A component security control method, system, device and medium based on a low-code platform

Abstract

The application discloses a kind of based on low code platform's component security control method, system, equipment and medium, the method includes: based on function form custom component, and the custom component resource is compressed storage;When rendering page, from the custom component resource, load the current custom component resource corresponding to current page in the custom component resource;Based on the current custom component position determination context instance, based on pre-defined global API determines security API;Based on the current custom component resource, the context instance and the security API are injected into the current custom component, and the current custom component is rendered;The application is based on component position dynamic injection corresponding context instance, only give matched business operation authority, avoid permission excessive opening;Provide safe alternative API, reduce the risk of data theft, page tampering to some extent.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a component security control method, system, device and medium based on a low-code platform. BACKGROUND

[0002] With the acceleration of enterprise digital transformation, low-code development platforms (APaaS) are widely used because they can significantly reduce the software development threshold, shorten the delivery cycle, and reduce IT costs. Such platforms usually allow developers to quickly build enterprise-level applications by dragging and dropping components, configuring parameters, and writing a small amount of code through a visual interface.

[0003] In relatively complex business scenarios, a simple configurable low-code solution often cannot meet all requirements, so most APaaS platforms provide custom component functionality, allowing business developers to upload and run custom code to extend platform capabilities. This mode greatly improves the flexibility of low-code platforms.

[0004] Currently, there are some low-code platforms based on Vue or some general practices in custom components, but existing technologies are mostly focused on how low-code platforms load custom components, how to improve the flexibility and expandability of low-code platforms, but there is no specific technical solution to the "component-level secure loading" we need.

[0005] Therefore, the existing technology has obvious deficiencies in component security loading, and more advanced methods are needed to improve the security of user-defined components in low-code platforms, and it is necessary to provide a component security control method based on a low-code platform to solve the above problems. SUMMARY

[0006] The present application provides a component security control method, system, device and medium based on a low-code platform to solve the security problem of user-defined components in a low-code platform and improve the security of applications.

[0007] In a first aspect, the present application provides a component security control method based on a low-code platform, comprising:

[0008] Defining a custom component based on a function form and compressing and storing the custom component resource;

[0009] When rendering a page, loading a current custom component resource corresponding to the current page from the custom component resource;

[0010] Determining a context instance based on the current custom component position and determining a security API based on a predefined global API;

[0011] based on the current custom component resource, injecting the context instance and the security API into the current custom component, and rendering the current custom component.

[0012] Optionally, the function-based custom component and compressing storage of the custom component resource include:

[0013] based on the function-based custom component, filling basic information of the custom component into a fixed json file, and packaging the custom component code as a js file, wherein the basic information includes an entry method name, a component function name, and a bound entity name;

[0014] compressing the js file and the json file, and uploading and storing to a server.

[0015] Optionally, determining the context instance based on the current custom component position includes:

[0016] based on a pre-defined context interface specification, creating a corresponding context instance according to the current custom component position by using a factory mode.

[0017] Optionally, determining the security API based on the pre-defined global API includes:

[0018] based on the pre-defined global API, determining an exception API list;

[0019] intercepting an exception API included in the exception API list by using a proxy interception technology, and replacing the exception API with a security API.

[0020] Optionally, based on the current custom component resource, injecting the context instance and the security API into the current custom component, and rendering the current custom component includes:

[0021] based on the current custom component resource, determining an entry method corresponding to the current custom component;

[0022] calling the entry method, injecting the context instance and the security API into the current custom component, and rendering the current custom component.

[0023] Optionally, after injecting the context instance and the security API into the current custom component based on the current custom component resource, the method further includes:

[0024] when the current custom component performs page jump, encapsulating the context instance and the security API through a secure page interaction interface;

[0025] Based on the context instance and the security API, a target component corresponding to the rendering jump page is rendered.

[0026] In a second aspect, an embodiment of the present application provides a component security control system based on a low-code platform, which is used to execute the component security control method based on the low-code platform according to any of the embodiments of the present application, and comprises:

[0027] A custom component module is configured to customize a component based on a function form, and compress and store the custom component resource.

[0028] A first determination module is configured to load a current custom component resource corresponding to a current page from the custom component resource when rendering the page.

[0029] A second determination module is configured to determine a context instance based on the current custom component position, and determine a security API based on a predefined global API.

[0030] A security control module is configured to inject the context instance and the security API into the current custom component based on the current custom component resource, and render the current custom component.

[0031] In a third aspect, an embodiment of the present application provides an electronic device, which comprises:

[0032] At least one processor; and

[0033] A memory connected in communication with the at least one processor; wherein

[0034] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the component security control method based on the low-code platform according to any of the embodiments of the present application.

[0035] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores computer instructions for enabling a processor to implement the component security control method based on the low-code platform according to any of the embodiments of the present application when executed by the processor.

[0036] (1) The self-defined component of the application is implemented by using a functional mode, without changing the platform architecture, compatible with the Vue framework and the existing loading mechanism, the learning cost of development is extremely low, and the development mode is not changed. Only through the bizContext parameter, the platform is interacted, the component execution environment is isolated, and the global scope is avoided from being polluted; by compiling and packaging the code of the self-defined component into a umd format js file, a plurality of front-end modularization specifications are supported, the compatibility of the component in different low-code platforms is ensured; the component configuration is independently described by a JSON file, and the code is decoupled; fast resource data analysis in dynamic loading is realized; by compressing the code file and the configuration file into a single file, the resources are managed uniformly, the uploading / distribution process is effectively simplified, and the resource loading efficiency is improved.

[0037] (2) Based on the pre-defined context interface specification, the factory mode is adopted, the corresponding context instance is created according to the current self-defined component position, the matching business operation permission is given through the position and permission strong binding, and the permission is avoided from being excessively opened; the contexts of different entity components are completely isolated, the factory mapping table needs to be extended only for the new position type, the platform architecture is not changed, the existing Vue component ecology is compatible, and the component development efficiency is effectively improved.

[0038] (3) The application determines an abnormal API list based on a pre-defined global API; the abnormal API in the abnormal API list is intercepted through proxy interception technology, and the abnormal API is replaced by a safe API; the API abuse problem is solved, the sensitive global object access is intercepted, the safe replacement API is provided, the risk of data stealing and page tampering is reduced to a certain extent; further, the API management is unified, the standard browser sensitive API is encapsulated, the extension of the later permission policy adjustment and the security log record is facilitated, and the maintenance cost is reduced.

[0039] (4) When the current self-defined component executes page jumping, the context instance and the safe API are encapsulated through a safe page interaction interface; based on the context instance and the safe API, a target component corresponding to the jumping page is run, the mode realizes the separation of the security capability and the business logic through the interface layer, the system robustness, the expansibility and the development efficiency are taken into account while the safety controllability of the jumping process is ensured, the complex scene interaction is supported, and it is ensured that the cross-page operation follows the security policy of the platform.

[0040] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the application, nor is it used to limit the scope of the application. Other features of the application will become apparent through the following description. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments description. Obviously, the drawings in the following description only show some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0042] Figure 1 A flow chart of a component security control method based on a low-code platform provided for the first embodiment of the present application;

[0043] Figure 2 A self-defined component construction flow chart provided for the first embodiment of the present application;

[0044] Figure 3 A security sandbox API setting flow chart provided for the second embodiment of the present application;

[0045] Figure 4 A flow chart of a component security control method based on a low-code platform provided for the second embodiment of the present application

[0046] Figure 5 A context interface and instantiation flow chart provided for the second embodiment of the present application;

[0047] Figure 6 A page jump flow chart based on a low-code platform provided for the second embodiment of the present application;

[0048] Figure 7 A framework diagram of a component security control system based on a low-code platform provided for the third embodiment of the present application;

[0049] Figure 8 A structural schematic diagram of an electronic device that can be used to implement the embodiments of the present application is shown. DETAILED DESCRIPTION

[0050] In order to make the person in the art better understand the present application scheme, the following will combine the drawings in the embodiments of the present application, and the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only some embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the present application.

[0051] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and in the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0052] Embodiment 1:

[0053] Figure 1 A flowchart of a component security control method based on a low-code platform is provided for Embodiment One of the present application. This embodiment can be applicable to the case of custom component security loading. The method is applied to a component security control system based on a low-code platform. As shown in Figure 1 , the method comprises:

[0054] S110, based on the function form, customizing a component, and compressing and storing the custom component resource.

[0055] Among them, the custom component can refer to a pure function; the custom component resource can refer to the basic information of the developed custom component and the custom component code.

[0056] Specifically, the custom component can be implemented in the form of a pure function (Function type), and receives a unique parameter bizContext (business context). The function encapsulates business logic inside, prohibits direct access to global objects (such as window, document), and all operations depend on the injected context. After determining the custom component, the basic information of the developed custom component needs to be filled into a fixed json file; wherein the basic information of the custom component includes: entry (entry method name), displayName (component function name), bindEntityName (bound entity name). And execute the node command, compile and package the custom component code into a umd format js file through the vue-cli scaffolding tool to ensure cross-environment compatibility. The generated js file is compressed into a zip package together with the json file, and the ZIP package is uploaded to the server storage through the low-code platform management interface.

[0057] In this embodiment, by defining components based on function form, the components are pure functions that only interact with the platform through the bizContext parameter, isolating the component execution environment and avoiding pollution of the global scope; by compiling and packaging the custom component code into a umd format js file, supporting multiple front-end modularization specifications, ensuring the compatibility of the components in different low-code platforms; by describing the component configuration independently through a JSON file, decoupling the code; fast metadata parsing during dynamic loading is achieved; by compressing the code file and the configuration file into a single file, resources are managed uniformly, effectively simplifying the upload / distribution process and improving resource loading efficiency.

[0058] S120, loading the current custom component resource corresponding to the current page from the custom component resource when rendering the page.

[0059] The component page rendering refers to the whole process of dynamically loading the custom component resource corresponding to the page according to the page configuration and rendering to the specified position of the page.

[0060] Specifically, during page rendering, the current page configuration information can be obtained, which contains a list of custom components to be loaded (including component name, position, etc.), each component has a unique identifier, such as the component name. According to the unique identifier of the component, the resource package (ZIP package) of the component is obtained from the server custom component resource, or it can also be directly obtained from the local cache (if the component has been loaded before).

[0061] In this embodiment, the custom component resource corresponding to the current page is dynamically loaded when rendering the page, realizing precise on-demand loading and avoiding redundant resource requests, significantly improving page performance.

[0062] S130, determining the context instance based on the current custom component position and determining the safe API based on the predefined global API.

[0063] The current custom component position can refer to the specific embedding position type of the component in the page layout, which is predefined by the low-code platform according to the page structure. The context instance can refer to a sandboxed business operation interface object dynamically created through the factory pattern and bound to the component position type. The predefined global API can refer to the global object and method provided by the browser, which has security risks, such as document, window, etc., and direct calling may cause the page content to be tampered maliciously. The safe API can refer to the safe alternative interface provided by the low-code platform, which encapsulates or rewrites the original high-risk API.

[0064] Specifically, the component position type includes: gridheader (view header), subgrid (subgrid header), formheader (form header), and according to different position types, corresponding context instances (ListContext, SubgridContext, FormContext) can be respectively created by the factory mode. A predefined global API interface is determined and encapsulated, that is, standard browser dangerous, sensitive and commonly used global methods are encapsulated into a unified interface, dangerous and sensitive APIs are shielded, document, window and other objects are set to undefined, and safe encapsulated alternative APIs such as safeQuerySelector, safeCreateElement are provided. Through the sandbox mechanism, the browser limits the plug-in to access only specific APIs (such as Chrome extension sandbox). After determining the context instance and the safe API, the safe API (such as safeQuerySelector, safeCreateElement) and the safe method (openDialogComponent, jumpComponentByRouter) provided by the platform can be mounted in the context instance.

[0065] In the embodiment, the differentiated context instance is automatically generated based on the component position type (gridheader / formheader / subgrid), that is, the position attribute is used to identify the position level of the component in the DOM tree, and the accessible data and operation permission range are determined; through the position-aware context injection, double API protection and sandbox nesting architecture, the safe loading of the custom component is realized, while the compatibility with the traditional Vue component ecosystem is maintained.

[0066] S140, based on the current custom component resource, injecting the context instance and the safe API into the current custom component, and rendering the current custom component.

[0067] Specifically, the current custom component resource is decompressed and parsed through the sandbox environment to obtain JS and JSON files. The JS file (UMD format) of the component is loaded, and the component entry function name (entry) is obtained from the JSON file. The entry function is obtained from the global object (because the UMD module is usually exposed in the global object) through the entry function name of the component, the entry function is called, the context instance mounted with the safe API is passed into the current custom component as a parameter, thereby initializing the component, and then the current custom component is rendered to the specified position of the current page, realizing the security isolation and permission minimization.

[0068] In this embodiment, the custom component resources corresponding to the current page are dynamically loaded when rendering the page, realizing precise on-demand loading, avoiding redundant resource requests, and significantly improving page performance; through position-aware context injection, precise matching of permissions and functions is realized, and the risk of permission generalization is eliminated; combined with safe API forced replacement (such as using safeQuerySelector to shield native DOM operations), the integrity of the function is ensured while completely isolating high-risk native API access; in combination with the sandboxed resource decompression execution mechanism, it is ensured that the third-party component code runs in an isolated environment, which not only maintains the development flexibility of the low-code platform, but also builds a security line for enterprise-level applications.

[0069] Optionally, the function-based custom component is compressed and stored, including:

[0070] The basic information of the function-based custom component is filled into a fixed JSON file, and the custom component code is packaged into a JS file, wherein the basic information includes an entry method name, a component function name, and a bound entity name.

[0071] The JS file and the JSON file are compressed and uploaded and stored to the server.

[0072] The entry method name can refer to the starting entry of the functional component; the function name of the component can refer to the identifier of the component function; and the bound entity name can refer to the name of the associated business data object (business entity).

[0073] Specifically, after implementing the custom component based on the function, the following standardized encapsulation operations need to be performed: first, the basic information of the component is strictly filled into a fixed structure of a JSON configuration file according to a predefined format. The predefined format can refer to the JSON format. Then, the node command is executed to compile and package the component source code into an independent JS file that meets the UMD specification through a build tool (such as vue-cli); wherein the Node command refers to a standard build instruction executed through the Vue CLI service. The generated JS file and the completed JSON file are compressed into a single ZIP resource package, which is uploaded to the server storage through the low-code platform management interface; three encapsulation is realized, namely, metadata configuration standardization (JSON), code delivery modularization (UMD JS), and resource management integration (ZIP), which establishes a traceable and verifiable component resource basis for subsequent safe loading.

[0074] In this embodiment, the custom component is implemented in a functional manner without changing the platform architecture, compatible with the Vue framework and existing loading mechanism, with extremely low development and learning costs, and no change in development mode. Only through the bizContext parameter to interact with the platform, isolate the component execution environment, avoid polluting the global scope; by compiling the custom component code into a umd format js file, supporting multiple front-end modularization specifications, ensuring the compatibility of the component in different low-code platforms; by describing the component configuration independently through a JSON file, decoupling the code; realizing fast resource data analysis during dynamic loading; by compressing the code file and the configuration file into a single file, managing resources uniformly, effectively simplifying the upload / distribution process, and improving the resource loading efficiency.

[0075] Exemplary, Figure 2 A custom component construction flowchart is provided for the first embodiment of the present application, as shown in Figure 2 The specific steps of custom component construction include:

[0076] 1. Develop a custom component based on Vue source code;

[0077] 2. Build through vue-cli compilation;

[0078] 3. Generate a compressed component file customComponent.min.js

[0079] 4. Core configuration items:

[0080] entry: declare the component entry method name

[0081] displayName: define the component function name

[0082] bindEntityName: specify the bound entity name

[0083] 5. Metadata file: generate component description file Component.info.json

[0084] 6. Perform compression and packaging operations to output the complete component package customComponent.zip.

[0085] Optionally, the context instance is determined based on the pre-defined context interface specification, comprising:

[0086] Based on the pre-defined context interface specification, a factory mode is adopted to create a corresponding context instance according to the current custom component position.

[0087] The context interface specification can refer to a predefined standardized business operation contract, a standardized operation interface defined by TypeScript or JavaScript, used to precisely control the business capabilities accessible to custom components. The factory mode refers to a location-aware context creation mechanism implemented by the ContextFactory class.

[0088] Specifically, the predefined context interface specification creates the BusinessComponentContext interface, which defines the business operation methods accessible to custom components, including data operation methods (updating form data, saving, loading, etc.), interface operation methods (opening pop-up windows, popping up prompts, etc.), and system information acquisition methods (account ID, account name, global system parameters, etc.). Based on the business operation methods accessible to custom components, the context inheritance system is determined: BaseContext (base context) → FormContext (form context) / ListContext (view context) / SubgridContext (subgrid context); wherein, BaseContext (base context) can refer to defining all component general capabilities at the base layer; at the functional layer, based on data operation dimensions, FormContext (form context, usually single data read-write) / ListContext (view context, usually batch data operation) / SubgridContext (subgrid context, usually restricted sub-data set operation). Through the inheritance system, components in different locations can only access operation methods matching their functions.

[0089] According to the current custom component location type identifier (location), the location type of the current custom component in the page is determined, including: gridheader (view header): located in the operation area at the top of the data list (e.g., add button, batch operation); formheader (form header): located in the title bar area of the form editing page (e.g., save button, back button); subgrid (subgrid header): located in the operation area of the nested sub-data table (e.g., sub-table new row). According to different location types, corresponding context instances (ListContext, SubgridContext, FormContext) are created through the factory mode. For example, ListContext can provide loadData(), refresh() and other list operations; FormContext can provide saveForm(), validate() and other form operations; SubgridContext can provide addRow(), deleteRow() and other sub-table operations.

[0090] In this embodiment, based on a predefined context interface specification, a factory mode is adopted to create a corresponding context instance according to the current custom component position, through a strong binding of position and authority, only matching business operation authority is given, and over-opening of authority is avoided; the contexts of different entity components are completely isolated, a new position type only needs to extend the factory mapping table, the platform architecture is not modified, the existing Vue component ecology is compatible, and the component development efficiency is effectively improved.

[0091] Optionally, the determining the security API based on the predefined global API comprises:

[0092] determining an exception API list based on the predefined global API;

[0093] intercepting the exception API contained in the exception API list through a proxy interception technology, and replacing the exception API with a security API.

[0094] Wherein, the exception API can refer to dangerous and sensitive API; the proxy interception technology can refer to property interception by Object.defineProperty. The security API can refer to a replacement API that is securely encapsulated.

[0095] Specifically, by analyzing the security risks of browser native APIs (such as document.write, window.localStorage, XMLHttpRequest, etc.), that is, determining dangerous and sensitive APIs, an exception API list is constructed in advance. The property access of global objects (such as window and document) is dynamically hijacked by using Object.defineProperty, and the document and window objects are set to undefined, that is, when the custom component attempts to call the exception API, real-time exception interception is triggered, and dangerous operations are blocked. Encapsulated security interfaces are provided for sensitive functions, and security is ensured through parameter verification, authority control, and log auditing, that is, replacement APIs that are securely encapsulated, such as safeQuerySelector, safeCreateElement, etc. In the context creation stage, the factory forcibly injects the security API when creating the context, and the custom component can only call the security interface through bizContext.safeAPI, and cannot directly access the native dangerous API.

[0096] In this embodiment, the abnormal API list is determined based on a predefined global API, the abnormal API in the abnormal API list is intercepted through proxy interception technology, and the abnormal API is replaced with a safe API. The API abuse problem is solved, the sensitive global object access is intercepted, the safe replacement API is provided, the risk of data theft and page tampering is reduced to a certain extent, the API management is unified, the standard browser sensitive API is encapsulated, the adjustment of the later permission policy and the expansion of the security log record are facilitated, and the maintenance cost is reduced.

[0097] For example, Figure 3 A security sandbox API setting flowchart is provided for the second embodiment of the application, as shown in Figure 3 The specific steps of setting the security sandbox API include:

[0098] 1. Re-encapsulating the API, shielding dangerous and sensitive APIs, setting document, window, etc. as undefined to prevent direct access, and providing rewritten safe APIs (such as subQuerySelector instead of querySelector) to ensure controlled operation.

[0099] 2. Based on the re-encapsulation strategy, API proxying and interception are realized, and global object properties are dynamically intercepted through Object.defineProperty.

[0100] 3. After completing the proxying and interception, the API follows the context injection custom component.

[0101] 4. If the custom component uses the low-code platform global API, it is used normally; if the custom component directly uses the browser native API, an exception is thrown.

[0102] Embodiment 2:

[0103] Figure 4 A flowchart of a component security control method based on a low-code platform is provided for the second embodiment of the application. The technical solution of this embodiment is further refined on the basis of the above-mentioned embodiment. As shown in Figure 4 The method includes:

[0104] S210, defining a custom component based on a function form, and compressing and storing the custom component resource.

[0105] S220, loading the current custom component resource corresponding to the current page from the custom component resource when rendering the page.

[0106] S230, determine a context instance based on the predefined context interface specification, and determine a security API based on the predefined global API.

[0107] S240, determine an entry method corresponding to the current custom component based on the current custom component resource.

[0108] Specifically, the entry method name is determined by parsing the entry field in the current custom component configuration JSON file.

[0109] In this embodiment, the entry method name is determined by parsing the entry field in the current custom component configuration JSON file, realizing the standardized management and dynamic loading of component resources; only the entry method name (entry) needs to be declared in the JSON configuration, without modifying the platform loading logic, realizing the decoupling of component development and platform architecture; the platform locates the entry function through dynamic lookup of window[entryName], ensures that the custom component code is executed in a sandbox environment, and prevents unauthorized component injection.

[0110] S250, call the entry method to inject the context instance and the security API into the current custom component.

[0111] Specifically, the entry method of the current custom component is called through the entry method name, and the context instance is passed in as a parameter, in which the custom component can access the controllable context provided by the low-code platform through the received parameter, realizing the closed environment.

[0112] In this embodiment, the entry method is called to inject the context instance and the security API into the current custom component, combining the location sensing capability of the location field, realizing the accurate matching injection of the context and the security API, avoiding the permission generalization; making the loading process of the custom component standardized, auditable, safe and controllable, reducing the maintenance cost, and at the same time eliminating the security vulnerability risk caused by the conflict of the entry method.

[0113] Exemplarily, Figure 5 A context interface and instantiation flowchart is provided for the second embodiment of the present application, as shown in Figure 5 The specific steps of the context interface and instantiation include:

[0114] 1. Define the context interface specification, create the BusinessComponentContext interface, define the business operation method (such as data read / write, permission verification, etc.), and build a unified context inheritance system.

[0115] 2. The factory mode creates a context, implements the InitContext method, and dynamically creates a corresponding context instance according to the location attribute of the component, including:

[0116] The location type gridReader (view header) creates a ListContext instance.

[0117] The location type subgrid (subgrid header) creates a SubgridContext instance.

[0118] The location type formReader (form header) creates a FormContext instance.

[0119] 3. Context parameter security injection: traverse all custom components, match the current component with the context type, and pass the corresponding context instance as a parameter into the component entry method.

[0120] Optionally, based on the current custom component resource, the context instance and the security API are injected into the current custom component, and further comprising:

[0121] When the current custom component performs page jump, the context instance and the security API are encapsulated through a secure page interaction interface.

[0122] Based on the context instance and the security API, run the target component corresponding to the jump page.

[0123] Among them, the page jump can refer to the view switching behavior of the user-defined component in the low-code platform through the secure navigation interface (not the native API) provided by the platform; the secure page interaction interface can refer to the controlled navigation method encapsulated by the low-code platform; for example, openDialogComponent and jumpComponentByRouter; its core features include: built-in context inheritance mechanism: automatically pass bizContext of the source component; integrate sandbox security policy: forced to carry security API proxy configuration; implement route whitelist verification: only allow jumping to platform pre-registered safe views.

[0124] Specifically, a page jump method is defined in the BusinessComponentContext interface, when the low-code platform loads a custom component, a context instance containing the jumpComponentByRouter method is injected into the component, and the page jump is called inside the custom component through the injected context. When the jumpComponentByRouter method is executed, it is checked whether the target component corresponding to the target page is in the platform-registered security component whitelist, and the minimum necessary permission set (such as data operation permission, interface operation permission) is extracted from the current context instance (i.e. encapsulating the context instance). A sandboxed context (SandboxedContext) with permission inheritance is created, which only contains part of the permissions of the source component, such as basic permissions, system information, and a set of security APIs. Dangerous parameters are filtered, XSS filtering and type checking are performed on all passed parameters, and sensitive parameters (such as ID, credentials) are encrypted. Jump through the platform routing system (non-native location.href), embed the security context signature in the routing meta information, verify the validity of the context signature when the target page is initialized, rebuild the sandbox environment through the context factory, and inject the rebuilt context into the target component entry function. When the target component is rendered and run, the browser API (i.e. encapsulated security API) is accessed in a restricted manner, and only the inherited permission set can be used to operate data / interface. The security log of the jump behavior is recorded.

[0125] Further, a popup method can also be declared in the BusinessComponentContext interface, and the popup method is implemented in the context instance: call the platform popup service, inherit the current context type, check whether the target component corresponding to the target page is in the platform-registered security component whitelist, create a sandboxed popup container, load the target component resources, create an isolated context, i.e. inherit the source context type, and extract the minimum necessary permission set from the current context instance. Filter dangerous parameters, perform XSS filtering and type checking on all passed parameters, and encrypt sensitive parameters (such as ID, credentials). Initializing the component specifically includes creating a container using a security API, applying CSS sandbox isolation, and adding to a secure DOM area.

[0126] In the embodiment, when the current custom component performs page jump, the context instance and the security API are encapsulated through the secure page interaction interface; based on the context instance and the security API, the target component corresponding to the jump page is run. This mode realizes the separation of security capabilities and business logic through the interface layer, ensures the safety and controllability of the jump process, and at the same time, takes into account the robustness, scalability and development efficiency of the system, supports complex scenario interaction, and ensures that cross-page operations comply with the security policy of the platform.

[0127] For example,Figure 6 A page jump flowchart based on a low-code platform is provided for embodiment two of the present application. As shown in Figure 6 The specific steps of the jump popup flow (openDialogComponent) are as follows:

[0128] 1. Inside the custom component, import the Vue page of the complex business (the page is a popup).

[0129] 2. Determine whether the jump page is a popup.

[0130] 3. If yes, call the openDialogComponent method in the controllable context provided by the low-code platform, and sequentially input the Vue page, the entry method of the Vue page, and the controllable context.

[0131] 4. Inside the openDialogComponent method, create a Vue instance according to the name of the Vue page.

[0132] 5. Execute the entry method of the Vue page and input the controllable context.

[0133] 6. In the entry method of the Vue page, open the popup itself and normally access the controllable context.

[0134] 7. If no, perform the route jump flow (jumpComponentByRouter), call the jumpComponentByRouter method in the controllable context provided by the low-code platform, and sequentially input the parameter Vue page, the route name, and the controllable context.

[0135] 8. Inside the jumpComponentByRouter method, register the Vue page to the route according to the route name, and take the controllable context as the route parameter.

[0136] 9. Inside jumpComponentByRouter, perform route jump, open the Vue page, and in the Vue page, access the controllable context through the route parameter.

[0137] Embodiment 3:

[0138] Figure 7 A framework diagram of a component security control system based on a low-code platform is provided for embodiment three of the present application. As shown in Figure 7 The system includes:

[0139] A custom component module 310 for customizing a component based on a function form and compressing and storing a custom component resource;

[0140] The first determining module 320 is configured to load a current custom component resource corresponding to a current page from the custom component resources when rendering the page;

[0141] The second determining module 330 is configured to determine a context instance based on the current custom component position and determine a security API based on a predefined global API;

[0142] The security control module 340 is configured to inject the context instance and the security API into the current custom component based on the current custom component resource, and render the current custom component.

[0143] Optionally, the custom component module 310 is specifically configured to:

[0144] For a function-form custom component, fill basic information of the custom component into a fixed json file, and package a code of the custom component as a js file, wherein the basic information includes an entry method name, a function name of the component, and a bound entity name.

[0145] Compress the js file and the json file, and upload and store them to a server.

[0146] Optionally, the second determining module 330 is specifically configured to:

[0147] Based on a predefined context interface specification, a corresponding context instance is created according to the current custom component position by using a factory mode.

[0148] Optionally, the second determining module 330 is specifically configured to:

[0149] Based on a predefined global API, an exception API list is determined.

[0150] An exception API included in the exception API list is intercepted by using a proxy interception technology, and the exception API is replaced by a security API.

[0151] Optionally, the security control module 340 is specifically configured to:

[0152] Based on the current custom component resource, an entry method corresponding to the current custom component is determined.

[0153] The entry method is called, the context instance and the security API are injected into the current custom component, and the current custom component is rendered.

[0154] The system further includes a jump module configured to:

[0155] When the current custom component performs a page jump, encapsulate the context instance and the secure API through a secure page interaction interface;

[0156] Based on the context instance and the secure API, render a target component corresponding to the jump page.

[0157] The component security control system based on a low-code platform provided by the embodiment of the application comprises: a custom component module, configured to define a custom component based on a function form and compress and store custom component resources; a first determination module, configured to load a current custom component resource corresponding to a current page from the custom component resources when rendering a page; a second determination module, configured to determine a context instance based on a position of the current custom component and determine a secure API based on a predefined global API; and a security control module, configured to inject the context instance and the secure API into the current custom component based on the current custom component resource, and render the current custom component. The custom component resource corresponding to the current page is dynamically loaded when rendering a page, precise loading on demand is achieved, redundant resource requests are avoided, and the performance of the page is significantly improved. Precise matching of permissions and functions is achieved through position-aware context injection, and the risk of permission generalization is eliminated. In combination with secure API forced replacement (such as shielding of native DOM operations by using safeQuerySelector), high-risk native API access is completely isolated while the integrity of functions is ensured. In combination with a sandboxed resource decompression execution mechanism, it is ensured that third-party component codes run in an isolated environment, which not only maintains the development flexibility of the low-code platform, but also builds a security line for enterprise-level applications.

[0158] Embodiment 4:

[0159] Figure 8 A structural schematic diagram of an electronic device that can be used to implement the embodiment of the application is shown. The electronic device 10 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (such as headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit implementations of the applications described and / or claimed in this document.

[0160] As Figure 8As shown, the electronic device 10 includes at least one processor 11, and a memory, such as a Read-Only Memory (ROM) 12, a Random Access Memory (RAM) 13, etc., connected to the at least one processor 11 in communication. The memory stores a computer program executable by the at least one processor 11, and the computer program is executed by the at least one processor 11 to enable the at least one processor 11 to perform the method provided by the present application.

[0161] The processor 11 can perform various appropriate actions and processes according to a computer program stored in the Read-Only Memory (ROM) 12 or a computer program loaded from the storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0162] Various components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, a loudspeaker, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0163] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various special-purpose Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, a Digital Signal Process (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the component security control method based on a low-code platform.

[0164] In some embodiments, the low-code platform-based component security control method can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, parts or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of the low-code platform-based component security control method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the low-code platform-based component security control method by way of other any suitable means, e.g., by way of firmware.

[0165] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0166] Computer programs used to implement the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed by the processor, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as part of a standalone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0167] In the context of the present application, the computer readable storage medium stores computer instructions for causing a processor to implement the component security control method based on a low-code platform provided by the present application when executed. The computer readable storage medium can be a tangible medium that can contain or store the computer program for use by or in connection with an instruction execution system, apparatus, or device. The computer readable storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium can be a machine-readable signal medium. More specific examples of the machine readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk drives, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0168] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a Cathode Ray Tube (CRT) or a Liquid Crystal Display (LCD) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0169] The systems and techniques described herein can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described herein, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0170] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and virtual private server (VPS) services.

[0171] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, as long as the desired results of the technical solutions of the present disclosure are achieved, and the present disclosure is not limited herein.

[0172] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A component security control method based on a low-code platform, characterized in that, The system comprises: a custom component is defined based on a function form, and a custom component resource is stored in a compressed manner; when a page is rendered, a current custom component resource corresponding to a current page is loaded from the custom component resource; a context instance is determined based on a current custom component position, and a security API is determined based on a predefined global API; the context instance and the security API are injected into the current custom component based on the current custom component resource, and the current custom component is rendered; the custom component is defined based on the function form, and the custom component resource is stored in a compressed manner, comprising: a custom component is defined based on a function form, and basic information of the custom component is filled into a fixed json file, and a code of the custom component is packaged as a js file, wherein the basic information comprises an entry method name, a function name of the component, and a bound entity name; the js file and the json file are compressed and uploaded and stored to a server; the context instance is determined based on the current custom component position, comprising: based on a predefined context interface specification, a corresponding context instance is created according to the current custom component position by using a factory mode; the security API is determined based on the predefined global API, comprising: an abnormal API list is determined based on the predefined global API; an abnormal API contained in the abnormal API list is intercepted by using a proxy interception technology, and the abnormal API is replaced by a security API.

2. The method of claim 1, wherein, the context instance and the security API are injected into the current custom component based on the current custom component resource, and the current custom component is rendered, comprising: based on the current custom component resource, an entry method corresponding to the current custom component is determined; the entry method is called, the context instance and the security API are injected into the current custom component, and the current custom component is rendered.

3. The method of claim 1, wherein, after the context instance and the security API are injected into the current custom component based on the current custom component resource, the following further comprises: when the current custom component performs page jump, the context instance and the security API are encapsulated by using a secure page interaction interface; based on the context instance and the security API, a target component corresponding to a jump page is rendered.

4. A component security control system based on a low-code platform, characterized by, The system is used for executing the component security control method based on the low-code platform in any one of claims 1-3, comprising: a custom component module is used for defining a custom component based on a function form, and a custom component resource is stored in a compressed manner; a first determination module is used for loading a current custom component resource corresponding to a current page from the custom component resource when a page is rendered; a second determination module is used for determining a context instance based on a current custom component position, and determining a security API based on a predefined global API; ​ A security control module is configured to inject the context instance and the security API into the current custom component based on the current custom component resource, and render the current custom component.

5. An electronic device, comprising: The method comprises the following steps: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the low-code platform-based component security control method of any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to implement the low-code platform-based component security control method of any one of claims 1-3 when executed.

Images