Horizontal unauthorized security vulnerability code auditing method and device, equipment and storage medium

Abstract

The invention relates to the technical field of information security maintenance, and particularly discloses a horizontal unauthorized security vulnerability code auditing method and device, equipment and a storage medium. According to the method, automatic mining of horizontal unauthorized vulnerabilities is realized through code preprocessing, code analysis and multi-agent collaborative auditing, the to-be-audited code is analyzed to generate the target data set, so that a large model can quickly and accurately read the code, the code auditing efficiency is improved, and the user experience is improved. Cooperative auditing is carried out on the to-be-audited codes through the agents of the large model, and the accuracy of the auditing result is improved. The method is applied to financial systems such as transactions, bank accounts and the like and medical systems such as medical record management, patient information and the like, the level unauthorized vulnerabilities can be quickly and accurately recognized, the vulnerability solving efficiency is improved, and the system stability and safety are maintained.

Description

Technical Field

[0001] This application relates to the field of information security maintenance technology, and in particular to a method, apparatus, device and storage medium for auditing code for horizontal privilege escalation security vulnerabilities. Background Technology

[0002] With the rapid development of fintech and medical technology, their core business systems process massive amounts of highly sensitive data. For example, financial systems handle users' payment transaction records, bank account information, credit assessment data, and investment preferences; medical systems manage patients' electronic health records, diagnostic results, medication history, and genetic information. Horizontal privilege escalation vulnerabilities are among the most common and high-risk security threats facing current financial and medical systems. These vulnerabilities are characterized by attackers exploiting flaws in application permission verification to illegally access sensitive data of other users with equivalent roles or perform unauthorized operations by tampering with request parameters (such as user ID, account number, and medical record number). For instance, an attacker only needs to modify the user ID value in the request to gain unauthorized access to another user's bank account balance or medical diagnosis report.

[0003] A traditional, relatively effective solution involves acquiring the data traffic of the API and understanding the application's API request format, then scanning the API with a black-box scanner. Finally, the response packets are analyzed to check for privilege escalation vulnerabilities. This approach requires intervention during the application's deployment to the testing phase, resulting in delayed problem detection. Furthermore, the accuracy of vulnerability detection decreases as business scenarios become more complex. Therefore, improving the efficiency and accuracy of code auditing results has become a pressing issue. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for auditing code that exposes horizontal privilege escalation vulnerabilities, in order to improve the efficiency of code auditing and the accuracy of audit results.

[0005] Firstly, this application provides a method for auditing code that exploits horizontal privilege escalation security vulnerabilities, the method comprising: Obtain the source code and preprocess it to obtain the code to be audited; The code to be audited is subjected to structured parsing to extract the target dataset; Obtain database table data, and based on the database table data and the target dataset, call the various agents of the large model to collaboratively perform horizontal privilege escalation vulnerability mining to obtain the audit report corresponding to the code to be audited.

[0006] Secondly, this application also provides a horizontal privilege escalation security vulnerability code auditing device, the device comprising: The module for obtaining auditable code is used to acquire source code and preprocess the source code to obtain auditable code. The target dataset extraction module is used to perform structured parsing on the code to be audited and extract the target dataset. The audit report acquisition module is used to obtain database table data, and based on the database table data and the target dataset, call the various agents of the large model to collaboratively perform horizontal privilege escalation vulnerability mining to obtain the audit report corresponding to the code to be audited.

[0007] Thirdly, this application also provides a computer device, the computer device including a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program and, when executing the computer program, implement the horizontal privilege escalation security vulnerability code auditing method as described above.

[0008] Fourthly, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, causes the processor to implement the horizontal privilege escalation security vulnerability code auditing method described above.

[0009] This application discloses a method, apparatus, device, and storage medium for auditing horizontal privilege escalation vulnerabilities. The method involves acquiring source code, preprocessing the source code to obtain code to be audited, performing structured parsing on the code to extract a target dataset, acquiring database table data, and, based on the database table data and the target dataset, invoking multiple agents within a large model to collaboratively mine horizontal privilege escalation vulnerabilities, thereby obtaining an audit report corresponding to the code to be audited. This application achieves automated mining of horizontal privilege escalation vulnerabilities through code preprocessing, code parsing, and multi-agent collaborative auditing. Parsing the code to be audited generates a target dataset, enabling the large model to quickly and accurately read the code, thus improving the efficiency of code auditing. Furthermore, the collaborative auditing of the code by multiple agents within the large model improves the accuracy of the audit results. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic flowchart of a code auditing method for horizontal privilege escalation security vulnerabilities provided in the first embodiment of this application; Figure 2This is a schematic flowchart of a method for auditing code for horizontal privilege escalation security vulnerabilities provided in the second embodiment of this application; Figure 3 This is a schematic flowchart of a method for auditing code for horizontal privilege escalation security vulnerabilities provided in the third embodiment of this application; Figure 4 A schematic block diagram of a horizontal privilege escalation security vulnerability code auditing device provided for embodiments of this application; Figure 5 A schematic block diagram of the structure of a computer device provided for an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0013] The flowchart shown in the attached diagram is for illustrative purposes only and does not necessarily include all content and operations / steps, nor does it necessarily have to be performed in the order described. For example, some operations / steps can be broken down, combined, or partially merged, so the actual execution order may change depending on the actual situation.

[0014] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0015] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0016] This application provides a method, apparatus, device, and storage medium for auditing code that detects horizontal privilege escalation vulnerabilities. The method can be applied to a server, automating the discovery of horizontal privilege escalation vulnerabilities through code preprocessing, code parsing, and multi-agent collaborative auditing. The code to be audited is parsed to generate a target dataset, enabling a large model to quickly and accurately read the code, thus improving the efficiency of code auditing. Furthermore, the collaborative auditing of the code by various agents within the large model improves the accuracy of the audit results. The server can be a standalone server or a server cluster.

[0017] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0018] Please see Figure 1 , Figure 1 This is a schematic flowchart illustrating a method for auditing horizontal privilege escalation vulnerabilities, as provided in an embodiment of this application. This method can be applied to servers to automate the discovery of horizontal privilege escalation vulnerabilities through code preprocessing, code parsing, and multi-agent collaborative auditing. The code to be audited is parsed to generate a target dataset, enabling a large model to quickly and accurately read the code, thus improving the efficiency of code auditing. Furthermore, the collaborative auditing of the code by various agents within the large model enhances the accuracy of the audit results.

[0019] like Figure 1 As shown, the method for auditing code for security vulnerabilities at this level specifically includes steps S101 to S103.

[0020] S101. Obtain the source code and preprocess the source code to obtain the code to be audited; In one embodiment, the source code can be obtained directly from the developer's local project directory. The source code includes all business logic, configuration files, and dependent framework code.

[0021] In one embodiment, to address potential anomalies in the source code, such as framework syntax errors, the source code is preprocessed to obtain auditable code. Preprocessing may include: Lombok framework processing, where classes annotated with `@Data`, `@Getter`, etc., are pre-compiled using Lombok plugins to generate bytecode, restoring dynamically generated getter / setter methods and preventing AST (Abstract Syntax Tree) parsing errors due to missing syntax; and code standardization, unifying indentation and line breaks, and removing special characters from comments to prevent AST parsing tools from misinterpreting the syntax structure due to formatting issues.

[0022] S102. Perform structured parsing on the code to be audited to extract the target dataset; In one embodiment, the code is structured and parsed using an AST tool to generate a target dataset that supports large-scale model auditing.

[0023] Specifically, the code to be audited is converted into an Abstract Syntax Tree (AST), a tree-like data structure, where each node corresponds to a code syntax unit (such as a class node, method node, or variable node). The resulting AST is traversed, and entry point datasets, entry method datasets, and class information datasets are extracted based on entry point identification rules. Using each entry method as the root node, its method body is recursively analyzed, parsing the method call expressions to determine the call relationships. This constructs a directed graph, i.e., a function call graph, showing the call path from the entry method to the lowest-level method, and generates a function call graph dataset.

[0024] S103. Obtain database table data, and based on the database table data and the target dataset, call the various agents of the large model to collaboratively perform horizontal privilege escalation vulnerability mining to obtain the audit report corresponding to the code to be audited.

[0025] In one implementation, obtaining database table data includes: processing the database connection string provided by the user to obtain the database table creation statement; parsing the database table creation statement to obtain database table and field information; obtaining the sensitivity markers of the database table fields set by security experts or developers based on business knowledge in the interface provided by the tool; and obtaining the database table data based on the sensitivity markers, database table and field information. The sensitivity markers include sensitivity and its degree of sensitivity, and non-sensitivity.

[0026] In one embodiment, by combining database table data with the target dataset, multiple large model agents with clearly defined roles collaborate in a pipeline manner to perform code auditing, thereby completing the discovery and reporting of horizontal privilege escalation vulnerabilities.

[0027] In a specific embodiment, the large model agent includes a taint discovery agent, which is used to traverse the call graph, find the taint that ultimately performs the data operation, and output the complete vulnerability chain from the entry point to the taint. Here, a taint refers to a direct sensitive data operation or a remote data call. A forward auditing agent is used to perform forward analysis of the vulnerability chain, starting from the entry parameters to track the data transmission process and identify whether there is valid permission verification logic on the call path. The reverse auditing agent is used to reverse-analyze the vulnerability chain output by the forward auditing agent, starting from the taint (data operation point) and tracing back upwards to determine whether the manipulated data was eventually returned to the front end, and to determine which fields of which business objects were specifically affected. The hazard assessment agent is used to make the final decision. It analyzes the vulnerability chain output by the reverse audit agent to determine whether it constitutes a real high-risk privilege escalation vulnerability and generates an audit report.

[0028] The report typically includes the function call process of the privilege escalation vulnerability, the privilege escalation variable, the business fields affected by the vulnerability, and a description of the cause and harm of the vulnerability.

[0029] In one embodiment, after the reverse auditing agent identifies the affected business fields, it queries the sensitive labels of these business fields from the database table data to obtain the sensitive labels of the fields.

[0030] In another embodiment, for unlabeled fields, the large model can be invoked to determine their sensitivity and obtain sensitive information labels.

[0031] The above embodiments provide a method, apparatus, device, and storage medium for auditing horizontal privilege escalation vulnerabilities. The method involves acquiring source code, preprocessing the source code to obtain code to be audited, performing structured parsing on the code to extract a target dataset, acquiring database table data, and, based on the database table data and the target dataset, invoking various agents of a large model to collaboratively mine horizontal privilege escalation vulnerabilities, thereby obtaining an audit report corresponding to the code to be audited. This application achieves automated mining of horizontal privilege escalation vulnerabilities through code preprocessing, code parsing, and multi-agent collaborative auditing. Parsing the code to be audited generates a target dataset, enabling the large model to quickly and accurately read the code, thus improving the efficiency of code auditing. Furthermore, the collaborative auditing of the code by various agents of the large model improves the accuracy of the audit results.

[0032] Please see Figure 2 , Figure 2 This is a schematic flowchart illustrating a method for auditing code for horizontal privilege escalation vulnerabilities, as provided in an embodiment of this application. This method can be applied to servers, enabling multi-agent collaboration and dataset linkage to progressively upgrade the vulnerability chain from the basic call path to a complete evidence chain containing risk markers and sensitive information. Ultimately, this supports accurate vulnerability location and hazard assessment, improving the accuracy of code auditing.

[0033] like Figure 2 As shown, the method for auditing code for security vulnerabilities of this level of privilege escalation specifically includes steps S201 to S204.

[0034] S201. Based on the entry point dataset and the function call graph dataset, call the taint discovery agent of the large model to perform taint mining and obtain the first vulnerability chain. In one embodiment, the entry point dataset, entry method dataset, class information dataset, and function call graph dataset are transmitted to the large model. The taint detection agent processes the entry point dataset and function call dataset, identifies existing taints, and obtains the complete path from the entry point to the taint as the first vulnerability chain.

[0035] Further, step S201 includes: determining the audit target based on the entry point dataset, and retrieving the function call graph corresponding to the audit target from the function call graph dataset; finding method call nodes that meet preset taint characteristics according to the function call graph; and generating the first vulnerability chain based on the order of the method call nodes in the function call graph.

[0036] In one embodiment, an audit target is identified from the entry point dataset, and the function call graph at that entry point is scanned downwards to find the taint that ultimately performs the data operation, thus constructing a complete vulnerability chain.

[0037] In one embodiment, the audit objective can be determined by selecting each entry point in the entry point dataset as the audit objective.

[0038] Alternatively, entry points with potential horizontal privilege escalation vulnerabilities can be selected from the entry point dataset as audit targets. Specifically, natural language processing is performed on the business scenario description to determine whether it involves sensitive information such as user privacy, funds, or permissions. If so, the presence of horizontal privilege escalation vulnerabilities poses a significant threat, and the corresponding entry points are selected as audit targets.

[0039] Furthermore, entry points containing user-controllable parameters can be filtered from the entry point dataset as audit targets. Specifically, since attackers can attempt to gain unauthorized access to others' resources by tampering with user-controllable parameters, it is necessary to determine whether the parameter list contains parameters that can directly identify resource ownership, such as "User ID," "Order ID," and "Resource ID." If such parameters exist, the entry point will be selected as the audit target.

[0040] In one implementation, the function call graph corresponding to the audit target is located in the function call graph dataset. Specifically, the name of the entry method of the audit target is matched with the method name of the root node of each function call graph in the function call graph dataset, and the function call graph corresponding to the matched root node is extracted.

[0041] In one embodiment, a taint refers to a direct manipulation of sensitive data or a remote data call. The function call graph is traversed to find method call nodes that match preset taint characteristics. These taint characteristics are the criteria for determining taint status and can be set by the developer based on the specific circumstances.

[0042] Starting from the root node of the function call graph corresponding to the audit target, traverse all child nodes layer by layer to check if they meet the characteristics of a taint. Specifically, first traverse the first layer of child nodes (such as N2, N4), and determine whether each child node is tainted; if not, continue traversing its child nodes (such as N2's child node N3) until a tainted node is found or all nodes have been traversed.

[0043] In one embodiment, for the identified tainted nodes, key information is recorded: node ID, full name of the method, taint type, and call parameters.

[0044] If there are multiple tainted nodes in the call graph (such as DAO (Data Access Object) calls and remote calls), all of them must be recorded, as multiple first-vulnerability chains may be generated subsequently.

[0045] In one embodiment, since the entry point is the externally exposed interface access address, it is composed of the class annotation URL (Uniform Resource Locator) and the method annotation URL of the entry method. Therefore, the first vulnerability chain is a complete call chain that starts from the entry method, passes through intermediate calling methods, and finally reaches the tainted node.

[0046] In one embodiment, starting from the tainted node, the process traces backward along the edges of the function call graph to the root node, collects all nodes along the path, arranges them in the forward call order, and adds the full name of the method, the call parameters, and the taint type to each node to form a structured chain, namely the first vulnerability chain.

[0047] In one embodiment, if a function call graph contains multiple tainted nodes, a separate first vulnerability chain needs to be generated for each tainted node.

[0048] S202. Based on the entry method dataset, call the positive auditing agent to perform positive code auditing on the first vulnerability chain, obtain the unauthorized access verification result, and mark the vulnerability chain based on the unauthorized access verification result to obtain the second vulnerability chain; Furthermore, the step of invoking a positive auditing agent to perform positive code auditing on the first vulnerability chain based on the entry method dataset to obtain an unauthorized access verification result includes: identifying user input parameters based on the positive auditing agent and tracing the parameter transmission process of the user input parameters based on the first vulnerability chain; during the parameter transmission process, determining whether each entry method has permission verification based on the entry method dataset to obtain the unauthorized access verification result.

[0049] In one embodiment, a forward auditing agent traces the transmission path of parameters along the first vulnerability chain, starting from user-controllable entry parameters, and identifies whether there is effective permission verification logic to prevent horizontal privilege escalation at each stage of the parameter flow.

[0050] In one embodiment, the method signature in the entry method information is analyzed to extract its parameter list. Parameters used to identify resources are identified, resulting in one or more target parameters that need to be tracked. Common parameter names include id, userId, username, orderId, documentId, etc.

[0051] In one embodiment, following the method call order in the first vulnerability chain, starting from the entry method, each method in the call chain is analyzed sequentially to confirm how the target parameter is passed layer by layer to the final sink point.

[0052] Specifically, for each method in the call chain, based on the method name and its class, the complete AST node of the method is queried from the entry method dataset to locate its method body. Within the method body, the flow of the target parameter is analyzed, including direct pass (the parameter is directly passed as an argument to the next method call), indirect pass (the parameter is assigned to a local variable or object field, and then that variable / field is passed to the next method), and encapsulated pass (the parameter is encapsulated in an object, and then the entire object is passed down).

[0053] In one embodiment, the positive auditing agent, while tracing parameter transmission, searches for logic that compares the user-submitted parameters with the currently logged-in user's identity credentials—that is, user access control verification. If, throughout the entire call chain, from the entry point to the taint, no access control verification is found, and the target parameter is passed unimpeded to the final data operation point, then the unauthorized access check result is determined to be a missing access control check.

[0054] In one embodiment, the unauthorized access verification result is used as metadata and marked on the original vulnerability chain to generate a second vulnerability chain.

[0055] In another embodiment, if the unauthorized access check result indicates that there is valid access control check, that is, there is logic to compare the parameters submitted by the user with the identity credentials of the currently logged-in user, and the comparison result shows that the parameters submitted by the user match the identity credentials of the currently logged-in user, then it is determined that the taint corresponding to the first vulnerability chain does not constitute a vulnerability, and the subsequent operations of the first vulnerability chain are stopped.

[0056] S203. Based on the entry method dataset and the class information dataset, call the reverse auditing agent to perform reverse code auditing on the second vulnerability chain and determine the business fields corresponding to the tainted data; In one embodiment, the reverse auditing agent traces the data return path backward along the chain that has been marked as a second vulnerability, starting from the bottom taint, to determine whether and how the manipulated data was ultimately exposed to the user, and to pinpoint the affected business fields.

[0057] In one embodiment, tainted method information is extracted from the second vulnerability chain, and the return value type of the tainted method is queried from the entry method dataset.

[0058] Following the reverse order of the second vulnerability chain, starting from the taint, the analysis traces back upwards to analyze how each caller handles the return value. Specifically, for each method in the call chain, the AST (Abstract Syntax Tree) of the current method is retrieved from the entry method dataset based on the method name. Within the method body AST, the expression calling the lower-level method is located, and the context of that call expression is analyzed to determine whether the return value is processed—whether it is returned directly or used for calculation, assignment, or encapsulation. Based on the context analysis results, it is determined whether the data processed by the current method is still part of the return value from the upper-level caller. If the data flow is interrupted (e.g., the return value is not processed or is discarded), the analysis terminates.

[0059] Tracing back to the top-level entry method, check if its return value contains data obtained from the taint. Examine the entry method's return value; if it's confirmed that the tainted data ultimately becomes part of the entry method's return value, then it's considered a data leak.

[0060] Analyze the structure of the final return value. Based on this structure, locate all business fields affected by the tainted data from the class information dataset. For example, if the return value is the entire entity object, use the class information dataset to find all fields of that entity class as the business fields affected by the tainted data.

[0061] S204. Find the sensitive tags of the business field in the database table data, mark the business field based on the sensitive tags, and associate the marked business field with the second vulnerability chain to obtain the third vulnerability chain; In one embodiment, the annotations corresponding to the business field are parsed to determine the key database table data for the business field. The database table data is then used to query whether a sensitive tag exists for the business field. This sensitive tag is used to mark the business field, and the marked business field is associated with the second vulnerability chain to generate a third vulnerability chain.

[0062] Furthermore, after step S203, the method further includes: searching for the sensitive tags of the business field in the database table data; when the search result corresponding to the business field is empty, performing sensitivity analysis on the business field based on the large model to obtain the sensitive tags corresponding to the business field.

[0063] In one implementation, the large model performs sensitivity analysis by integrating the field's own characteristics, its contextual information, and the business scenario to obtain sensitive labels.

[0064] Specifically, natural language processing is used to analyze the names of business fields, parsing their semantics and extracting sensitive keywords, including directly sensitive keywords (such as personal identification information, financial information, authentication information, etc.) and indirectly sensitive keywords (user ID, order key, etc.). Contextual information such as the database table name, table comments, and related fields to which the field belongs is analyzed to extract sensitive factors. The business function and data usage to which the vulnerability belongs are determined to assess the field's sensitivity to the business. A comprehensive analysis of sensitive keywords, sensitive factors, and the field's sensitivity to the business is conducted to determine the sensitive label for that business field.

[0065] S205. Analyze the third vulnerability chain based on the hazard assessment agent and generate the audit report.

[0066] In one embodiment, a hazard assessment agent makes a final decision on the third vulnerability chain and generates a detailed audit report that includes the complete vulnerability context, root cause analysis, hazard assessment, and specific remediation recommendations.

[0067] In a specific embodiment, the hazard assessment agent extracts the call order, method name, and privilege escalation risk marker from the third vulnerability chain, organizes them into a function call process according to the forward execution flow, and intuitively displays the complete path of the privilege escalation vulnerability from the entry point to the taint.

[0068] First, key nodes are selected from the third-party vulnerability chain, specifically by extracting the fully qualified method name, class, and privilege escalation risk flag for each node. Then, the function call process is described using arrows and risk flags, following the execution order of the entry method, intermediate methods, and tainted methods. For example, the entry method includes: fully qualified method name and privilege escalation variable; intermediate methods include: fully qualified method name and privilege escalation risk flag (e.g., missing access control or unvalidated parameters); and tainted methods include: fully qualified method name, taint type, and data source of the operation.

[0069] In one embodiment, the unauthorized variable and its corresponding business field name are extracted. The unauthorized variable is a user-controllable but unverified parameter in the third vulnerability chain, and the corresponding business field is a business field marked as sensitive in the third vulnerability chain, i.e., the ultimately leaked sensitive information.

[0070] Specifically, from the entry method parameters of the third vulnerability chain, parameters that are user-controllable and have not undergone permission verification are filtered to obtain unauthorized variables. From the business field association part of the third vulnerability chain, sensitive business fields with sensitive tags are filtered, and their field names are supplemented (usually DTO layer field names or database table field names).

[0071] In one embodiment, the specific entry method with missing / invalid access control is located from the unauthorized access risk markers in the third vulnerability chain, and the code logic corresponding to the entry method is obtained. The code logic is then analyzed to determine the root cause of the vulnerability.

[0072] In one embodiment, a hazard assessment agent evaluates the severity level of a vulnerability based on the number of sensitive fields, sensitivity level, and business scenario in the third vulnerability chain, and describes the potential consequences. The sensitivity level, hazard level, and potential consequences are then integrated to form a vulnerability hazard description.

[0073] In one embodiment, the function call process of the aforementioned vulnerability, the name of the unauthorized variable and its corresponding business field, the cause of the vulnerability, and the description of the vulnerability's harm are integrated to generate the final audit report.

[0074] In the above embodiments, through multi-agent collaboration and dataset linkage, the vulnerability chain is gradually upgraded from the basic call path to a complete evidence chain containing risk markers and sensitive information, ultimately supporting accurate vulnerability location and hazard assessment, and improving the accuracy of code auditing.

[0075] Please see Figure 3 , Figure 3 This is a schematic flowchart illustrating a method for auditing code for horizontal privilege escalation vulnerabilities, provided in an embodiment of this application. This method can be applied to servers, converting the code to be audited into a logically structured, traversable abstract syntax tree, extracting the target dataset based on the syntax tree, and transforming unstructured code into structured information. This enables large models to quickly and accurately read the code, improving the efficiency of code auditing.

[0076] like Figure 3 As shown, the method for auditing code for security vulnerabilities at this level specifically includes steps S301 to S303.

[0077] S301. Convert the code to be audited into an abstract syntax tree based on a preset tool; In one embodiment, the code to be audited is converted into a structured, programmable, tree-like data structure, namely an abstract syntax tree, based on a pre-defined tool (such as an AST tool).

[0078] Specifically, read the code to be audited line by line, breaking it down into indivisible syntactic units, including: keywords, identifiers (such as class name UserController, method name getInfo, variable name userId), annotations (such as @Controller, @GetMapping), operators (such as =, ==, +); separators (such as "}", ")", ";"), etc.

[0079] According to the syntax rules of programming languages, indivisible syntax units are combined into higher-level syntax units (nodes). For example, a class node consists of keywords, class name, and class body, and contains child nodes such as class annotations, parent class, implemented interface, member variables, and method list; a method node consists of access modifiers, return type, method name, parameter list, and method body, and contains child nodes such as method annotations, parameters, local variables, and expressions; and an annotation node consists of @, annotation name, and annotation attributes.

[0080] Using the entire code project to be audited as the root node, the syntactic units are organized according to the code logic hierarchy to form a tree structure. The first-level child node can be a package; the second-level child node can be a class; the child nodes of the class node can be member variables, methods, and class annotations; the child nodes of the method node can be method annotations, parameters, and method bodies (including expressions, statement blocks, etc.).

[0081] S302. Traverse the abstract syntax tree, extract entry points, entry methods, and class information based on preset entry point identification rules, and generate entry point datasets, entry method datasets, and class information datasets; In one embodiment, based on entry point identification rules, class and method information related to external interface entry points are filtered and extracted from the syntax tree to generate a structured dataset.

[0082] Specifically, the syntax tree nodes are traversed to locate the controller class, implement class information extraction, and generate a class information dataset. Starting from the root node, package nodes, and class nodes of the syntax tree, each class node is checked to see if it conforms to the entry point identification rules. For controller classes that conform to the rules, the basic attributes of the class (such as class name, access modifiers, etc.), inheritance and implementation, class annotations, member variables, etc. are extracted to generate a class information dataset.

[0083] Traverse the controller class methods to extract the entry point method. Starting from the controller class node and moving down to the method node, check each method node for characteristics matching the entry point method. For example, method annotation matching: the method node contains request mapping annotations; parameter characteristic matching: the method parameters contain request parameter annotations, or the parameters are request-related objects; return value characteristic matching: the return value is a business data type, not a page template. For methods that meet the criteria, extract the method's basic attributes (such as method name, access modifier, return value type, etc.), parameter list, method annotations, and code logic summary to generate the entry point method dataset.

[0084] The entry point is the externally exposed interface access address, which is composed of the class annotation URL and the method annotation URL of the entry method. Based on the annotations of the entry method and its controller class, the interface URL, request method, class, entry method name, and request parameters are extracted to generate the entry point dataset.

[0085] S303. Construct a function call graph based on the entry point and the entry method, and generate a function call graph dataset.

[0086] In one embodiment, starting from the entry method, the call relationships between methods are traced to construct a method call chain topology graph, i.e., a function call graph, which visually displays the code execution flow.

[0087] Furthermore, the step of constructing a function call graph based on the entry point and the entry method includes: traversing the method body corresponding to each entry method and identifying the call expression of the entry method; identifying the call relationship of each entry method based on the call expression of each entry method; and constructing the function call graph by using the entry point as the root node, the call expression as the child node, and the call relationship as the edge.

[0088] In one embodiment, the entry point method is an interface method that provides services to the outside world. The invocation expression is a statement within the method body that calls another method. The invocation relationship is a directed association between the calling method and the called method.

[0089] Specifically, an entry method is selected from the entry method dataset as the root node of the call graph. The method body nodes of the entry method are traversed, identifying all method call expressions. Each call expression corresponds to a direct child node, including the caller (i.e., the current method), the callee (i.e., the target method), the call parameters (parameters passed to the callee), and the call position (line number in the method body). Starting from the direct child node, the above steps are repeated, tracing the methods called within the direct child node until no new calls are made or the data operation layer (such as the DAO layer or remote calls) is reached. If the called method is a DAO layer method or a remote call, it is marked as a leaf node (i.e., the end of the call chain).

[0090] Organize all call relationships into a directed graph structure, where nodes are methods and directed edges are call relationships, generating a function call graph that includes node information (such as unique method identifier, class, and method type) and edge information (such as caller node ID, callee node ID, call parameters, and call order).

[0091] Collect the function call graphs generated from each entry method to generate a function call graph dataset.

[0092] In another embodiment, it is determined whether the calling expression belongs to the DAO layer (data call layer). If the calling expression belongs to the data call layer, the SQL statement is restored by using the AST tool, and the restored SQL statement is associated with the corresponding node in the function call graph.

[0093] Specifically, the local class information dataset identifies the characteristics of DAO layer classes, such as class names containing keywords like "DAO" or "Mapper" (e.g., UserDAO, OrderMapper); class annotations being framework-specific identifiers; and implementation of specific interfaces or inheritance of DAO layer base classes. If the target class of the calling expression matches the above DAO layer characteristics, the call is determined to be a DAO layer method call, triggering SQL statement restoration.

[0094] Based on the SQL definition method of the DAO layer methods (annotation-based, XML configuration-based, or dynamically generated), SQL templates are extracted from the entry method dataset or XML mapping file. Dynamic conditions in the SQL template are parsed to generate possible SQL statement variations. These variations are then combined with the arguments in the calling expression to generate the complete execution SQL text. In the function call graph, each DAO layer method call corresponds to a child node. The AST tool adds SQL information attributes to this node, including the execution SQL text.

[0095] In the above embodiments, by converting the code to be audited into a logically structured and traversable abstract syntax tree, and extracting the target dataset based on the syntax tree, unstructured code is converted into structured information, enabling large models to read the code quickly and accurately, thus improving the efficiency of code auditing.

[0096] Please see Figure 4 , Figure 4 This application provides a schematic block diagram of a horizontal privilege escalation vulnerability code auditing device, which is used to execute the aforementioned horizontal privilege escalation vulnerability code auditing method. The horizontal privilege escalation vulnerability code auditing device can be configured on a server.

[0097] like Figure 4 As shown, the horizontal privilege escalation security vulnerability code auditing device 400 includes: The module 401 for obtaining auditable code is used to obtain source code and preprocess the source code to obtain auditable code. The target dataset extraction module 402 is used to perform structured parsing on the code to be audited and extract the target dataset; The audit report acquisition module 403 is used to acquire database table data, and based on the database table data and the target dataset, to call the various agents of the large model to collaboratively perform horizontal privilege escalation vulnerability mining, and obtain the audit report corresponding to the code to be audited.

[0098] Furthermore, the audit report obtaining module 403 includes: The first vulnerability chain acquisition unit is used to call the taint discovery agent of the large model to perform taint mining based on the entry point dataset and the function call graph dataset, and to obtain the first vulnerability chain. The second vulnerability chain acquisition unit is used to call the positive auditing agent to perform positive code auditing on the first vulnerability chain based on the entry method dataset, obtain the unauthorized access verification result, and mark the vulnerability chain based on the unauthorized access verification result to obtain the second vulnerability chain; The business field determination unit is used to call the reverse auditing agent to perform reverse code auditing on the second vulnerability chain based on the entry method dataset and the class information dataset, and determine the business fields corresponding to the tainted data; The third vulnerability chain determination unit is used to find the sensitive tags of the business field in the database table data, mark the business field based on the sensitive tags, and associate the marked business field with the second vulnerability chain to obtain the third vulnerability chain; The audit report generation unit is used to analyze the third vulnerability chain based on the hazard assessment agent and generate the audit report.

[0099] Furthermore, the first vulnerability chain acquisition unit includes: The function call graph retrieval subunit is used to determine the audit target based on the entry point dataset and retrieve the function call graph corresponding to the audit target from the function call graph dataset. The method call node lookup subunit is used to find method call nodes that meet the preset taint characteristics according to the function call graph. The first vulnerability chain generation subunit is used to generate the first vulnerability chain based on the order of the method call nodes in the function call graph.

[0100] Furthermore, the second vulnerability chain acquisition unit includes: The parameter transmission process tracking subunit is used to identify user input parameters based on the positive auditing agent and to track the parameter transmission process of the user input parameters based on the first vulnerability chain. The unauthorized access verification result acquisition subunit is used to determine whether each of the entry methods has an access permission verification based on the entry method dataset during the parameter transmission process, and to obtain the unauthorized access verification result.

[0101] Furthermore, the audit report obtaining module 403 also includes: A sensitive tag lookup unit is used to look up sensitive tags for the business field in the database table data; The sensitivity analysis unit is used to perform sensitivity analysis on the business field based on the large model when the search result corresponding to the business field is empty, and to obtain the sensitivity label corresponding to the business field.

[0102] Furthermore, the target dataset extraction module 402 includes: The code to be audited conversion unit is used to convert the code to be audited into an abstract syntax tree based on a preset tool; The target information extraction unit is used to traverse the abstract syntax tree, extract entry points, entry methods and class information based on preset entry point identification rules, and generate entry point datasets, entry method datasets and class information datasets; The function call graph construction unit is used to construct a function call graph based on the entry point and the entry method, and generate a function call graph dataset.

[0103] Furthermore, the function call graph construction unit includes: The call expression recognition subunit is used to traverse the method body corresponding to each of the entry methods and recognize the call expression of the entry method; The call relationship identification subunit is used to identify the call relationship of each of the entry methods based on the call expression of each entry method; A function call graph construction sub-unit is used to construct the function call graph by taking the entry point as the root node, the call expression as the child node, and the call relationship as the edge.

[0104] It should be noted that those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the above-described apparatus and modules can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0105] The aforementioned device can be implemented as a computer program, which can be used in, for example... Figure 5 It runs on the computer device shown.

[0106] Please see Figure 5 , Figure 5 This is a schematic block diagram illustrating the structure of a computer device according to an embodiment of this application. The computer device may be a server.

[0107] See Figure 5 The computer device includes a processor, memory, and network interface connected via a system bus, wherein the memory may include non-volatile storage media and internal memory.

[0108] Non-volatile storage media can store operating systems and computer programs. These computer programs include program instructions that, when executed, cause the processor to perform any level of privilege escalation security vulnerability code auditing method.

[0109] The processor provides computing and control capabilities, supporting the operation of the entire computer device.

[0110] Internal memory provides an environment for the execution of computer programs on non-volatile storage media. When these computer programs are executed by a processor, the processor can perform any level of privilege escalation security vulnerability code auditing method.

[0111] This network interface is used for network communication, such as sending assigned tasks. Those skilled in the art will understand that... Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0112] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0113] In one embodiment, the processor is configured to run a computer program stored in memory to perform the following steps: Obtain the source code and preprocess it to obtain the code to be audited; The code to be audited is subjected to structured parsing to extract the target dataset; Obtain database table data, and based on the database table data and the target dataset, call the various agents of the large model to collaboratively perform horizontal privilege escalation vulnerability mining to obtain the audit report corresponding to the code to be audited.

[0114] In one embodiment, when the processor implements the task of collaboratively invoking various agents of a large model to perform horizontal privilege escalation vulnerability mining based on the database table data and the target dataset, and obtaining the audit report corresponding to the code to be audited, it is configured to: Based on the entry point dataset and the function call graph dataset, the taint discovery agent of the large model is invoked to perform taint mining and obtain the first vulnerability chain. Based on the aforementioned entry method dataset, a positive auditing agent is invoked to perform positive code auditing on the first vulnerability chain, obtain an unauthorized access verification result, and mark the vulnerability chain based on the unauthorized access verification result to obtain a second vulnerability chain. Based on the entry method dataset and the class information dataset, the reverse auditing agent is invoked to perform reverse code auditing on the second vulnerability chain to determine the business fields corresponding to the tainted data; Search for sensitive tags of the business field in the database table data, mark the business field based on the sensitive tags, and associate the marked business field with the second vulnerability chain to obtain the third vulnerability chain; The audit report is generated by analyzing the third vulnerability chain based on the hazard assessment agent.

[0115] In one embodiment, when the processor invokes the taint discovery agent of the large model to perform taint mining based on the entry point dataset and the function call graph dataset to obtain the first vulnerability chain, it is used to: The audit target is determined based on the entry point dataset, and the function call graph corresponding to the audit target is retrieved from the function call graph dataset; Find the method call node that matches the preset taint characteristics according to the function call graph; The first vulnerability chain is generated based on the order of the method call nodes in the function call graph.

[0116] In one embodiment, when the processor invokes a positive auditing agent based on the entry method dataset to perform positive code auditing on the first vulnerability chain and obtain an unauthorized access verification result, it is configured to: The positive auditing agent identifies user input parameters and traces the parameter transmission process of the user input parameters based on the first vulnerability chain. During the parameter transmission process, based on the entry method dataset, it is determined whether each entry method has permission verification, and the unauthorized access verification result is obtained.

[0117] In one embodiment, after the processor implements the reverse auditing agent to perform reverse code auditing on the second vulnerability chain based on the entry method dataset and the class information dataset, and determines the business fields corresponding to the tainted data, it is further configured to: Search for the sensitive tags of the business fields in the database table data; When the search result corresponding to the business field is empty, a sensitivity analysis is performed on the business field based on the large model to obtain the sensitive label corresponding to the business field.

[0118] In one embodiment, when the processor performs structured parsing of the code to be audited and extracts the target dataset, it is configured to: The code to be audited is converted into an abstract syntax tree based on a preset tool; Traverse the abstract syntax tree and extract entry points, entry methods, and class information based on preset entry point identification rules to generate entry point datasets, entry method datasets, and class information datasets; A function call graph is constructed based on the entry point and the entry method, and a function call graph dataset is generated.

[0119] In one embodiment, when the processor implements the construction of a function call graph based on the entry point and the entry method, it is configured to: Iterate through the method bodies corresponding to each entry method and identify the call expression of the entry method; Based on the calling expressions of each entry method, the calling relationship of each entry method is identified; The function call graph is constructed by using the entry point as the root node, the call expression as the child node, and the call relationship as the edge.

[0120] The embodiments of this application also provide a computer-readable storage medium storing a computer program, the computer program including program instructions, and the processor executing the program instructions to implement any of the horizontal privilege escalation security vulnerability code auditing methods provided in the embodiments of this application.

[0121] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiments, such as the hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the computer device.

[0122] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for auditing code that exposes horizontal privilege escalation security vulnerabilities, characterized in that, include: Obtain the source code and preprocess it to obtain the code to be audited; The code to be audited is subjected to structured parsing to extract the target dataset; Obtain database table data, and based on the database table data and the target dataset, call the various agents of the large model to collaboratively perform horizontal privilege escalation vulnerability mining to obtain the audit report corresponding to the code to be audited.

2. The method for auditing code for horizontal privilege escalation security vulnerabilities according to claim 1, characterized in that, Based on the database table data and the target dataset, the various agents of the large model are invoked to collaboratively perform horizontal privilege escalation vulnerability mining to obtain an audit report corresponding to the code to be audited, including: Based on the entry point dataset and the function call graph dataset, the taint discovery agent of the large model is invoked to perform taint mining and obtain the first vulnerability chain. Based on the aforementioned entry method dataset, a positive auditing agent is invoked to perform positive code auditing on the first vulnerability chain, obtain an unauthorized access verification result, and mark the vulnerability chain based on the unauthorized access verification result to obtain a second vulnerability chain. Based on the entry method dataset and the class information dataset, the reverse auditing agent is invoked to perform reverse code auditing on the second vulnerability chain to determine the business fields corresponding to the tainted data; Search for sensitive tags of the business field in the database table data, mark the business field based on the sensitive tags, and associate the marked business field with the second vulnerability chain to obtain the third vulnerability chain; The audit report is generated by analyzing the third vulnerability chain based on the hazard assessment agent.

3. The method for auditing code for horizontal privilege escalation security vulnerabilities according to claim 2, characterized in that, The step of invoking the taint detection agent of the large model to perform taint mining based on the entry point dataset and the function call graph dataset, and obtaining the first vulnerability chain, includes: The audit target is determined based on the entry point dataset, and the function call graph corresponding to the audit target is retrieved from the function call graph dataset; Find the method call node that matches the preset taint characteristics according to the function call graph; The first vulnerability chain is generated based on the order of the method call nodes in the function call graph.

4. The method for auditing code for horizontal privilege escalation security vulnerabilities according to claim 2, characterized in that, The step of invoking a positive auditing agent to perform positive code auditing on the first vulnerability chain based on the entry method dataset, and obtaining the unauthorized access verification result, includes: The positive auditing agent identifies user input parameters and traces the parameter transmission process of the user input parameters based on the first vulnerability chain. During the parameter transmission process, based on the entry method dataset, it is determined whether each entry method has permission verification, and the unauthorized access verification result is obtained.

5. The method for auditing code for horizontal privilege escalation security vulnerabilities according to claim 2, characterized in that, After invoking the reverse auditing agent to perform reverse code auditing on the second vulnerability chain based on the entry method dataset and the class information dataset, and determining the business fields corresponding to the tainted data, the process further includes: Search for the sensitive tags of the business fields in the database table data; When the search result corresponding to the business field is empty, a sensitivity analysis is performed on the business field based on the large model to obtain the sensitive label corresponding to the business field.

6. The method for auditing code for horizontal privilege escalation security vulnerabilities according to any one of claims 1 to 5, characterized in that, The process of performing structured parsing on the code to be audited to extract the target dataset includes: The code to be audited is converted into an abstract syntax tree based on a preset tool; Traverse the abstract syntax tree and extract entry points, entry methods, and class information based on preset entry point identification rules to generate entry point datasets, entry method datasets, and class information datasets; A function call graph is constructed based on the entry point and the entry method, and a function call graph dataset is generated.

7. The method for auditing code for horizontal privilege escalation security vulnerabilities according to claim 6, characterized in that, The construction of the function call graph based on the entry point and the entry method includes: Iterate through the method bodies corresponding to each entry method and identify the call expression of the entry method; Based on the calling expressions of each entry method, the calling relationship of each entry method is identified; The function call graph is constructed by using the entry point as the root node, the call expression as the child node, and the call relationship as the edge.

8. A horizontal privilege escalation security vulnerability code auditing device, characterized in that, include: The module for obtaining auditable code is used to acquire source code and preprocess the source code to obtain auditable code. The target dataset extraction module is used to perform structured parsing on the code to be audited and extract the target dataset. The audit report acquisition module is used to obtain database table data, and based on the database table data and the target dataset, call the various agents of the large model to collaboratively perform horizontal privilege escalation vulnerability mining to obtain the audit report corresponding to the code to be audited.

9. A computer device, characterized in that, The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is configured to execute the computer program and, in executing the computer program, implement the horizontal privilege escalation security vulnerability code auditing method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, causes the processor to implement the horizontal privilege escalation security vulnerability code auditing method as described in any one of claims 1 to 7.

Images