Component security control method, system and equipment based on low-code platform and medium

Abstract

The invention discloses a component security control method, system and device based on a low-code platform and a medium, and the method comprises the steps: customizing a component based on a function form, and compressing and storing the custom component resources; when the page is rendered, loading the current custom component resource corresponding to the current page from the custom component resource; determining a context instance based on the current custom component location, and determining a secure API based on a predefined global API; based on the current custom component resource, injecting the context instance and the security API into the current custom component, and rendering the current custom component; according to the method, the corresponding context instance is dynamically injected based on the component position, only the matched service operation authority is given, and excessive opening of the authority is avoided; and a safe replacement API is provided, so that the risks of data stealing and page tampering are reduced to a certain extent.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a component security control method, system, device and medium based on a low-code platform. Background Art

[0002] With the acceleration of enterprise digital transformation, low-code development platforms (APaaS) have gained widespread adoption due to their ability to significantly lower the barrier to entry for software development, shorten delivery cycles, and reduce IT costs. These platforms typically allow developers to quickly build enterprise-grade applications by dragging and dropping components, configuring parameters, and writing minimal code through a visual interface.

[0003] In relatively complex business scenarios, a simple configurable low-code solution often cannot meet all needs. Therefore, most APaaS platforms provide the function of custom components, allowing developers in business departments to upload and run custom code to expand platform capabilities. This model greatly improves the flexibility of the low-code platform.

[0004] At present, there are some low-code platforms based on Vue or some common practices in custom components in the existing technologies. However, most of the existing technologies focus on how the low-code platform can load the functions of custom components and how to improve the flexibility and scalability of the low-code platform. However, there is no specific technical solution to solve the "component-level secure loading" we need.

[0005] Therefore, the existing technology has obvious deficiencies in component security loading, and more advanced methods are needed to improve the security of user-defined components on low-code platforms. It is necessary to provide a component security control method based on a low-code platform to solve the above problems. Summary of the Invention

[0006] The present invention provides a component security control method, system, device and medium based on a low-code platform to solve the security issues of user-defined components under the low-code platform and improve the security of applications.

[0007] In a first aspect, an embodiment of the present invention provides a component security control method based on a low-code platform, including: Customize components based on function forms and compress and store the custom component resources; When rendering a page, loading the current custom component resource corresponding to the current page from the custom component resource; Determine a context instance based on the current custom component location, and determine a secure API based on a predefined global API; Based on the current custom component resource, the context instance and the security API are injected into the current custom component, and the current custom component is rendered.

[0008] Optionally, the customizing the component based on the function form and compressing and storing the custom component resources include: Based on the function form of the custom component, fill the basic information of the custom component into a fixed json file, and package the custom component code into a js file, where the basic information includes: the entry method name, the function name of the component, and the bound entity name; Compress the js file and the json file, upload and store them on the server.

[0009] Optionally, determining the context instance based on the current custom component position includes: Based on the predefined context interface specification, a factory mode is adopted to create a corresponding context instance according to the current custom component position.

[0010] Optionally, determining the secure API based on the predefined global API includes: Based on the predefined global API, determine the abnormal API list; The abnormal APIs included in the abnormal API list are intercepted by proxy interception technology, and the abnormal APIs are replaced by safe APIs.

[0011] Optionally, injecting the context instance and the security API into the current custom component based on the current custom component resource and rendering the current custom component includes: Based on the current custom component resource, determining an entry method corresponding to the current custom component; The entry method is called to inject the context instance and the security API into the current custom component, and the current custom component is rendered.

[0012] Optionally, after injecting the context instance and the security API into the current custom component based on the current custom component resource, the method further includes: When the current custom component executes a page jump, the context instance and the security API are encapsulated through a secure page interaction interface; Based on the context instance and the security API, the target component corresponding to the jump page is rendered.

[0013] In a second aspect, an embodiment of the present invention provides a component security control system based on a low-code platform, wherein the system is used to execute the component security control method based on a low-code platform described in any embodiment of the present invention, including: A custom component module, used to customize components based on function forms and compress and store the custom component resources; A first determining module is configured to load a current custom component resource corresponding to the current page from the custom component resource when rendering the page; A second determining module is configured to determine a context instance based on the current custom component location and a security API based on a predefined global API; The security control module is used to inject the context instance and the security API into the current custom component based on the current custom component resources, and render the current custom component.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the component security control method based on the low-code platform described in any embodiment of the present invention.

[0015] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a processor to implement the component security control method based on a low-code platform described in any embodiment of the present invention when executed.

[0016] (1) The custom component of the present invention is implemented in a functional manner, without changing the platform architecture. It is compatible with the Vue framework and existing loading mechanisms, with extremely low learning costs and no change in the development model. It interacts with the platform only through the bizContext parameter, isolating the component execution environment and avoiding contamination of the global scope. By compiling and packaging the custom component code into a js file in the UMD format, it supports multiple front-end modular specifications and ensures the compatibility of the component in different low-code platforms. The component configuration is independently described in a JSON file, decoupling it from the code. Fast resource data parsing is achieved during dynamic loading. By compressing the code file and the configuration file into a single file, resources are managed uniformly, effectively simplifying the upload / distribution process and improving resource loading efficiency.

[0017] (2) The present invention is based on the predefined context interface specification and adopts the factory mode. According to the current custom component location, a corresponding context instance is created. By strongly binding the location and the permission, only the matching business operation permissions are granted to avoid excessive openness of permissions. The contexts of different entity components are completely isolated. New location types only need to expand the factory mapping table without modifying the platform architecture. It is compatible with the existing Vue component ecosystem and effectively improves the efficiency of component development.

[0018] (3) The present invention determines an abnormal API list based on a predefined global API; intercepts the abnormal APIs included in the abnormal API list through proxy interception technology, and replaces the abnormal API with a safe API; solves the API abuse problem, intercepts access to sensitive global objects, and provides a safe alternative API, thereby reducing the risk of data theft and page tampering to a certain extent; further, it unifies API management, encapsulates standard browser sensitive APIs, facilitates the subsequent adjustment of permission policies and the expansion of security log records, and reduces maintenance costs.

[0019] (4) When the current custom component executes a page jump, the present invention encapsulates the context instance and the security API through the security page interaction interface; based on the context instance and the security API, the target component corresponding to the jump page is run. This mode realizes the separation of security capabilities and business logic through the interface layer. While ensuring the security and controllability of the jump process, it takes into account the robustness, scalability and development efficiency of the system, supports complex scenario interactions, and ensures that cross-page operations comply with the platform's security policies.

[0020] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a component security control method based on a low-code platform provided in Example 1 of the present invention; Figure 2 A flowchart of building a custom component provided in the first embodiment of the present invention; Figure 3 A flow chart of setting up a secure sandbox API provided in the second embodiment of the present invention; Figure 4 Flowchart of a component security control method based on a low-code platform provided in Example 2 of the present invention Figure 5 A context interface and instantiation flow chart provided for the second embodiment of the present invention; Figure 6 A page jump flow chart based on a low-code platform provided in Example 2 of the present invention; Figure 7 A framework diagram of a component security control system based on a low-code platform provided in Example 3 of the present invention; Figure 8 A schematic structural diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] Example 1:

[0026] Figure 1 This is a flowchart of a component security control method based on a low-code platform provided in the first embodiment of the present invention. This embodiment is applicable to the case of secure loading of custom components. This method is applied to a component security control system based on a low-code platform. Figure 1 As shown, the method includes: S110: Customize a component based on a function form, and compress and store the customized component resources.

[0027] Among them, custom components can refer to pure functions; custom component resources can refer to the basic information of developed custom components and custom component codes.

[0028] Specifically, custom components can be implemented as pure functions (Function type), receiving a single parameter, bizContext (business context). Business logic is encapsulated within the function, and direct access to global objects (such as window and document) is prohibited. All operations rely on the injected context. After determining the custom component, the basic information of the developed custom component needs to be filled in a fixed json file; the basic information of the custom component includes: entry (entry method name), displayName (component function name), and bindEntityName (bound entity name). Execute the node command and use the vue-cli scaffolding tool to compile and package the custom component code into a js file in umd format to ensure cross-environment compatibility. Compress the generated js file and json file together into a zip compressed package, and upload the ZIP package to the server storage through the low-code platform management interface.

[0029] In this embodiment, by customizing components in the form of functions, the components act as pure functions and interact with the platform only through the bizContext parameter, isolating the component execution environment and avoiding pollution of the global scope; by compiling and packaging the custom component code into a js file in the umd format, it supports multiple front-end modular specifications and ensures the compatibility of components in different low-code platforms; the component configuration is independently described through a JSON file and decoupled from the code; fast metadata parsing is achieved during dynamic loading; by compressing the code file and the configuration file into a single file, resources are managed in a unified manner, effectively simplifying the upload / distribution process and improving resource loading efficiency.

[0030] S120. When rendering a page, load a current custom component resource corresponding to the current page from the custom component resources.

[0031] Component page rendering refers to the entire process of dynamically loading the custom component resources corresponding to the page according to the page configuration and rendering them to the specified location on the page.

[0032] Specifically, when rendering a page, you can retrieve the current page configuration information, which contains a list of custom components to load (including component name, location, and other information). Each component has a unique identifier, such as the component name. Based on the component's unique identifier, the component's resource package (ZIP package) is retrieved from the server-side custom component resources, or directly from the local cache (if the component has been loaded before).

[0033] In this embodiment, the custom component resources corresponding to the current page are dynamically loaded when rendering the page, achieving accurate loading on demand, avoiding redundant resource requests, and significantly improving page performance.

[0034] S130: Determine a context instance based on the current custom component location, and determine a security API based on a predefined global API.

[0035] Among them, the current custom component position may refer to the specific embedded position type of the component in the page layout, which is predefined by the low-code platform according to the page structure. The context instance may refer to a sandboxed business operation interface object dynamically created through the factory pattern and bound to the component location type. The predefined global API may refer to global objects and methods that are natively provided by the browser and have security risks, such as document, window, etc. Direct calls may cause the page content to be maliciously tampered with. The secure API may refer to a secure alternative interface provided by the low-code platform to encapsulate or rewrite native high-risk APIs.

[0036] Specifically, component location types include: gridheader (view header), subgrid (subgrid header), and formheader (form header). Depending on the location type, corresponding context instances (ListContext, SubgridContext, and FormContext) can be created using the factory pattern. Predefined global API interfaces are identified and encapsulated. This involves encapsulating common, dangerous, and sensitive global methods in standard browsers into a unified interface. Dangerous and sensitive APIs are blocked, objects like document and window are set to undefined, and safe encapsulated alternative APIs are provided, such as safeQuerySelector and safeCreateElement. Through the sandbox mechanism, browsers restrict plugins to accessing only specific APIs (e.g., the Chrome extension sandbox). After determining the context instance and safe APIs, safe APIs (such as safeQuerySelector and safeCreateElement) as well as platform-provided safe methods (such as openDialogComponent and jumpComponentByRouter) can be mounted within the context instance.

[0037] In this embodiment, differentiated context instances are automatically generated based on the component location type (gridheader / formheader / subgrid). That is, the location level of the component in the DOM tree is identified by the location attribute, which determines the data it can access and the scope of its operation permissions. Through location-aware context injection, dual API protection and sandbox nested architecture, safe loading of custom components is achieved while maintaining compatibility with the traditional Vue component ecosystem.

[0038] S140: Based on the current custom component resources, inject the context instance and the security API into the current custom component, and render the current custom component.

[0039] Specifically, the current custom component resources are decompressed and parsed in a sandbox environment to obtain JS and JSON files. The component's JS file (UMD format) is loaded, and the component's entry function name (entry) is obtained from the JSON file. Using the component's entry function name, the entry function is retrieved from the global object (because UMD modules are typically exposed globally). This entry function is called, and the context instance with the security API mounted on it is passed as a parameter to the current custom component, initializing the component. The component is then rendered to the specified location on the current page, achieving security isolation and minimal permissions.

[0040] In this embodiment, custom component resources corresponding to the current page are dynamically loaded when rendering the page, achieving on-demand precise loading, avoiding redundant resource requests, and significantly improving page performance; through location-aware context injection, precise matching of permissions and functions is achieved, eliminating the risk of permission generalization; combined with secure API forced replacement (such as using safeQuerySelector to block native DOM operations), high-risk native API access is completely isolated while ensuring functional integrity; in conjunction with the sandboxed resource decompression execution mechanism, third-party component code is ensured to run in an isolated environment, which not only maintains the development flexibility of the low-code platform, but also builds a security line of defense for enterprise-level applications.

[0041] Optionally, the customizing the component based on the function form and compressing and storing the custom component resources include: Based on the function form of the custom component, fill the basic information of the custom component into a fixed json file, and package the custom component code into a js file, where the basic information includes: the entry method name, the function name of the component, and the bound entity name; Compress the js file and the json file, upload and store them on the server.

[0042] Among them, the entry method name can refer to the startup entry that identifies the functional component; the function name of the component can refer to the identifier that describes the component function; and the bound entity name can refer to the name of the associated business data object (business entity).

[0043] Specifically, after implementing a custom component in a functional form, the following standardized packaging operations need to be performed: First, the basic information of the component is filled into a fixed-structure JSON configuration file in strict accordance with the predefined format. The predefined format can refer to the JSON format. Then, the node command is executed to compile and package the component source code into an independent JS file that complies with the UMD specification through a build tool (such as vue-cli); wherein, the Node command refers to the standard build instruction executed by the Vue CLI service. The generated JS file and the configured JSON file are compressed together into a single ZIP resource package, and the ZIP resource package is uploaded to the server storage through the low-code platform management interface; three-dimensional packaging is realized, namely metadata configuration standardization (JSON), code delivery modularization (UMD JS), and resource management integration (ZIP), establishing a traceable and verifiable component resource foundation for subsequent secure loading.

[0044] In this embodiment, custom components are implemented functionally, requiring no changes to the platform architecture. They are compatible with the Vue framework and existing loading mechanisms, resulting in a minimal learning curve and no changes to the development model. They interact with the platform solely through the bizContext parameter, isolating the component execution environment and avoiding global scope contamination. By compiling and packaging custom component code into js files in the UMD format, they support a variety of front-end modularization specifications, ensuring component compatibility across different low-code platforms. Component configuration is independently described in JSON files, decoupling it from the code. This allows for rapid resource data parsing during dynamic loading. By compressing code and configuration files into a single file, resources are managed uniformly, effectively simplifying the upload / distribution process and improving resource loading efficiency.

[0045] For example, Figure 2 A flowchart of a custom component construction provided in the first embodiment of the present invention is shown as follows: Figure 2 As shown in the figure, the specific steps for building a custom component include: 1. Develop custom components based on Vue source code; 2. Build through vue-cli compilation; 3. Generate the compressed component file customComponent.min.js 4. Core configuration items: entry: declares the component entry method name displayName: defines the component function name bindEntityName: Specifies the bound entity name 5. Metadata file: Generate component description file Component.info.json 6. Perform compression and packaging operations to output the complete component package customComponent.zip.

[0046] Optionally, determining the context instance based on a predefined context interface specification includes: Based on the predefined context interface specification, a factory mode is adopted to create a corresponding context instance according to the current custom component position.

[0047] The context interface specification refers to a predefined standardized business operation contract, a standardized operation interface defined in TypeScript or JavaScript, that precisely controls the business capabilities accessible to custom components. The factory pattern refers to a location-aware context creation mechanism implemented through the ContextFactory class.

[0048] Specifically, a predefined context interface specification is created, creating the BusinessComponentContext interface. This defines the business operations accessible to custom components, including data manipulation methods (such as updating form data, saving, and loading); interface manipulation methods (such as opening pop-up windows and prompts); and system information retrieval methods (such as account ID, account name, and global system parameters). Based on the business operations accessible to custom components, a context inheritance hierarchy is established: BaseContext (base context) → FormContext (form context) / ListContext (view context) / SubgridContext (subgrid context). BaseContext (base context) defines the common capabilities of all components at the foundational level. At the functional level, it is differentiated based on data manipulation dimensions, such as FormContext (form context, typically for reading and writing single data records), ListContext (view context, typically for batch data operations), and SubgridContext (subgrid context, typically for operations on limited sub-datasets). This inheritance hierarchy ensures that components in different locations can only access the operations that match their functionality.

[0049] The location type identifier (location) of the current custom component determines its location on the page. Location types include: gridheader (view header): the operation area at the top of the data list (for example, the add button, batch operations); formheader (form header): the title bar area of ​​the form editing page (for example, the save button, the back button); subgrid (subgrid header): the operation area of ​​a nested sub-data table (for example, adding a new row to a sub-table). Based on the different location types, corresponding context instances (ListContext, SubgridContext, FormContext) are created using the factory pattern. For example, ListContext can provide list operations such as loadData() and refresh(); FormContext can provide form operations such as saveForm() and validate(); and SubgridContext can provide sub-table operations such as addRow() and deleteRow().

[0050] In this embodiment, based on the predefined context interface specification, the factory pattern is adopted to create a corresponding context instance according to the current custom component location. By strongly binding the location and permissions, only matching business operation permissions are granted to avoid excessive openness of permissions. The contexts of different entity components are completely isolated. New location types only need to expand the factory mapping table without modifying the platform architecture. It is compatible with the existing Vue component ecosystem and effectively improves component development efficiency.

[0051] Optionally, determining the secure API based on the predefined global API includes: Based on the predefined global API, determine the abnormal API list; The abnormal APIs included in the abnormal API list are intercepted by proxy interception technology, and the abnormal APIs are replaced by safe APIs.

[0052] Abnormal APIs can refer to dangerous or sensitive APIs; proxy interception technology can refer to property interception using Object.defineProperty; and safe APIs can refer to alternative APIs that have been securely encapsulated.

[0053] Specifically, by analyzing the security risks of the browser's native APIs (such as document.write, window.localStorage, XMLHttpRequest, etc.), we can identify dangerous and sensitive APIs and pre-build a list of abnormal APIs. Use Object.defineProperty to dynamically hijack the property access of global objects (such as window and document), and set objects such as document and window to undefined. That is, when a custom component tries to call an abnormal API, an exception interception is triggered in real time to block dangerous operations. Provide encapsulated security interfaces for sensitive functions, and ensure security through parameter verification, permission control, and log auditing, that is, provide securely encapsulated alternative APIs, such as safeQuerySelector and safeCreateElement. During the context creation phase, the factory forcibly injects the security API when creating the context. Custom components can only call the security interface through bizContext.safeAPI and cannot directly access native dangerous APIs.

[0054] In this embodiment, an abnormal API list is determined based on a predefined global API; the abnormal APIs included in the abnormal API list are intercepted through proxy interception technology, and a safe API is used to replace the abnormal API; the API abuse problem is solved, access to sensitive global objects is intercepted, and a safe alternative API is provided, which reduces the risk of data theft and page tampering to a certain extent; further, API management is unified, and standard browser sensitive APIs are encapsulated to facilitate subsequent permission policy adjustments and security log record expansion, thereby reducing maintenance costs.

[0055] Exemplary, exemplary, Figure 3 A flow chart of setting up a secure sandbox API is provided in the second embodiment of the present invention, as shown in FIG. Figure 3 As shown in the figure, the specific steps for setting up a secure sandbox API include: 1. Repackage the API, block dangerous and sensitive APIs, set document and window to undefined, and prevent direct access; provide rewritten safe APIs (such as subQuerySelector instead of querySelector) to ensure controlled operations.

[0056] 2. Based on the repackaging strategy, implement API proxy and interception, and dynamically intercept global object properties through Object.defineProperty.

[0057] 3. After completing the proxy and interception, the API injects the custom component following the context.

[0058] 4. If the custom component uses the low-code platform global API, it will be used normally; if the custom component directly uses the browser native API, an exception will be thrown.

[0059] Example 2:

[0060] Figure 4 This is a flowchart of a component security control method based on a low-code platform provided in the second embodiment of the present invention. The technical solution of this embodiment is further refined on the basis of the above embodiment. Figure 4 As shown, the method includes: S210: Customize a component based on a function form, and compress and store the customized component resources.

[0061] S220. When rendering a page, load the current custom component resource corresponding to the current page from the custom component resources.

[0062] S230: Determine a context instance based on a predefined context interface specification, and determine a security API based on a predefined global API.

[0063] S240: Determine an entry method corresponding to the current custom component based on the current custom component resource.

[0064] Specifically, the entry method name is determined by parsing the entry field in the current custom component configuration JSON file.

[0065] In this embodiment, the entry method name is determined by parsing the entry field in the current custom component configuration JSON file, thereby achieving standardized management and dynamic loading of component resources; only the entry method name (entry) needs to be declared in the JSON configuration without modifying the platform loading logic, thereby achieving decoupling of component development from the platform architecture; the platform locates the entry function by dynamically searching window[entryName] to ensure that the custom component code is executed in a sandbox environment and prevent unauthorized component injection.

[0066] S250: Call the entry method to inject the context instance and the security API into the current custom component.

[0067] Specifically, the entry method of the current custom component is called through the entry method name, and the context instance is passed in as a parameter. In this context instance, the custom component can access the controllable context provided by the low-code platform through the received parameters to achieve a closed environment.

[0068] In this embodiment, the entry method is called, the context instance and the security API are injected into the current custom component, and the location awareness capability of the location field is combined to achieve precise matching injection of the context and the security API, avoiding permission generalization; making the loading process of the custom component standardized, auditable, secure and controllable, reducing maintenance costs, and eliminating the risk of security vulnerabilities caused by entry method conflicts.

[0069] For example, Figure 5 A context interface and instantiation flow chart provided in the second embodiment of the present invention, such as Figure 5 As shown in the figure, the specific steps of context interface and instantiation include: 1. Define the context interface specification, create the BusinessComponentContext interface, define business operation methods (such as data reading and writing, permission verification, etc.), and build a unified context inheritance system.

[0070] 2. The factory mode creates a context, implements the InitContext method, and dynamically creates a corresponding context instance based on the location attribute of the component, including: Position type gridReader (view header) → create ListContext instance; Location type subgrid (subgrid header) → create a SubgridContext instance; Position type formReader (form header) → Create FormContext instance.

[0071] 3. Safe injection of context parameters: Traverse all custom components, match the current component with the context type, and pass the corresponding context instance as a parameter to the component entry method.

[0072] Optionally, after injecting the context instance and the security API into the current custom component based on the current custom component resource, the method further includes: When the current custom component executes a page jump, the context instance and the security API are encapsulated through a secure page interaction interface; Based on the context instance and the security API, the target component corresponding to the jump page is run.

[0073] Among them, page jump can refer to the view switching behavior implemented by user-defined components in the low-code platform through the secure navigation interface provided by the platform (rather than the native API); the secure page interaction interface can refer to the controlled navigation method encapsulated by the low-code platform; for example, openDialogComponent and jumpComponentByRouter; its core features include: built-in context inheritance mechanism: automatic transfer of the bizContext of the source component; integrated sandbox security policy: mandatory security API proxy configuration; implementation of routing whitelist verification: only allowing jumps to secure views pre-registered on the platform.

[0074] Specifically, a page redirect method is defined in the BusinessComponentContext interface. When the low-code platform loads a custom component, a context instance containing the jumpComponentByRouter method is injected into the component. Within the custom component, the page redirect is called using the injected context. When the jumpComponentByRouter method is executed, the target component corresponding to the target page is verified to be in the platform's registered security component whitelist. The minimum required permission set (such as data operation permissions and interface operation permissions) is extracted from the current context instance (i.e., the encapsulated context instance). A sandboxed context (SandboxedContext) is created, which inherits permissions and only contains some of the permissions of the source component, such as basic permissions, system information, and a secure API set. Dangerous parameters are filtered, XSS filtering and type verification are performed on all passed parameters, and sensitive parameters (such as IDs and credentials) are encrypted. Redirection is performed through the platform routing system (not the native location.href), and a security context signature is embedded in the routing metadata. When the target page is initialized, the validity of the context signature is verified, the sandbox environment is rebuilt through the context factory, and the rebuilt context is injected into the target component entry function. When the target component is rendering and running, access to the browser API (i.e., the encapsulated secure API) is restricted, and data / interface operations can only be performed using the inherited permission set. A security log is also maintained to record redirect behavior.

[0075] Furthermore, you can declare pop-up methods in the BusinessComponentContext interface and implement them in the context instance: call the platform pop-up service, inherit the current context type, verify whether the target component corresponding to the target page is in the platform's registered security component whitelist, create a sandboxed pop-up container, load the target component resources, create an isolated context, that is, inherit the source context type, and extract the minimum required permission set from the current context instance. Filter dangerous parameters, perform XSS filtering and type verification on all passed parameters, and encrypt sensitive parameters (such as IDs and credentials). Initializing the component specifically includes creating a container using the security API, applying CSS sandbox isolation, and adding it to the secure DOM area.

[0076] In this embodiment, when the current custom component executes a page jump, the context instance and the security API are encapsulated through the security page interaction interface; based on the context instance and the security API, the target component corresponding to the jump page is run. This mode realizes the separation of security capabilities and business logic through the interface layer. While ensuring the security and controllability of the jump process, it takes into account the robustness, scalability and development efficiency of the system, supports complex scenario interactions, and ensures that cross-page operations comply with the platform's security policies.

[0077] For example, Figure 6 A page jump flow chart based on a low-code platform is provided for the second embodiment of the present invention. Figure 6 As shown, the specific steps of the jump pop-up window process (openDialogComponent) are: 1. Inside the custom component, import the Vue page of complex business (this page is a pop-up window).

[0078] 2. Determine whether the jump page is a pop-up window.

[0079] 3. If so, call the openDialogComponent method in the controllable context provided by the low-code platform, and pass in the Vue page, the entry method that triggers the Vue page, and the controllable context in sequence.

[0080] 4. Inside the openDialogComponent method, create a Vue instance based on the name of the Vue page.

[0081] 5. Execute the entry method of the Vue page and pass in the controllable context.

[0082] 6. In the entry method of the Vue page, open its own pop-up window and access the controllable context normally.

[0083] 7. If not, perform the route jump process (jumpComponentByRouter), call the jumpComponentByRouter method in the controllable context provided by the low-code platform, and pass in the parameters Vue page, route name, and controllable context in turn.

[0084] 8. Inside the jumpComponentByRouter method, register the Vue page to the route based on the route name and pass the controllable context as the route parameter.

[0085] 9. In jumpComponentByRouter, execute the route jump, open the Vue page, and access the controllable context through the route parameters in the Vue page.

[0086] Example 3:

[0087] Figure 7 This is a framework diagram of a component security control system based on a low-code platform provided in Example 3 of the present invention. Figure 7 As shown, the system includes: A custom component module 310 is used to customize components based on function forms and compress and store the custom component resources; A first determining module 320 is configured to load a current custom component resource corresponding to the current page from the custom component resource when rendering the page; A second determining module 330 is configured to determine a context instance based on the current custom component location and a security API based on a predefined global API; The security control module 340 is configured to inject the context instance and the security API into the current custom component based on the current custom component resources, and render the current custom component.

[0088] Optionally, the custom component module 310 is specifically used to: Based on the function form of the custom component, fill the basic information of the custom component into a fixed json file, and package the custom component code into a js file, where the basic information includes: the entry method name, the function name of the component, and the bound entity name; Compress the js file and the json file, upload and store them on the server.

[0089] Optionally, the second determining module 330 is specifically configured to: Based on the predefined context interface specification, a factory mode is adopted to create a corresponding context instance according to the current custom component position.

[0090] Optionally, the second determining module 330 is further configured to: Based on the predefined global API, determine the abnormal API list; The abnormal APIs included in the abnormal API list are intercepted by proxy interception technology, and the abnormal APIs are replaced by safe APIs.

[0091] Optionally, the security control module 340 is specifically configured to: Based on the current custom component resource, determining an entry method corresponding to the current custom component; The entry method is called to inject the context instance and the security API into the current custom component, and the current custom component is rendered.

[0092] The system further includes a jump module for: When the current custom component executes a page jump, the context instance and the security API are encapsulated through a secure page interaction interface; Based on the context instance and the security API, the target component corresponding to the jump page is rendered.

[0093] A component security control system based on a low-code platform provided by an embodiment of the present invention includes: a custom component module, which is used to customize components based on function form and compress and store the custom component resources; a first determination module, which is used to load the current custom component resources corresponding to the current page from the custom component resources when rendering a page; a second determination module, which is used to determine the context instance based on the current custom component position and determine the security API based on the predefined global API; a security control module, which is used to inject the context instance and the security API into the current custom component based on the current custom component resources and render the current custom component; dynamically loading the custom component resources corresponding to the current page when rendering the page, realizing on-demand precise loading, avoiding redundant resource requests, and significantly improving page performance; through location-aware context injection, achieving precise matching of permissions and functions, eliminating the risk of permission generalization; combined with forced replacement of security APIs (such as using safeQuerySelector to shield native DOM operations), high-risk native API access is completely isolated while ensuring functional integrity; cooperating with the sandboxed resource decompression execution mechanism to ensure that third-party component code runs in an isolated environment, maintaining the development flexibility of the low-code platform and building a security line of defense for enterprise-level applications.

[0094] Example 4:

[0095] Figure 8Schematic diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. Electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0096] like Figure 8 As shown, the electronic device 10 includes at least one processor 11, and a memory communicatively connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program executable by the at least one processor 11, and the computer program is executed by the at least one processor 11 so that the at least one processor 11 can perform the method provided by the present invention.

[0097] The processor 11 can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 12 or a computer program loaded from a storage unit 18 into a random access memory (RAM) 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0098] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0099] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as the component security control method based on the low-code platform.

[0100] In some embodiments, the component security control method based on the low-code platform can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the component security control method based on the low-code platform described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the component security control method based on the low-code platform in any other appropriate manner (for example, by means of firmware).

[0101] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard parts (ASSPs), system on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0102] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0103] In the context of the present invention, a computer-readable storage medium stores computer instructions that, when executed by a processor, implement the component security control method based on a low-code platform provided by the present invention. A computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by, or in conjunction with, an instruction execution system, device, or apparatus. Computer-readable storage media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or apparatuses, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0104] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD monitor)) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0105] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: Local Area Networks (LANs), Wide Area Networks (WANs), blockchain networks, and the Internet.

[0106] A computing system may include a client and a server. The client and server are generally remote from each other and typically interact via a communication network. The client-server relationship arises through computer programs running on the respective computers and establishing a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, a host product within a cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosts and virtual private server (VPS) services.

[0107] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0108] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A component security control method based on a low-code platform, characterized in that: include: Customize components based on function forms and compress and store the custom component resources; When rendering a page, loading the current custom component resource corresponding to the current page from the custom component resource; Determine a context instance based on the current custom component location, and determine a secure API based on a predefined global API; Based on the current custom component resource, the context instance and the security API are injected into the current custom component, and the current custom component is rendered.

2. The method according to claim 1, characterized in that The function-based custom component and the compressed storage of the custom component resources include: Based on the function form of the custom component, fill the basic information of the custom component into a fixed json file, and package the custom component code into a js file, where the basic information includes: the entry method name, the function name of the component, and the bound entity name; Compress the js file and the json file, upload and store them on the server.

3. The method according to claim 1, characterized in that The determining of the context instance based on the current custom component position includes: Based on the predefined context interface specification, a factory mode is adopted to create a corresponding context instance according to the current custom component position.

4. The method according to claim 1, wherein Determining the secure API based on the predefined global API includes: Based on the predefined global API, determine the abnormal API list; The abnormal APIs included in the abnormal API list are intercepted by proxy interception technology, and the abnormal APIs are replaced by safe APIs.

5. The method according to claim 1, wherein The injecting the context instance and the security API into the current custom component based on the current custom component resource and rendering the current custom component includes: Based on the current custom component resource, determining an entry method corresponding to the current custom component; The entry method is called to inject the context instance and the security API into the current custom component, and the current custom component is rendered.

6. The method according to claim 1, characterized in that After injecting the context instance and the security API into the current custom component based on the current custom component resource, the method further includes: When the current custom component executes a page jump, the context instance and the security API are encapsulated through a secure page interaction interface; Based on the context instance and the security API, the target component corresponding to the jump page is rendered.

7. A component security control system based on a low-code platform, characterized in that: The system is used to execute the component security control method based on the low-code platform according to any one of claims 1 to 6, including: A custom component module, used to customize components based on function forms and compress and store the custom component resources; A first determining module is configured to load a current custom component resource corresponding to the current page from the custom component resource when rendering the page; A second determining module is configured to determine a context instance based on the current custom component location and a security API based on a predefined global API; The security control module is used to inject the context instance and the security API into the current custom component based on the current custom component resources, and render the current custom component.

8. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the component security control method based on the low-code platform as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, which are used to enable a processor to implement the component security control method based on a low-code platform as described in any one of claims 1 to 6 when executed.

Images