Checking rule processing method and processing device

Abstract

The invention provides an inspection rule processing method and device, and the method comprises the steps: obtaining a to-be-detected code and / or related information of the to-be-detected code, the related information of the to-be-detected code comprises at least one of the following items: a programming language of the to-be-detected code, a development framework of the to-be-detected code, a deployment form of the to-be-detected code, a business category of the to-be-detected code, a tripartite library used by the to-be-detected code, a coding style of the to-be-detected code or description information of a target item to which the to-be-detected code belongs; according to the to-be-detected code and / or the related information of the to-be-detected code, a target rule set is determined from a static analysis rule base, the target rule set comprises one or more candidate check rules, and the one or more candidate check rules are used for conducting static analysis on the to-be-detected code; and controlling to display the target rule set. According to the scheme, the efficiency of static analysis can be improved.

Description

Inspection rule processing method and processing device

[0001] This application claims priority to the Russian Federation patent application with application number 2023122167 filed with the State Intellectual Property Office of the Russian Federation on August 25, 2023, and priority to the Russian Federation patent application entitled "A method and system for recommending inspection rules", the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of testing technology, and more specifically, to a method and device for processing inspection rules. Background Art

[0003] Static application security testing (SAST) primarily relies on static analysis to examine source code to identify vulnerable security vulnerabilities and code defects. It is a white-box code review technology. SAST detects problems in code without running it, helping users quickly identify issues before code deployment, effectively reducing vulnerabilities and security risks.

[0004] The SAST service provides inspection capabilities through a series of inspection rules. These rules usually implement defect inspection by inspecting abstract representations of programs such as the abstract syntax tree (AST), control flow graph (CFG), or data flow graph (DFG). Currently, the SAST service provides a large number of inspection rules for various languages. Some SAST services can also support user-defined inspection rules and the introduction of inspection rules provided by open source, which can provide powerful inspection capabilities. However, the above solution also leads to a large increase in the number of inspection rules. It is difficult for users to effectively select rules from a large number of inspection rules, which seriously affects the analysis efficiency.

[0005] Therefore, how to improve the analysis efficiency of SAST has become an urgent problem to be solved.

[0006] Summary of the Invention

[0007] The present application provides a method and apparatus for processing inspection rules, which are beneficial to improving the analysis efficiency of SAST.

[0008] In a first aspect, a method for processing inspection rules is provided, comprising: obtaining the code to be inspected and / or relevant information of the code to be inspected, the relevant information of the code to be inspected including at least one of the following: the programming language of the code to be inspected, the development framework of the code to be inspected, the deployment form of the code to be inspected, the business scope of the code to be inspected, the third-party library used by the code to be inspected, the coding style of the code to be inspected, or the description information of the target project to which the code to be inspected belongs; determining a target rule set from a static analysis rule library based on the code to be inspected and / or relevant information of the code to be inspected, the target rule set including one or more candidate inspection rules, the one or more candidate inspection rules being used to perform static analysis on the code to be inspected; and controlling the display of the target rule set.

[0009] According to the scheme of the embodiment of the present application, the target rule set is determined based on at least one of the code to be detected and the relevant information of the code to be detected, that is, the target rule set is determined based on the characteristics of the project, and the inspection rules related to the code to be detected are screened out, so that the inspection rules are more targeted, which is conducive to achieving a comprehensive inspection of the code to be detected, and at the same time is conducive to avoiding rules that are irrelevant to the code to be detected, thereby helping to improve the efficiency of static analysis and reduce the waste of resources. In the scheme of the embodiment of the present application, different inspection rules can be recommended for different users or for different projects, providing convenience for users to select suitable rules for static analysis, thereby helping to improve the efficiency of inspection and thus improve user experience.

[0010] At the same time, the solution of the embodiment of the present application is conducive to achieving efficient reuse of existing inspection rules, avoiding repeated development of inspection rules, and thus reducing resource waste.

[0011] The deployment form of the code to be tested refers to the way the code to be tested is deployed and used. For example, the deployment form can be divided into virtual machines, containers, or bare metal. Alternatively, the deployment form can be divided into microservices or local applications.

[0012] For example, the coding style may include a naming style, a commenting style, or a formatting style.

[0013] Optionally, the description information of the target project may be indicated by a readme file of the target project.

[0014] In combination with the first aspect, in certain implementations of the first aspect, determining a target rule set from a static analysis rule base based on the code to be detected and / or relevant information of the code to be detected includes: determining a first subset of the target rule set from the static analysis rule base based on the similarity between the target project and multiple candidate projects, the similarity between the target project and the multiple candidate projects is determined based on the similarity between the code to be detected and the code of at least one first candidate project, and / or the similarity between the relevant information of the code to be detected and the relevant information of the code of at least one second candidate project, the multiple candidate projects include at least one first candidate project, or the multiple candidate projects include at least one second candidate project.

[0015] Exemplarily, the similarity between the target project and the plurality of candidate projects may be the similarity between the code to be detected and the codes of the plurality of first candidate projects.

[0016] Alternatively, the similarity between the target item and the plurality of candidate items may be the similarity between the relevant information of the code to be detected and the relevant information of the plurality of second candidate items.

[0017] Alternatively, the similarity between the target item and the plurality of candidate items may be based on the similarity between the relevant information of the code to be detected and the relevant information of the code of the at least one second candidate item, and the similarity between the code to be detected and the code of the at least one first candidate item.

[0018] In the scheme of the embodiment of the present application, the first subset of the target rule set can be determined from the detection rules selected by the candidate projects based on the similarity between the projects, which is conducive to the reuse of inspection rules for similar projects, and can further match the code to be detected, thereby providing inspection rules suitable for the code to be detected, which is conducive to achieving a comprehensive inspection of the code to be detected, avoiding missing key rules, and at the same time helping to improve the accuracy of the inspection results, thereby helping to reduce related security issues of the project.

[0019] In combination with the first aspect, in certain implementations of the first aspect, a first subset of the target rule set is determined from a static analysis rule base based on the similarity between the target project and multiple candidate projects, including: determining the first subset based on the inspection rules selected for N candidate projects among the multiple candidate projects that have the highest similarity with the target project, the inspection rules selected for the N candidate projects are from the static analysis rule base, and N is a positive integer.

[0020] In combination with the first aspect, in certain implementations of the first aspect, the processing method also includes: embedding a representation of the code to be detected to obtain a representation vector of the code to be detected; determining the similarity between the code to be detected and the codes of multiple first candidate projects based on the similarity between the representation vector of the code to be detected and the representation vectors of the codes of multiple first candidate projects; or, the description information of the target project is indicated by the readme file of the target project, and the processing method also includes: embedding a representation of the readme file of the target project to obtain a representation vector of the readme file of the target project; determining the similarity between the relevant information of the code to be detected and the relevant information of the codes of multiple second candidate projects based on the similarity between the representation vector of the readme file of the target project and the representation vectors of the readme files of multiple second candidate projects.

[0021] For example, the embedded representation can be achieved through a machine learning model.

[0022] When calculating similarity, the code large model can be used for embedded representation, which is conducive to improving the accuracy of similarity calculation and further improving the accuracy of recommendation rules.

[0023] In combination with the first aspect, in certain implementations of the first aspect, determining a target rule set from a static analysis rule base based on the code to be detected and / or relevant information of the code to be detected includes at least one of the following: obtaining inspection rules corresponding to a third-party library used by the code to be detected from the static analysis rule base; determining a second subset of the target rule set based on the inspection rules corresponding to the third-party library used by the code to be detected; obtaining inspection rules corresponding to the coding style of the code to be detected from the static analysis rule base; determining a third subset of the target rule set based on the inspection rules corresponding to the coding style of the code to be detected; or obtaining inspection rules corresponding to the programming language of the code to be detected from the static analysis rule base; and determining a fourth subset of the target rule set based on the inspection rules corresponding to the programming language of the code to be detected.

[0024] In the solution of the embodiment of the present application, by analyzing the third-party libraries used in the code to be tested, corresponding inspection rules are provided, which is conducive to ensuring the safe use of the third-party libraries in the code to be tested. By analyzing the coding style of the code to be tested, corresponding inspection rules are provided, which is conducive to ensuring that the code to be tested complies with the corresponding coding standards.

[0025] In conjunction with the first aspect, in certain implementations of the first aspect, the relevant information of the code to be detected may include the coding style of the code to be detected. The processing method may include: traversing the AST of the code to be detected through static inspection to determine the coding style of the code to be detected.

[0026] In an embodiment of the present application, static inspection can be combined to determine the characteristics of the project (for example, coding style), and rule recommendations can be made based on the characteristics of the project.

[0027] In combination with the first aspect, in certain implementations of the first aspect, the processing method further includes: obtaining a package management file of the code to be detected; and analyzing the package management file to determine a third-party library used by the code to be detected.

[0028] In combination with the first aspect, in certain implementations of the first aspect, a target rule set is determined from a static analysis rule base based on the code to be detected and / or related information of the code to be detected, including: scanning the code to be detected according to a preset rule set to determine candidate problems in the code to be detected; and determining a fifth subset of the target rule set based on the inspection rules that expose the candidate problems in the preset rule set.

[0029] In the embodiment of the present application, the code to be checked can be pre-scanned to find problems in the current project. The inspection rules that reveal the problems are recommended to the user to provide more effective inspection rules for the user, which is conducive to avoiding missing important inspection rules.

[0030] In combination with the first aspect, in certain implementations of the first aspect, the fifth subset of the target rule set is determined based on the inspection rules that expose candidate problems in the preset rule set, including: controlling the display of candidate problems; obtaining feedback information of the candidate problems, the feedback information of the candidate problems indicating the real problems in the candidate problems; and determining the fifth subset based on the inspection rules that expose the real problems in the preset rule set.

[0031] In combination with the first aspect, in certain implementations of the first aspect, the processing method also includes: when any two subsets among the first subset, the second subset, the third subset, the fourth subset and the fifth subset have an intersection, deduplication screening is performed on the subsets with an intersection to obtain the target rule set.

[0032] By adopting the solution of the embodiment of the present application, each subset can be deduplicated and screened, which is conducive to reducing redundant rules and repeated analysis, thereby reducing waste of resources, reducing inspection time, and improving user experience.

[0033] In combination with the first aspect, in some implementations of the first aspect, the processing method further includes: generating a configuration for a target inspection rule to be configured in the target rule set according to the code to be detected.

[0034] In the solution of the embodiment of this application, rule configurations can be automatically generated, improving the efficiency of rule usage and helping to reduce false positives and missed negatives caused by users' unfamiliarity with the inspection rules, thereby improving the accuracy of analysis. It also lowers the user threshold, allowing non-security experts to use some advanced inspection capabilities, thereby improving the user experience. Furthermore, generating rule configurations based on projects helps avoid situations where key rules are not configured, reducing security issues related to project areas.

[0035] In combination with the first aspect, in some implementations of the first aspect, the processing method further includes: obtaining feedback information of the target rule set, where the feedback information of the target rule set is used to indicate the selected target inspection rule.

[0036] In a second aspect, a device for processing inspection rules is provided, including: a first acquisition module, used to obtain the code to be inspected and / or relevant information of the code to be inspected, the relevant information of the code to be inspected including at least one of the following: the programming language of the code to be inspected, the development framework of the code to be inspected, the deployment form of the code to be inspected, the business scope of the code to be inspected, the third-party library used by the code to be inspected, the coding style of the code to be inspected, the comments of the code to be inspected, or the description information of the target project to which the code to be inspected belongs; a processing module, used to: determine a target rule set from a static analysis rule library based on the code to be inspected and / or relevant information of the code to be inspected, the target rule set including one or more candidate inspection rules, the one or more candidate inspection rules being used to perform static analysis on the code to be inspected; and control the display of the target rule set.

[0037] In combination with the second aspect, in certain implementations of the second aspect, the processing module is specifically used to: determine a first subset of the target rule set from the static analysis rule base based on the similarity between the target project and multiple candidate projects, the similarity between the target project and the multiple candidate projects is determined based on the similarity between the code to be detected and the code of at least one first candidate project, and / or, the similarity between the relevant information of the code to be detected and the relevant information of the code of at least one second candidate project, the multiple candidate projects include at least one first candidate project, or the multiple candidate projects include at least one second candidate project.

[0038] In combination with the second aspect, in certain implementations of the second aspect, the processing module is specifically used to: determine a first subset based on the inspection rules selected for N candidate projects with the highest similarity to the target project among multiple candidate projects, the inspection rules selected for the N candidate projects come from a static analysis rule base, and N is a positive integer.

[0039] In combination with the second aspect, in certain implementations of the second aspect, the processing module is specifically used to: embed a representation of the code to be detected to obtain a representation vector of the code to be detected; determine the similarity between the code to be detected and the codes of multiple first candidate projects based on the similarity between the representation vector of the code to be detected and the representation vectors of the codes of multiple first candidate projects; or, the description information of the target project is indicated by the readme file of the target project, and the processing module is specifically used to: embed a representation of the readme file of the target project to obtain a representation vector of the readme file of the target project; determine the similarity between the relevant information of the code to be detected and the relevant information of the codes of multiple second candidate projects based on the similarity between the representation vector of the readme file of the target project and the representation vectors of the readme files of multiple second candidate projects.

[0040] In combination with the second aspect, in certain implementations of the second aspect, the processing module is specifically used for at least one of the following: obtaining the inspection rules corresponding to the third-party library used by the code to be detected from the static analysis rule base; determining the second subset of the target rule set based on the inspection rules corresponding to the third-party library used by the code to be detected; obtaining the inspection rules corresponding to the coding style of the code to be detected from the static analysis rule base; determining the third subset of the target rule set based on the inspection rules corresponding to the coding style of the code to be detected; or obtaining the inspection rules corresponding to the programming language of the code to be detected from the static analysis rule base; and determining the fourth subset of the target rule set based on the inspection rules corresponding to the programming language of the code to be detected.

[0041] In combination with the second aspect, in some implementations of the second aspect, the processing device further includes: a second acquisition module, used to: obtain a package management file of the code to be detected; and analyze the package management file to determine the third-party library used by the code to be detected.

[0042] In combination with the second aspect, in certain implementations of the second aspect, the processing module is specifically used to: scan the code to be detected according to a preset rule set to determine candidate problems in the code to be detected; and determine the fifth subset of the target rule set based on the inspection rules that expose the candidate problems in the preset rule set.

[0043] In combination with the second aspect, in certain implementations of the second aspect, the processing module is specifically used to: control the display of candidate questions; obtain feedback information of the candidate questions, the feedback information of the candidate questions indicating the real problems in the candidate questions; and determine the fifth subset based on the inspection rules that expose the real problems in the preset rule set.

[0044] In combination with the second aspect, in some implementations of the second aspect, the processing device further includes: a configuration module, configured to generate a configuration for a target inspection rule to be configured in a target rule set according to the code to be detected.

[0045] In combination with the second aspect, in some implementations of the second aspect, the processing device further includes: a third acquisition module, configured to acquire feedback information of the target rule set, where the feedback information of the target rule set is used to indicate the selected target inspection rule.

[0046] It should be understood that the expansion, limitation, explanation and description of the relevant content in the above-mentioned first aspect also apply to the same content in the second aspect.

[0047] In a third aspect, a computing device cluster is provided, comprising at least one computing device, each computing device including a processor and a memory. The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster performs the method of the first aspect and any implementation of the first aspect.

[0048] In a fourth aspect, a computer-readable medium is provided, comprising computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method in the first aspect and any one of the implementations of the first aspect.

[0049] In a fifth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the method in the above-mentioned first aspect and any one of the implementations of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 is a schematic diagram of a SAST service architecture.

[0051] FIG. 2 is a schematic diagram of a list of various rule sets.

[0052] FIG3 is a schematic flowchart of a method for processing an inspection rule according to an embodiment of the present application.

[0053] FIG4 is a schematic flowchart of another method for processing inspection rules according to an embodiment of the present application.

[0054] FIG5 is a schematic diagram of an example processing flow of an inspection rule according to an embodiment of the present application.

[0055] Figure 6 is a schematic diagram of the processing flow of inspection rules in a SAST cloud service platform in an embodiment of the present application.

[0056] FIG. 7 is a schematic diagram of a processing flow of an inspection rule in an IDE according to an embodiment of the present application.

[0057] FIG8 is a schematic block diagram of a device for processing inspection rules according to an embodiment of the present application.

[0058] FIG9 is a schematic block diagram of a computing device according to an embodiment of the present application.

[0059] FIG10 is a schematic block diagram of a computing device cluster according to an embodiment of the present application.

[0060] FIG11 is a schematic block diagram of another computing device cluster according to an embodiment of the present application. DETAILED DESCRIPTION

[0061] The technical solution in this application will be described below with reference to the accompanying drawings.

[0062] The terms used in the following embodiments are for the purpose of describing specific embodiments only and are not intended to limit the present application. As used in the specification and appended claims of this application, the singular expressions "a," "an," and "the" are intended to include expressions such as "one or more," unless the context clearly indicates otherwise. It should also be understood that in the following embodiments of this application, "at least one," "at least one," and "one or more" refer to one, two, or more. "First," "second," and various numerical designations are merely distinctions made for ease of description and are not intended to limit the scope of the embodiments of this application. "And / or" is used to describe the corresponding relationship between corresponding objects, indicating that three relationships can exist. For example, "A and / or B" can mean: only A exists, only B exists, and both A and B exist, where A and B can be singular or plural. The character " / " generally indicates that the objects associated with each other are in an "or" relationship. The order of the sequence numbers of the processes below does not imply a sequence of execution. The execution order of each process should be determined by its function and inherent logic and should not constitute any limitation on the implementation process of the embodiments of this application. For example, in the embodiments of the present application, words such as "301", "401", and "501" are merely identifiers for the convenience of description and do not limit the order of executing the steps.

[0063] References to "one embodiment" or "some embodiments" in this specification mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. In this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described in this application as "exemplary" or "for example" should not be interpreted as being more preferred or more advantageous than other embodiments or design. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete way. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized. In the embodiments of the present application, descriptions such as "when...", "in the case of...", "if" and "if" all mean that the device will perform corresponding processing under certain objective circumstances, and do not limit the time, nor do they require the device to perform judgment actions when implemented, nor do they mean that there are other limitations.

[0064] In this application, "used to indicate" can include being used for direct indication and being used for indirect indication. When describing that a certain indication information is used to indicate A, it can include that the indication information directly indicates A or indirectly indicates A, and it does not mean that the indication information must carry A.

[0065] In order to help those skilled in the art better understand the technical solutions of the present application, some terms that may be involved in the embodiments of the present application are explained below.

[0066] 1. Integrated development environment (IDE):

[0067] IDE is an application used to provide a program development environment, generally including tools such as code editors, compilers, debuggers, and graphical user interfaces. It is an integrated development software service suite that integrates code writing, analysis, compilation, debugging, and other functions.

[0068] IDEs can include local IDEs and web IDEs. Local IDEs can also be called desktop IDEs. Local IDEs are installed in the user's local development operating environment. For example, the local development operating environment can be a terminal device, such as a desktop computer, laptop, or mobile phone. Web IDEs refer to online IDE services, including an IDE front-end and an IDE back-end. The IDE back-end runs in a remote environment. For example, the remote environment can be a cloud server, providing the IDE to the user in the form of a cloud service.

[0069] 2. Check Engine:

[0070] An inspection engine is a program that implements inspection capabilities.

[0071] 3. Source of taint:

[0072] Tainted sources are the starting point of sensitive data.

[0073] 4. Sink:

[0074] Taint sinks are places where sensitive data can be exploited.

[0075] 5. Third-party library:

[0076] Third-party libraries, also known as external libraries, are reusable code libraries developed by organizations or individuals and released to the public. These libraries typically provide pre-written code for specific or complex functions, allowing developers to use them directly without having to write all the code from scratch.

[0077] SAST, a white-box code inspection technology, primarily relies on static analysis to inspect source code to identify vulnerable security vulnerabilities and code defects. SAST detects problems in code without requiring code execution, helping users quickly identify issues before code deployment, effectively reducing vulnerabilities and avoiding security risks.

[0078] FIG1 shows a schematic diagram of a SAST service architecture.

[0079] As shown in Figure 1, the SAST service architecture can include a SAST service layer, an engine adaptation and scheduling layer, and an inspection engine. SAST service providers provide inspection capabilities through a large number of inspection rules in each inspection engine. These inspection rules usually implement code inspection through abstract representations of programs such as AST, CFG, and DFG. In addition to supporting inspection engines developed by the platform itself, some SAST service platforms can also support access to other inspection engines that comply with the intermediate protocol. In addition, some SAST service platforms also provide domain-specific languages ​​(DSL) for code inspection, which greatly improves the flexibility and ease of use of code inspection and reduces the difficulty of user-defined inspection rules.

[0080] SAST service platforms provide a large number of inspection rules for various languages. Some SAST services also support user-defined inspection rules and the import of open source inspection rules, providing powerful inspection capabilities. However, the above solutions also lead to a significant increase in the number of inspection rules.

[0081] FIG2 is a schematic diagram showing a list of various rule sets.

[0082] As shown in Figure 2, the SAST service platform can organize rule sets based on programming languages, application scenarios, or industry standards. The list of rule sets shown in Figure 2 can be provided to users for selection.

[0083] When users select their own rule sets, the sheer number of check rules makes it difficult to effectively select them, resulting in a waste of resources. Furthermore, these check rules may contain redundant rules. Repeatedly analyzing code using these redundant rules wastes resources and affects analysis efficiency.

[0084] In view of this, an embodiment of the present application provides a method for processing inspection rules to implement recommendation of inspection rules, which is conducive to improving analysis efficiency.

[0085] FIG3 illustrates a method for processing inspection rules according to an embodiment of the present application. The method illustrated in FIG3 may be executed by an inspection rule processing device. The inspection rule processing device may be used to provide an inspection rule recommendation function. The inspection rule may be used for static analysis.

[0086] In some possible implementations, the processing device for checking rules may be a device for providing SAST services, or a functional module of a device for providing SAST services.

[0087] In some possible implementations, the inspection rule processing device can cooperate with the device for providing SAST services to provide inspection rules. For example, the inspection rule processing device can be a device for providing a DSL, or a functional module of a device for providing a DSL. The DSL is applied in the field of static analysis.

[0088] The following is an exemplary description of the processing device for checking rules.

[0089] Exemplarily, the processing device for checking rules may be a development tool or a functional module of a development tool. The SAST service may be provided by the development tool. For example, the processing device for checking rules may be an IDE. IDEs may include desktop IDEs and WebIDEs. The backend of the WebIDE runs in a remote environment. For example, the remote environment may be a cloud server. For another example, the processing device for checking rules may be a command-line interface (CLI) tool.

[0090] Exemplarily, the processing device of the test case can be deployed in the cloud management platform, that is, the method 300 can be applied to the cloud management platform. The processing device of the inspection rule can be an independent product (such as a cloud platform application, service or microservice, etc.), or it can be a functional module in the product. For example, the processing device of the test case can be deployed on the SAST cloud service platform. The SAST cloud service platform can be used to provide SAST services, that is, to provide SAST services in the form of cloud services. The SAST service provided by the SAST cloud service platform can also be called SAST cloud service. The SAST cloud service platform is provided with online services by the cloud management platform, and the back-end runs in the cloud management platform. The cloud management platform is used to manage the infrastructure that provides multiple cloud services. The infrastructure may include multiple cloud data centers, and each cloud data center may include multiple servers. Each server includes cloud service resources to provide corresponding services to users.

[0091] For ease of description, the embodiments of the present application are mainly illustrated by taking the execution of method 300 by the SAST cloud service platform or IDE as an example, and do not limit the solutions of the embodiments of the present application.

[0092] As shown in FIG3 , method 300 includes the following steps.

[0093] 310. Obtain the code to be detected and / or related information of the code to be detected.

[0094] The relevant information of the code to be tested includes at least one of the following: the programming language of the code to be tested, the development framework of the code to be tested, the deployment form of the code to be tested, the business scope of the code to be tested, the coding style of the code to be tested, the third-party libraries used by the code to be tested, or the description information of the target project to which the code to be tested belongs, etc.

[0095] 320. Determine a target rule set from a static analysis rule library based on the code to be detected and / or related information of the code to be detected. The target rule set includes one or more candidate checking rules, which are used to perform static analysis on the code to be detected.

[0096] The static analysis rule base includes a plurality of checking rules, which are used to perform static analysis on program codes.

[0097] In the embodiment of the present application, “checking rules” may also be referred to as “rules” for short.

[0098] According to the solution of the embodiment of the present application, the target rule set is determined based on at least one of the code to be detected and the relevant information of the code to be detected, that is, the target rule set is determined based on the characteristics of the project, and the inspection rules related to the code to be detected are screened out, making the inspection rules more targeted, which is conducive to achieving a comprehensive inspection of the code to be detected, and at the same time is conducive to avoiding rules that are irrelevant to the code to be detected, thereby facilitating improving the efficiency of static analysis and reducing waste of resources. In the solution of the embodiment of the present application, different inspection rules can be recommended for different users or for different projects.

[0099] At the same time, the solution of the embodiment of the present application is conducive to achieving efficient reuse of existing inspection rules, avoiding repeated development of inspection rules, and thus reducing resource waste.

[0100] Further, optionally, method 300 may further include step 330 .

[0101] 330, controlling the display of the target rule set.

[0102] The target rule set is provided to the user.

[0103] Target rule sets can be recommended to users for their selection.

[0104] Exemplarily, step 330 may include: displaying the target rule set through a user interface.

[0105] In the solution of the embodiment of the present application, the target rule set can be recommended to the user for selection. The rules in the target rule set are all rules related to the code to be detected, that is, on-demand recommendations are made based on the characteristics of the project itself. This can facilitate users to select suitable rules for static analysis, thereby improving the efficiency of inspection and thus improving user experience.

[0106] At the same time, this solution is conducive to the efficient reuse of existing inspection rules, improves the utilization rate of developed rules, enhances the value of existing inspection capabilities, and helps reduce the repeated development of existing inspection rules, thereby reducing resource waste.

[0107] The recommended rules provided by this solution can also serve as a reference for users to develop inspection rules, which is conducive to improving the efficiency of inspection rule development.

[0108] Specifically, in some scenarios, for example, in the process of developing inspection rules, the user can obtain multiple target inspection rules based on the code to be detected and / or relevant information of the code to be detected, and display the obtained multiple target inspection rules to the user. The multiple target inspection rules can provide a reference for the user. If the user determines that there are inspection rules that meet the requirements in the target rule set, the corresponding inspection rules can be directly selected from the target rule set, and the corresponding inspection rules can be used as the basis for static analysis. Alternatively, the user only needs to modify some rules in the target rule set or add some rules on the basis of the target rule set, and use it for static analysis without the need to write inspection rules for the entire project. The solution of the embodiment of the present application greatly reduces the development time of inspection rules, lowers the usage threshold, improves development efficiency, and is conducive to improving user experience. For example, in the DSL development process, the user can modify some DSL rules or supplement some DSL rules based on the target rule set to complete the DSL development required by the user.

[0109] Exemplarily, the code to be detected may be a source code.

[0110] For example, the programming language of the code to be detected may include Java, Python, or C, etc. The embodiment of the present application does not limit the type of programming language.

[0111] The development framework and deployment form of the code to be tested can also be collectively referred to as the ecology of the code to be tested, that is, the development ecology of the code to be tested.

[0112] In other words, the relevant information of the code to be detected may also include the ecology of the code to be detected.

[0113] The development ecosystem can include the third-party software system used and the deployment and usage methods.

[0114] Third-party software can also be called third-party libraries.

[0115] For example, Spring's third-party software system can be considered an ecosystem, consisting of an open source framework and tool set for building Java applications.

[0116] The deployment form of the code to be tested refers to how the code to be tested is deployed and used. The deployment form of the code to be tested is the deployment form of the target project to which the code to be tested belongs. The specific division of deployment forms can be set as needed.

[0117] For example, the deployment form can be divided into virtual machines, containers, or bare metal, etc.

[0118] For example, the target project can be run in a container. The container deployment form can be considered as an ecosystem type.

[0119] For another example, the target project can be run on bare metal. Bare metal deployment can be considered an ecosystem type.

[0120] Alternatively, the deployment can be divided into microservices or local applications.

[0121] For example, the target project can be deployed as a microservice, that is, it can be provided to users in the form of microservices. The form of microservice deployment can be regarded as an ecosystem type.

[0122] For another example, the target project can be deployed as a local application, that is, provided to users in the form of a local application. The local deployment form can be regarded as an ecosystem type.

[0123] The technology stacks used in different ecosystems may vary greatly.

[0124] For example, the coding style may include a naming style, a commenting style, or a formatting style.

[0125] The description information of the target project is a description of the target project.

[0126] Illustratively, the description information of the target project may indicate at least one of the following: the business scope handled by the target project, the structure of the target project, or the target operating environment.

[0127] The business scope of the target project can also be understood as the application area of ​​the target project. For example, if the target project is used for code review, then the business scope of the target project can include code review. Another example is that if the target project is used for shopping transactions, then the business scope of the target project can include shopping transactions.

[0128] Optionally, the description information of the target project may be indicated by a readme file of the target project.

[0129] In step 310, the code to be detected and the related information of the code to be detected may be obtained in the same manner or in a different manner.

[0130] As a possible example, obtaining the code to be detected may include obtaining an input code to be detected.

[0131] The code to be detected may be input by a user.

[0132] Exemplarily, a processing device (such as an IDE) for checking rules may obtain input code in real time and use it as the code to be checked.

[0133] Exemplarily, the processing device for checking rules may obtain a modified code file and use the code in the code file as the code to be detected.

[0134] For example, the code file may be a code file submitted to a local code repository. After the user's code changes are committed, the code in the code file may be used as the code to be tested.

[0135] For another example, the code file may be a code file stored in a local temporary storage area.

[0136] For another example, the code file may be a code file pushed to a remote code repository.

[0137] Exemplarily, the processing device for checking rules may obtain a modified code file and use the incremental code therein as the code to be detected.

[0138] In this way, when the code changes, the target rule set can be updated in a timely manner, which is conducive to continuously providing matching inspection rules for the project, thereby improving the accuracy of the inspection.

[0139] The above is only an example. The method for obtaining the code to be detected can be adjusted according to the application scenario. The embodiment of the present application does not limit the method for obtaining the code to be detected.

[0140] In the case that the relevant information of the code to be detected includes multiple pieces of information, the ways of obtaining the multiple pieces of information may be the same or different.

[0141] As a possible example, obtaining relevant information of the code to be detected may include: obtaining relevant information of the input code to be detected.

[0142] The relevant information of the code to be detected may be input by the user.

[0143] For example, the relevant information of the code to be detected may include the programming language of the code to be detected. The programming language of the code to be detected can be input by the user. For example, the user is provided with labels of multiple candidate programming languages, and the user selects the corresponding programming language.

[0144] Exemplarily, the relevant information about the code to be tested may include the ecosystem of the code to be tested. The ecosystem of the code to be tested can be input by the user. For example, as shown in Figure 6 or Figure 7, the user is provided with multiple candidate ecosystem labels, and the user selects the corresponding ecosystem. For example, as shown in Figure 5, the candidate ecosystem labels may include: spring, security, or java, etc.

[0145] As a possible example, obtaining relevant information of the code to be detected may include: analyzing the code to be detected or a file related to the code to be detected to obtain relevant information of the code to be detected.

[0146] Alternatively, step 310 may also be understood as: obtaining the code to be detected and / or files related to the code to be detected.

[0147] Optionally, the files related to the code to be detected may include at least one of the following: a readme file of the target project or a package management file of the code to be detected.

[0148] The readme file of the target project can be used to indicate the description information of the target project.

[0149] Exemplarily, the relevant information of the code to be detected may include the coding style of the code to be detected. For example, the coding style of the code to be detected is determined by traversing the AST of the code to be detected through static inspection. For example, if the proportion of code in the code to be detected that conforms to a certain coding style is greater than or equal to a set threshold, then the coding style can be used as the coding style of the code to be detected.

[0150] In an embodiment of the present application, static inspection can be combined to determine the characteristics of the project (for example, coding style), and rule recommendations can be made based on the characteristics of the project.

[0151] Exemplarily, the relevant information of the code to be detected may include a third-party library used by the code to be detected.

[0152] Optionally, the method 300 may further include: analyzing the package management file of the code to be detected to determine the third-party libraries used by the code to be detected, or in other words, the third-party software used by the user.

[0153] Exemplarily, the relevant information of the code to be detected may include the deployment form of the code to be detected. For example, the deployment form of the code to be detected may be determined by analyzing the code to be detected.

[0154] Exemplarily, the relevant information of the code to be detected may include the business scope of the code to be detected. For example, the business scope of the code to be detected may be determined by analyzing the code to be detected.

[0155] It should be understood that the above is merely an example and does not limit the method for obtaining the relevant information of the code. For example, the programming language of the code to be detected can also be obtained by analyzing the code to be detected. The method for obtaining the relevant information of the code to be detected can be adjusted according to the application scenario, and the embodiments of the present application do not limit this.

[0156] Optionally, step 320 may include step 321 (not shown in the figure).

[0157] 321 , determining a first subset of a target rule set from a static analysis rule base according to similarities between the target item and multiple candidate items.

[0158] In other words, the first subset of the target rule set is determined from the check rules selected by the multiple candidate items based on the similarity between the target item and the multiple candidate items. The check rules selected by the multiple candidate items are from the static analysis rule base.

[0159] The candidate project may be a mature project that has been selected through the inspection rules.

[0160] For a candidate item, the similarity between the target item and the candidate item can be determined based on at least one of the following: the similarity between the code to be detected and the code of the candidate item, or the similarity between the relevant information of the code to be detected and the relevant information of the code of the candidate item.

[0161] The information related to the code of the candidate item may also be referred to as the relevant information of the candidate item.

[0162] For multiple candidate items, the similarity between the target item and the multiple candidate items can be determined based on the similarity between the code to be detected and the code of at least one first candidate item, and / or the similarity between the relevant information of the code to be detected and the relevant information of the code of at least one second candidate item.

[0163] In other words, step 321 may include any of the following:

[0164] Determining a first subset of the target rule set from rules selected for the at least one first candidate item and rules selected for the at least one second candidate item based on similarity between the code to be detected and the code of the at least one first candidate item, and similarity between relevant information of the code to be detected and relevant information of the code of the at least one second candidate item;

[0165] determining a first subset of the target rule set from the rules selected by the plurality of first candidate items according to the similarity between the code to be detected and the codes of the plurality of first candidate items; or

[0166] A first subset of the target rule set is determined from the rules selected by the plurality of second candidate items according to similarities between the relevant information of the code to be detected and the relevant information of the codes of the plurality of second candidate items.

[0167] The multiple candidate items include a first candidate item and a second candidate item. The "first" in the "first candidate item" is only used to illustrate that the code of the first candidate item can be used to determine the similarity between it and the code to be detected, and has no other limiting effect. In other words, if the similarity between the code of a candidate item and the code to be detected is used to determine the first subset, then the candidate item can be regarded as the first candidate item. The "second" in the "second candidate item" is only used to illustrate that the relevant information of the code of the second candidate item can be used to determine the similarity between it and the relevant information of the code to be detected, and has no other limiting effect. In other words, if the similarity between the relevant information of the code of a candidate item and the relevant information of the code to be detected is used to determine the first subset, then the candidate item can be regarded as the second candidate item. The at least one first candidate item and the at least one second candidate item may be the same or different.

[0168] Optionally, step 321 may include determining a first subset based on the check rules selected by N candidate items with the highest similarity to the target item among the plurality of candidate items, where N is a positive integer and the check rules selected by the N candidate items are from a static analysis rule base.

[0169] The checking rules selected for the N candidate items may be referred to as similar item rules corresponding to the target item.

[0170] Exemplarily, the inspection rules selected by the N candidate items are used as elements of the first subset. The inspection rules in the first subset may be obtained through deduplication and screening. If there are duplicate inspection rules among the inspection rules selected by the N candidate items, these duplicate inspection rules are deduplicated and screened and used as elements of the first subset.

[0171] The following is an exemplary description of step 321.

[0172] For example, the similarity between the target project and the plurality of candidate projects may be the similarity between the code to be detected and the codes of the plurality of candidate projects (i.e., the plurality of first candidate projects). The checking rules selected for the N candidate projects with the highest similarity between their codes and the code to be detected among the plurality of candidate projects are used as elements of the first subset.

[0173] For example, the similarity between the target project and the plurality of candidate projects may be the similarity between the relevant information of the code to be detected and the relevant information of the plurality of candidate projects (i.e., the plurality of second candidate projects). The checking rules selected for the N candidate projects having the highest similarity between the relevant information of the plurality of candidate projects and the relevant information of the code to be detected are used as elements of the first subset.

[0174] Exemplarily, the similarity between the target project and the plurality of candidate projects can be based on the similarity between the relevant information of the code to be detected and the relevant information of the code of the at least one second candidate project, as well as the similarity between the code to be detected and the code of the at least one first candidate project. If the at least one first candidate project and the at least one second candidate project have the same candidate project, the similarity between the target project and the candidate project can be a statistical value of the similarity between the codes and the similarity between the relevant information. For example, the statistical value can be a maximum value, a minimum value, an average value, or a sum, etc.

[0175] Taking the statistical value as the maximum value as an example, assuming that the multiple candidate projects include project #A, project #B, project #C and project #D, the at least one first candidate project includes project #A, project #B and project #C, and the at least one candidate project includes project #C and project #D. The similarity between the code of project #A and the code to be detected is 60%, the similarity between the code of project #B and the code to be detected is 70%, and the similarity between the code of project #C and the code to be detected is 80%. The similarity between the relevant information of the code of project #C and the relevant information of the code to be detected is 75%, and the similarity between the relevant information of the code of project #D and the relevant information of the code to be detected is 85%. The similarity between project #C and the target project can take the maximum value, i.e. 80%. The similarity between these four projects and the target project in the order of project #A, project #B, project #C and project #D is respectively: 60%, 70%, 80% and 85%. It should be understood that the above numerical values ​​are merely illustrative and do not constitute a limitation on the solutions of the embodiments of the present application.

[0176] Optionally, the similarity between the code to be detected and the code of the first candidate item may be determined according to the similarity between the representation vector of the code to be detected and the representation vector of the code of the first candidate item.

[0177] Exemplarily, the similarity between the code to be detected and the code of the first candidate item may be positively correlated with the similarity between the representation vector of the code to be detected and the representation vector of the code of the first candidate item.

[0178] For example, the similarity between the code to be detected and the code of the first candidate item may be the similarity between the representation vector of the code to be detected and the representation vector of the code of the first candidate item.

[0179] Specifically, the source code is embedded and represented to obtain a representation vector of the source code. The similarity between the representation vector of the code to be detected and the representation vector of the code of the first candidate project can also be called the similarity between the embedding of the code to be detected and the embedding of the code of the first candidate project.

[0180] Optionally, the method 300 may further include: performing embedding representation on the code to be detected to obtain a representation vector of the code to be detected.

[0181] In some implementations, the code to be checked can come from a code file in a code repository. Embedding the code to be checked can also be called embedding the code repository.

[0182] By performing embedding representation on the code of the first candidate item, a representation vector of the code of the first candidate item can be obtained.

[0183] Furthermore, the representation vector of the code of the first candidate item may be pre-generated. For example, the representation vector of the code of the first candidate item may be pre-stored in a vector database. Before calculating the similarity, the representation vector of the code of the first candidate item may be read from the vector database.

[0184] As an example, embedding representation can be implemented through machine learning models.

[0185] Exemplarily, a code large model can be used to perform embedding representation on the source code. The code large model can also be called a code large language model (code LLM). For example, the code large model can include Unixcoder, Codebert, Codex or Pangucode. Unixcoder is a unified cross-modal pre-trained model for programming languages. Codebert is a pre-trained model for programming and natural languages. Pangucode can also be called the Pangu large model.

[0186] It should be understood that the above is only an example. In other scenarios, the similarity between source codes can also be calculated by other methods, and the embodiments of the present application do not limit this.

[0187] Optionally, the similarity between the relevant information of the code to be detected and the relevant information of the code of the second candidate item may be determined based on the similarity between the representation vector of the relevant information of the code to be detected and the representation vector of the relevant information of the code of the second candidate item.

[0188] The similarity between the relevant information of the code to be detected and the relevant information of the code of the second candidate item may be determined based on the similarity between part or all of the relevant information of the code to be detected and part or all of the relevant information of the code of the second candidate item.

[0189] In other words, when calculating the similarity between related information, if the related information of the code to be detected includes multiple items, the similarity can be calculated based on some of the multiple items of related information, or the similarity can be calculated based on each item of the multiple items of related information.

[0190] For example, the relevant information of the code to be detected may include the coding style of the code to be detected and the explanatory information of the target project. The similarity between the relevant information of the code to be detected and the relevant information of the second candidate project may be the similarity between the explanatory information of the target project and the explanatory information of the second candidate project. Alternatively, the similarity between the relevant information of the code to be detected and the relevant information of the second candidate project may include the similarity between the explanatory information of the target project and the explanatory information of the second candidate project, as well as the similarity between the coding style of the code to be detected and the coding style of the second candidate project.

[0191] The following description is made by taking the example that the relevant information includes description information. The similarity between the relevant information of the code to be detected and the relevant information of the code of the second candidate item can be the similarity between the description information of the target item and the description information of the second candidate item.

[0192] For example, the similarity between the description information of the target item and the description information of the second candidate item may be positively correlated with the similarity between the representation vector of the description information of the target item and the representation vector of the description information of the second candidate item.

[0193] For example, the similarity between the description information of the target item and the description information of the second candidate item may be the similarity between the representation vector of the description information of the target item and the representation vector of the description information of the second candidate item.

[0194] For example, the description information may be indicated by a readme file, and the representation vector of the description information may be a representation vector of the readme file.

[0195] By performing embedding representation on the readme file, we can obtain the representation vector of the readme file.

[0196] Optionally, the method 300 may further include: performing embedding representation on the readme file of the target project to obtain a representation vector of the readme file of the target project.

[0197] By performing embedding representation on the readme file of the second candidate project, a representation vector of the readme file of the second candidate project can be obtained.

[0198] The similarity between the representation vector of the readme file of the target project and the representation vector of the readme file of the second candidate project may also be referred to as the similarity between the embedding of the readme file of the target project and the embedding of the readme file of the second candidate project.

[0199] Furthermore, the characterization vector of the readme file of the second candidate project may be pre-generated. For example, the characterization vector of the readme file of the second candidate project may be pre-stored in a vector database. Before calculating the similarity, the characterization vector of the readme file of the second candidate project may be read from the vector database.

[0200] As an example, embedding representation can be implemented through machine learning models.

[0201] For example, the code model can be used to embed relevant information (e.g., description information). Specific examples can be found above and will not be repeated here.

[0202] The model used to embed relevant information and the model used to embed source code can be of the same type or different types.

[0203] It should be understood that the above is only an example. In other scenarios, the similarity between related information can also be calculated by other methods, and the embodiments of the present application are not limited to this.

[0204] In the scheme of the embodiment of the present application, the first subset of the target rule set can be determined from the detection rules selected by the candidate projects based on the similarity between the projects, which is conducive to the reuse of inspection rules for similar projects, and can further match the code to be detected, thereby providing inspection rules suitable for the code to be detected, which is conducive to achieving a comprehensive inspection of the code to be detected, avoiding missing key rules, and at the same time helping to improve the accuracy of the inspection results, thereby helping to reduce related security issues of the project.

[0205] In addition, when calculating similarity, the code large model can be used for embedded representation, which is conducive to improving the accuracy of similarity calculation and further improving the accuracy of recommendation rules.

[0206] Optionally, the relevant information of the code to be checked may include a third-party library used by the code to be checked. In this case, method 300 may further include: obtaining, from the static analysis rule library, a check rule corresponding to the third-party library used by the code to be checked; and determining a second subset of the target rule set based on the check rule corresponding to the third-party library used by the code to be checked.

[0207] The static analysis rule library can store checking rules for various third-party libraries, from which the checking rules for the third-party library used by the code to be checked can be retrieved. For example, the static analysis rule library stores checking rules for third-party library #A, third-party library #B, and third-party library #C. If analysis determines that the third-party library used by the code to be checked is third-party library #B, the checking rules for third-party library #B can be retrieved from the static analysis rule library.

[0208] The check rules for the third-party library are used to check the third-party library used by the code to be tested. These check rules can also be called the third-party library security rules, or the third-party library improper use rules. They are used to check the third-party library to analyze whether the third-party library is used safely or complies with regulations in the code to be tested.

[0209] Exemplarily, the second subset may include the inspection rules corresponding to the third-party library.

[0210] For example, the set of security rules of the third-party library can be used as the second subset.

[0211] The interfaces of some third-party components have vulnerabilities themselves, or vulnerabilities may occur when used improperly.

[0212] Exemplarily, the inspection rules corresponding to the third-party component can be used to inspect vulnerabilities in the third-party component's interface and vulnerabilities caused by improper use. For example, the inspection rules corresponding to the third-party component can include inspection rules for APIs with vulnerabilities and inspection rules for API misuse.

[0213] In the solution of the embodiment of the present application, by analyzing the third-party libraries used in the code to be detected, corresponding inspection rules are provided, which is conducive to ensuring the safe use of the third-party libraries in the code to be detected.

[0214] Optionally, the relevant information of the code to be detected may include the coding style of the code to be detected. In this case, method 300 may further include: obtaining, from a static analysis rule library, a check rule corresponding to the coding style of the code to be detected; and determining a third subset of the target rule set based on the check rule corresponding to the coding style of the code to be detected.

[0215] The static analysis rule library can store checking rules corresponding to multiple coding styles, from which the checking rules corresponding to the coding style of the code to be checked are obtained. For example, the static analysis rule library stores checking rules corresponding to coding style #A, coding style #B, and coding style #C. After analysis determines that the coding style of the code to be checked is coding style #A, the checking rules corresponding to coding style #A are obtained from the static analysis rule library.

[0216] The checking rules corresponding to the coding style of the code to be checked can be used to check code blocks in the code to be checked that do not conform to the coding style. The checking rules corresponding to the coding style of the code to be checked can also be called the coding style class checking rules of the code to be checked.

[0217] For example, the coding style may include a naming style, a comment style, and a formatting style. The checking rules corresponding to the coding style may be used to check whether the naming, comments, and code indentation of the source code comply with the specifications of the coding style.

[0218] Exemplarily, the third subset may include checking rules corresponding to the coding style of the code to be checked.

[0219] For example, a set of checking rules corresponding to the coding style of the code to be checked can be used as the third subset.

[0220] Optionally, the relevant information of the code to be checked may include the programming language of the code to be checked. In this case, method 300 may further include: obtaining, from a static analysis rule library, a check rule corresponding to the programming language of the code to be checked; and determining a fourth subset of the target rule set based on the check rule corresponding to the programming language of the code to be checked.

[0221] The static analysis rule library can store checking rules for multiple programming languages, from which the checking rule corresponding to the programming language of the code to be checked can be retrieved. For example, the static analysis rule library stores checking rules for programming language #A and programming language #B. If the programming language of the code to be checked is programming language #A, the checking rule corresponding to programming language #A can be retrieved from the static analysis rule library.

[0222] The checking rules corresponding to a programming language are the checking rules applicable to the programming language.

[0223] Exemplarily, the fourth subset may include checking rules corresponding to the programming language.

[0224] For example, the set of checking rules corresponding to programming languages ​​can be used as the fourth subset.

[0225] In addition, in some implementations, the ecology of the code to be detected can also be used to indicate the programming language of the code to be detected, that is, the inspection rules corresponding to the programming language of the code to be detected can also be determined based on the ecology of the code to be detected.

[0226] Different programming languages ​​and ecosystems have some basic rules that apply to each language. These rules apply to all projects written in that language. In the static analysis rule library, basic rules can be managed by programming language. These rules can be determined based on industry consensus or practical experience.

[0227] The checking rules corresponding to the programming language can also be called predefined rules corresponding to the coding language.

[0228] Exemplarily, the checking rules corresponding to the programming language may include at least one of the following types: coding style rules, code smell rules, or security rules.

[0229] The inspection rules corresponding to a programming language may be the inspection rules common to that programming language. Accordingly, the coding style rules corresponding to a coding language may be the coding style rules common to that programming language. The code smell rules corresponding to a coding language may be the code smell rules common to that programming language. The code smell rules are used to identify code smells in the code to be detected. The security rules corresponding to a coding language may be the security rules common to that programming language.

[0230] Optionally, the method 300 may further include: scanning the code to be detected based on a preset rule set to determine candidate issues in the code to be detected; and determining a fifth subset of the target rule set according to the inspection rules that expose the candidate issues in the preset rule set.

[0231] Exposed candidate issues are issues detected based on a pre-set set of rules. The inspection rules that expose candidate issues are those that the code blocks in the code being inspected do not comply with. Candidate issues are issues identified based on these inspection rules.

[0232] Illustratively, the fifth subset may include inspection rules that reveal problems.

[0233] Exemplarily, the preset rule set may include security rules.

[0234] Since the coding style rules covered by SAST may be different from the coding style of the code to be tested, the scanning of coding style issues can be excluded in the pre-scan.

[0235] In some implementations, the code to be inspected comes from a code repository. In this case, the code repository can be fully scanned based on a preset rule set to identify candidate issues in the code repository.

[0236] For example, before the first inspection begins, a full scan of the code repository is performed based on security rules to identify candidate issues. The set of security rules can be customized, for example, the security rules can be derived from the inspection rules for the programming language of the code being inspected.

[0237] Optionally, determining the fifth subset of the target rule set according to the inspection rules that expose the candidate problem in the preset rule set may include the following steps.

[0238] 1) Control the display of candidate questions.

[0239] 2) Obtaining feedback information of the candidate questions, where the feedback information of the candidate questions indicates the real problems among the candidate questions.

[0240] 3) Determine the fifth subset based on the inspection rules that expose real problems in the preset rule set.

[0241] The candidate questions are provided to the user for confirmation, and the fifth subset is determined based on the user's feedback on the candidate questions.

[0242] Candidate issues can be divided into two categories: real issues and false positives. Real issues can also be called accurate issues. Real issues refer to actual problems in the code, not false positives.

[0243] Feedback on candidate questions can come in a variety of forms.

[0244] For example, a user can fix some or all of the candidate issues. The feedback information for a candidate issue can include the issues that the user fixed. The issues that the user fixed are considered real issues.

[0245] For another example, a user can select some or all of the candidate questions and confirm them as real questions. The feedback information of the candidate questions may include the user's selection result. The user's selection result is the real question.

[0246] For example, a user can select some or all of the candidate questions and identify them as false positives. The feedback for the candidate questions can include the user's selection results. Questions other than those selected by the user are considered true positives. The check rules corresponding to the false positives are removed from the check rules that revealed the candidate questions, and the remaining check rules are the check rules that revealed the true positives.

[0247] If the user chooses not to confirm, for example, the candidate question's feedback information is empty, then all candidate questions can be considered real questions. The check rule that reveals the real question is the same check rule that reveals the candidate question.

[0248] Exemplarily, the fifth subset may include inspection rules in the preset rule set that expose real problems.

[0249] For example, the set of inspection rules that expose real problems can be used as the fifth subset.

[0250] The rules in the fifth subset may also be referred to as pre-scan rules.

[0251] As an example, before the first inspection task begins, a full security rule scan can be performed on the code repository. The scan report of this scan can be provided to the user for confirmation. The scan report indicates the problems existing in the code repository. The inspection rules corresponding to the problems fixed by the user and / or the inspection rules corresponding to the problems confirmed by the user as accurate are used as pre-scan rules. In other words, the inspection rules corresponding to the problems confirmed by the user as false positives are removed from the inspection rules that exposed the problems, and the inspection rules that exposed the accurate problems are used as pre-scan rules. If the user does not confirm, all inspection rules that exposed the problems can be used as pre-scan rules.

[0252] The above is merely an example and does not limit the solutions of the embodiments of the present application. For example, in other implementations, the scanning results may not be provided to the user, and the set of inspection rules that expose candidate issues may be directly used as the fifth subset.

[0253] Pre-scanning can be used to find problems in the current project.

[0254] It should be understood that the above are only some examples of rule recommendations. For other relevant information, you can refer to the above scheme for rule recommendation. For example, the static analysis rule base can store inspection rules corresponding to a variety of deployment forms, from which the inspection rules corresponding to the deployment form of the code to be detected are obtained. The inspection rules corresponding to the deployment form of the code to be detected can be used as elements of the target rule set. For another example, the static analysis rule base can store inspection rules corresponding to a variety of business categories, from which the inspection rules corresponding to the business category of the code to be detected are obtained. The inspection rules corresponding to the business category of the code to be detected can be used as elements of the target rule set.

[0255] For the convenience of description, the embodiments of the present application are mainly illustrated by taking the first subset, the second subset, the third subset, the fourth subset and the fifth subset as examples, without limiting the scope of the embodiments of the present application.

[0256] There may or may not be an intersection between any two subsets in the first subset, the second subset, the third subset, the fourth subset, and the fifth subset.

[0257] After determining the above subsets, they can be filtered for deduplication to obtain the target rule set.

[0258] When users select a rule set from the rule library for inspection, the selected inspection rules may be redundant, that is, repeated inspections may occur. Repeatedly analyzing the code through redundant rules will cause a waste of resources and increase the time cost of the inspection. Using the solution of the embodiment of the present application, each subset can be deduplicated and screened, which is conducive to reducing redundant rules and repeated analysis, thereby reducing the waste of resources and shortening the inspection time, which is conducive to improving the user experience.

[0259] In the solution of the embodiment of the present application, based on the different characteristics of the project, for example, based on the different related information of the code to be detected and the code to be detected, inspection rules can be recommended from different perspectives, thus achieving hierarchical rule recommendation. At the same time, in the solution of the embodiment of the present application, inspection rules can be determined as needed for different projects, achieving more refined recommendations.

[0260] For example, multiple subsets of the target rule set can be presented to the user in the form of multiple sets. Furthermore, the user can be prompted with the source of each subset. For example, the first subset may be recommended based on similar projects, while the second subset may be recommended based on third-party components used in the project.

[0261] Alternatively, the target rule set may be provided to the user in the form of a set, that is, without distinguishing between the various subsets. For example, the check rules in the target rule set may be displayed in the form of a list.

[0262] Furthermore, in step 330, relevant information of the target inspection rule in the target rule set may be marked on the interactive interface. For example, the relevant information of the inspection rule may include the specification document to which the inspection rule belongs or the common weakness enumeration (CWE) type to which the inspection rule belongs.

[0263] Further, optionally, method 300 may further include step 340 .

[0264] 340 , generating a configuration for a target inspection rule to be configured in a target rule set according to the code to be inspected.

[0265] Exemplarily, the generated configuration may include a basic configuration or a taint configuration. The taint configuration is a taint label generation configuration for a taint class rule.

[0266] Taint rules refer to rules implemented through taint analysis. For example, taint analysis can analyze whether data introduced by a tainted source in a program can be directly transmitted to a taint sink without undergoing harmless processing. If not, the information flow is secure; otherwise, the program may have issues such as private data leakage or dangerous data manipulation.

[0267] Exemplarily, step 340 may be performed before step 330 .

[0268] If there are inspection rules that need to be configured in the target rule set, the corresponding configuration is generated for the inspection rules that need to be configured. After the configuration is generated, the target rule set is provided to the user.

[0269] In some cases, the interactive interface can also display whether the inspection rule has a configuration file. Users can preview the inspection rule with a generated configuration file and view the configuration file.

[0270] Furthermore, a modification function may be provided to allow users to modify configuration files or inspection rules.

[0271] In this way, the target rule set recommended to the user is the out-of-the-box rule.

[0272] Alternatively, step 340 may be performed after step 330 .

[0273] After the target rule set is provided to the user, the user can make a selection from the target rule set. If there are inspection rules that need to be configured in the target inspection rules selected by the user for static analysis, the corresponding configuration is generated for the target inspection rules that need to be configured.

[0274] In this way, configurations can be generated only for the inspection rules that will be statically analyzed later, which helps save resources.

[0275] Some inspection rules require no configuration and are ready to use, supporting scanning tasks in the same or multiple programming languages. Other inspection rules, however, require configuration to accurately identify issues within a project. Some rules cannot be used correctly without basic configuration, while others require configuration generated based on project content. Manually filling out basic configuration and labeling taints consumes significant labor and requires expert knowledge, making the rules' use more challenging.

[0276] In the solution of the embodiment of the present application, rule configurations can be automatically generated, which improves the efficiency of rule use and helps reduce false positives and omissions caused by users' unfamiliarity with the inspection rules, thereby improving the accuracy of analysis. At the same time, it lowers the user's usage threshold, allowing non-security experts to use some advanced inspection capabilities, which helps improve the user experience. At the same time, generating rule configurations based on the project helps avoid the situation where key rules are not configured. For example, it avoids the situation where some taint labels may be omitted when manually annotating taint labels, thereby reducing security issues related to the project field.

[0277] Furthermore, optionally, the method 300 may further include: obtaining feedback information of the target rule set. The feedback information of the target rule set is used to indicate the selected target inspection rule. The selected target inspection rule is the inspection rule used for static analysis.

[0278] In step 330 , the target rule set may be provided to the user for selection.

[0279] For example, the user may select some or all target checking rules from the target rule set to implement static analysis, and the feedback information of the target rule set may include the some or all target checking rules.

[0280] For example, a user can delete some or all target check rules from a target rule set, and use the remaining target check rules for static analysis. The feedback information for the target rule set can include the deleted target check rules. Alternatively, the feedback information for the target rule set can also be different from the remaining target check rules.

[0281] The feedback information of the target rule set is used to indicate the selected target inspection rule. It can also be understood that the feedback information of the target rule set is used to indicate the unselected target inspection rule.

[0282] As an example, the feedback information of the target rule set can be used to optimize the previous recommendation strategy.

[0283] Exemplarily, the feedback information of the target rule set can be used to adjust at least one of the following types of recommendation strategies: predefined rules, pre-scanning rules, coding style rules, third-party library security rules, or similar project rules.

[0284] For example, for the third subset in the target rule set, if the user selects fewer or even no checking rules from it, the coding style judgment method can be optimized and the accuracy of coding style judgment can be improved to provide more appropriate coding style rules.

[0285] As an example, feedback information of the target rule set can be used to optimize the machine learning model.

[0286] For example, as previously described, the embedding representation process can be implemented using a machine learning model. For example, if the user does not select a similar item rule, the machine learning model can be optimized to obtain a more accurate representation vector, thereby providing a more accurate similar item rule.

[0287] For example, as described above, the generation of stain labels can be achieved through a machine learning model. For example, if the user does not select a stain classification rule, the machine learning model can be optimized to obtain a more accurate stain label.

[0288] In the solution of the embodiment of the present application, by collecting user feedback information and continuously optimizing the recommendation strategy, it is beneficial to continuously improve the recommendation ability and continuously provide users with more appropriate inspection rules.

[0289] The solution of the embodiment of the present application can be applied to static analysis scenarios to recommend inspection rules for the static analysis process.

[0290] The solution of the embodiment of the present application can be applied in code writing scenarios.

[0291] Exemplarily, the method 300 may be triggered when a user creates an inspection task. After the user creates the inspection task, the method 300 is triggered so as to recommend inspection rules to the user.

[0292] Exemplarily, the method 300 may also be triggered when the user's code changes.

[0293] For example, the IDE may monitor code changes in real time. If the code changes, the method 300 is triggered to perform real-time rule recommendations.

[0294] For another example, when the user saves the code, method 300 may be triggered to recommend a check rule to the user. The code to be checked may be a code in a temporary storage area.

[0295] For another example, when code is submitted to a local code repository, method 300 may be triggered to recommend inspection rules to the user. The code to be inspected may include code in the local code repository.

[0296] For another example, when code is pushed to a remote code repository, method 300 may be triggered to recommend inspection rules to the user. The code to be inspected may include code in the remote code repository.

[0297] The solution of the embodiment of the present application can be applied to the scenario where the SAST cloud service performs a full scan.

[0298] For example, when the SAST cloud service needs to perform a full scan, method 300 is triggered to recommend inspection rules for the SAST cloud service.

[0299] The above are merely examples. The solutions in the embodiments of this application can also be applied to other scenarios involving inspection rules. For example, inspection rules can be recommended to users in a DSL rule market. Another example is recommending inspection rules to users when they are writing a DSL. This embodiment of this application is not limited to this.

[0300] Figure 4 shows a schematic flow chart of a method for processing inspection rules according to an embodiment of the present application. Method 400 shown in Figure 4 can be considered as a specific implementation of method 300 shown in Figure 3. For related descriptions, reference can be made to method 300. To avoid repetition, some descriptions of method 400 will be omitted.

[0301] 4 , after creating an inspection task, method 400 may be executed to recommend corresponding inspection rules. It should be understood that this is merely an example, and method 400 may also be triggered by other means. For detailed descriptions, please refer to the previous text and will not be repeated here.

[0302] As shown in FIG. 4 , method 400 may include the following steps.

[0303] 410 , determine predefined rules and / or pre-scanning rules.

[0304] Exemplarily, the predefined rules may include at least one of basic coding style rules, code smell rules, or security rules.

[0305] Exemplarily, the fourth subset of the target rule set may include predefined rules. The fifth subset of the target rule set may include pre-scan rules. Step 410 may be understood as determining the fourth subset and / or the fifth subset of the target rule set. A detailed description of the predefined rules and pre-scan rules can be found above and will not be repeated here.

[0306] The set of predefined rules and / or the set of pre-scanning rules may be considered as a first-level rule set.

[0307] 420. Determine the inspection rules based on the characteristics of the target project.

[0308] Each project has its own characteristics, such as the project's coding style, the third-party libraries used, the project's deployment model, or the business scope it addresses. In step 420, inspection rules can be determined as needed for different projects, and different types of rules can be recommended to achieve more refined recommendations.

[0309] Exemplarily, as shown in FIG4 , the checking rules determined in step 420 may include at least one of the following types: coding style rules, third-party library security rules, or similar project rules.

[0310] As previously mentioned, the first subset of the target rule set may include similar project rules corresponding to the target project. The second subset of the target rule set may include security class rules of the third-party library used by the target project (security class rules of the third-party library used by the code to be detected). The third subset of the target rule set may include coding style class rules of the target project (i.e., coding style class rules of the code to be detected). Step 420 can also be understood as determining at least one of the following subsets in the target rule set: the first subset, the second subset, or the third subset.

[0311] The detailed descriptions of coding style rules, third-party library security rules, and similar project rules can be found in the previous article and will not be repeated here. The set of coding style rules and / or the set of third-party library security rules can be considered the second-level rule set.

[0312] The set of similar item rules can be regarded as the third-level rule set.

[0313] The set obtained by deduplicating and filtering the inspection rules in the above three levels of rule sets can be used as the target rule set. Alternatively, it can be understood that the union of the above three levels of rule sets can be used as the target rule set.

[0314] The target rule set may be recommended to the user for selection.

[0315] The embodiments of this application do not restrict the order in which the determination process for each type of inspection rule is executed, that is, the order in which the determination process for each of the aforementioned subsets is executed is not restricted. For example, steps 410 and 420 can be executed simultaneously. Alternatively, steps 410 and 420 can be executed sequentially. For another example, the determination processes for the first and third subsets can be executed simultaneously or sequentially.

[0316] Further, optionally, method 400 may also include step 430 .

[0317] 430, generate rule configuration.

[0318] For example, as shown in Figure 4, the rule configuration may include a basic configuration and / or a taint label. Detailed descriptions of the rule configuration can be found in the previous text and will not be repeated here.

[0319] For example, step 430 may be performed before the target rule set is provided to the user.

[0320] Exemplarily, step 430 may be performed after the target rule set is provided to the user.

[0321] Further, optionally, method 400 may further include step 440 .

[0322] 440, obtaining feedback information of the target rule set.

[0323] Exemplarily, the feedback information can be used to optimize previous recommendation strategies and / or machine learning models.

[0324] FIG5 is an example of a processing flow of an inspection rule according to an embodiment of the present application.

[0325] As mentioned above, the solution of the embodiment of the present application can provide services in the form of cloud services, for example, to users. For ease of description, Figure 5 mainly uses this as an example for illustration, and does not constitute a limitation on the solution of the embodiment of the present application.

[0326] The solution of the embodiment of the present application can be applied to scenarios where SAST services can be provided. For example, SAST services can be provided in scenarios such as SAST cloud service platforms, IDEs, or local CLIs. In these scenarios, the solution of the embodiment of the present application can be used to recommend inspection rules.

[0327] As mentioned above, after the user creates an inspection task, the method 400 may be triggered to execute.

[0328] For example, a user can create a check task from a remote code repository. For example, a user can provide a git link and create a check task on the SAST cloud service platform.

[0329] For example, the user can create an inspection task locally. For example, the user can create an inspection task locally through an IDE or a CLI.

[0330] As shown in FIG5 , the inspection rules recommended to the user can be divided into three levels, namely, the first level rule set, the second level rule set and the third level rule set.

[0331] The following is an illustrative description of how to determine the rule sets at the three levels.

[0332] After the inspection task is created, an interactive interface may be provided for the user to input relevant information of the current project (ie, the target project).

[0333] For example, multiple candidate tags are provided to the user for selection. For example, a project's tag could indicate its ecosystem or programming language. As shown in Figure 5, candidate tags might include security, spring, or java. Project tags can also be referred to as repository attribute tags.

[0334] The user can select a label for the project from the plurality of candidate labels. Predefined rules can be determined based on the labels provided by the user and / or the programming language of the project.

[0335] Scan the project's code to determine the pre-scan rules.

[0336] The set of predefined rules and pre-scan rules can be called a first-level rule set.

[0337] Furthermore, as shown in FIG5 , the source code (ie, the code to be detected), comments, readme files, and package management files of the project are obtained.

[0338] The characteristics of the project can be identified through source code, comments, readme files, and package management files, providing the project with second-level and third-level rule sets.

[0339] As an example, the coding style of the source code is identified to determine the checking rules corresponding to the coding style.

[0340] For example, the AST of the source code is traversed and checked based on static checking to identify the coding style of the source code. For example, if most of the content in the source code conforms to a certain coding style, then the coding style can be used as the coding style of the source code. Then, rules for checking the coding style are provided, that is, the checking rules corresponding to the coding style. For example, the checking rules corresponding to the coding style can be used to check whether the naming, comments, and code indentation of the source code conform to the specifications of the coding style.

[0341] As an example, the third-party software used in the project is matched to determine the inspection rules corresponding to the third-party software.

[0342] For example, based on static checks, the package management file is reviewed to match the third-party software used by the user. Then, the user is provided with the check rules for checking the third-party software, i.e., the check rules corresponding to the third-party software. For example, the check rules corresponding to the third-party software may include check rules for vulnerable APIs and check rules for API misuse.

[0343] The set of checking rules corresponding to the coding style and the checking rules corresponding to the third-party components can be called the second-level rule set.

[0344] As an example, we perform embedding representation on the source code and readme files to obtain their embeddings. We then calculate similarity between these embeddings and the embeddings of candidate items in the vector database, identify similar items to the target item, and determine the check rules for selecting similar items. For example, the similar items to the target item may include the N candidate items with the highest similarity to the target item.

[0345] Embedding representation can be achieved through code LLM. For detailed description, please refer to the previous article.

[0346] The embeddings of mature projects are stored in the vector database. That is, the source code and readme files of mature projects are embedded and represented, and their embeddings are pre-stored in the vector database.

[0347] The set of checking rules for similar items can be called the third-level rule set.

[0348] The three levels of rule sets are deduplicated and filtered, and relevant configurations are generated for the rules that need to be configured. For example, as shown in Figure 5, the relevant configurations can include base configurations and taint labels. After the configurations are generated, the target rule set is generated for the user to select.

[0349] As shown in FIG5 , in the solution of the embodiment of the present application, static inspection and machine learning can be used to determine the characteristics of the project, and different rules can be recommended for different projects based on the project characteristics.

[0350] Furthermore, feedback information of the target rule set is obtained, and the feedback information is used to optimize the recommendation strategy or machine learning model, etc.

[0351] FIG6 and FIG7 respectively show examples of two application scenarios of the solution of the embodiment of the present application.

[0352] Figure 6 shows an example of implementing this solution in the SAST cloud service platform.

[0353] Figure 7 shows an example of executing this solution in the IDE.

[0354] The solution of the embodiment of the present application is exemplarily described below with reference to FIG6 and FIG7 .

[0355] As shown in FIG6 , when a user creates an inspection task, or when a user configures a task for the first time, the user may be prompted to enter a git link and select a property tag on the task configuration interface.

[0356] The background may run a recommendation algorithm, i.e., execute the method of the embodiment of the present application (such as method 300 or method 400), to obtain a target rule set. For example, the target rule set may include a first subset, a second subset, a third subset, a fourth subset, and a fifth subset.

[0357] For example, a prompt is displayed on the interactive interface to determine whether the user wishes to display the recommended rules. For example, a pop-up window may be displayed asking whether to display the recommended rules. If the user confirms to display the recommended rules, the rule recommendation results, i.e., the check rules in the target rule set, are displayed.

[0358] Furthermore, the SAST cloud service platform can also display whether a configuration file has been generated for each check rule. Users can preview the check rules that have generated configuration files and view the configuration files.

[0359] Furthermore, the SAST cloud service platform also provides a modification function, allowing users to modify configuration files or inspection rules.

[0360] Furthermore, the SAST cloud service platform can also annotate relevant information of each inspection rule. For example, the relevant information of the inspection rule may include the specification document to which the inspection rule belongs or the common weakness enumeration (CWE) type to which the inspection rule belongs.

[0361] Users can select the required inspection rules.

[0362] If this is not the first time the user is configuring a code repository, additional rules can be recommended after the code changes are committed.

[0363] For example, the types of supplementary rules may include coding style rules, third-party library security rules, or similar project rules. That is, if new third-party libraries are introduced into the submitted code, the coding style changes, or similar projects change, corresponding supplementary rules can be recommended.

[0364] For example, after a code change, if a new third-party component is detected, the user can be provided with the corresponding checking rules for the new third-party component. Another example is that after a code change, if a change in the coding style is detected, the user can be provided with the checking rules corresponding to the changed coding style. Another example is that after a code change, if a similar project is detected to be a different project, i.e., a new similar code repository is matched, the user can be provided with the checking rules selected for the new similar project.

[0365] In the solution shown in FIG7 , when using the SAST service in an IDE, if the user configures a task for the first time, the user may be prompted to select a property tag in the task configuration interface.

[0366] The background may run a recommendation algorithm, i.e., execute the method of the embodiment of the present application (such as method 300 or method 400), to obtain a target rule set. For example, the target rule set may include a first subset, a second subset, a third subset, a fourth subset, and a fifth subset.

[0367] The main difference between the solution shown in FIG6 and the solution shown in FIG7 is that in the solution shown in FIG7 , the IDE can monitor code changes in real time and recommend inspection rules corresponding to the changed code to the user in real time.

[0368] For other descriptions, please refer to the relevant description in Figure 6, which will not be repeated here.

[0369] It should be understood that the solutions shown in Figures 4 to 7 are only examples and do not constitute a limitation to the solutions of the embodiments of the present application. For other possible implementations, please refer to method 300.

[0370] The apparatus of the embodiment of the present application is described below with reference to Figures 8 to 11. It should be understood that the apparatus described below can execute the method of the embodiment of the present application described above. To avoid unnecessary repetition, repeated descriptions are appropriately omitted when introducing the apparatus of the embodiment of the present application.

[0371] FIG8 is a schematic block diagram of a processing device for checking rules according to an embodiment of the present application. The processing device 2000 shown in FIG8 can be used to execute the method shown in FIG3. The processing device 2000 includes a first acquisition module 2010 and a processing module 2020.

[0372] In one possible implementation, the processing device 2000 may be used to execute the method shown in FIG. 3 .

[0373] The first acquisition module 2010 is used to obtain the code to be detected and / or related information of the code to be detected. The related information of the code to be detected includes at least one of the following: the programming language of the code to be detected, the development framework of the code to be detected, the deployment form of the code to be detected, the business scope of the code to be detected, the third-party library used by the code to be detected, the coding style of the code to be detected, the comments of the code to be detected, or the description information of the target project to which the code to be detected belongs.

[0374] Processing module 2020 is used to: determine a target rule set from a static analysis rule library based on the code to be detected and / or related information of the code to be detected, the target rule set including one or more candidate inspection rules, and the one or more candidate inspection rules are used to perform static analysis on the code to be detected; control the display of the target rule set.

[0375] Optionally, the processing module 2020 is specifically used to: determine a first subset of the target rule set from the static analysis rule base based on the similarity between the target project and multiple candidate projects, the similarity between the target project and the multiple candidate projects is determined based on the similarity between the code to be detected and the code of at least one first candidate project, and / or, the similarity between the relevant information of the code to be detected and the relevant information of the code of at least one second candidate project, the multiple candidate projects include at least one first candidate project, or the multiple candidate projects include at least one second candidate project.

[0376] Optionally, the processing module 220 is specifically used to: determine the first subset based on the inspection rules selected by N candidate projects with the highest similarity to the target project among multiple candidate projects, the inspection rules selected by the N candidate projects are from the static analysis rule library, and N is a positive integer.

[0377] Optionally, the processing module 2020 is specifically used to: embed a representation of the code to be detected to obtain a representation vector of the code to be detected; determine the similarity between the code to be detected and the codes of multiple first candidate projects based on the similarity between the representation vector of the code to be detected and the representation vectors of the codes of multiple first candidate projects; or, the description information of the target project is indicated by the readme file of the target project, and the processing module 2020 is specifically used to: embed a representation of the readme file of the target project to obtain a representation vector of the readme file of the target project; determine the similarity between the relevant information of the code to be detected and the relevant information of the codes of multiple second candidate projects based on the similarity between the representation vector of the readme file of the target project and the representation vectors of the readme files of multiple second candidate projects.

[0378] Optionally, the processing module 2020 is specifically used for at least one of the following: obtaining the inspection rules corresponding to the third-party library used by the code to be detected from the static analysis rule base; determining the second subset of the target rule set based on the inspection rules corresponding to the third-party library used by the code to be detected; obtaining the inspection rules corresponding to the coding style of the code to be detected from the static analysis rule base; determining the third subset of the target rule set based on the inspection rules corresponding to the coding style of the code to be detected; or obtaining the inspection rules corresponding to the programming language of the code to be detected from the static analysis rule base; determining the fourth subset of the target rule set based on the inspection rules corresponding to the programming language of the code to be detected.

[0379] Optionally, the processing device 2000 further includes: a second acquisition module (not shown in the figure), configured to: acquire a package management file of the code to be detected; and analyze the package management file to determine a third-party library used by the code to be detected.

[0380] The second acquisition module and the first acquisition module may be the same module or different modules.

[0381] Optionally, the processing module 2020 is specifically configured to: scan the code to be detected according to a preset rule set to determine candidate issues in the code to be detected; and determine a fifth subset of the target rule set according to the inspection rules that expose the candidate issues in the preset rule set.

[0382] Optionally, the processing module 220 is specifically used to: control the display of candidate questions; obtain feedback information of the candidate questions, the feedback information of the candidate questions indicating the real problems in the candidate questions; determine the fifth subset according to the inspection rules that expose the real problems in the preset rule set.

[0383] Optionally, the processing device 2000 further includes: a configuration module (not shown in the figure), configured to generate a configuration for a target inspection rule to be configured in a target rule set according to the code to be inspected.

[0384] Optionally, the processing device 2000 further includes: a third acquisition module (not shown in the figure), configured to acquire feedback information of the target rule set, where the feedback information of the target rule set is used to indicate the selected target inspection rule.

[0385] The third acquisition module, the second acquisition module, and the first acquisition module may be the same module or different modules.

[0386] For a detailed description, please refer to the method 300 in the previous text, which will not be repeated here.

[0387] Each module in the processing device 2000 can be implemented by software or hardware. For example, the implementation of the processing module 2020 will be described below using the processing module 2020 as an example. Similarly, the implementation of other modules can refer to the implementation of the processing module 2020.

[0388] As an example of a software functional unit, the processing module 2020 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the processing module 2020 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0389] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0390] As an example of a hardware functional unit, processing module 2020 may include at least one computing device, such as a server. Alternatively, processing module 2020 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0391] The multiple computing devices included in processing module 2020 can be distributed in the same region or in different regions. The multiple computing devices included in processing module 2020 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in processing module 2020 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of servers, ASICs, PLDs, CPLDs, FPGAs, GALs, and other computing devices.

[0392] It should be noted that, in other embodiments, the processing module 2020 can be used to execute any step in the processing method of the inspection rules, and the first acquisition module 2010 can be used to execute any step in the processing method of the inspection rules. The steps that each module is responsible for implementing can be specified as needed, and all functions of the processing device 2000 are realized by each module implementing different steps in the processing method of the inspection rules.

[0393] This application also provides a computing device 1000. As shown in Figure 9, computing device 1000 includes a bus 1002, a processor 1004, a memory 1006, and a communication interface 1008. Processor 1004, memory 1006, and communication interface 1008 communicate with each other via bus 1002. Computing device 1000 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 1000.

[0394] Bus 1002 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG9 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 1002 may include a path for transmitting information between various components of computing device 1000 (e.g., memory 1006, processor 1004, and communication interface 1008).

[0395] The processor 1004 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0396] The memory 1006 may include volatile memory, such as random access memory (RAM). The processor 1004 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0397] The memory 1006 stores executable program code, and the processor 1004 executes the executable program code to implement the functions of the first acquisition module 2010 and the processing module 2020, thereby implementing the inspection rule processing method. In other words, the memory 1006 stores instructions for executing the inspection rule processing method.

[0398] The communication interface 1008 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1000 and other devices or a communication network.

[0399] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0400] As shown in Figure 10, the computing device cluster includes at least one computing device 1000. The memory 1006 of one or more computing devices 1000 in the computing device cluster may store the same instructions for executing the processing method for checking rules.

[0401] In some possible implementations, the memory 1006 of one or more computing devices 1000 in the computing device cluster may also store partial instructions for executing the processing method for the inspection rule. In other words, the combination of one or more computing devices 1000 can jointly execute the instructions for executing the processing method for the inspection rule.

[0402] It should be noted that the memory 1006 in different computing devices 1000 in the computing device cluster can store different instructions, each for executing a portion of the functions of the processing device for checking rules. In other words, the instructions stored in the memory 1006 in different computing devices 1000 can implement the functions of one or more modules in the first acquisition module 2010 and the processing module 2020.

[0403] In some possible implementations, one or more computing devices in the computing device cluster can be connected via a network. The network can be a wide area network or a local area network, etc. Figure 11 shows a possible implementation. As shown in Figure 11, two computing devices 1000A and 1000B are connected via a network. Specifically, the connection to the network is made via a communication interface in each computing device. In this type of possible implementation, the memory 1006 in the computing device 1000A stores instructions for executing the functions of the first acquisition module 2010. At the same time, the memory 1006 in the computing device 1000B stores instructions for executing the functions of the processing module 2020.

[0404] The connection method between the computing device clusters shown in Figure 11 may be to consider that the processing method of the inspection rules provided in this application may need to store data, so it is considered to hand over the functions implemented by the processing module 2020 to the computing device 1000B for execution.

[0405] It should be understood that the functions of the computing device 1000A shown in FIG11 may also be completed by multiple computing devices 1000. Similarly, the functions of the computing device 1000B may also be completed by multiple computing devices 1000.

[0406] The present application also provides a computer program product including instructions. The computer program product may be software or a program product including instructions that can be run on a computing device or stored on any available medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to execute a processing method for checking rules.

[0407] The present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device, or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the processing method for the inspection rule.

[0408] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0409] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0410] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0411] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0412] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0413] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the processing method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0414] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for processing inspection rules, characterized in that: include: Obtaining the code to be detected and / or relevant information of the code to be detected, wherein the relevant information of the code to be detected includes at least one of the following: the programming language of the code to be detected, the development framework of the code to be detected, the deployment form of the code to be detected, the business scope of the code to be detected, the third-party library used by the code to be detected, the coding style of the code to be detected, or the description information of the target project to which the code to be detected belongs; Determine a target rule set from a static analysis rule library according to the code to be detected and / or relevant information of the code to be detected, wherein the target rule set includes one or more candidate inspection rules, and the one or more candidate inspection rules are used to perform static analysis on the code to be detected; Controls display of the target rule set.

2. The processing method according to claim 1, characterized in that: Determining a target rule set from a static analysis rule base according to the code to be detected and / or relevant information of the code to be detected includes: A first subset of the target rule set is determined from the static analysis rule base according to the similarity between the target project and multiple candidate projects, the similarity between the target project and the multiple candidate projects is determined based on the similarity between the code to be detected and the code of at least one first candidate project, and / or the similarity between the relevant information of the code to be detected and the relevant information of the code of at least one second candidate project, the multiple candidate projects include the at least one first candidate project, or the multiple candidate projects include the at least one second candidate project.

3. The processing method according to claim 2, characterized in that: Determining the first subset of the target rule set from the static analysis rule base according to the similarity between the target item and a plurality of candidate items includes: The first subset is determined according to the checking rules selected by N candidate items among the multiple candidate items that have the highest similarity with the target item, the checking rules selected by the N candidate items are from the static analysis rule base, and N is a positive integer.

4. The processing method according to claim 2 or 3, characterized in that: The processing method also includes: Embedding and representing the code to be detected to obtain a representation vector of the code to be detected; Determining the similarity between the code to be detected and the codes of the plurality of first candidate items according to the similarity between the characterization vector of the code to be detected and the characterization vectors of the codes of the plurality of first candidate items; or, the description information of the target item is indicated by a readme file of the target item, and the processing method further includes: Embedding the self-description file of the target project to obtain a representation vector of the self-description file of the target project; The similarity between the relevant information of the code to be detected and the relevant information of the codes of the plurality of second candidate projects is determined according to the similarity between the characterization vector of the self-description file of the target project and the characterization vectors of the self-description files of the plurality of second candidate projects.

5. The processing method according to any one of claims 1 to 4, characterized in that: Determining a target rule set from a static analysis rule base according to the code to be detected and / or related information of the code to be detected includes at least one of the following: Obtaining, from the static analysis rule library, the inspection rules corresponding to the third-party library used by the code to be inspected; Determine a second subset of the target rule set according to the inspection rules corresponding to the third-party library used by the code to be detected; Obtaining the checking rules corresponding to the coding style of the code to be checked from the static analysis rule library; Determine a third subset of the target rule set according to the inspection rule corresponding to the coding style of the code to be inspected; or Obtaining the checking rules corresponding to the programming language of the code to be checked from the static analysis rule library; A fourth subset of the target rule set is determined according to the checking rules corresponding to the programming language of the code to be checked.

6. The processing method according to any one of claims 1 to 5, characterized in that: Determining a target rule set from a static analysis rule base according to the code to be detected and / or relevant information of the code to be detected includes: Scan the code to be detected according to a preset rule set to determine candidate problems in the code to be detected; The fifth subset of the target rule set is determined according to the inspection rule in the preset rule set that exposes the candidate problem.

7. The processing method according to claim 6, characterized in that: The step of determining the fifth subset of the target rule set according to the inspection rule that exposes the candidate problem in the preset rule set includes: controlling display of the candidate questions; Acquiring feedback information of the candidate questions, wherein the feedback information of the candidate questions indicates a real question among the candidate questions; The fifth subset is determined according to the inspection rule in the preset rule set that exposes the real problem.

8. The processing method according to any one of claims 1 to 7, characterized in that: The processing method also includes: Obtaining the package management file of the code to be detected; The package management file is analyzed to determine the third-party library used by the code to be detected.

9. The processing method according to any one of claims 1 to 8, characterized in that: The processing method also includes: Generate a configuration for a target inspection rule to be configured in the target rule set according to the code to be detected.

10. The processing method according to any one of claims 1 to 9, characterized in that: The processing method also includes: Acquire feedback information of the target rule set, where the feedback information of the target rule set is used to indicate a selected target inspection rule.

11. A processing device for checking rules, characterized in that: include: A first acquisition module is used to acquire the code to be detected and / or relevant information of the code to be detected, wherein the relevant information of the code to be detected includes at least one of the following: the programming language of the code to be detected, the development framework of the code to be detected, the deployment form of the code to be detected, the business scope of the code to be detected, the third-party library used by the code to be detected, the coding style of the code to be detected, the comments of the code to be detected, or the description information of the target project to which the code to be detected belongs; Processing modules for: Determine a target rule set from a static analysis rule library according to the code to be detected and / or relevant information of the code to be detected, wherein the target rule set includes one or more candidate inspection rules, and the one or more candidate inspection rules are used to perform static analysis on the code to be detected; Controls display of the target rule set.

12. The processing device according to claim 11, characterized in that The processing module is specifically used for: A first subset of the target rule set is determined from the static analysis rule base according to the similarity between the target project and multiple candidate projects, the similarity between the target project and the multiple candidate projects is determined based on the similarity between the code to be detected and the code of at least one first candidate project, and / or the similarity between the relevant information of the code to be detected and the relevant information of the code of at least one second candidate project, the multiple candidate projects include the at least one first candidate project, or the multiple candidate projects include the at least one second candidate project.

13. The processing device according to claim 12, characterized in that The processing module is specifically used for: The first subset is determined according to the checking rules selected by N candidate items among the multiple candidate items that have the highest similarity with the target item, the checking rules selected by the N candidate items are from the static analysis rule base, and N is a positive integer.

14. The processing device according to claim 12 or 13, characterized in that The processing module is specifically used for: Embedding and representing the code to be detected to obtain a representation vector of the code to be detected; Determine the similarity between the code to be detected and the codes of the plurality of first candidate items according to the similarity between the characterization vector of the code to be detected and the characterization vectors of the codes of the plurality of first candidate items; or, the description information of the target item is indicated by a readme file of the target item, and the processing module is specifically used for: Embedding the self-description file of the target project to obtain a representation vector of the self-description file of the target project; The similarity between the relevant information of the code to be detected and the relevant information of the codes of the plurality of second candidate projects is determined according to the similarity between the characterization vector of the self-description file of the target project and the characterization vectors of the self-description files of the plurality of second candidate projects.

15. The processing device according to any one of claims 11 to 14, characterized in that The processing module is specifically used for at least one of the following: Obtaining, from the static analysis rule library, the inspection rules corresponding to the third-party library used by the code to be inspected; Determine a second subset of the target rule set according to the inspection rules corresponding to the third-party library used by the code to be detected; Obtaining the checking rules corresponding to the coding style of the code to be checked from the static analysis rule library; Determine a third subset of the target rule set according to the inspection rule corresponding to the coding style of the code to be inspected; or Obtaining the checking rules corresponding to the programming language of the code to be checked from the static analysis rule library; A fourth subset of the target rule set is determined according to the checking rules corresponding to the programming language of the code to be checked.

16. The processing device according to any one of claims 11 to 15, characterized in that The processing module is specifically used for: Scan the code to be detected according to a preset rule set to determine candidate problems in the code to be detected; The fifth subset of the target rule set is determined according to the inspection rule in the preset rule set that exposes the candidate problem.

17. The processing device according to claim 16, characterized in that The processing module is specifically used for: controlling display of the candidate questions; Acquiring feedback information of the candidate questions, wherein the feedback information of the candidate questions indicates a real question among the candidate questions; The fifth subset is determined according to the inspection rule in the preset rule set that exposes the real problem.

18. The processing device according to any one of claims 11 to 17, characterized in that The processing device also includes: The second acquisition module is used to: Obtaining the package management file of the code to be detected; The package management file is analyzed to determine the third-party library used by the code to be detected.

19. The processing device according to any one of claims 11 to 18, characterized in that The processing device also includes: A configuration module is used to generate a configuration for a target inspection rule to be configured in the target rule set according to the code to be detected.

20. The processing device according to any one of claims 11 to 19, characterized in that The processing device also includes: The third acquisition module is used to acquire feedback information of the target rule set, where the feedback information of the target rule set is used to indicate the selected target inspection rule.

21. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 10.

22. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 10.

23. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster is caused to perform the method according to any one of claims 1 to 10.

Images