Code review method, system and equipment and storage medium

Abstract

The invention discloses a code review method, system and device and a storage medium, and the method comprises the steps: obtaining a source code file, calling a first analysis tool to carry out the dependency analysis of the source code file, obtaining a dependency vulnerability report, calling a second analysis tool to carry out the risk analysis of the source code file, and obtaining an analysis result; performing risk code extraction based on the analysis result to obtain a risk code snippet; and constructing a multi-dimensional cue word framework, mapping the analysis result, the risk code snippets and the dependency vulnerability report to a dimension classification corresponding to the multi-dimensional cue word framework to obtain a structured input template, and inputting the structured input template into a preset large model for risk assessment to obtain a code review report. According to the method, after the code is examined by using the first analysis tool and the second analysis tool, the corresponding static examination result and the vulnerability analysis report are obtained, and then the code examination is comprehensively detected by using the large model, so that the accuracy of the examination result is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of code review, and in particular to a code review method, system, device and storage medium. BACKGROUND

[0002] The current code review technology mainly adopts a multi-tool combination scheme to detect code quality from different dimensions. Typical tools include: open network application security project dependency checking tools and static code analysis tools. Although the above tools have certain detection capabilities in their respective fields, in the current code review process, the dependency checking tools and the static code analysis tools are usually run independently, lack of deep integration, and cannot comprehensively cover the evaluation of multiple aspects of code quality, such as architecture defects, component dependency risks and context relevance of security vulnerabilities, which cannot be comprehensively detected. Moreover, the dependency scanning tool only provides a vulnerability list and does not guide how to fix it, such as upgrading to which version, and the static analysis tool may suggest refactoring the code, but cannot associate the update needs of the dependent library, so that the developer needs to manually cross-analyze, resulting in a high false positive rate or missing critical issues. SUMMARY

[0003] To solve the above technical problems, the embodiments of the present application provide a code review method, system, device and storage medium to solve the technical problem that the code review cannot be comprehensively detected in the code review, resulting in a high false positive rate.

[0004] The first aspect of the embodiments of the present application provides a code review method, the method comprising: obtaining a source code file; calling a first analysis tool to perform dependency item analysis on the source code file to obtain a dependency vulnerability report, calling a second analysis tool to perform risk analysis on the source code file to obtain an analysis result, extracting risk code based on the analysis result to obtain a risk code segment; constructing a multi-dimensional prompt word framework, mapping the analysis result, the risk code segment and the dependency vulnerability report into a dimension classification corresponding to the multi-dimensional prompt word framework to obtain a structured input template, inputting the structured input template into a preset large model for risk assessment to obtain a code review report.

[0005] In a possible implementation manner of the first aspect, the calling of the first analysis tool to perform dependency item analysis on the source code file comprises: calling the first analysis tool to perform dependency item analysis on the source code file to obtain a dependency library name and a version number; obtaining an identifier according to the dependency library name and the version number, and performing vulnerability information matching based on the identifier to obtain the dependency vulnerability report.

[0006] In a possible implementation manner of the first aspect, the second analysis tool is called to perform risk analysis on the source code file, and analysis results are obtained, including: The second analysis tool is called to parse the source code, and a syntax tree is obtained, wherein the syntax tree includes a plurality of nodes; A rule template is determined, the types of the nodes in the syntax tree are matched by a path expression according to the rule template, and a matching result is obtained, the matching result is aggregated and analyzed, and analysis results are obtained, wherein the rule template is determined by a custom rule of an XPath expression.

[0007] In a possible implementation manner of the first aspect, the analysis results, the risk code segment and the dependency vulnerability report are mapped into a dimension classification corresponding to a multi-dimensional prompt word framework, and a structured input template is obtained, including: Key fields of the analysis results are extracted, and a plurality of key fields are obtained; The dependency vulnerability report is extracted, a dependency tree is obtained, and the plurality of key fields, the dependency tree and the risk code segment are respectively mapped into a dimension classification corresponding to the multi-dimensional prompt word framework, and an audit prompt word is obtained, and the audit prompt word is determined as the structured input template.

[0008] In a possible implementation manner of the first aspect, after the code review report is obtained, the method further includes: A plurality of error cases are obtained by counting cases in which correct source code in the source code file is identified as risk code; The error cases are added to a rule library of a preset large model, and an updated preset large model is obtained, so that the reviewer performs risk assessment on the source code file by using the updated preset large model.

[0009] To solve the same technical problem, a second aspect of an embodiment of the present application provides a code review system, including an acquisition module, a parsing module and a risk identification module, wherein, The acquisition module is configured to acquire a source code file; The parsing module is configured to call a first analysis tool to perform dependency analysis on the source code file, obtain a dependency vulnerability report, call a second analysis tool to perform risk analysis on the source code file, obtain analysis results, and perform risk code extraction based on the analysis results to obtain a risk code segment; The risk identification module is configured to construct a multi-dimensional prompt word framework, map the analysis results, the risk code segment and the dependency vulnerability report into a dimension classification corresponding to the multi-dimensional prompt word framework, obtain a structured input template, input the structured input template into a preset large model for risk assessment, and obtain a code review report.

[0010] In a possible implementation manner of the second aspect, the parsing module includes a dependency analysis unit and a matching unit, wherein, The dependency analysis unit is configured to call the first analysis tool to perform dependency analysis on the source code file to obtain a dependency library name and a version number; The matching unit is configured to obtain an identifier according to the dependency library name and the version number, perform vulnerability information matching based on the identifier, and obtain a dependency vulnerability report.

[0011] In a possible implementation of the second aspect, the parsing module further includes a syntax tree parsing unit and a risk analysis unit, wherein, The syntax tree parsing unit is configured to call the second analysis tool to parse the source code to obtain a syntax tree, wherein the syntax tree includes a plurality of nodes; The risk analysis unit is configured to determine a rule template, match types of the nodes in the syntax tree based on the rule template through a path expression, obtain a matching result, aggregate and analyze the matching result, and obtain an analysis result, wherein the rule template is determined by a custom rule through an XPath expression.

[0012] The third aspect of the embodiment of the present application provides a computer device, including: A memory configured to store a computer program; A processor configured to execute the computer program to implement the steps of the code review method according to the first aspect.

[0013] The fourth aspect of the embodiment of the present application provides a storage medium, and the storage medium stores a computer program. When the computer program is executed by a processor, the steps of the code review method according to the first aspect are implemented.

[0014] The technical scheme of the present application has the following advantages: The code review method provided by the embodiment of the present application acquires a source code file, calls a first analysis tool to perform dependency analysis on the source code file to obtain a dependency vulnerability report, then calls a second analysis tool to perform risk analysis on the source code file to obtain an analysis result, performs risk code extraction based on the analysis result to obtain a risk code segment, constructs a multi-dimensional prompt word framework, maps the analysis result, the risk code segment and the dependency vulnerability report into a dimension classification corresponding to the multi-dimensional prompt word framework to obtain a structured input template, inputs the structured input template into a preset large model to perform risk assessment, and obtains a code review report. The above method performs code review by using the first analysis tool and the second analysis tool respectively to obtain a corresponding static review result and a vulnerability analysis report, and then uses a large model to comprehensively detect the code review, thereby effectively improving the accuracy of the review result. BRIEF DESCRIPTION OF DRAWINGS

[0015] In order to make the technical solutions in the specific embodiments of the present application or the prior art clearer, the accompanying drawings needed in the specific embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0016] Figure 1 Flow chart of the code review method in the embodiment of the present application; Figure 2 Code review framework diagram of the code review method in the embodiment of the present application; Figure 3 Structure block diagram of the code review system in the embodiment of the present application; The figure marks are: 300, code review system; 301, acquisition module; 302, analysis module; 303, risk identification module. Specific embodiments

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort belong to the scope of protection of the present application.

[0018] In the description of the present application, it should be noted that the terms "first", "second", "third" are only for the purpose of description, and cannot be understood as indicating or implying relative importance.

[0019] The code review method provided in the embodiments of the present application, as shown in Figure 1 Figure 1 is a code review method flow chart, including steps S101 to S103, and each step is specifically as follows: S101, acquiring a source code file.

[0020] In this embodiment, the source code file is acquired, specifically, the code file is received through the API interface, and the source code file is stored to the distributed database, and a unique version identification is generated.

[0021] ​By using distributed version control to realize high-availability storage, and then generating the code fingerprint of the code file, i.e. the hash value, through content addressing, the integrity and uniqueness of the code are ensured. Specifically, the code fingerprint value is calculated, the hash value is generated for the file, the directory structure, and the submission record using the SHA-1 algorithm, the file content is directly located through the hash value, and version identification, distributed synchronization, and change comparison are realized. Since the SHA-1 algorithm is commonly used in the art to calculate the hash value, the specific calculation process will not be described here. Taking the calculation of the hash value of the file as an example, the SHA-1 algorithm is calculated for the file content to obtain binary data, and then the binary hash value is converted into a 40-bit hexadecimal string.

[0022] After the client code sends a request to the API interface through the POST request mode, it first checks whether the request contains a file and necessary parameters (project_name and author). If the parameters are missing, an error response is returned. Then the file content is read, and the hash value of the file is generated as a unique version identifier. Then it is checked whether the same version of code already exists in the database. If it exists, the existing version identifier is directly returned. If it does not exist, the file content and related information (code name, author, upload time, etc.) are stored in the distributed database, and a successful response and the generated version identifier are returned.

[0023] It should be noted that the distributed database is preferably MongoDB.

[0024] S102, a first analysis tool is called to perform dependency analysis on the source code file to obtain a dependency vulnerability report, a second analysis tool is called to perform risk analysis on the source code file to obtain an analysis result, risk code extraction is performed based on the analysis result to obtain a risk code segment.

[0025] In this embodiment, as shown in Figure 2 , Figure 2 is a code review framework diagram, and from Figure 2As can be seen, the first step of the code review is to store the uploaded source code, and the second step is to use a scanning tool to parse the source code, and then to perform a preliminary static scan on the source code file quality, and the specific process is as follows: calling an open-source dependency security detection tool to parse the dependencies of the source code file, generating a dependency vulnerability report, and then scanning the code structure in the source code file, such as function call chain and complexity, by using a SonarQube static analysis tool to obtain an analysis result. Then, according to the hash value and the analysis result, the complete code context is extracted from the distributed database to obtain a risk code segment. The third step is to review the deep quality problems and component dependency problems of the code, and the specific review process is described in detail in the S103 step. Finally, a code review report is obtained, and relevant personnel can adjust the code according to the obtained code review report, and can also update the rule library of the preset large model after integrating the error cases in the review result.

[0026] It should be noted that the known vulnerability database includes, but is not limited to, the NVD vulnerability library, and the NVD vulnerability library is periodically synchronized, the vulnerability data is parsed, and a local index is formed.

[0027] In an embodiment, a first analysis tool is called to parse the dependencies of the source code file, including: The first analysis tool is called to parse the dependencies of the source code file to obtain the dependency library name and version number; According to the dependency library name and version number, an identifier is obtained, and the identifier is used for vulnerability information matching to obtain a dependency vulnerability report.

[0028] In this embodiment, an open-source dependency security detection tool is used to parse the code dependencies to obtain the dependency library name and version number, and then a Common Platform Enumeration (CPE) format identifier is generated according to the dependency name and version number. The identifier is used to match the known vulnerability database to find the vulnerability information related to the dependency library. The vulnerability database stores detailed information of each vulnerability, such as CPE identifier, CVE number, CVSS score, vulnerability description, and impact range.

[0029] The CVE number and CVSS score of the vulnerability matched with the dependency library are obtained from the vulnerability database, and then the parsed dependency library information, generated CPE identifier, matched CVE number, CVSS score, and vulnerability description are integrated into a dependency vulnerability report.

[0030] It should be noted that the CVE number is the unique identifier of the vulnerability, and the CVSS score is used to quantify the severity of the vulnerability. In addition, the dependency name and version number are mapped to the NVD database to obtain the CVE number and CVSS score, and a dependency vulnerability report is obtained.

[0031] It should be noted that the first analysis tool can be understood as an open source dependency security detection tool, In an embodiment, the second analysis tool is called to perform risk analysis on the source code file, and an analysis result is obtained, including: The second analysis tool is called to parse the source code and obtain a syntax tree, wherein the syntax tree includes a plurality of nodes; A rule template is determined, and the types of the nodes in the syntax tree are matched by a path expression according to the rule template to obtain a matching result, and the matching result is aggregated and analyzed to obtain an analysis result, wherein the rule template is determined by a XPath expression.

[0032] In this embodiment, the selected second analysis tool is used to parse the source code and generate a syntax tree. The syntax tree is a tree-shaped data structure representing the abstract syntax structure of the source code, and each node represents a structural element (such as a class, function, variable, expression, etc.) in the source code. Then, according to the analysis requirement, a XPath expression is defined as a rule template. The defined XPath expression is used to query the syntax tree, match the nodes that meet the conditions, and then aggregate and analyze the matched nodes to obtain the required analysis result. Exemplarily, the source file code is scanned by the SonarQube static analysis tool, the source code file structure is scanned, such as function call chain and complexity, a syntax tree is generated, and a XPath expression is defined to identify risk code, such as SQL injection points and methods with more than 50 lines of statements. The user can set it according to the requirement. Then, the XPath expression is used to query the syntax tree, find all matching method nodes, count the number of matched methods, output the names and positions of these methods, generate a report of the analysis result, and point out which methods are too long and may need to be refactored.

[0033] It should be noted that the second analysis tool refers to the SonarQube static analysis tool, which can provide a predefined rule set for each supported language, and can also define rules through XPath expressions. XPath expression is a path expression based on syntax tree pattern matching, which is a language used for navigating and querying nodes in XML documents, and can also be used to query syntax trees. The rule template is used to match nodes of a specific type in the syntax tree.

[0034] S103, constructing a multi-dimensional prompt word framework, mapping the analysis result, the risk code segment and the dependency vulnerability report to the dimension classification corresponding to the multi-dimensional prompt word framework to obtain a structured input template, inputting the structured input template into a preset large model to perform risk assessment, and obtaining a code review report.

[0035] In the embodiment, to improve the efficiency and accuracy of code security review, the analysis result, risk code segment and dependency vulnerability report are structured and integrated to build a hierarchical input template, i.e., a structured input template, by using a 6D Framework prompt word framework. Then the structured template is input into a preset large model for semantic analysis to generate a high-quality code review report.

[0036] The embodiment overcomes the drawbacks of the conventional scheme that only realizes local scanning, such as the dependency check of OWASP, and builds an end-to-end audit closed loop through the integration of the whole link of "storage-scanning-review-feedback", thereby covering multi-level problems of code quality, such as architecture defects and component dependency risks. Specifically, before analysis by the preset large model, the analysis result, risk code segment and dependency vulnerability report are converted into a structured input template, and cross-dimension association is established through vulnerability_id and is_called fields. Then the JSON template is parsed by the preset large model to extract the vulnerability type, code context and dependency vulnerability report, and further combined with the code context of the source file and the vulnerability rule to generate a repair suggestion, and according to the CVSS score of the dependency vulnerability and whether it is called, the actual risk level is evaluated. Through the combination of the 6D Framework prompt word framework and the preset large model, the automation and standardization of code quality review are realized, and the review efficiency and quality are significantly improved, which is especially suitable for continuous integration scenarios of large-scale code library, and helps auditors to quickly find and repair security vulnerabilities.

[0037] It should be noted that the preset large model includes but is not limited to fine-tuning based on DeepSeek-R1, Doubao, etc.

[0038] In an embodiment, the analysis result, risk code segment and dependency vulnerability report are mapped to the dimension classification corresponding to the multi-dimensional prompt word framework to obtain a structured input template, including: key fields are extracted from the analysis result to obtain a plurality of key fields; The dependency vulnerability report is extracted to obtain a dependency tree, and the plurality of key fields, the dependency tree and the risk code segment are respectively mapped to the dimension classification corresponding to the multi-dimensional prompt word framework to obtain a review prompt word, and the review prompt word is determined as the structured input template.

[0039] In the embodiment, the 6D Framework provides structured guidance for input template design, which includes 6 dimensions, namely role definition dimension, task decomposition dimension, constraint system dimension, knowledge injection dimension, interaction protocol dimension and exception handling dimension. The functions of each dimension are as follows: 1) Role definition dimension, the goal of this dimension is to clearly define the subject role of performing source code inspection work and its specific responsibilities, providing a basis for subsequent task allocation and responsibility tracing. For example, it can be defined as: you are a source code inspection assistant, conducting a comprehensive inspection of source code about to be released to the production environment, covering the following core responsibilities: static vulnerability scanning, performance bottleneck detection, code specification verification, and dependency risk assessment, etc.

[0040] 2) Task decomposition dimension, the goal of this dimension is to analyze the potential risks of project source code, including: 1) describing specific vulnerabilities in source code based on static scanning results, and giving specific risk levels, 2) giving optimization suggestions, etc.

[0041] 3) Constraint system dimension, the goal of this dimension is to specify the background conditions, limiting factors and rules followed by the inspection work, to ensure the accuracy and consistency of the inspection results, and to avoid deviations caused by unclear conditions or inconsistent rules, for example, the source code package is developed using JAVA language as background information, and the code specification verification should be performed according to the coding specification of JAVA language.

[0042] 4) Knowledge injection dimension, the role of this dimension is to provide relevant knowledge, experience and rules for the inspection work, to help the inspection personnel better identify problems and make accurate judgments. For example, the following audit experience can be referred to, and the misjudgment rules in the rule library should be ignored: 1) potential performance bottlenecks, such as unnecessary repeated rendering, resource loading strategy, cache mechanism implementation, etc. 2) security issues, such as XSS protection, sensitive information processing, interface security verification, etc.

[0043] 5) Interaction protocol dimension, the interaction rules include: 1. Each problem needs to be described; 2. Each problem needs to give optimization suggestions; 3. The code package needs to give score details.

[0044] 6) Exception handling dimension, the role of this dimension is to handle possible exceptions in the inspection process, to ensure the smooth progress of the inspection work and the integrity of the results, and to avoid interruption of the inspection work or inaccurate results due to exceptions. For example, if the dependent library is missing, mark the risk point: the dependent library information is not obtained, and evaluate the component dependency risk as usual.

[0045] Based on the construction of a multi-dimensional prompt word framework, the analysis results, risk code snippets, and dependency vulnerability reports are organized by dimension to facilitate the understanding of large models and cross-dimensional associations, such as binding the vulnerability CVE number to the code snippet to achieve precise analysis. Specifically, key fields are extracted from the analysis results, including fields such as tool name, rule number, problem description, and code location. Dependency vulnerability reports such as CVE number, CVSS score, vulnerability description, and impact range are extracted from the dependency vulnerability report. Then, the relationship between the dependency vulnerability report and the risk code snippet is established according to the mapping rules. According to the constructed multi-dimensional prompt word framework, the review prompt words are obtained through dimensional integration, and the review prompt words are determined as a structured input template.

[0046] In one embodiment, after obtaining the code review report, the method further includes: Count the cases where correct source code in the source code file is identified as risky code, and obtain multiple error cases; The error cases are added to the rule library of the preset large model to obtain an updated preset large model, so that the reviewer can use the updated preset large model to perform risk assessment on the source code file.

[0047] In this embodiment, after obtaining the code review report, the operator performs repairs such as upgrading dependency versions and refactoring the code according to the review report. Appeals can also be submitted for misjudgment issues, and the administrator will update the rule base, such as correcting the weight of misjudgment rules and adding new vulnerability features. Specifically, cases in the source code file that were originally correct source code but were identified as risky code are counted as error cases, and then the error cases are added to the rule base of the preset large model to obtain an updated preset large model, so that the reviewer can use the updated preset large model to perform risk assessment on the source code file. By introducing the rule base update process, user appeals can automatically correct misjudgment rules, such as adjusting the vulnerability matching threshold, thereby reducing the misjudgment rate.

[0048] For example, after obtaining the code review report, you can click the appeal button in the review details interface to make an appeal. The maintenance plan reviewer will manually judge the content of the appeal when reviewing the maintenance plan. After it is judged to be a misjudgment problem of the large model, the administrator will manually maintain it in the large model rule library and mark it as a misjudgment rule.

[0049] The code review system provided by the embodiment of the present invention is as follows: Figure 3 As shown, Figure 3 The system block diagram of the code review system 300 includes an acquisition module 301, a parsing module 302 and a risk identification module 303, wherein: The acquisition module 301 is used to obtain source code files; The parsing module 302 is configured to call a first analysis tool to perform dependency parsing on the source code file to obtain a dependency vulnerability report, call a second analysis tool to perform risk analysis on the source code file to obtain an analysis result, perform risk code extraction based on the analysis result to obtain a risk code segment, and perform risk code extraction based on the analysis result to obtain a risk code segment. The risk identification module 303 is configured to construct a multi-dimensional prompt word framework, map the analysis result, the risk code segment, and the dependency vulnerability report to a dimension classification corresponding to the multi-dimensional prompt word framework to obtain a structured input template, input the structured input template into a preset large model to perform risk assessment, and obtain a code review report.

[0050] In an embodiment, the parsing module 302 includes a dependency parsing unit and a matching unit, wherein, The dependency parsing unit is configured to call a first analysis tool to perform dependency parsing on the source code file to obtain a dependency library name and a version number. The matching unit is configured to obtain an identifier based on the dependency library name and the version number, perform vulnerability information matching based on the identifier, and obtain a dependency vulnerability report.

[0051] In an embodiment, the parsing module 302 further includes a syntax tree parsing unit and a risk analysis unit, wherein, The syntax tree parsing unit is configured to call a second analysis tool to parse the source code to obtain a syntax tree, wherein the syntax tree includes a plurality of nodes. The risk analysis unit is configured to determine a rule template, match types of the nodes in the syntax tree based on the rule template through a path expression to obtain a matching result, aggregate and analyze the matching result to obtain an analysis result, and wherein the rule template is determined by a XPath expression.

[0052] The specific implementation of the code review system based on the large model is basically the same as the specific embodiments of the above code review method, and will not be repeated here.

[0053] In an embodiment of the present application, a computer device is provided, which includes a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the above steps; the computer device provided in the embodiment has similar implementation principles and technical effects to the above method embodiments, and will not be repeated here.

[0054] In an embodiment of the present application, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement the above steps; the computer readable storage medium provided in the embodiment has similar implementation principles and technical effects to the above method embodiments, and will not be repeated here.

[0055] Any combination of the technical features in the above embodiments can be made, and for the sake of brevity, not all possible combinations are described above. However, any combination of features described is to be considered as being encompassed by the scope of the present disclosure.

[0056] The above-described embodiments have further detailed the purposes, technical solutions, and beneficial effects of the present application. It should be understood that the above-described embodiments are merely specific embodiments of the present application and are not intended to limit the protection scope of the present application. It is particularly pointed out that any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A code review method characterized by, The method comprises the following steps: obtaining a source code file; calling a first analysis tool to perform dependency analysis on the source code file to obtain a dependency vulnerability report, calling a second analysis tool to perform risk analysis on the source code file to obtain an analysis result, performing risk code extraction based on the analysis result to obtain a risk code segment; constructing a multi-dimensional prompt word framework, mapping the analysis result, the risk code segment and the dependency vulnerability report into a dimension classification corresponding to the multi-dimensional prompt word framework to obtain a structured input template, inputting the structured input template into a preset large model to perform risk assessment to obtain a code review report.

2. The code review method of claim 1, wherein, The method comprises the following steps: calling a first analysis tool to perform dependency analysis on the source code file to obtain a dependency library name and a version number; based on the dependency library name and the version number, obtaining an identifier, and performing vulnerability information matching based on the identifier to obtain a dependency vulnerability report.

3. The code review method of claim 1, wherein, The method comprises the following steps: calling a second analysis tool to perform analysis on the source code to obtain a syntax tree, wherein the syntax tree comprises a plurality of nodes; determining a rule template, matching the types of the nodes in the syntax tree through a path expression based on the rule template to obtain a matching result, and aggregating and analyzing the matching result to obtain an analysis result, wherein the rule template is determined by a XPath expression.

4. The code review method of claim 1, wherein, The method comprises the following steps: extracting key fields from the analysis result to obtain a plurality of key fields; extracting a dependency tree from the dependency vulnerability report, and mapping the plurality of key fields, the dependency tree and the risk code segment into a dimension classification corresponding to the multi-dimensional prompt word framework to obtain a review prompt word, and determining the review prompt word as a structured input template.

5. The code review method of claim 1, wherein, After obtaining the code review report, the method further comprises the following steps: counting a plurality of error cases in which correct source code is identified as risk code in the source code file; adding the error cases to a rule library of the preset large model to obtain an updated preset large model, so that a reviewer performs risk assessment on the source code file by using the updated preset large model.

6. A code review system, characterized by, The method comprises the following steps: obtaining a source code file; calling a first analysis tool to perform dependency analysis on the source code file to obtain a dependency vulnerability report, calling a second analysis tool to perform risk analysis on the source code file to obtain an analysis result, performing risk code extraction based on the analysis result to obtain a risk code segment; The risk identification module is configured to construct a multi-dimensional prompt word framework, map the analysis result, the risk code segment and the dependency vulnerability report into a dimension category corresponding to the multi-dimensional prompt word framework to obtain a structured input template, input the structured input template into a preset large model to perform risk assessment, and obtain a code review report.

7. The code review system of claim 6, wherein, The analysis module includes a dependency item analysis unit and a matching unit, wherein, The dependency item analysis unit is configured to call a first analysis tool to analyze dependencies of the source code file to obtain a dependency library name and a version number; The matching unit is configured to obtain an identifier according to the dependency library name and the version number, perform vulnerability information matching based on the identifier, and obtain a dependency vulnerability report.

8. The code review system of claim 6, wherein, The analysis module further includes a syntax tree analysis unit and a risk analysis unit, wherein, The syntax tree analysis unit is configured to call a second analysis tool to analyze the source code to obtain a syntax tree, wherein the syntax tree includes a plurality of nodes; The risk analysis unit is configured to determine a rule template, match types of the nodes in the syntax tree through a path expression according to the rule template to obtain a matching result, aggregate and analyze the matching result to obtain an analysis result, and wherein the rule template is determined by a self-defined rule through an XPath expression.

9. A computer device, comprising: comprise: a memory configured to store a computer program; a processor configured to implement the code review method according to any one of claims 1 to 5 when executing the computer program.

10. A storage medium, characterized by The storage medium has a computer program stored thereon, and the computer program is executed by the processor to implement the steps of the code review method according to any one of claims 1 to 5.

Images