Software project vulnerability detection method and device, equipment and medium

Abstract

The invention relates to a software project vulnerability detection method, device and equipment and a medium, a dependency tree of a software project is generated according to configuration information in a configuration file of the software project, and the dependency tree comprises direct dependency items and indirect dependency items in the software project. Furthermore, according to the attribute information of the direct dependency item and the attribute information of the indirect dependency item, querying vulnerability data obtained from a vulnerability database to determine whether vulnerability exists in the direct dependency item and the indirect dependency item, and according to the direct dependency item and / or the indirect dependency item with the vulnerability, generating a vulnerability detection report. According to the method, the vulnerability detection is performed on the direct dependency item and the indirect dependency item, so that comprehensive detection of the software project is realized, efficient matching with the vulnerability data is performed, a detailed vulnerability detection report is generated, the vulnerability detection accuracy of the software project is improved, and the security of a software project supply chain is improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method, apparatus, device and medium for detecting software project vulnerabilities. Background Technology

[0002] Existing technologies use vulnerability scanning tools to scan for vulnerabilities in software projects. However, these tools only detect vulnerabilities in packages directly referenced by the software project, i.e., direct dependencies, resulting in vulnerabilities not being detected comprehensively and accurately. Summary of the Invention

[0003] To address the aforementioned technical issues, this disclosure provides a method, apparatus, device, and medium for detecting software project vulnerabilities, thereby improving the accuracy of software project vulnerability detection and enhancing the security of the software project supply chain.

[0004] In a first aspect, embodiments of this disclosure provide a software project vulnerability detection method, including:

[0005] Obtain the configuration file for the software project;

[0006] Based on the configuration information in the configuration file, a dependency tree for the software project is generated, which includes direct and indirect dependencies in the software project.

[0007] Based on the attribute information of the direct dependency, query the vulnerability data obtained from the vulnerability database to determine whether the direct dependency has a vulnerability;

[0008] Based on the attribute information of the indirect dependency, query the vulnerability data to determine whether the indirect dependency has a vulnerability;

[0009] Based on the direct and / or indirect dependencies of the software project that contain vulnerabilities, a vulnerability detection report is generated. The vulnerability detection report includes the attribute information, vulnerability description, vulnerability level, and remediation information of the direct and / or indirect dependencies of the vulnerabilities.

[0010] In some embodiments, generating the dependency tree of the software project based on the configuration information in the configuration file includes:

[0011] Use a dependency management tool to read the configuration information from the configuration file;

[0012] Based on the configuration information in the configuration file, parse the dependency chain in the software project;

[0013] Generate the dependency tree of the software project based on the dependency chain in the software project.

[0014] In some embodiments, after generating the dependency tree of the software project based on the configuration information in the configuration file, the method further includes:

[0015] The attribute information of each direct dependency and each indirect dependency in the dependency tree is converted into a standard format data structure.

[0016] In some embodiments, before querying vulnerability data obtained from a vulnerability database based on the attribute information of the direct dependencies, the method further includes:

[0017] The vulnerability data in the vulnerability database is periodically or in real time synchronized to the local machine.

[0018] In some embodiments, after generating a vulnerability detection report based on the direct and / or indirect dependencies of the vulnerability in the software project, the method further includes:

[0019] The vulnerability detection report is converted into files in multiple formats and output.

[0020] In some embodiments, the method further includes:

[0021] Retrieve license information from the open-source license database;

[0022] Based on the attribute information of the direct dependency, query the license information to determine whether the license of the direct dependency has expired;

[0023] Based on the attribute information of the indirect dependency, query the license information to determine whether the license of the indirect dependency has expired;

[0024] If the licenses for the direct dependencies and / or the indirect dependencies expire, the direct dependencies and / or the indirect dependencies shall be replaced or modified.

[0025] Secondly, embodiments of this disclosure provide a software project vulnerability detection device, comprising:

[0026] The acquisition module is used to retrieve configuration files for software projects.

[0027] The first generation module is used to generate the dependency tree of the software project according to the configuration information in the configuration file. The dependency tree includes direct dependencies and indirect dependencies in the software project.

[0028] The query module is used to query vulnerability data obtained from the vulnerability database based on the attribute information of the direct dependency to determine whether the direct dependency has a vulnerability; and to query the vulnerability data based on the attribute information of the indirect dependency to determine whether the indirect dependency has a vulnerability.

[0029] The second generation module is used to generate a vulnerability detection report based on the direct and / or indirect dependencies of the software project that have vulnerabilities. The vulnerability detection report includes the attribute information, vulnerability description, vulnerability level, and remediation information of the direct and / or indirect dependencies of the vulnerabilities.

[0030] In some embodiments, when the first generation module generates the dependency tree of the software project based on the configuration information in the configuration file, it is specifically used for:

[0031] Use a dependency management tool to read the configuration information from the configuration file;

[0032] Based on the configuration information in the configuration file, parse the dependency chain in the software project;

[0033] Generate the dependency tree of the software project based on the dependency chain in the software project.

[0034] In some embodiments, the software project vulnerability detection device further includes: a conversion module, configured to convert the attribute information of each direct dependency and each indirect dependency in the dependency tree into a standard format data structure after the first generation module generates the dependency tree of the software project according to the configuration information in the configuration file.

[0035] In some embodiments, the software project vulnerability detection device further includes: a synchronization module, used to periodically or in real-time synchronize the vulnerability data in the vulnerability database to the local machine before the query module queries the vulnerability data obtained from the vulnerability database based on the attribute information of the direct dependencies.

[0036] In some embodiments, the conversion module is further configured to: after the second generation module generates a vulnerability detection report based on the direct and / or indirect dependencies of the vulnerability in the software project, convert the vulnerability detection report into files of various formats and output them.

[0037] In some embodiments, the acquisition module is further configured to: acquire license information from an open-source license database; the query module is further configured to: query the license information based on the attribute information of the direct dependency to determine whether the license of the direct dependency has expired; query the license information based on the attribute information of the indirect dependency to determine whether the license of the indirect dependency has expired; the software project vulnerability detection device further includes: a replacement and modification module, configured to replace or modify the direct dependency and / or the indirect dependency when the licenses of the direct dependency and / or the indirect dependency have expired.

[0038] Thirdly, embodiments of this disclosure provide an electronic device, including:

[0039] Memory;

[0040] Processor; and

[0041] Computer programs;

[0042] The computer program is stored in the memory and configured to be executed by the processor to implement the method as described in the first aspect.

[0043] Fourthly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the method described in the first aspect.

[0044] Fifthly, embodiments of this disclosure also provide a computer program product comprising a computer program or instructions that, when executed by a processor, implement the method described above.

[0045] The software project vulnerability detection method, apparatus, device, and medium provided in this disclosure generate a dependency tree for the software project based on configuration information in the software project's configuration file. This dependency tree includes direct and indirect dependencies within the software project. Further, based on the attribute information of the direct and indirect dependencies, vulnerability data obtained from a vulnerability database is queried to determine whether vulnerabilities exist in the direct and indirect dependencies. A vulnerability detection report is generated based on the direct and / or indirect dependencies with vulnerabilities. That is, vulnerability detection is performed not only on direct dependencies but also on indirect dependencies, achieving comprehensive detection of the software project. Furthermore, it efficiently matches vulnerabilities with vulnerability data to generate detailed vulnerability detection reports, improving the accuracy of software project vulnerability detection and enhancing the security of the software project supply chain. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0047] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 A flowchart of a software project vulnerability detection method provided in this embodiment of the disclosure;

[0049] Figure 2 A schematic diagram illustrating an application scenario provided by an embodiment of this disclosure;

[0050] Figure 3 A schematic diagram of a dependency tree provided for embodiments of this disclosure;

[0051] Figure 4 A flowchart of a software project vulnerability detection method provided in this embodiment of the disclosure;

[0052] Figure 5 A flowchart of a software project vulnerability detection method provided in this embodiment of the disclosure;

[0053] Figure 6 A flowchart of a software project vulnerability detection method provided in this embodiment of the disclosure;

[0054] Figure 7 This is a schematic diagram of the structure of the software project vulnerability detection device provided in the embodiments of this disclosure;

[0055] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0056] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0057] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0058] Existing technologies use vulnerability scanning tools to scan for vulnerabilities in software projects. However, these tools only detect vulnerabilities in packages directly referenced or depended upon by the software project, resulting in incomplete and inaccurate detection of vulnerabilities. To address this issue, this disclosure provides a method for detecting vulnerabilities in software projects, which will be described below with reference to specific embodiments.

[0059] Figure 1 A flowchart illustrating a software project vulnerability detection method provided in this disclosure embodiment. This method can be applied to... Figure 2The application scenario shown includes a terminal device 21 and a server 22. The terminal device 21 can specifically be a smartphone, PDA, tablet, wearable device with a display, desktop computer, laptop computer, all-in-one computer, smart home device, etc. It is understood that the software project vulnerability detection method provided in this embodiment can also be applied to other scenarios. This software project vulnerability detection method can be executed by either the terminal device 21 or the server 22. For example, the terminal device 21 is a device used by developers, and it locally stores the software project and has a vulnerability scanning tool deployed locally. Developers use this vulnerability scanning tool to scan for vulnerabilities in the software project, and the terminal device 21 displays the scan results. Alternatively, the terminal device 21 sends the configuration file of the software project to the server 22, which has a vulnerability scanning tool deployed on it. The server 22 uses this vulnerability scanning tool to scan for vulnerabilities in the software project and sends the scan results to the terminal device 21.

[0060] The following is about Figure 1 The software project vulnerability detection method shown is introduced below, and the specific steps of this method are as follows:

[0061] S101. Obtain the configuration file for the software project.

[0062] For example, terminal device 21 locally stores a software project, and sends the configuration file of this software project to server 22. This software project is specifically written in any computer programming language. Furthermore, the format of the configuration file differs depending on the programming language. For example, if the software project is written in Java, the configuration file is pom.xml. If the software project is written in JavaScript, the configuration file is package.json. If the software project is written in Python, the configuration file is requirements.txt.

[0063] S102. Generate the dependency tree of the software project according to the configuration information in the configuration file. The dependency tree includes direct dependencies and indirect dependencies in the software project.

[0064] For example, server 22 is equipped with a vulnerability scanning tool, which includes dependency management tools for various programming languages. In other words, different programming languages ​​have different dependency management tools. When server 22 receives the configuration file for the software project, it reads the configuration information from the configuration file using the dependency management tool corresponding to the software project's programming language, and generates the software project's dependency tree based on this information. This dependency tree includes direct and indirect dependencies within the software project. Direct dependencies are external packages or modules directly referenced by the software project and can be directly imported by the software project. Indirect dependencies are external packages or modules indirectly referenced by the software project. These indirect dependencies are not directly imported by the software project but are imported through direct dependencies; that is, an indirect dependency is an external package or module referenced by a direct dependency, or a lower-level indirect dependency is an external package or module referenced by a higher-level indirect dependency. Figure 3 As shown, the dependency tree of this software project includes the software project identifier and various dependencies (direct dependencies and indirect dependencies). A, B, C, and D represent direct dependencies. E, F, G, H, J, K, L, and M represent indirect dependencies. Direct dependencies A, B, C, and D are external packages or modules directly referenced by the software project. Indirect dependency E is an external package or module referenced by direct dependency A; indirect dependencies F and G are external packages or modules referenced by direct dependency B; indirect dependency H is an external package or module referenced by direct dependency C; indirect dependencies J and K are external packages or modules referenced by direct dependency D; indirect dependency L is an external package or module referenced by indirect dependency F; and indirect dependency M is an external package or module referenced by indirect dependency J. Additionally, indirect dependencies can also be denoted as transitive dependencies.

[0065] S103. Based on the attribute information of the direct dependency, query the vulnerability data obtained from the vulnerability database to determine whether the direct dependency has a vulnerability.

[0066] like Figure 3As shown, the software project identifier is the root node of this dependency tree, and the indirect dependency identifier and direct dependency identifier are the leaf nodes of the dependency tree, respectively. The database can store the data structures corresponding to the root node and leaf nodes. For example, the data structure corresponding to the root node includes the software project name, creation time, and functional description. The data structure corresponding to any indirect dependency includes the attribute information of that indirect dependency, such as the library name, version number, and dependency relationships (e.g., upstream and downstream nodes). The data structure corresponding to any direct dependency includes the attribute information of that direct dependency, such as the library name, version number, and dependency relationships.

[0067] For example, server 22 can obtain vulnerability data from a vulnerability database, which includes attribute information of vulnerable packages. Server 22 can query the vulnerability data based on the attribute information of each direct dependency in the dependency tree. For example, it can match the library name of the direct dependency with the library name of each package recorded in the vulnerability data, and match the version number of the direct dependency with the version number of each package recorded in the vulnerability data. If the library name of the direct dependency matches the library name of any package recorded in the vulnerability data, and the version number of the direct dependency matches the version number of any package, then the direct dependency and the package are determined to match. Furthermore, if the tag for any package in the vulnerability data indicates that it is vulnerable, then the direct dependency is determined to be vulnerable. If the tag for any package in the vulnerability data indicates that it is not vulnerable, then the direct dependency is determined to be not vulnerable. During the matching process, server 22 can use fuzzy matching (such as version range matching) and exact matching. For example, if the version number of the direct dependency is v1.0 and the version number of any package is v1.01, using fuzzy matching, we can determine that the version numbers of the direct dependency and the package belong to the same version range. Using exact matching, we can determine that the version number of the direct dependency is the base version and the version number of the package is an upgrade version. Since the base version may also have vulnerabilities if the upgrade version has vulnerabilities, if the tag for the package in the vulnerability data indicates that it is vulnerable, then the direct dependency is confirmed to be vulnerable.

[0068] S104. Based on the attribute information of the indirect dependency, query the vulnerability data to determine whether the indirect dependency has a vulnerability.

[0069] For example, server 22 queries the vulnerability data based on the attribute information of each indirect dependency in the dependency tree. For instance, it matches the library name of the indirect dependency with the library name of each package recorded in the vulnerability data, and it matches the version number of the indirect dependency with the version number of each package recorded in the vulnerability data. If the library name of the indirect dependency matches the library name of any package recorded in the vulnerability data, and the version number of the indirect dependency matches the version number of any package, then the indirect dependency and the package are considered a match. Furthermore, if the tag for any package in the vulnerability data indicates a vulnerability, then the indirect dependency is considered vulnerable. If the tag for any package in the vulnerability data indicates a non-vulnerability, then the indirect dependency is considered non-vulnerable. During the matching process, server 22 can use fuzzy matching (such as version range matching) and exact matching. For example, if the version number of the indirect dependency is v1.0 and the version number of any package is v1.01, using fuzzy matching, we can determine that the version numbers of the indirect dependency and the package belong to the same version range. Using exact matching, we can determine that the version number of the indirect dependency is the base version and the version number of the package is an upgrade version. Since the base version may also have vulnerabilities if the upgrade version has vulnerabilities, if the tag for the package in the vulnerability data indicates that it is vulnerable, then the indirect dependency is confirmed to be vulnerable.

[0070] In addition, server 22 can also use multi-threading or multi-processing to detect vulnerabilities in each direct dependency and each indirect dependency in parallel.

[0071] S105. Generate a vulnerability detection report based on the direct and / or indirect dependencies of the software project that have vulnerabilities. The vulnerability detection report includes the attribute information, vulnerability description, vulnerability level, and remediation information of the direct and / or indirect dependencies of the vulnerabilities.

[0072] By using S103 and S104 as described above, the direct and / or indirect dependencies containing vulnerabilities in the dependency tree can be identified. Further, a vulnerability detection report is generated based on these direct and / or indirect dependencies. This report includes attribute information, vulnerability description, vulnerability level, and remediation information for each vulnerable direct and / or indirect dependency. The remediation information can be remediation suggestions that can be understood by ordinary technical personnel or developers, including upgrading to a secure version and the security version number. The vulnerability description can specifically include information such as the time of vulnerability occurrence and the potential dangers of the vulnerability.

[0073] This embodiment generates a dependency tree for the software project based on the configuration information in the project's configuration file. This dependency tree includes direct and indirect dependencies within the software project. Further, based on the attribute information of the direct and indirect dependencies, vulnerability data obtained from a vulnerability database is queried to determine whether vulnerabilities exist in the direct and indirect dependencies. A vulnerability detection report is then generated based on the direct and / or indirect dependencies with vulnerabilities. In other words, vulnerability detection is performed not only on direct dependencies but also on indirect dependencies, achieving comprehensive detection of the software project. Furthermore, efficient matching with vulnerability data generates detailed vulnerability detection reports, improving the accuracy of vulnerability detection and enhancing the security of the software project's supply chain.

[0074] Optionally, after generating a vulnerability detection report based on the direct and / or indirect dependencies of the vulnerability in the software project, the method further includes: converting the vulnerability detection report into files of various formats and outputting them.

[0075] For example, after generating a vulnerability detection report, the report is converted into multiple file formats and then output. These formats include JavaScript Object Notation (JSON), Hyper Text Markup Language (HTML), and Portable Document Format (PDF).

[0076] Based on the above embodiments, the dependency tree of the software project is generated according to the configuration information in the configuration file, including, for example... Figure 4 The following steps are shown:

[0077] S401. Use a dependency management tool to read the configuration information in the configuration file.

[0078] For example, a vulnerability scanning tool is deployed on server 22. When server 22 receives the configuration file of the software project, it reads the configuration information in the configuration file through a dependency management tool corresponding to the programming language of the software project. This dependency management tool could be, for example, a project management tool (Maven), a Node Package Manager (NPM), or a Python package management tool (pip).

[0079] S402. Based on the configuration information in the configuration file, parse the dependency chain in the software project.

[0080] For example, the dependency management tool resolves the dependency chain in the software project based on the configuration information in the configuration file. Figure 3 As shown, if the software project directly references direct dependency A, and direct dependency A references indirect dependency E, then the software project—direct dependency A—indirect dependency E constitutes a dependency chain.

[0081] S403. Generate the dependency tree of the software project based on the dependency chain in the software project.

[0082] Since this software project includes multiple dependency chains, integrating these multiple dependency chains can generate the dependency tree of the software project, such as... Figure 3 As shown.

[0083] Based on the above embodiments, after generating the dependency tree of the software project according to the configuration information in the configuration file, the method further includes: converting the attribute information of each direct dependency and each indirect dependency in the dependency tree into a standard format data structure.

[0084] For example, after generating the dependency tree of the software project, since each node in the dependency tree, such as the root node and leaf nodes, has attribute information, and the format of the attribute information of different nodes may be different, the attribute information of each node can be converted into a standard format such as JSON data structure, thereby converting the dependency tree into a standard format file.

[0085] Optionally, before querying vulnerability data obtained from the vulnerability database based on the attribute information of the direct dependencies, the method further includes: periodically or in real-time synchronizing the vulnerability data in the vulnerability database to the local machine.

[0086] For example, the vulnerability database could be a foreign vulnerability database or the GitHub Advisory Database. Server 22 can synchronize vulnerability data from this database to its local machine. For instance, server 22 can periodically or in real-time synchronize the vulnerability data from this database to its local machine. Specifically, when server 22 does not need to detect vulnerabilities in the software project, it periodically synchronizes the vulnerability data to its local machine. Before detecting vulnerabilities in the software project, server 22 first synchronizes the vulnerability data from the vulnerability database to its local machine in real-time, and then performs vulnerability detection on the software project based on the synchronized vulnerability data.

[0087] This embodiment of the disclosure reduces network requests by periodically synchronizing vulnerability data from the vulnerability database to the local machine.

[0088] In addition, such as Figure 2As shown, after terminal device 21 submits the software project to server 22, terminal device 21 further sends an execution command to server 22, enabling server 22 to perform vulnerability detection on the software project based on the execution command. In other words, server 22 provides a command-line interface (CLI) to terminal device 21 to support direct invocation by developers. Furthermore, this embodiment also supports integrating vulnerability scanning tools into CI / CD tools. CI / CD stands for Continuous Integration (CI) and Continuous Delivery / Continuous Deployment (CD). CI / CD tools include open-source software projects (Jenkins) and continuous integration and continuous delivery (CI / CD) platforms (GitHub Actions), etc. For example, server 22 can not only receive code submitted by terminal device 21, but also code submitted by other devices, and merge the code submitted by different terminal devices into the software project. Before merging the code submitted by different terminal devices into the software project, server 22 can perform vulnerability detection on the code submitted by each terminal device. If a vulnerability is found in the code submitted by a terminal device, a notification message is sent to that terminal device, prompting the developer using that device to fix the vulnerability in their code. After the developer fixes the vulnerability, they resubmit the fixed code to server 22. Server 22 then performs another vulnerability check on the fixed code until no vulnerabilities are found in the code submitted by the developer. Finally, the fixed code is merged into the software project. Furthermore, the vulnerability detection method provided in this embodiment also supports scheduled scanning and real-time alerting. For example, after each terminal device submits code to server 22, server 22 can perform vulnerability checks on the code at scheduled times, such as at a fixed time each evening for code received during the day. This avoids vulnerability checks taking up a significant amount of daytime time. Additionally, it allows developers to receive the vulnerability detection results as soon as they arrive at work the next day.

[0089] Optionally, the method further includes, for example, Figure 5 The following steps are shown:

[0090] S501. Obtain license information from the open-source license database.

[0091] For example, an open-source license database contains license information for multiple packages. Server 22 can retrieve the license information for each package from this open-source license database, and the license information for each package includes the package's attribute information. This open-source license database is, for example, a Software Package Data Exchange (SPDX) database.

[0092] S502. Based on the attribute information of the direct dependency, query the license information to determine whether the license of the direct dependency has expired.

[0093] For example, server 22 queries the license information of each package based on the attribute information of each direct dependency in the dependency tree. For instance, it matches the library name of the direct dependency with the library name of each package, and it matches the version number of the direct dependency with the version number of each package. If the library name of the direct dependency matches the library name of any package, and the version number of the direct dependency matches the version number of any package, then it is determined that the direct dependency and any package match. Further, if the license information corresponding to any package indicates that the license of that package has expired, then it is determined that the license of the direct dependency has expired. If the license information corresponding to any package indicates that the license of that package has not expired, then it is determined that the license of the direct dependency has not expired.

[0094] S503. Based on the attribute information of the indirect dependency, query the license information to determine whether the license of the indirect dependency has expired.

[0095] For example, server 22 queries the license information of each package based on the attribute information of each indirect dependency in the dependency tree. For instance, it matches the library name of the indirect dependency with the library name of each package, and it matches the version number of the indirect dependency with the version number of each package. If the library name of the indirect dependency matches the library name of any package, and the version number of the indirect dependency matches the version number of any package, then it is determined that the indirect dependency and any package match. Further, if the license information corresponding to any package indicates that the license of that package has expired, then it is determined that the license of the indirect dependency has expired. If the license information corresponding to any package indicates that the license of that package has not expired, then it is determined that the license of the indirect dependency has not expired.

[0096] S504. If the licenses of the direct dependencies and / or the indirect dependencies expire, replace or modify the direct dependencies and / or the indirect dependencies.

[0097] By using S502 and S503 as described above, the direct and / or indirect dependencies in the dependency tree whose licenses have expired can be identified. Further, the expired direct and / or indirect dependencies are replaced or modified. Additionally, a license compliance report can be generated based on the expired direct and / or indirect dependencies in the dependency tree. This report includes attribute information, expiration dates, and compliance recommendations for the expired direct and / or indirect dependencies. Specifically, the compliance recommendations may involve replacement or modification.

[0098] This disclosure supports vulnerability detection in software projects written in different programming languages, preventing programming language from becoming a barrier to vulnerability detection. Furthermore, by periodically or in real-time synchronizing the latest vulnerability data, the accuracy of vulnerability detection in software projects can be improved. Additionally, by generating vulnerability detection reports that include remediation suggestions understandable to ordinary technical personnel or developers, the efficiency and accuracy of vulnerability remediation can be improved.

[0099] Figure 6 A flowchart of a software project vulnerability detection method provided in another embodiment of this disclosure is shown below. Figure 6 As shown, the method includes the following steps:

[0100] S601. Obtain the configuration file for the software project.

[0101] S602. Parse the configuration file and generate a dependency tree.

[0102] S603. Convert the dependency tree into JSON format data.

[0103] S604. Synchronize vulnerability data from the vulnerability database.

[0104] S605. Match the JSON data with the vulnerability data.

[0105] S606, Format the matched information.

[0106] S607. Generate vulnerability detection reports in standard formats, such as HTML and JSON.

[0107] The implementation process and specific principles of S601-S607 as described above can be found in the above content, and will not be repeated here.

[0108] Figure 7This is a schematic diagram of the structure of a software project vulnerability detection device provided in this embodiment. The software project vulnerability detection device can be a terminal device or server as described in the above embodiments, or it can be a component or part within the terminal device or server. The software project vulnerability detection device provided in this embodiment can execute the processing flow provided in the software project vulnerability detection method embodiments, such as... Figure 7 As shown, the software project vulnerability detection device 70 includes:

[0109] Module 71 is used to retrieve configuration files for the software project.

[0110] The first generation module 72 is used to generate the dependency tree of the software project according to the configuration information in the configuration file. The dependency tree includes direct dependencies and indirect dependencies in the software project.

[0111] The query module 73 is used to query vulnerability data obtained from the vulnerability database based on the attribute information of the direct dependency to determine whether the direct dependency has a vulnerability; and to query the vulnerability data based on the attribute information of the indirect dependency to determine whether the indirect dependency has a vulnerability.

[0112] The second generation module 74 is used to generate a vulnerability detection report based on the direct and / or indirect dependencies of the software project that have vulnerabilities. The vulnerability detection report includes attribute information, vulnerability description, vulnerability level, and remediation information of the direct and / or indirect dependencies of the vulnerabilities.

[0113] Optionally, when the first generation module 72 generates the dependency tree of the software project based on the configuration information in the configuration file, it is specifically used for:

[0114] Use a dependency management tool to read the configuration information from the configuration file;

[0115] Based on the configuration information in the configuration file, parse the dependency chain in the software project;

[0116] Generate the dependency tree of the software project based on the dependency chain in the software project.

[0117] Optionally, the software project vulnerability detection device 70 further includes a conversion module 75, which, after the first generation module 72 generates the dependency tree of the software project according to the configuration information in the configuration file, converts the attribute information of each direct dependency and each indirect dependency in the dependency tree into a standard format data structure.

[0118] Optionally, the software project vulnerability detection device 70 further includes a synchronization module 76, which is used to periodically or in real-time synchronize the vulnerability data in the vulnerability database to the local machine before the query module 73 queries the vulnerability data obtained from the vulnerability database based on the attribute information of the direct dependencies.

[0119] Optionally, the conversion module 75 is further configured to: after the second generation module 74 generates a vulnerability detection report based on the direct and / or indirect dependencies of the vulnerability in the software project, convert the vulnerability detection report into files of various formats and output them.

[0120] Optionally, the acquisition module 71 is further configured to: acquire license information from an open-source license database; the query module 73 is further configured to: query the license information based on the attribute information of the direct dependency to determine whether the license of the direct dependency has expired; query the license information based on the attribute information of the indirect dependency to determine whether the license of the indirect dependency has expired; the software project vulnerability detection device 70 further includes: a replacement and modification module 77, configured to replace or modify the direct dependency and / or the indirect dependency when the licenses of the direct dependency and / or the indirect dependency have expired.

[0121] Figure 7 The software project vulnerability detection device shown in the embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0122] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. The electronic device can be a terminal device or a server as described in the above embodiments. The electronic device provided in this disclosure can execute the processing flow provided in the embodiments of the software project vulnerability detection method, such as… Figure 8 As shown, the electronic device 80 includes: a memory 81, a processor 82, a computer program, and a communication interface 83; wherein the computer program is stored in the memory 81 and configured to be executed by the processor 82 as described above.

[0123] In addition, this disclosure also provides a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the methods described in the above embodiments.

[0124] Furthermore, this disclosure also provides a computer program product comprising a computer program or instructions that, when executed by a processor, implement the method described above.

[0125] It should be noted that the computer-readable medium described above in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In embodiments of this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In embodiments of this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0126] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol, such as HTTP (Hypertext Transfer Protocol), and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (LANs), wide area networks (WANs), the internet (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0127] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0128] It should be noted that when one or more programs stored in a computer-readable medium are executed by the electronic device, the electronic device may also perform other methods provided in the examples of this disclosure.

[0129] In embodiments of this disclosure, computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include, but are not limited to, object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0130] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0131] The modules or units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules or units do not necessarily constitute a limitation on the module or unit itself.

[0132] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0133] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0134] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting software project vulnerabilities, characterized in that, The method includes: Obtain the configuration file for the software project; Based on the configuration information in the configuration file, a dependency tree for the software project is generated, which includes direct and indirect dependencies in the software project. Based on the attribute information of the direct dependency, query the vulnerability data obtained from the vulnerability database to determine whether the direct dependency has a vulnerability; Based on the attribute information of the indirect dependency, query the vulnerability data to determine whether the indirect dependency has a vulnerability; Based on the direct and / or indirect dependencies of the software project that contain vulnerabilities, a vulnerability detection report is generated. The vulnerability detection report includes the attribute information, vulnerability description, vulnerability level, and remediation information of the direct and / or indirect dependencies of the vulnerabilities.

2. The method according to claim 1, characterized in that, Based on the configuration information in the configuration file, generate the dependency tree of the software project, including: Use a dependency management tool to read the configuration information from the configuration file; Based on the configuration information in the configuration file, parse the dependency chain in the software project; Generate the dependency tree of the software project based on the dependency chain in the software project.

3. The method according to claim 1, characterized in that, After generating the dependency tree of the software project based on the configuration information in the configuration file, the method further includes: The attribute information of each direct dependency and each indirect dependency in the dependency tree is converted into a standard format data structure.

4. The method according to claim 1, characterized in that, Before querying vulnerability data obtained from the vulnerability database based on the attribute information of the direct dependencies, the method further includes: The vulnerability data in the vulnerability database is periodically or in real time synchronized to the local machine.

5. The method according to claim 1, characterized in that, After generating a vulnerability detection report based on the direct and / or indirect dependencies of the vulnerabilities in the software project, the method further includes: The vulnerability detection report is converted into files in multiple formats and output.

6. The method according to claim 1, characterized in that, The method further includes: Retrieve license information from the open-source license database; Based on the attribute information of the direct dependency, query the license information to determine whether the license of the direct dependency has expired; Based on the attribute information of the indirect dependency, query the license information to determine whether the license of the indirect dependency has expired; If the licenses for the direct dependencies and / or the indirect dependencies expire, the direct dependencies and / or the indirect dependencies shall be replaced or modified.

7. A software project vulnerability detection device, characterized in that, include: The acquisition module is used to retrieve configuration files for software projects. The first generation module is used to generate the dependency tree of the software project according to the configuration information in the configuration file. The dependency tree includes direct dependencies and indirect dependencies in the software project. The query module is used to query vulnerability data obtained from the vulnerability database based on the attribute information of the direct dependency to determine whether the direct dependency has a vulnerability. Based on the attribute information of the indirect dependency, query the vulnerability data to determine whether the indirect dependency has a vulnerability; The second generation module is used to generate a vulnerability detection report based on the direct and / or indirect dependencies of the software project that have vulnerabilities. The vulnerability detection report includes the attribute information, vulnerability description, vulnerability level, and remediation information of the direct and / or indirect dependencies of the vulnerabilities.

8. The apparatus according to claim 7, characterized in that, When the first generation module generates the dependency tree of the software project based on the configuration information in the configuration file, it is specifically used for: Use a dependency management tool to read the configuration information from the configuration file; Based on the configuration information in the configuration file, parse the dependency chain in the software project; Generate the dependency tree of the software project based on the dependency chain in the software project.

9. An electronic device, characterized in that, include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and configured to be executed by the processor to implement the method as described in any one of claims 1-6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images