of the current basic block are determined based on the control flow graph, and the undefined variable set corresponding to the current basic block is propagated to all predecessor blocks of the current basic block.

[0093] All predecessor blocks of the current basic block are independent of each other and do not transmit data between them. However, during the reverse query process, the reverse query order between basic blocks is linear, that is, only one basic block can be queried at a time. Therefore, the query order of all predecessor blocks of the current basic block is determined according to the control flow graph. According to the query order of all predecessor blocks of the current basic block, each predecessor block of the current basic block is updated to the current basic block in sequence. The process returns to the step of determining all successor blocks of the current basic block according to the control flow graph, and the reverse query continues until the definition data of the interface parameters is found.

[0094] In this optional approach, the definition data of the interface parameters is reversely queried in the static single-assignment intermediate representation structure within the current basic block according to the definition usage chain, enabling accurate and fast intra-block reverse query. If the definition data of the interface parameters cannot be found within the current basic block, the interface parameters are transferred to the previous basic block of the current basic block according to the control flow graph, and an inter-block iterative reverse query is performed until the definition data of the interface parameters is obtained. This enables accurate inter-block iteration and facilitates fast and accurate query of the definition data of the interface parameters.

[0095] In an exemplary embodiment, determining the structured query statement and the location of the structured query statement in the source code data according to the definition data of the interface parameters includes:

[0096] In the case where a primary variable exists in the definition data of the interface parameter, the definition data of the primary variable is searched backward from the location of the primary variable in the static single-assignment intermediate representation structure in the first basic block where the definition data of the interface parameter is located according to the definition usage chain;

[0097] If definition data of a primary variable is not found in the first basic block, the primary variable is added to an undefined variable set corresponding to the first basic block, and the undefined variable set corresponding to the first basic block is transferred to all predecessor blocks of the first basic block according to the control flow graph, and each predecessor block of the first basic block is used as a second basic block.

[0098] Determine all successor blocks of each second basic block according to the control flow graph, and determine the current propagation variable set of each second basic block according to the undefined variable sets of all successor blocks of each second basic block; wherein the successor blocks of each second basic block include the first basic block, and the current propagation variable set of each second basic block includes the primary variables; and reversely query the definition data of the variables in the current propagation variable set of each second basic block in the static single-assignment intermediate representation structure within each second basic block according to the query order of each second basic block in the control flow graph;

[0099] If the definition data of the primary variable is not found in each second basic block, each second basic block is updated to the first basic block, and the process returns to the step of adding the primary variable to the undefined variable set corresponding to the first basic block, and the reverse search is continued until the definition data of the primary variable is found.

[0100] In the case where a constant value exists in the definition data of the primary variable, the constant value and the position of the constant value in the definition data of the primary variable are respectively determined as the structured query statement and the position of the structured query statement.

[0101] The first level variables refer to the variables used in the definition data of the interface parameters, including newly added or previously appeared variables. The first basic block refers to the basic block where the definition data of the interface parameters are located.

[0102] Optionally, if a primary variable exists within the definition data of an interface parameter, a reverse query is first performed within the first basic block. Specifically, a variable propagation algorithm is nested within the variable propagation algorithm. Based on the definition chain, a reverse query is performed on the primary variable's definition data, starting from the location of the primary variable within the static single-assignment intermediate representation structure within the first basic block where the definition data of the interface parameter exists. If the primary variable's definition data is not found within the first basic block, the primary variable is added to the undefined variable set corresponding to the first basic block.

[0103] In this embodiment, all predecessor blocks of the first basic block are determined according to the control flow graph, and the undefined variable set corresponding to the first basic block is transferred to all predecessor blocks of the first basic block. For the sake of convenience, each predecessor block of the first basic block is regarded as the second basic block.

[0104] All successor blocks of each second basic block are determined based on the control flow graph. When each second basic block includes multiple successor blocks, since the undefined variable sets of each successor block may be different, this embodiment obtains the undefined variable sets of all successor blocks of each second basic block, calculates the union of the undefined variable sets of all successor blocks of each second basic block, and obtains the currently propagated variable set of each second basic block. The successor blocks of each second basic block include the first basic block, and the currently propagated variable set of each second basic block includes primary variables.

[0105] The control flow graph is used to determine the order in which each second basic block is searched. Based on the order in which each second basic block is searched, the static single-valued intermediate representation within each second basic block is sequentially used to reversely search for the definition data of the variables in the current propagation variable set of each second basic block. If the definition data of the primary variable is not found within each second basic block, each second basic block is updated to the first basic block, and the process returns to the step of adding the primary variable to the undefined variable set corresponding to the first basic block. The reverse search is continued until the definition data of the primary variable is found.

[0106] It is identified whether a constant value exists in the definition data of the primary variable. If a constant value exists, the constant value is determined as a structured query statement, and the position of the constant value is determined as the position of the structured query statement.

[0107] For example, the variable propagation algorithm (vars_propagation) used in this embodiment is as follows: Figure 4 As shown, the code is explained as follows: the input of the variable propagation algorithm is basic block B, and the output is the line number and constant value of vars. Among them, vars represents the variables whose definition data contains structured query statements (constant values) during the reverse query process. The following is an explanation of each line of code: 1: Reversely traverse each IR of basic block B; IR represents a static single-assignment intermediate representation structure; 2: If the definition of var is found, add var to the kill set; var represents a variable, which is initially an interface parameter; the kill set represents the set of defined variables in basic block B, storing variables whose definition data has been found in basic block B; 3: If the definition is a constant; 4: Print the line number and constant value; 5: If the definition uses the variable used_var, add used_var to the gen set; used_var represents a variable used in the definition data of basic block B. The gen set represents the used variable set of basic block B, which stores the variable used_var used in the definition data of basic block B; 6: nested call of VARS_PROPAGATION function to perform reverse data flow propagation within the block for used_var; 7: end judgment; 8: if the definition of var is not found; 9: add var to the IN[B] set and hand it over to the predecessor block for processing; IN[B] represents the undefined variable set of basic block B, which stores variables whose definition data are not found in basic block B; 10: end judgment; 11: end loop traversal.

[0108] Furthermore, the conversion relationship between the kill set, gen set, and IN[B] can be shown as follows:

[0109] IN[B]=gen B ∪(OUT[B]–killB )

[0110] For a basic block B, IN[B] represents the set of undefined variables of basic block B. B That is the gen set, which represents the set of variables used by basic block B. OUT[B] represents the current propagation variable set of basic block B. kill B That is the kill set, which represents the combination of defined variables of basic block B.

[0111] Furthermore, OUT[B]=∪ S a successor of B IN[S], where basic block S represents the successor block of basic block B, and OUT[B] is equal to the union of the undefined variable sets of all successor blocks of basic block B.

[0112] In this optional method, by identifying whether there are primary variables in the definition data of the interface parameters, if there are primary variables, a reverse query is first performed in the first basic block where the definition data of the interface parameters is located according to the control flow graph. If the definition data of the primary variables is not found, a reverse query is continued in the predecessor block of the first basic block. For each predecessor block, the current propagation variable set of each second basic block is obtained by combining the undefined variables of all successor blocks of each predecessor block. The definition data of the variables in the current propagation variable set of each second basic block is reversely queried in each second basic block, which can avoid missing variable definitions and thus accurately find the definition data of the primary variables.

[0113] Furthermore, after the definition data of the primary variable is found, the method further includes:

[0114] When a secondary variable exists in the definition data of a primary variable, the definition data of the secondary variable is queried backwards from the location of the secondary variable in the static single-assignment intermediate representation structure within the third basic block where the definition data of the primary variable is located according to the definition usage chain;

[0115] If no definition data of the secondary variable is found in the third basic block, the secondary variable is added to the undefined variable set corresponding to the third basic block, and the undefined variable set corresponding to the third basic block is transferred to all predecessor blocks of the third basic block according to the control flow graph, and each predecessor block of the third basic block is used as the fourth basic block;

[0116] Determine all successor blocks of each fourth basic block according to the control flow graph, and determine a current propagation variable set of each fourth basic block according to undefined variable sets of all successor blocks of each fourth basic block; wherein the successor blocks of each fourth basic block include the third basic block, and the current propagation variable set of each fourth basic block includes secondary variables; and reversely query the definition data of the variables in the current propagation variable set of each fourth basic block in a static single-assignment intermediate representation structure within each fourth basic block according to the query order of each fourth basic block in the control flow graph;

[0117] If the definition data of the secondary variable is not found in each fourth basic block, each fourth basic block is updated to the third basic block, and the step of adding the secondary variable to the undefined variable set corresponding to the third basic block is returned, and the reverse query is continued until the definition data of the secondary variable is found.

[0118] The second-level variables refer to the variables used in the definition data of the first-level variables. The third basic block refers to the basic block where the definition data of the first-level variables are located.

[0119] Optionally, if the secondary variable does not exist in the definition data of the primary variable, it indicates that all variables have been queried, and the reverse query process is stopped at this time.

[0120] The reverse query process for secondary variable definition data is the same as that for primary variable definition data. Specifically, if a secondary variable is used in the definition data of a primary variable, a reverse query is first performed within the third basic block. Specifically, the variable propagation algorithm is invoked, and based on the definition usage chain, the definition data of the secondary variable is reversely searched, starting from the location of the secondary variable in the static single-assignment intermediate representation structure within the third basic block where the primary variable definition data is located. If the definition data of the secondary variable is not found within the third basic block, the secondary variable is added to the undefined variable set corresponding to the third basic block.

[0121] All predecessor blocks of the third basic block are determined according to the control flow graph, and the undefined variable set corresponding to the third basic block is transferred to all predecessor blocks of the third basic block. For ease of expression, each predecessor block of the third basic block is regarded as the fourth basic block.

[0122] All successor blocks of each fourth basic block are determined based on the control flow graph. When each fourth basic block includes multiple successor blocks, since the undefined variable sets of each successor block may be different, this embodiment obtains the undefined variable sets of all successor blocks of each fourth basic block, calculates the union of the undefined variable sets of all successor blocks of each fourth basic block, and obtains the currently propagated variable set of each fourth basic block. The successor blocks of each fourth basic block include the third basic block, and the currently propagated variable set of each fourth basic block includes secondary variables.

[0123] The control flow graph is used to determine the query order for each fourth basic block. Based on the query order for each fourth basic block, a reverse query is performed in the static single-assignment intermediate representation structure within each fourth basic block to find the definition data of the variables in the current propagation variable set of each fourth basic block. If the definition data of the secondary variable is not found within each fourth basic block, each fourth basic block is updated to the third basic block, and the process returns to the step of adding the secondary variable to the undefined variable set corresponding to the third basic block. The reverse query is continued until the definition data of the secondary variable is found.

[0124] In this embodiment, if there are secondary variables in the definition data of the primary variable, the definition data of the secondary variable is queried according to the reverse query method of the definition data of the primary variable, and the definition data of all variables can be accurately queried, thereby determining the structured query statement in the definition data, and accurately identifying the structured query statements in all positions.

[0125] For example, the complete backword propagation algorithm is as follows Figure 5 As shown, the code is explained: the input of the reverse data flow propagation algorithm is all basic blocks, and the output is the interface parameter of the sink function. The following is an explanation of each line of code: 1: / / Intra-block propagation; 2: Reverse traverse each basic block; 3: Call the SINK_PROPAGARION function to identify the interface function; 4: End traversal; 6: / / Inter-block iterative propagation; 7: Set the Worklist collection, which is used to store all basic blocks; 8: Start the loop when the Worklist collection is not empty; 9: Determine a basic block B; 10: Calculate the OUT[B] collection of basic block B; 11: Store the IN[B] collection of basic block B; 12: Start the loop when OUT[B] is not empty; 13: Traverse the variables vars in the OUT[B] collection; 14: Call the VARS_PROPAGATION function to complete the reverse data propagation of all vars in basic block B; 15: End the loop; 16: When it is determined that IN[B] has changed; 17: Add the predecessor block of basic block B to the Worklist collection to complete the data propagation of the newly generated variables; 18: End the judgment; 19: End the loop.

[0126] Specifically, intra-block propagation is first performed, traversing each basic block in reverse. The SINK_PROPAGARION function is called to identify sinks and complete reverse data propagation within the block. Inter-block propagation is then iterated, storing all basic blocks in the Worklist set. During the reverse query process, a basic block is retrieved from the Worklist set for reverse query. When basic block B is retrieved for reverse query, the OUT[B] set for basic block B is calculated, representing the current set of propagated variables for basic block B. The variables vars in the OUT[B] set are traversed, and the VAR_PROPAGATION function is called to complete reverse data propagation for all vars in basic block B. If a new variable appears in basic block B, IN[B] will change, requiring all predecessor blocks of basic block B to be re-added to the Worklist set to complete data propagation for the new variable. This is primarily to account for loops between basic blocks. For example, if the data propagation relationship between each basic block is basic block 1 -> basic block 2, basic block 2 -> basic block 3, and basic block 3 -> basic block 2, a loop exists between basic blocks 2 and 3. Basic Block 2's predecessors include Basic Block 1 and Basic Block 3. The default reverse query order is Basic Block 3, Basic Block 2, and Basic Block 1. If the IN set changes while querying Basic Block 2, this indicates a new variable has appeared in Basic Block 2, possibly defined in a predecessor of Basic Block 2. Therefore, its predecessors, Basic Block 1 and Basic Block 3, are added to the Worklist set. (Although Basic Block 1 has not yet been queried, an operation is still added to the Worklist set, and internal deduplication is performed. Unqueried items are only queried once, but Basic Block 3 has already been queried, and variables may be defined in Basic Block 3.) Basic Block 1 is then reverse-queried, followed by another reverse-query of Basic Block 4.

[0127] When the Worklist collection is completely executed and empty, inter-block propagation is complete. After the BACKWORD PROPAGATION algorithm completes intra-block and inter-block propagation, it can obtain all structured query statements and their locations in the network application. Based on the value and line number of the structured query statement, it can accurately add random tags to the keywords of the structured query statement in the source code data.

[0128] In an exemplary embodiment, determining a structured query statement and a position of the structured query statement in source code data based on definition data of an interface parameter includes: when a constant value exists in the definition data of the interface parameter, determining the constant value and the position of the constant value in the definition data of the interface parameter as the structured query statement and the position of the structured query statement, respectively.

[0129] After querying the definition data of the interface parameter, if a constant value exists in the definition data of the interface parameter, the constant value is determined as a structured query statement, and the position of the constant value is determined as the position of the structured query statement. The structured query statement and its position can be quickly determined.

[0130] In an exemplary embodiment, the static analysis results include at least one basic block corresponding to the source code data, a definition-use chain, and a static single-assignment intermediate representation structure within each basic block. When the number of basic blocks is at least two, the static analysis results also include a control flow graph corresponding to the basic block. Static program analysis is performed on the source code data of the network application to obtain the static analysis results, which include: performing lexical analysis and syntactic analysis on the source code data of the network application to obtain an abstract syntax tree; converting the abstract syntax tree into an initial intermediate representation structure; dividing the initial intermediate representation structure into at least one basic block; when there is one basic block, performing data flow analysis and static single-assignment form conversion on the basic block to obtain a definition-use chain corresponding to the basic block and a static single-assignment intermediate representation structure within each basic block; when there are at least two basic blocks, performing control flow analysis, data flow analysis, and static single-assignment form conversion on at least two basic blocks to obtain control flow graphs, definition-use chains, and static single-assignment intermediate representation structures corresponding to the at least two basic blocks.

[0131] Optionally, during the static program analysis process, the source code data of the network application is subjected to lexical analysis, syntax analysis, intermediate code generation, basic block partitioning, control flow analysis (CFA), data flow analysis (DFA), and static single assignment (SSA) conversion.

[0132] Specifically, lexical analysis is performed on the source code data to generate character sequences (tokens). Tokens are character sequences that the source code data is broken down into. Each token represents a basic element in the program, such as a keyword, identifier, literal, or operator. Tokens are the output of lexical analysis and form the basis for constructing an Abstract Syntax Tree (AST).

[0133] Performs syntactic analysis on a character sequence to generate an abstract syntax tree (AST). This tree represents the abstract syntax structure of the source code data, representing the building blocks of a programming language. AST is a key intermediate representation when compiling or interpreting source code data.

[0134] Intermediate code generation involves converting an abstract syntax tree into an initial intermediate representation (IR). This IR (Intermediate Representation) is a representation between source code and target machine code, used to transfer and process code between different compilation stages.

[0135] Afterwards, the initial intermediate representation structure is divided into at least one basic block. Specifically, the entry statement can be determined first. The entry statement is the starting instruction of a basic block and must meet the following three conditions: ① The first statement of the program: The starting position of the code segment must be the entry point of a basic block. ② The target statement of the jump instruction: This includes the target position of conditional jumps (such as if statements) and unconditional jumps (such as goto statements). ③ The statement immediately following the jump statement: If the program execution flow may pass through the next statement after the jump instruction, this statement also serves as the entry point, for example, the sequential execution position after a conditional jump fails.

[0136] Next, the scope of the basic block is divided. It begins at the entry point and ends at the next entry point or the end of the program: each basic block contains all consecutive instructions from the current entry point to the next entry point (excluding the previous one). For example, if the entry statement is instruction 3 and the next entry point is instruction 7, the basic block scope is instruction 3-instruction 6. Jumping into or out of a basic block is not allowed: only sequential execution is allowed within a basic block. If a jump instruction (such as return or goto) is encountered, it marks the end of the current basic block.

[0137] When there is only one basic block, data flow analysis and static single assignment form conversion are performed on only one basic block, and control flow analysis is not performed. When there are at least two basic blocks, control flow analysis, data flow analysis, and static single assignment form conversion need to be performed on at least two basic blocks.

[0138] By performing control flow analysis on each basic block, we determine the jump relationships between basic blocks and the possible execution paths of the network application, forming a control flow graph (CFG). Control flow analysis focuses on the execution path of the program, that is, the possible direction of the program's control flow. The purpose of the analysis is to determine which code paths in the program are reachable and the program's execution flow.

[0139] By performing data flow analysis on each basic block, we identify the definition (def) and use (use) of each variable in each basic block, and obtain a definition-use chain. Data flow analysis focuses on how the values of variables in each basic block are transmitted between different nodes. It is used to connect the definition of a variable with the node that uses the definition, thereby tracing the definition and use of variables in the program.

[0140] Furthermore, the process of static single assignment form conversion includes: (1) Inserting Euler function (Phi function): Determine the confluence point of the control flow in the control flow graph, that is, the place where multiple paths merge, and determine whether the variable in the IR within each basic block has multiple definition points. If a variable has multiple definition points, it is necessary to insert Phi function at these confluence points. Phi function is used to determine the value of the variable at the confluence point according to the actual situation of the control flow. During the reverse query process, multiple definition points need to be traversed. (2) Renaming variables: For each variable definition, a new variable version is created, and the variable version is updated at the node where the variable is used. In this way, each variable is assigned only once, maintaining the SSA form, and finally obtaining the SSA form IR. In the SSA form IR, the definition of each variable is unique and can only be used after the variable is defined.

[0141] In this embodiment, lexical and syntactic analysis is performed on the source code data of a network application to obtain an abstract syntax tree (ABST). The ABST is then converted into an initial intermediate representation (IOR) structure useful for program analysis. The IOR structure is then divided into at least one basic block to facilitate variable search. When there are at least two basic blocks, control flow analysis, data flow analysis, and static single assignment form conversion are performed on the at least two basic blocks. Control flow analysis can reveal all possible execution paths within the network application and reveal jump relationships between basic blocks. Data flow analysis can track the definition and use of variables in the network application, facilitating data propagation tracking of the variables. Converting the at least two basic blocks into a static single assignment form allows for the determination of the unique definition of each variable, making it easier to quickly and accurately search for structured query statements within the definition.

[0142] In an exemplary embodiment, the overall framework of the structured query statement protection method is as follows: Figure 6 As shown, lexical analysis is performed on the web application source code to obtain a character sequence (Token). Syntax analysis is performed on the character sequence to obtain an Abstract Syntax Tree (AST). The AST is translated into an initial Intermediate Representation (IR). The IR is divided into at least one basic block, and control flow analysis (CFA), data flow analysis (DFA), and static single assignment intermediate representation (SSA IR) are performed on the at least one basic block.

[0143] Backward data propagation is performed based on the control flow graph, definition usage chain, and static single assignment intermediate representation structure to identify the database operation function (sink) and extract the interface parameters called by the database operation function. When the interface parameter is a variable (vars), the definition data of the interface parameter is reversely queried. Finally, the structured query statement (SQL statement) can be found based on the definition data of the interface parameter.

[0144] Next, the structured query statement is randomized (SQL keyword randomization). The structured query statement is matched with the SQL keyword pool to determine the keywords in the structured query statement. Random labels are added to the keywords in the source data. Based on the random labels, the randomized structured query statement is generated.

[0145] like Figure 7 The following example shows a web source code example of string concatenation for SQL queries. In line 1, the variable $keyword obtains user input from the page. In line 5, it is concatenated with "WHERE userid LIKE" and assigned to the variable $wheresql. The value of $wheresql represents a conditional statement in the SQL statement. In line 8, $wheresql is concatenated with "SELECT * FROM `users`" and assigned to the variable $sql. Finally, in line 9, the mysqli_query function accepts the variable $sql as a parameter to access the database. The final value of $sql is "SELECT * FROM `users` WHERE userid LIKE 'XXX'", where XXX is the user input data obtained by $keyword. In the SQL statement that accesses the database, the keywords SELECT and FROM appear on line 8, while the keywords WHERE and LIKE appear on line 5.

[0146] In order to prevent SQL injection attacks caused by malicious user input, SQL randomization is performed on the Web application source code.

[0147] First, we perform static program analysis on the Web source code to obtain the static analysis results. Then, based on the static analysis results, we extract the interface parameters called by the database programming interface functions in the Web source code. If the interface parameters are variables, we reversely query the definition data of the interface parameters in the Web source code and find the SQL statements in the source code based on the definition data of the interface parameters.

[0148] like Figure 8 The figure shows a schematic diagram of SQL query on Web source code. The reverse query order is basic block B2, basic block B1 and basic block B0. The arrows between the basic blocks indicate the jump relationship between the basic blocks. The predecessor blocks of basic block B2 include basic block B1 and basic block B0. The successor blocks and predecessor blocks of basic block B1 are basic block B2 and basic block B0 respectively. The successor blocks of basic block B0 include basic block B1 and basic block B2. First process basic block B2. There is a sink function mysqli_query in basic block B2. The called interface parameter is the variable $sql. Traverse the static single assignment intermediate representation structure in basic block B2 upwards and find the definition data of variable $sql in line 8. The definition data of variable $sql includes the constant value "xxx" and Pin ($wheresql1, $wheresql2). According to Figure 7 As shown in line 8 of the code, the constant value "xxx" is "SELECT * FROM `users`." The constant value "SELECT * FROM `users`" in the definition data of the variable $sql is printed, along with the line number where the constant value occurs. This constant value "SELECT * FROM `users`" is a SQL statement. Since the definition data of the variable $sql is found in basic block B2, $sql is added to the kill set of basic block B2. The definition data of $sql uses Pin($wheresql1, $wheresql2), indicating that $sql is the junction of $wheresql1 and $wheresql2. Therefore, $wheresql1 and $wheresql2 are both variables used in the definition data of $sql. These variables are added to the gen set of basic block B2. After traversal, the IN[B2] set of basic block B2 is calculated. Since the variable data for $wheresql1 and $wheresql2 is not found in basic block B2, $wheresql1 and $wheresql2 are added to the IN[B2] set, where IN[B2] = {$wheresql1, $wheresql2}. The IN[B2] set is transmitted to the predecessor blocks, basic block B1 and basic block B0.

[0149] Next, we process basic block B1. The successor block of basic block B1 is basic block B2. Based on IN[B2] of basic block B2, we determine the OUT[B1] set of basic block B1. OUT[B1]=IN[B2]={$wheresql1, $wheresql2}. In the static single-assignment intermediate representation structure within basic block B1, we reversely query the definition data of the variables in OUT[B1]. In line 5, we find the definition data of $wheresql2. The definition data of $wheresql2 includes the constant value "xxx" and the variable $keyword. According to Figure 7 As shown in line 5 of the code, the constant value "xxx" is "WHERE userid LIKE." The constant value "WHERE userid LIKE" in the definition data for $wheresql2 is printed out. This constant value "WHERE userid LIKE" is an SQL statement. Since the definition data for the variable $wheresql2 is found in basic block B1, $wheresql2 is added to the kill set of basic block B1. The variable $keyword is used in the definition data for variable $wheresql2, so $keyword is added to the gen set of basic block B1. Since the definition data for $wheresql1 and $keyword are not found in basic block B1, the IN[B1] set for basic block B1 is calculated to be {$wheresql1, $keyword}. The IN[B1] set is transferred to the predecessor basic block, basic block B0.

[0150] Finally, basic block B0 is processed. Its successors are basic blocks B2 and B1. Based on the union of IN[B1] and IN[B2], the set OUT[B0] for basic block B0 is obtained. OUT[B0] = {$wheresql1, $wheresql2, $keyword}. A reverse query is performed within basic block B0 to find the variable definitions in OUT[B0]. The definitions for $wheresql1 and $keyword are found, and the definition for $wheresql2 has already been found in basic block B1. Therefore, this reverse query method accurately locates all SQL statements. Definitions for $wheresql1 and $keyword exist within basic block B0, but since $wheresql1 is an empty string constant, it is not treated as an SQL statement. However, the empty string constant and the corresponding line number are printed. Within the definition of $keyword, $_GET is used to obtain user input. $keyword can be fixedly retrieved from external sources, so $keyword is a special external input variable and is therefore ignored.

[0151] In summary, by performing a reverse query on the variable definition in the Web source code, we can find the SQL statements in lines 8 and 5 of the source code.

[0152] Finally, the SQL keyword randomization module is used to add randomization tags to SQL keywords in the Web source code according to the SQL statements and their positions, and the SQL randomized Web application is output.

[0153] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0154] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 9 As shown. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via wired or wireless means. The wireless means can be implemented via WIFI, a mobile cellular network, NFC (near field communication), or other technologies. When executed by the processor, the computer program implements a structured query statement protection method.

[0155] Those skilled in the art will understand that Figure 9 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0156] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0157] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0158] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0159] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0160] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0161] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A structured query statement protection method, characterized in that: The method comprises: Perform static program analysis on source code data of network applications to obtain static analysis results; Extracting interface parameters called by the database programming interface function in the source code data based on the static analysis results, and, if the interface parameters are variables, reversely querying definition data of the interface parameters in the source code data, and determining a structured query statement and a location of the structured query statement in the source code data based on the definition data of the interface parameters; According to the structured query statement and the position of the structured query statement, a randomization tag is added to the keyword of the structured query statement to obtain a randomized structured query statement according to the randomization tag.

2. The method according to claim 1, characterized in that The static analysis result includes at least one basic block corresponding to the source code data, a definition usage chain, and a static single assignment intermediate representation structure within each basic block. When the number of the basic blocks is at least two, the static analysis result also includes a control flow graph corresponding to the basic block.

3. The method according to claim 2, characterized in that The step of extracting interface parameters called by the database programming interface function in the source code data according to the static analysis result, and reversely querying definition data of the interface parameters in the source code data when the interface parameters are variables comprises: Identifying a database programming interface function in a static single-valued intermediate representation structure within the at least one basic block, and extracting interface parameters called by the database programming interface function; When the interface parameter is a variable and the number of basic blocks is at least two, reversely querying definition data of the interface parameter in a static single-assignment intermediate representation structure in at least two basic blocks according to the control flow graph and the definition usage chain; In the case that the interface parameter is a variable and the number of basic blocks is one, definition data of the interface parameter is reversely queried in a static single-assignment intermediate representation structure within one basic block according to the definition usage chain.

4. The method according to claim 3, characterized in that When the interface parameter is a variable and the number of basic blocks is at least two, reversely querying definition data of the interface parameter in a static single-assignment intermediate representation structure in the at least one basic block according to the control flow graph and the definition usage chain includes: For a current basic block, all successor blocks of the current basic block are determined according to the control flow graph, and a current propagation variable set of the current basic block is determined according to undefined variable sets of all successor blocks of the current basic block; the variables in the current propagation variable set of the current basic block are the interface parameters; Reversely query definition data of the interface parameter in a static single-assignment intermediate representation structure in the current basic block according to the definition usage chain; If definition data of the interface parameter is not found in the current basic block, the interface parameter is added to an undefined variable set corresponding to the current basic block, and the undefined variable set corresponding to the current basic block is transmitted to all predecessor blocks of the current basic block according to the control flow graph; According to the query order of all predecessor blocks of the current basic block in the control flow graph, the predecessor blocks of the current basic block are updated to the current basic block in sequence, and the step of determining all successor blocks of the current basic block according to the control flow graph is returned to, and reverse query is continued until the definition data of the interface parameters are queried.

5. The method according to claim 2, characterized in that Determining the structured query statement and the position of the structured query statement in the source code data according to the definition data of the interface parameters includes: When a primary variable exists in the definition data of the interface parameter, query the definition data of the primary variable in reverse order starting from the location of the primary variable in a static single-assignment intermediate representation structure within the first basic block where the definition data of the interface parameter is located using the chain according to the definition; If definition data of the primary variable is not found in the first basic block, the primary variable is added to an undefined variable set corresponding to the first basic block, and the undefined variable set corresponding to the first basic block is transferred to all predecessor blocks of the first basic block according to the control flow graph, and each predecessor block of the first basic block is used as a second basic block; Determine all successor blocks of each second basic block according to the control flow graph, and determine the current propagation variable set of each second basic block according to the undefined variable sets of all successor blocks of each second basic block; wherein the successor blocks of each second basic block include the first basic block, and the current propagation variable set of each second basic block includes the primary variable; and reversely query the definition data of the variables in the current propagation variable set of each second basic block in the static single-assignment intermediate representation structure within each second basic block according to the query order of each second basic block in the control flow graph; If the definition data of the primary variable is not found in each second basic block, each second basic block is updated to the first basic block, and the process returns to the step of adding the primary variable to the set of undefined variables corresponding to the first basic block, and continues the reverse search until the definition data of the primary variable is found. In the case where a constant value exists in the definition data of the primary variable, the constant value in the definition data of the primary variable and the position of the constant value are respectively determined as the structured query statement and the position of the structured query statement.

6. The method according to claim 5, characterized in that After querying the definition data of the primary variable, the method further includes: When a secondary variable exists in the definition data of the primary variable, querying the definition data of the secondary variable in reverse order starting from the location of the secondary variable in a static single-assignment intermediate representation structure within a third basic block where the definition data of the primary variable is located according to the definition usage chain; If definition data of the secondary variable is not found in the third basic block, the secondary variable is added to an undefined variable set corresponding to the third basic block, and the undefined variable set corresponding to the third basic block is transferred to all predecessor blocks of the third basic block according to the control flow graph, and each predecessor block of the third basic block is used as a fourth basic block. Determining all successor blocks of each fourth basic block according to the control flow graph, and determining a current propagation variable set of each fourth basic block according to the undefined variable sets of all successor blocks of each fourth basic block; wherein the successor blocks of each fourth basic block include the third basic block, and the current propagation variable set of each fourth basic block includes the secondary variables; and reversely querying the definition data of the variables in the current propagation variable set of each fourth basic block in a static single-assignment intermediate representation structure within each fourth basic block according to the query order of each fourth basic block in the control flow graph; If the definition data of the secondary variable is not found in each fourth basic block, each fourth basic block is updated to the third basic block, and the step of adding the secondary variable to the undefined variable set corresponding to the third basic block is returned to, and reverse query is continued until the definition data of the secondary variable is found.

7. The method according to claim 1, characterized in that The method further comprises: In the case that the interface parameter is a constant, the constant value of the interface parameter and the position of the constant value are respectively determined as the structured query statement and the position of the structured query statement.

8. The method according to claim 1, characterized in that Determining the structured query statement and the position of the structured query statement in the source code data according to the definition data of the interface parameters includes: In the case where a constant value exists in the definition data of the interface parameter, the constant value in the definition data of the interface parameter and the position of the constant value are respectively determined as the structured query statement and the position of the structured query statement.

9. The method according to claim 1, characterized in that The static analysis result includes at least one basic block corresponding to the source code data, a definition-use chain, and a static single-assignment intermediate representation structure within each basic block. When there are at least two basic blocks, the static analysis result also includes a control flow graph corresponding to the basic block. The static program analysis of the source code data of the network application is performed to obtain the static analysis results including: Perform lexical analysis and grammatical analysis on the source code data of the network application to obtain an abstract syntax tree; Converting the abstract syntax tree into an initial intermediate representation structure; Dividing the initial intermediate representation structure into at least one basic block; In the case where there is only one basic block, data flow analysis and static single assignment form conversion are performed on each basic block to obtain a definition use chain corresponding to the basic block and a static single assignment intermediate representation structure in each basic block; When the number of the basic blocks is at least two, control flow analysis, data flow analysis and static single assignment form conversion are performed on the at least two basic blocks respectively to obtain control flow graphs, definition use chains and static single assignment intermediate representation structures within each basic block corresponding to the at least two basic blocks.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images