A web security auditing method and device based on a browser runtime

Abstract

This invention discloses a web security auditing method and apparatus based on browser runtime, relating to the field of network security technology. It includes: forcibly activating a trusted type mechanism and supplementing it with API instrumentation in the browser environment of the page to be audited to construct a hybrid monitoring environment; acquiring the page's JavaScript code data and injecting path control functions into its control flow branches through abstract syntax tree analysis; executing the transformed code in the monitoring environment, using the path control functions to guide traversal of different logical branches, and capturing the call stack and code fragments containing vulnerability trigger points when execution triggers monitoring; extracting precise code slices based on call stack information and performing security semantic reasoning using a large language model with input prompt words, and generating an audit report based on the structured results output by the model. This achieves high coverage and low false positive automated detection of deep DOM XSS vulnerabilities, solving the problems of difficult path reach and insufficient intelligent analysis in traditional security auditing technologies.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a web security auditing method and apparatus based on browser runtime. Background Technology

[0002] As web applications, especially single-page applications, become more complex, their front-end JavaScript code logic becomes increasingly complex and often obfuscated and compressed, causing traditional security auditing techniques to face significant bottlenecks in detecting client-side vulnerabilities such as DOM XSS.

[0003] Static analysis tools search for dangerous data streams by parsing source code, but they struggle with the dynamic nature of JavaScript, resulting in high false positive and false negative rates. Traditional dynamic scanning tools rely on preset payloads for black-box testing, failing to reach deep code logic requiring specific interactions or permission states, thus limiting coverage. Directly analyzing complete code files using large language models is limited by the length of their context window, easily leading to information loss or analytical illusions. Existing dynamic analysis solutions based on taint tracing often require injecting large amounts of detection code, potentially disrupting the original program logic, causing page errors, and requiring frequent updates to adapt to rapidly iterating front-end frameworks.

[0004] Therefore, there is an urgent need in this field for a web security auditing method that can automatically and non-destructively reach deep code paths and accurately and intelligently characterize potential vulnerabilities, so as to significantly reduce the cost of manual auditing and improve the automation and accuracy of detection. Summary of the Invention

[0005] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a web security auditing method and apparatus based on browser runtime to solve the technical problems mentioned in the background art.

[0006] One aspect of the present invention provides a web security auditing method based on browser runtime, comprising the following steps: A monitoring environment construction step: In the browser runtime environment of the web page to be audited, the browser's native trusted type mechanism is forcibly activated, and at least one preset API not covered by the trusted type mechanism is instrumented for monitoring, thereby constructing a hybrid monitoring environment; A dynamic code conversion and path control step: JavaScript code data of the web page to be audited is obtained, and path control functions are injected into the control flow branch nodes of the abstract syntax tree of the JavaScript code data to realize the conversion and rewriting of the JavaScript code data; A vulnerability triggering and context capture step: The converted and rewritten JavaScript code data is executed in the hybrid monitoring environment, and different logical branches are traversed through the path control functions; when the execution of the JavaScript code data triggers the trusted type mechanism or the instrumentation monitoring, call stack information containing the vulnerability trigger point and the corresponding JavaScript code data fragment are captured; An intelligent analysis step: Based on the call stack information, a target code slice containing the vulnerability trigger point is extracted from the JavaScript code data fragment; the target code slice and predefined analysis prompt words are input into a large language model to obtain vulnerability analysis results generated by the large language model, and a security audit report is generated based on the vulnerability analysis results.

[0007] In another aspect, the present invention provides a web security auditing device based on browser runtime, comprising: a monitoring environment construction module, used to forcibly activate the browser's native trusted type mechanism in the browser runtime environment of the web page to be audited, and to perform instrumentation monitoring on at least one preset API not covered by the trusted type mechanism, so as to construct a hybrid monitoring environment; a dynamic code conversion and path control module, used to acquire JavaScript code data of the web page to be audited, and inject path control functions into the control flow branch nodes of the abstract syntax tree of the JavaScript code data to realize the conversion and rewriting of the JavaScript code data; a vulnerability triggering and context capture module, used to execute the converted and rewritten JavaScript code data in the hybrid monitoring environment, and traverse different logical branches through the path control function; when the execution of the JavaScript code data triggers the trusted type mechanism or the instrumentation monitoring, it captures call stack information containing the vulnerability trigger point and the corresponding JavaScript code data fragment; and an intelligent analysis module, used to extract the target code slice containing the vulnerability trigger point from the JavaScript code data fragment based on the call stack information; input the target code slice and predefined analysis prompt words into a large language model to obtain the vulnerability analysis result generated by the large language model, and generate a security audit report based on the vulnerability analysis result.

[0008] The present invention provides a web security auditing method and apparatus based on browser runtime, which has the following beneficial effects:

[0009] First, by injecting path control functions into the control flow branch through dynamic code transformation, the browser can be forced to execute deep code logic that is difficult to reach with traditional scanning, which significantly improves the path coverage of the test and effectively discovers hidden vulnerabilities.

[0010] Second, by leveraging the browser's native trusted type mechanism as a monitoring engine, defensive features are transformed into proactive detection tools. Because the trusted type mechanism resides at the browser kernel level, monitoring is precise with minimal interference to the original page logic, avoiding the potential for page crashes or abnormal behavior that can occur with traditional instrumentation methods.

[0011] Third, by capturing the contextual information of real vulnerability trigger points and using large language models for expert-level analysis, we can understand the semantic logic of the code, identify effective filters implemented by developers, thereby significantly reducing the false positive rate and providing high-quality vulnerability characterization.

[0012] Fourth, by capturing and splicing the call stack of asynchronous operation chains, the problem of exploiting chain breaks in traditional analysis is solved, ensuring complete auditing capabilities for asynchronous logic commonly used in modern front-end frameworks.

[0013] Fifth, it has achieved full automation of the entire process from environment building, dynamic code conversion, path exploration, vulnerability trigger capture to intelligent analysis and report generation, which greatly reduces the cost of manual auditing and improves the efficiency of security operations. Attached Figure Description

[0014] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0015] Figure 1 This is a flowchart illustrating a web security auditing method based on browser runtime, provided in one embodiment of this application.

[0016] Figure 2 This is a flowchart illustrating the steps for constructing a monitoring environment according to an embodiment of this application;

[0017] Figure 3 This is a flowchart illustrating dynamic code conversion and path control provided in one embodiment of this application;

[0018] Figure 4 This is a flowchart illustrating the vulnerability triggering and context capture steps provided in one embodiment of this application;

[0019] Figure 5 This is a flowchart illustrating the intelligent analysis steps provided in one embodiment of this application;

[0020] Figure 6 This is a schematic diagram of the structure of a web security auditing device based on browser runtime, provided in one embodiment of this application;

[0021] Figure 7 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] One embodiment of this application details a web security auditing method based on browser runtime. See also Figure 1 The method includes the following steps:

[0024] Step S101: Monitoring environment construction.

[0025] This step aims to build a transparent, highly accurate, and low-intrusive vulnerability trigger monitoring environment for the target web page. Its core principle is to utilize and enforce the Trusted Types mechanism, natively supported by modern browsers, as the primary monitoring engine. The Trusted Types mechanism is originally a browser security feature used to defend against DOM XSS, requiring explicit verification and encapsulation of strings passed to certain dangerous receiver APIs through a trusted policy. This invention transforms this into a proactive detection tool: forcibly enabling this mechanism through content security policies and injecting a custom policy with monitoring capabilities. When page code attempts to violate this policy (i.e., passing the raw string to the receiver), the browser immediately detects the vulnerability trigger point. For a few APIs that are not covered by the Trusted Types mechanism but are equally dangerous, lightweight runtime instrumentation is used for supplementary monitoring, thus forming a hybrid monitoring environment with the native mechanism as the primary mechanism and lightweight instrumentation as a supplement.

[0026] Specifically, in the browser runtime environment of the web page to be audited, the browser's native trusted type mechanism is forcibly activated, and at least one preset API not covered by the trusted type mechanism is instrumented for monitoring, thereby constructing a hybrid monitoring environment. See also Figure 2 The construction of the monitoring environment includes the following sub-steps:

[0027] Step S1011: Force the activation of the trusted type mechanism.

[0028] To ensure that the page to be audited is under trusted monitoring and protection during loading and execution, the system needs to forcibly inject appropriate content security policies. Specifically, this can be achieved through man-in-the-middle proxy technology. The man-in-the-middle proxy intercepts all HTTP(S) responses from the browser to the target page. When it identifies the response content type as HTML, it inserts a specific... <meta> The `<type>` tag carries a CSP directive that forces the trusted type mechanism to be enabled. This CSP directive informs the browser of any attempts to pass trusted types within the context of this page. <script>标签相关接收器的字符串都必须通过可信类型机制的处理。通过此方式，无论原始页面是否设置了CSP，都能确保可信类型机制被激活，为后续监控奠定了基础。

[0029] 步骤S1012，注入自定义的安全策略以注册监控钩子函数。

[0030] 仅启用可信类型机制还不够，需要一个具体的策略来定义如何处理字符串以及执行监控逻辑。本步骤通过浏览器的开发者工具协议或其它运行时注入技术，在页面JavaScript代码数据执行之初，向页面全局上下文注入一个自定义的安全策略，可命名为default（浏览器默认策略名）。在该策略的创建过程中，对关键的方法进行钩子（Hook）函数注册。具体而言，策略对象包含createHTML、createScript、createScriptURL等方法。系统在实现这些方法时，不仅进行简单的创建操作，更重要的是在此加入监控逻辑。例如，在createHTML方法内，可以记录调用栈、触发时间、以及试图创建的原始字符串值。更重要的是，该方法可以设计为始终抛出异常（即上报安全事件），或者在其内部调用一个统一的审计函数来触发审计流程。这样，当页面中的任何JavaScript代码数据试图执行可能引发DOMXSS漏洞的危险操作，如element.innerHTML = untrustedString时，都会触发这个自定义策略的钩子函数，从而被系统捕获。

[0031] 步骤S1013，补充插桩非可信类型覆盖的敏感API。

[0032] 可信类型机制主要覆盖DOM操作相关的接收器。然而，Web中还存在其他重要的攻击向量，例如通过location.href、location.assign()、location.replace()等进行的URL跳转，这些通常不属于可信类型的强制管控范围。为了确保监控的完整性，本步骤对这些未被覆盖的预设API进行运行时插桩。插桩方式通过CDP脚本注入实现，将页面全局对象上的这些方法替换为包装函数。包装函数的核心逻辑是拦截原始调用，将调用参数和当前的调用栈信息传递给统一的监控函数，然后再决定是否继续执行原始逻辑或为了审计目的而阻断执行。通过这种补充插桩，构建了一个无死角的混合监控环境，确保无论是DOM注入型还是URL跳转型的潜在漏洞触发点都能被有效捕获。

[0033] 步骤S102：动态代码转换与路径控制。

[0034] 本步骤旨在解决传统动态扫描无法触达受条件保护的深层代码分支的问题，并优化代码结构以支持后续的精确分析和异步链路追踪。该步骤的核心原理是：在代码加载入浏览器执行前，对其进行一次静态的抽象语法树分析、转换与重写。转换的目标主要有：一是在所有控制流分支（如if、switch）处注入一个路径控制函数，该函数可根据审计系统的指令，动态地决定分支的走向，从而实现强制性的路径探索；二是对异步操作进行封装，以捕获和保存完整的调用链上下文；三是进行变量重命名等优化，便于后续的数据流追踪和代码理解。

[0035] 具体的，获取所述待审计Web页面的JavaScript代码数据，在所述JavaScript代码数据的抽象语法树的控制流分支节点中注入路径控制函数，以实现对所述JavaScript代码数据的转换重写。参见图3，动态代码转换与路径控制具体包括以下子步骤：

[0036] 步骤S1021，抽象语法树解析与代码映射关系建立。

[0037] 具体的，对所述JavaScript代码数据进行抽象语法树解析与转换，建立转换重写后的代码节点与原始代码行之间的映射关系。

[0038] 系统通过一个高性能的JavaScript编译器 / 转译器（例如SWC、Babel等）对从网络拦截或从浏览器运行时获取的目标Web网页的JavaScript源代码进行解析，生成其抽象语法树。在遍历和转换AST的过程中，一个关键任务是建立转换前后代码位置的精确映射关系。具体而言，系统维护一个映射表，该映射表记录了每一个经过转换的AST节点所对应的原始JavaScript源代码行号和内容。由于生产环境的代码常被压缩混淆，单行可能包含大量语句，映射关系需要精细到语句级别。这一映射是后续步骤中能够将插桩后的代码还原为原始语义的关键，确保提交给大语言模型分析的是干净、易于理解的业务逻辑代码，而非工具插入的辅助代码。

[0039] 步骤S1022，异步操作封装与调用栈快照。

[0040] 具体的，识别所述JavaScript代码数据中的异步操作API并进行封装，封装后的异步操作API用于在异步任务启动时捕获并保存当前的同步调用栈信息。

[0041] 为了应对现代前端应用中普遍的异步编程模式，防止漏洞触发时的调用栈因异步而断裂丢失关键的上游信息，本步骤对识别出的异步操作API进行AST级别的封装。具体地，在转换过程中，当遇到new Promise()、.then()、.catch()、async函数声明、await表达式等节点时，系统将其重写为对自定义包装函数的调用。该包装函数的核心职责是，在异步任务（如一个Promise的执行器函数）真正开始执行前，立即捕获并保存当前JavaScript调用栈的快照。这个快照通常通过new Error().stack获取，它包含了同步执行到该点时的完整函数调用链信息。该快照与当前异步任务（例如，通过一个唯一ID标识）关联并存储。当这个异步任务在未来某个时刻完成并执行回调，且回调中触发了漏洞监控点时，系统便能从存储中取出对应的同步栈快照，与异步回调内的栈信息进行拼接，形成增强型调用栈，从而完整呈现从用户输入点到漏洞接收器的、跨越了异步边界的传播路径。

[0042] 步骤S1023，控制流分支注入与路径控制函数插入。

[0043] 系统在AST遍历过程中，识别所有控制程序流程的分支节点，主要包括IfStatement和SwitchStatement。对于IfStatement，其转换的核心思想是将原始的条件判断表达式包装到一个路径控制函数的调用中。例如：if (path_hook(condition, nodeId,branchIndex)) { ...}。

[0044] 其中，condition是原始的条件表达式；nodeId是为该分支节点分配的唯一全局标识符，格式可包含文件名、随机码等信息，用于在后续审计中精确定位；branchIndex标识当前是if块（真分支）还是else块（假分支）；_path_hook函数的逻辑由审计系统控制。在默认或首次执行时，它可能返回condition的实际求值结果，保持原始逻辑。但在审计系统的路径探索模式下，系统可以通过CDP等接口，动态指示_path_hook函数忽略传入的condition值，强制返回true或false，从而引导程序执行进入原本因条件不满足而不会执行的分支代码块。对于SwitchStatement，其case分支也可采用类似原理进行转换和强制跳转。通过这种方式，审计系统能够逐一探索所有可能的逻辑路径，极大提高了对隐藏在深层条件判断后的安全隐患的发现能力。

[0045] 步骤S103：漏洞触发与上下文捕获。

[0046] 本步骤是在构建的监控环境和转换后的代码基础上，执行动态的路径探索，并精准捕获漏洞触发时的关键上下文信息。该步骤的核心是一个迭代和引导的过程，即：系统驱动浏览器执行页面，并通过控制步骤S1023中注入的_path_hook函数，在多次页面加载或状态重置中，强制程序走入不同的逻辑分支。一旦执行流触及一个潜在的危险操作，步骤S101构建的混合监控环境便会立即被触发。系统此时的任务是捕获此刻最丰富的诊断信息，为后续的智能分析提供素材。

[0047] 具体的，在所述混合监控环境下执行经转换重写的JavaScript代码数据，通过所述路径控制函数遍历不同的逻辑分支；当JavaScript代码数据执行触发所述可信类型机制或所述插桩监控时，捕获包含漏洞触发点的调用栈信息和对应的JavaScript代码数据片段。参见图4，该步骤具体包括以下子步骤：步骤S1031，引导式路径遍历与代码执行。

[0048] 审计系统启动一个或多个无头浏览器实例，加载目标URL。页面加载过程中，步骤S102转换重写后的JavaScript代码数据被执行。系统根据预设的审计策略（例如，广度优先或深度优先探索），通过浏览器调试协议，向页面上下文中的_path_hook函数发送指令。例如，在第一次页面访问时，可能让所有_path_hook返回其原始条件值，记录下正常执行路径。在后续的迭代访问中，系统会选择特定的nodeId和branchIndex组合，强制_path_hook返回相反的布尔值，从而引导程序跳转到之前未执行的代码分支。这个过程可能涉及模拟点击、表单填充等交互操作以改变页面状态，配合分支强制跳转，实现对应用状态空间的系统性探索。

[0049] 步骤S1032，监控触发与增强型调用栈捕获。

[0050] 当代码执行到某个分支，并最终调用了一个被监控的敏感API（例如，尝试设置innerHTML）时，步骤S101中构建的监控环境立刻响应。无论是通过可信类型策略抛出的异常，还是通过补充插桩调用的统一审计函数，系统都会在此刻进行关键信息捕获，捕获的核心信息是调用栈（Stack Trace）。可选的，系统通过监听console.error或直接在审计函数中调用new Error().stack来获取当前执行点的错误堆栈。更重要的是，如果当前执行点位于某个异步回调中，系统会根据当前执行上下文或预设的标识，检索出在步骤S1022中为该异步任务保存的同步栈快照。然后将这两部分栈信息进行逻辑上的拼接，即：将同步栈快照放置在异步回调栈的上方，形成一个从同步入口点到异步漏洞触发点的、完整的增强型调用栈。这个增强型调用栈是理解漏洞形成路径的至关重要的证据。同时，系统也会记录下触发点的类型、试图传递的原始数据、以及相关联的JavaScript源代码数据等信息。

[0051] 步骤S1033，关联代码片段提取。

[0052] 仅有调用栈信息还不够，还需要知道漏洞触发点周围的代码逻辑。系统根据捕获的调用栈信息，特别是其中的文件名和行号，从其内部的代码缓存中快速定位到对应的JavaScript源文件数据。然后，以触发点行号为中心，向前后各扩展若干行（如10-20行），截取出一段代码片段。这段代码片段包含了漏洞触发的直接上下文数据，例如变量赋值、条件判断、函数调用链等。截取的代码片段是经过步骤S102转换重写后的版本，其中包含了_path_hook、_audit_sink等注入的函数调用。

[0053] 步骤S104：智能分析。

[0054] 本步骤旨在利用大语言模型的强大语义理解能力，对步骤S103捕获的原始的上下文信息进行自动化、专家级的漏洞分析与定性，并生成人类可读的安全审计报告。其核心原理是：首先，对捕获的代码片段进行净化还原，去除审计工具引入的噪声（如插桩函数），使其更接近开发人员编写的原始代码，便于模型理解。然后，构造一个结构化的提示词（Prompt），将净化后的代码切片、触发点标记以及明确的专家分析任务指令一同提交给大语言模型。模型在指令的约束下，扮演安全专家角色，分析代码逻辑，判断是否存在真实漏洞，并推理出用户可控数据的传播路径。

[0055] 具体的，根据所述调用栈信息定位漏洞触发点，并截取漏洞触发点的上下文代码作为初始切片；利用转换重写后的代码节点与原始代码行之间的映射关系，将所述初始切片中因转换重写而插入的辅助代码移除，还原为原始的代码语义，得到所述目标代码切片；将所述目标代码切片与提示词一同输入至所述大语言模型，获取其输出的结构化分析结果；所述结构化分析结果至少包括漏洞判定和用户可控输入的传播路径。

[0056] 如图5所示，该步骤具体包括以下子步骤：

[0057] 步骤S1041，代码切片净化与语义还原。

[0058] 直接从步骤S1033获取的代码切片包含了_path_hook、_audit_sink等工具注入的辅助代码，这些代码对于大语言模型理解业务逻辑是干扰和噪声。本步骤利用在步骤S1021中建立的转换后代码节点与原始代码行映射关系，对代码切片进行净化处理。系统遍历切片中的每一行，通过查找映射表，将识别出的、由工具插入的函数调用语句替换为对应的原始代码行内容，或者直接将其移除。经过净化处理后，得到一份目标代码切片。该目标代码切片保留了触发漏洞的业务逻辑本质，但去除了所有工具层面的痕迹，使得大语言模型能够聚焦于分析代码的安全语义，而非被无关的语法结构迷惑，从而显著提高分析的准确率。

[0059] 步骤S1042，构造专家分析提示词与模型推理。

[0060] 系统预定义了一个结构化的分析提示词模板。该模板通常包含以下几个部分：

[0061] （1）角色指令：要求大语言模型扮演一名经验丰富的Web安全审计专家。

[0062] （2）上下文代码：提供步骤S1041中得到的目标代码切片，目标代码切片包含漏洞触发点和漏洞触发点标记。其中，漏洞触发点标记是在代码切片中使用特殊标记高亮显示出触发监控的具体代码行，即漏洞接收器所在行。

[0063] （3）提示词：判断漏洞出发点是否存在真实的安全漏洞，如DOM XSS、开放重定向；如果存在则分析并描述用户可控的输入数据是如何通过变量传递、函数调用等过程，最终到达该漏洞触发点的；评估漏洞的风险等级，如高危、中危、低危；通过指定的结构化格式输出分析结论。

[0064] 系统将此构造好的提示词与目标代码切片一并输入到选定的大语言模型中，如GPT系列、Claude、或本地部署的专业大语言模型。大语言模型根据其内化的编程知识、安全知识和对指令的理解，输出结构化的分析结果。

[0065] 步骤S1043，生成安全审计报告。

[0066] 系统接收并解析大语言模型返回的结构化分析结果，基于此结果自动化生成一份详尽的安全审计报告。

[0067] 安全审计内容可包括：

[0068] 漏洞概述：漏洞类型、触发位置、风险等级；漏洞细节：复现步骤、触发的接收器、传递的恶意载荷；

[0069] 利用链分析：详细描述从用户输入源到漏洞接收器的完整数据流传播路径，这是报告的核心价值所在。

[0070] 修复建议：基于漏洞成因，提供具体的代码修复建议或安全配置建议。

[0071] 辅助证据：可附上触发漏洞时的页面截图、网络请求记录以及原始的增强型调用栈信息，形成完整的证据链。

[0072] 安全审计可直接用于指导开发人员进行漏洞修复，或集成到安全运营平台中完成漏洞管理闭环。

[0073] 应用示例：

[0074] 以下通过一个模拟的金融Web应用漏洞审计场景，来展示本实施例方法的具体应用过程。

[0075] 场景：某在线金融平台的产品详情页，包含复杂的用户权限校验和异步数据加载逻辑。安全团队怀疑其存在潜在的DOM型XSS漏洞，但传统扫描器未能发现。

[0076] （1）环境初始化与监控构建：审计系统启动，配置目标URL为金融产品详情页。通过中间人代理，在页面响应中注入强制可信类型的CSP元标签require-trusted-types-for 'script'。同时，通过CDP向页面注入自定义的default安全策略，该策略的createHTML方法被重写以记录堆栈并触发审计事件。此外，对location.href和location.assign进行轻量级插桩，重定向至统一的_audit_sink监控函数。

[0077] （2）代码获取与动态转换：系统拦截并获取页面加载的核心JavaScript文件finance_app.min.js。使用SWC编译器解析其AST。建立行号映射表lineRawCodeMap。识别出代码中的一个关键if语句，其原始压缩代码为：if(u.vip){d.innerHTML=a.url}。

[0078] 变量重命名与映射：对局部变量进行规范化重命名以便追踪。

[0079] 异步封装：识别出用于获取用户数据的fetch().then()链，对其进行封装，确保在then回调执行前保存调用栈快照。

[0080] 分支注入：将上述if语句转换为：if(_path_hook(u.vip, "node_fin_001”, 0)){_audit_sink(a.url, "innerHTML”, d)}。同时，记录_audit_sink调用对应还原后的原始代码d.innerHTML=a.url。

[0081] （3）强制路径探索与漏洞触发：

[0082] 第一轮扫描（默认路径）：系统首次加载页面，_path_hook函数返回u.vip的实际值。由于当前测试账户非VIP用户，条件为false，代码块未执行，传统扫描器在此轮无发现。

[0083] 第二轮扫描（强制路径）：系统重置页面状态，并通过CDP指令，将标识为"node_fin_001”的_path_hook函数返回值强制设置为true。程序随即进入原本受保护的代码块。

[0084] 监控捕获：当执行到_audit_sink(a.url, "innerHTML”, d)时，注入的自定义可信类型策略被触发。系统立即捕获到当前的错误堆栈。同时，由于a.url的赋值可能发生在某个fetch的异步回调中，系统检索并拼接了之前保存的同步栈快照，形成增强型调用栈。系统根据调用栈中的信息，从缓存中提取出转换后代码的对应片段。

[0085] （4）智能分析与报告生成：

[0086] 切片净化：系统根据映射表，将捕获的代码片段中的_path_hook和_audit_sink调用还原，得到干净的目标代码切片" / / ... 上下文代码 ... if (u.vip) { d.innerHTML =a.url;} / / ... 后续代码 ...”，并高亮d.innerHTML = a.url行。

[0087] 模型推理：将净化后的目标代码切片和结构化提示词输入大语言模型。模型分析上下文发现，u.vip来自用户会话状态，a.url来自当前页面URL的查询参数?url=，且代码数据中未见任何过滤或编码。大语言模型判定此为高危DOM XSS漏洞，并输出JSON格式的分析结果，描述了从location.search到innerHTML的传播路径。

[0088] 报告输出：系统整合所有信息，生成审计安全报告。

[0089] 报告内容包括：漏洞类型为DOM XSS；风险等级高危；触发于finance_app.min.js；复现需满足VIP条件（测试中通过路径强制实现），并传递?url=<script>alert(1)< / script> The suggested fix is ​​to perform HTML entity encoding on a.url.

[0090] As can be seen from this application example, the browser runtime-based web security auditing method of the present invention can automatically penetrate front-end logic protection, accurately trigger and capture deep vulnerabilities, and use AI capabilities to generate expert-level analysis reports, thus achieving efficient and highly accurate web security auditing.

[0091] See Figure 6 Another embodiment of the present invention provides a browser runtime-based web security auditing device 200, including a monitoring environment construction module 201, a dynamic code conversion and path control module 202, a vulnerability triggering and context capture module 203, and an intelligent analysis module 204. This browser runtime-based web security auditing device 200 is capable of executing the browser runtime-based web security auditing method in the method embodiments.

[0092] Specifically, the browser runtime-based web security auditing device 200 includes: a monitoring environment construction module 201, used to forcibly activate the browser's native trusted type mechanism in the browser runtime environment of the web page to be audited, and to perform instrumentation monitoring on at least one preset API not covered by the trusted type mechanism, so as to construct a hybrid monitoring environment; a dynamic code conversion and path control module 202, used to obtain the JavaScript code data of the web page to be audited, and inject path control functions into the control flow branch nodes of the abstract syntax tree of the JavaScript code data, so as to realize the conversion and rewriting of the JavaScript code data; a vulnerability triggering and context capture module 203, used to execute the converted and rewritten JavaScript code data in the hybrid monitoring environment, and traverse different logical branches through the path control function; when the execution of the JavaScript code data triggers the trusted type mechanism or the instrumentation monitoring, it captures the call stack information containing the vulnerability trigger point and the corresponding JavaScript code data fragment; The intelligent analysis module 204 is used to extract the target code slice containing the vulnerability trigger point from the JavaScript code data fragment based on the call stack information; input the target code slice and predefined analysis prompt words into the large language model to obtain the vulnerability analysis result generated by the large language model; and generate a security audit report based on the vulnerability analysis result.

[0093] It should be noted that the Web security auditing device 200 based on browser runtime provided in this embodiment, which can be used to execute the technical solutions of various method embodiments, has similar implementation principles and technical effects to the methods, and will not be repeated here.

[0094] Figure 7This is a schematic diagram of the structure of an electronic device 300 provided in another embodiment of the present invention. The electronic device 300 is used to implement the browser-based runtime-based web security auditing method in the method embodiment. The electronic device 300 in the embodiments of the present invention may include, but is not limited to, smartphones, tablet computers, PCs, laptops, servers, etc. Figure 7 The electronic device 300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0095] like Figure 7 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments described herein, based on a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing device 301, ROM 302, and RAM 303 are interconnected via a bus 305. An input / output (I / O) interface 304 is also connected to the bus 305.

[0096] Typically, the following devices can be connected to I / O interface 304: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0097] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A web security auditing method based on browser runtime, characterized in that, Includes the following steps: Monitoring environment construction steps: In the browser runtime environment of the web page to be audited, the browser's native trusted type mechanism is forcibly activated, and at least one preset API not covered by the trusted type mechanism is instrumented for monitoring in order to build a hybrid monitoring environment; Dynamic code transformation and path control steps: Obtain the JavaScript code data of the web page to be audited; perform abstract syntax tree parsing and transformation on the JavaScript code data; establish a mapping relationship between the transformed and rewritten code nodes and the original code lines; identify and encapsulate the asynchronous operation APIs in the JavaScript code data; the encapsulated asynchronous operation APIs are used to capture and save the current synchronous call stack information when the asynchronous task starts; inject path control functions at the identified control flow branch nodes, so that the path control functions can force the return of a preset boolean value according to the audit configuration to control the execution branch; Vulnerability Triggering and Context Capture Steps: Execute the transformed and rewritten JavaScript code data in the hybrid monitoring environment, and traverse different logical branches through the path control function; When the execution of JavaScript code triggers the trusted type mechanism or the instrumentation monitoring, the call stack containing the vulnerability trigger point and the corresponding JavaScript code data fragment are captured. If the vulnerability trigger point is located inside an asynchronous operation, the synchronous call stack pre-stored during the execution of the asynchronous operation is concatenated with the call stack containing the vulnerability trigger point to form complete cross-asynchronous call chain information. Intelligent analysis steps: Based on the call stack information, extract the target code slice containing the vulnerability trigger point from the captured JavaScript code data fragment; The target code slice and predefined analysis hints are input into a large language model to obtain vulnerability analysis results generated by the large language model, and a security audit report is generated based on the vulnerability analysis results.

2. The Web security auditing method based on browser runtime according to claim 1, characterized in that, The specific steps for constructing the monitoring environment include: By using a man-in-the-middle proxy, the web page response is intercepted and modified, and a content security policy meta tag that forces the trusted type mechanism to be enabled is injected into the HTML header of the web page; A custom security policy is injected into the browser runtime environment through the browser debugging interface. This custom security policy registers monitoring hook functions for the interface methods in the browser used to create security objects. Instrument at least one pre-defined API that is not covered by the trusted type mechanism, redirecting its logic to a unified monitoring function.

3. The Web security auditing method based on browser runtime according to claim 1, characterized in that, The intelligent analysis steps specifically include: Based on the call stack information, locate the vulnerability trigger point and extract the context code of the vulnerability trigger point as the initial slice; By utilizing the mapping relationship between the transformed and rewritten code nodes and the original code lines, the auxiliary code inserted in the initial slice due to the transformation and rewriting is removed, restoring the original code semantics, and the target code slice is obtained. The target code slice and the prompt words are input into the large language model to obtain its output structured analysis results; the structured analysis results include at least the vulnerability determination and the propagation path of user-controllable input.

4. A web security auditing device based on browser runtime, characterized in that, include: The monitoring environment building module is used to forcibly activate the browser's native trusted type mechanism in the browser runtime environment of the web page to be audited, and to instrument at least one preset API that is not covered by the trusted type mechanism to build a hybrid monitoring environment. The dynamic code transformation and path control module is used to acquire JavaScript code data of the web page to be audited, perform abstract syntax tree parsing and transformation on the JavaScript code data, and establish a mapping relationship between the transformed and rewritten code nodes and the original code lines; identify asynchronous operation APIs in the JavaScript code data and encapsulate them. The encapsulated asynchronous operation APIs are used to capture and save the current synchronous call stack information when the asynchronous task starts; inject path control functions at the identified control flow branch nodes, so that the path control functions can force the return of a preset boolean value according to the audit configuration to control the execution branch; The vulnerability triggering and context capture module is used to execute transformed and rewritten JavaScript code data in the hybrid monitoring environment and traverse different logical branches through the path control function. When the execution of JavaScript code triggers the trusted type mechanism or the instrumentation monitoring, the call stack containing the vulnerability trigger point and the corresponding JavaScript code data fragment are captured. If the vulnerability trigger point is located inside an asynchronous operation, the synchronous call stack pre-stored during the execution of the asynchronous operation is concatenated with the call stack containing the vulnerability trigger point to form complete cross-asynchronous call chain information. The intelligent analysis module is used to extract the target code slice containing the vulnerability trigger point from the captured JavaScript code data fragment based on the call stack information; The target code slice and predefined analysis hints are input into a large language model to obtain vulnerability analysis results generated by the large language model, and a security audit report is generated based on the vulnerability analysis results.

5. A web security auditing device based on browser runtime according to claim 4, characterized in that, The monitoring environment construction module is specifically used for: By using a man-in-the-middle proxy, the web page response is intercepted and modified, and a content security policy meta tag that forces the trusted type mechanism to be enabled is injected into the HTML header of the web page; A custom security policy is injected into the browser runtime environment through the browser debugging interface. This custom security policy registers monitoring hook functions for the interface methods in the browser used to create security objects. Instrument at least one pre-defined API that is not covered by the trusted type mechanism, redirecting its logic to a unified monitoring function.

6. A web security auditing device based on browser runtime according to claim 4, characterized in that, The intelligent analysis module is specifically used for: Based on the call stack information, locate the vulnerability trigger point and extract the context code of the vulnerability trigger point as the initial slice; By utilizing the mapping relationship between the transformed and rewritten code nodes and the original code lines, the auxiliary code inserted in the initial slice due to the transformation and rewriting is removed, restoring the original code semantics, and the target code slice is obtained. The target code slice and prompt words are input into the large language model to obtain its output structured analysis results; The structured analysis results include at least vulnerability determination and the propagation path of user-controlled input.

Images