Automatic repairing method and device for front-end code security vulnerabilities, equipment and medium

Abstract

The embodiment of the invention discloses an automatic repairing method and device for front-end code security vulnerabilities, equipment and a medium, and the method comprises the steps that in a front-end code deployment and operation environment, static analysis and dynamic behavior monitoring are conducted on front-end codes through a pre-trained AI model, and the security vulnerabilities existing in the front-end codes are recognized; automatically generating a vulnerability report containing vulnerability types, code positions and repair suggestions according to the identified types and influence levels of the security vulnerabilities; according to the risk level of the vulnerability in the vulnerability report and a preset trigger strategy, judging whether to start an automatic repair process or not; when the automatic repair process is started, calling the AI model and generating repair patch codes for the security vulnerabilities according to repair suggestions in the vulnerability report; performing automatic test and verification on the repair patch code in a sandbox environment to ensure that the security vulnerability is eliminated and no new functional exception is introduced; according to the verification result of the sandbox environment and feedback data collected in the operation process, continuously training and optimizing the AI model; and automatically integrating the verified repair patch code into front-end code version management through an integrated management module to finish closed-loop repair and system update of the vulnerability.

Description

Technical Field

[0001] This application relates to, but is not limited to, the field of data security technology, and in particular to an automatic repair method, apparatus, device, and medium for front-end code security vulnerabilities. Background Technology

[0002] With the widespread adoption of web applications and their increasing complexity, the security of front-end code has become a critical element in ensuring the security of the entire application system. Front-end code runs directly in the user's browser environment, resulting in a wide exposure and vulnerability to various security vulnerabilities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and DOM injection. Especially in real-time interactive scenarios such as video conferencing and online collaboration, the front-end heavily relies on modern communication technologies such as WebRTC and WebSocket, introducing new security challenges.

[0003] In existing technologies, security remediation relies on manual intervention, which is inefficient and prone to errors: security issues are often reported late, and by the time R&D issues are addressed and security patches are released, it is difficult to keep up with the rapid iteration of front-end updates, and the effectiveness of the remediation is difficult to verify. There is a lack of targeted security testing for communication scenarios such as WebRTC, WebSocket, and MCP: modern web front-ends heavily rely on real-time communication (such as WebRTC in video conferencing and WebSocket / MCP protocols in chat systems), but security testing tools for these protocols are scarce and difficult to integrate. Vulnerability remediation lacks a closed-loop feedback mechanism, preventing model evolution: traditional tools cannot "remember" remediation results and feedback, causing models to fail to learn and the same vulnerabilities to recur. It is difficult to embed automated security defenses into actual business operations (such as video conferencing systems): many current security systems cannot be seamlessly integrated into complex business architectures (such as real-time video communication systems), often affecting normal business operations. Summary of the Invention

[0004] In view of this, embodiments of this application provide at least one method, apparatus, device, and medium for automatically repairing front-end code security vulnerabilities.

[0005] The technical solution of this application embodiment is implemented as follows: On one hand, embodiments of this application provide an automatic repair method for front-end code security vulnerabilities, the method comprising: In the front-end code deployment and runtime environment, a pre-trained AI model is used to perform static analysis and dynamic behavior monitoring on the front-end code to identify security vulnerabilities in the front-end code. Based on the type and impact level of the identified security vulnerabilities, an automatic vulnerability report is generated, which includes the vulnerability type, code location, and remediation suggestions. Based on the risk level of the vulnerability in the vulnerability report and the preset triggering strategy, determine whether to start the automatic remediation process; When the automatic remediation process is initiated, the AI ​​model is invoked and, based on the remediation suggestions in the vulnerability report, remediation patch code for the security vulnerability is generated; The patch code was automatically tested and verified in a sandbox environment to ensure that the security vulnerability was eliminated and no new functional anomalies were introduced. Based on the verification results of the sandbox environment and the feedback data collected during the operation, the AI ​​model is continuously trained and optimized. The integrated management module automatically integrates verified patch code into the front-end code version management, completing the closed-loop repair of vulnerabilities and system updates.

[0006] On the other hand, embodiments of this application provide another method for automatically repairing front-end code security vulnerabilities, the method comprising: The identification module is used to perform static analysis and dynamic behavior monitoring of front-end code in the front-end code deployment and runtime environment using a pre-trained AI model to identify security vulnerabilities in the front-end code. Based on the type and impact level of the identified security vulnerabilities, an automatic vulnerability report is generated, which includes the vulnerability type, code location, and remediation suggestions. Based on the risk level of the vulnerability in the vulnerability report and the preset triggering strategy, determine whether to start the automatic remediation process; The repair module is used to call the AI ​​model and generate repair patch code for the security vulnerability based on the repair suggestions in the vulnerability report when the automatic repair process is started. The patch code was automatically tested and verified in a sandbox environment to ensure that the security vulnerability was eliminated and no new functional anomalies were introduced. Based on the verification results of the sandbox environment and the feedback data collected during the operation, the AI ​​model is continuously trained and optimized. The integrated management module automatically integrates verified patch code into the front-end code version management, completing the closed-loop repair of vulnerabilities and system updates.

[0007] In another aspect, embodiments of this application provide a computer device, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements some or all of the steps in the above-mentioned automatic repair method for front-end code security vulnerabilities.

[0008] In another aspect, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described automatic repair method for front-end code security vulnerabilities.

[0009] In another aspect, embodiments of this application provide a computer program including computer-readable code. When the computer-readable code is run in a computer device, the processor in the computer device executes some or all of the steps in the automatic repair method for implementing the aforementioned front-end code security vulnerability.

[0010] In another aspect, embodiments of this application provide a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, it implements some or all of the steps in the above-mentioned automatic repair method for front-end code security vulnerabilities.

[0011] This application's embodiments utilize AI models to detect front-end code vulnerabilities in real time and automatically assess risks. Subsequently, a remediation process is triggered based on a strategy, with AI generating remediation code. The effectiveness and security of the remediation are then verified in a secure, isolated sandbox. Upon successful verification, the remediation is automatically integrated into the codebase, and the AI ​​model is continuously optimized using feedback data generated throughout the process. This series of steps works collaboratively to achieve rapid discovery, automatic remediation, reliable verification, and continuous learning of front-end security vulnerabilities, significantly improving the automation level and response efficiency of front-end application security protection, while reducing manual maintenance costs and security risks.

[0012] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this application. Attached Figure Description

[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with this application and, together with the specification, serve to explain the technical solutions of this application.

[0014] Figure 1 A schematic diagram illustrating the implementation process of an automatic repair method for front-end code security vulnerabilities provided in this application embodiment; Figure 2 A system flowchart illustrating an automatic repair method for front-end code security vulnerabilities provided in this application embodiment; Figure 3 A schematic diagram of the logic flow of an automatic repair method for front-end code security vulnerabilities provided in an embodiment of this application; Figure 4 A schematic diagram of the interactive process of an automatic repair method for front-end code security vulnerabilities provided in an embodiment of this application; Figure 5 A schematic diagram illustrating a scenario of an automatic repair method for front-end code security vulnerabilities provided in an embodiment of this application; Figure 6 A schematic diagram illustrating the composition of an automatic front-end code security vulnerability repair device provided in this application embodiment; Figure 7 This is a schematic diagram of the hardware entity of a computer device provided in an embodiment of this application. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0016] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0017] The terms “first / second / third” are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that “first / second / third” may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used herein is for descriptive purposes only and is not intended to limit the scope of this application.

[0019] This application provides an automatic method for fixing front-end code security vulnerabilities, which can be executed by the processor of a computer device. The computer device can refer to a server, laptop, tablet, desktop computer, smart TV, set-top box, mobile device (such as a mobile phone, portable video player, personal digital assistant, dedicated messaging device, portable gaming device), or other similar computer equipment. Figure 1 A schematic diagram illustrating the implementation process of an automatic front-end code security vulnerability repair method provided in this application embodiment is shown below. Figure 1 As shown, the method includes: Step 101: In the front-end code deployment and runtime environment, use a pre-trained AI model to perform static analysis and dynamic behavior monitoring on the front-end code to identify security vulnerabilities in the front-end code.

[0020] In this application embodiment, the AI ​​model refers to an intelligent model trained based on deep learning algorithms, used to analyze potential security vulnerabilities in front-end code. Front-end code security vulnerabilities refer to security risks caused by code defects in web front-end pages or applications, including cross-site scripting, improper DOM manipulation, and missing input validation.

[0021] The system deploys and runs a pre-trained AI model within the deployment and runtime environment of the front-end code. This model performs static analysis on the front-end code, parsing its structure to identify potential risk patterns. Simultaneously, the system dynamically monitors the runtime behavior of the front-end application in the browser, simulating user interactions and capturing abnormal operations. The AI ​​model comprehensively analyzes static code features and dynamic behavior logs to identify various security vulnerabilities in the front-end code.

[0022] Step 102: Based on the type and impact level of the identified security vulnerabilities, automatically generate a vulnerability report containing the vulnerability type, code location, and remediation suggestions.

[0023] In this embodiment, a vulnerability report is a structured data document used to record detailed information about security vulnerabilities. Code location refers to the specific location of the vulnerability within the front-end code file.

[0024] Based on the identified security vulnerabilities, the system automatically extracts the vulnerability's type characteristics and assesses its impact level. The system then generates a structured vulnerability report, which includes the identified vulnerability type, the code file containing the vulnerability and its specific line number, as well as preliminary remediation suggestions provided by the AI ​​model or rule base.

[0025] Step 103: Based on the risk level of the vulnerability in the vulnerability report and the preset triggering strategy, determine whether to start the automatic repair process.

[0026] In this embodiment, the risk level is a classification rating based on the potential severity of the vulnerability. The preset triggering strategy is a set of rules pre-configured by the system to determine whether to initiate an automated remediation process.

[0027] The system reads the generated vulnerability report and extracts the vulnerability risk level information. The system compares the risk level with pre-configured triggering policies. Triggering policies define the corresponding actions for different risk levels; for example, high-risk vulnerabilities are patched immediately, while low-risk vulnerabilities are recorded and await manual review. Based on the comparison results, the system automatically determines whether the current vulnerability requires immediate initiation of the subsequent automatic patching process.

[0028] Step 104: When starting the automatic repair process, the AI ​​model is invoked and, based on the repair suggestions in the vulnerability report, repair patch code for the security vulnerability is generated.

[0029] In the embodiments of this application, the patch code refers to one or more pieces of program code used to correct a specific security vulnerability.

[0030] When the system determines that an automatic remediation process needs to be initiated, the automatic remediation module is invoked. This module takes the generated vulnerability report as input, particularly the vulnerability context and remediation suggestions, and submits it to the AI ​​model. Based on its training knowledge, the AI ​​model analyzes the vulnerability context and generates one or more pieces of patch code that can eliminate the security vulnerability.

[0031] Step 105: The patch code is automatically tested and verified in a sandbox environment to ensure that the security vulnerability is eliminated and no new functional anomalies are introduced.

[0032] In this embodiment, the sandbox environment is an isolated and secure testing environment used to execute unverified code without affecting the production system. Automated testing refers to the process of automatically executing test cases using testing tools and scripts.

[0033] The system deploys the generated patch code to a separate sandbox environment. Within this environment, automated testing tools execute predefined test cases to verify that the code functions correctly after the patch is applied. Simultaneously, the system performs specific security tests on the original vulnerability to confirm that the vulnerability has been eliminated. The entire verification process ensures that the patch is effective and does not introduce any new functional defects or security anomalies.

[0034] Step 106: Based on the verification results of the sandbox environment and the feedback data collected during the operation, continuously train and optimize the AI ​​model.

[0035] In this embodiment, feedback data refers to various types of information collected during system operation, testing, and remediation regarding the accuracy of vulnerability identification, the effectiveness of remediation, and system behavior. Continuous training refers to the process of periodically retraining the AI ​​model using new data to improve its performance.

[0036] The system collects verification results from the sandbox environment, including successful and unsuccessful remediation cases. Simultaneously, the system continuously collects security event logs from the production environment, user feedback on remediation results, and newly emerging attack samples. The model update module cleans and organizes this feedback data, using it as training data to fine-tune or retrain the AI ​​model, optimizing its accuracy and adaptability in vulnerability identification and remediation suggestion generation.

[0037] Step 107: The verified patch code is automatically integrated into the front-end code version management through the integration management module, completing the closed-loop repair of the vulnerability and system update.

[0038] In this embodiment, the integration management module is a software module responsible for coordinating the various components of the system and interfacing with external development and deployment platforms. Version management refers to a system that records and controls the modification history of software code.

[0039] Once the patch code passes verification in the sandbox environment, the integration management module is triggered. This module automatically commits and merges the verified patch code into the main branch or a specific branch of the front-end code through version control system hooks or continuous integration pipelines. This operation completes a fully automated closed-loop process from vulnerability detection and patching to code updates, achieving system self-updating and security hardening.

[0040] This application's embodiments utilize AI models to detect front-end code vulnerabilities in real time and automatically assess risks. Subsequently, a remediation process is triggered based on a strategy, with AI generating remediation code. The effectiveness and security of the remediation are then verified in a secure, isolated sandbox. Upon successful verification, the remediation is automatically integrated into the codebase, and the AI ​​model is continuously optimized using feedback data generated throughout the process. This series of steps works collaboratively to achieve rapid discovery, automatic remediation, reliable verification, and continuous learning of front-end security vulnerabilities, significantly improving the automation level and response efficiency of front-end application security protection, while reducing manual maintenance costs and security risks.

[0041] Optionally, step 101 includes: Step 1011: Use a code parsing tool to parse the front-end code into an abstract syntax tree structure, and traverse the nodes in the abstract syntax tree structure to locate potentially dangerous code fragments.

[0042] In this embodiment, the code parsing tool is a software program or library capable of converting source code into a structured data representation, such as the Babel Parser library, which can parse JavaScript code into an abstract syntax tree. An abstract syntax tree is an intermediate representation of the syntactic structure of source code in a tree-like structure, where each node corresponds to a syntactic construct in the source code. Dangerous code snippets refer to specific parts of the source code that may introduce security vulnerabilities, such as API calls like `innerHTML` or `document.write` that could trigger cross-site scripting attacks.

[0043] The system invokes an integrated code parsing tool to process the target front-end JavaScript code file. This tool takes the source code text as input, performs lexical and syntactic analysis, and generates a complete abstract syntax tree (AST). Subsequently, the system uses a traversal tool (such as the Babel Traverse library) to traverse each node of the AST according to a predefined algorithm. During traversal, the system compares the type and attributes of each node with a predefined dangerous pattern rule base. When a specific dangerous API call or code pattern is matched, the system determines that the corresponding source code region is a potentially dangerous code fragment and records its location information.

[0044] Step 1012: During the execution of the front-end code, user interaction behavior is simulated and test scripts are injected through browser automation tools to monitor changes and abnormal events in the document object model.

[0045] In this embodiment, a browser automation tool is a software library or framework capable of programmatically controlling browser behavior, such as Puppeteer, which can launch a headless browser instance and simulate user actions. User interaction behavior refers to typical actions a user takes when interacting with a web page, such as mouse clicks, keyboard input, and form submissions. A test script is a code snippet specifically designed to trigger or detect security vulnerabilities, such as a string containing malicious JavaScript. The Document Object Model (DOM) is the programming interface for HTML and XML documents; it represents a page in a tree structure, allowing programs and scripts to dynamically access and update the document's content, structure, and style.

[0046] The system launches a browser automation tool, controlling a headless browser instance to load the front-end application to be tested. Using this tool, the system programmatically simulates a series of predefined user interactions, such as entering test scripts in input boxes, clicking specific buttons or links, etc. Simultaneously, the system listens for and records changes to the page's Document Object Model (DOM) structure, error or warning messages output to the console, and runtime events such as network requests via the browser developer tools protocol. By analyzing this monitoring data, the system can detect abnormal modifications to the DOM or script execution caused by simulated malicious input, thereby identifying security vulnerabilities hidden in dynamic behaviors.

[0047] Step 1013: For the front-end code using the real-time communication protocol, collect the signaling and data transmission information in the communication protocol, and analyze whether there is a risk of missing encryption or unauthorized access in combination with the AI ​​model.

[0048] In this embodiment, the real-time communication protocol is a network protocol, such as WebRTC, that supports low-latency, bidirectional communication between a web browser and a server, or between browsers. Signaling information refers to control messages exchanged during the establishment, management, and termination of communication sessions, such as session description protocol information used to negotiate connection parameters in WebRTC. Data transmission information refers to the content and metadata of the media stream or data stream actually transmitted in the communication channel. Lack of encryption refers to a situation where communication data is not protected by encryption algorithms during transmission, potentially leading to eavesdropping or tampering. Unauthorized access risk refers to the security threat that allows unauthorized entities to access or intercept the communication stream.

[0049] For front-end applications using real-time communication protocols such as WebRTC, the system utilizes the browser's built-in diagnostic interface or external packet capture tools to collect signaling and data flow information during communication establishment and transmission. The system parses the collected session description protocol and other content to check for any mandatory encryption instructions. Simultaneously, the system analyzes transport layer data packets to determine if a secure transmission protocol is used. The system inputs the collected and preprocessed protocol analysis data into an AI model. Based on its training data, the AI ​​model analyzes these signaling and data transmission patterns to determine if the current communication carries risks such as unenabled encryption, the use of insecure transmission methods, or configuration flaws that could be exploited by man-in-the-middle attacks.

[0050] Step 1014: For the front-end code using the WebSocket or MCP protocol, intercept and analyze the communication message content to identify whether there is leakage of sensitive information or abnormal behavior patterns.

[0051] In this application embodiment, the WebSocket protocol is a network protocol that provides a full-duplex communication channel over a single TCP connection. The MCP protocol is a communication specification for Model Context Protocols. Communication message content refers to the actual data payload sent and received through a WebSocket or MCP connection. Sensitive information disclosure refers to the plaintext transmission or improper exposure of information that should not be publicly disclosed, such as authentication tokens, user identifiers, and personal data, during communication. Abnormal behavior patterns refer to message sequences or data patterns that deviate from normal communication logic and may indicate attack behavior, such as high-frequency repetitive messages, extremely large data payloads, or data packets that conform to known attack characteristics.

[0052] For front-end code using WebSocket or MCP protocols for communication, the system intercepts messages at both sending and receiving nodes through injected monitoring scripts or integrated development environment (IDE) protocols. The system captures complete communication messages, including message headers and bodies. Subsequently, the system parses and analyzes the message content, checking for any sensitive information fields carried in plaintext. Simultaneously, the system uses an AI model to perform pattern recognition on the continuous message stream. Based on normal and abnormal patterns learned during training, the AI ​​model determines whether the current communication sequence contains abnormal behavioral characteristics such as denial-of-service attack probes, protocol abuse, or data leakage.

[0053] This application's embodiments construct a multi-layered, comprehensive front-end code security vulnerability detection system by sequentially performing static code structure analysis, dynamic runtime behavior monitoring, real-time deep detection of communication protocols, and application-layer communication message auditing. This system covers the entire attack surface, from source code defects to runtime interaction risks and network communication security, achieving automated and accurate identification of various front-end security threats such as cross-site scripting, DOM injection, insecure data transmission, and information leakage. This provides a comprehensive and reliable basis for subsequent automatic remediation, significantly improving the overall security of front-end applications.

[0054] Optionally, step 1011 includes: Step 10111: Input the source code of the front-end code into the code parsing library to generate the corresponding abstract syntax tree representation.

[0055] In this embodiment, the code parsing library is a software tool or program library capable of reading source code text and converting it into a structured data representation according to the syntax rules of the programming language. An abstract syntax tree (AST) is a tree-like data structure that represents the syntactic structure of source code in a hierarchical manner. Each node corresponds to a syntactic construct in the source code (such as an expression, statement, function declaration, etc.), thereby stripping away the specific format details of the source code and facilitating programmatic analysis and processing.

[0056] The system first obtains the raw source code text of the front-end code. Then, the system calls a pre-integrated code parsing library, such as Babel Parser. The system passes the source code text as input to the parsing library. The parsing library performs a parsing process, performing lexical and syntactic analysis on the source code according to the syntax specifications of front-end languages ​​such as JavaScript. After parsing, the parsing library outputs a structured abstract syntax tree object. The system receives and stores this abstract syntax tree, providing a data foundation for subsequent analysis steps.

[0057] Step 10112: Traverse each node in the abstract syntax tree and identify code nodes that contain dangerous application programming interface calls.

[0058] In this application embodiment, traversal refers to the process by which the system visits each node in the abstract syntax tree in a specific order (such as depth-first or breadth-first). A node is the basic building block in the abstract syntax tree, representing a syntactic element in the source code. Dangerous application programming interface (API) calls refer to calls to built-in functions or methods in the code that may cause security problems, such as assigning a value to the `innerHTML` property or calling the `document.write` method when manipulating the document object model, which may lead to cross-site scripting vulnerabilities.

[0059] The system starts from the root node of the generated abstract syntax tree and systematically visits each node in the tree using a traversal utility library (such as BabelTraverse). When visiting each node, the system examines the syntax construct type that the node represents. The system compares the node type to a predefined list containing known dangerous application programming interface (API) names (such as `innerHTML`, `document.write`). When the system finds that a node represents a function call or property assignment, and its identifier matches an entry in the list of dangerous APIs, the system marks the node as a "code node containing a dangerous API call". The system records references or location information for all such identified nodes.

[0060] Step 10113: Input the code node containing the dangerous application interface call and its context information into the AI ​​model, and the AI ​​model determines whether the code node constitutes a security vulnerability.

[0061] In this embodiment, contextual information refers to the relevant code information surrounding the identified dangerous application interface call node. This may include the function scope where the call occurs, the source of variables (such as whether they are user input), adjacent control flow statements, etc. This information helps to more accurately assess vulnerability risks. The AI ​​model refers to a trained deep learning model that has the ability to understand code semantics and identify potential security patterns.

[0062] For each identified dangerous code node, the system extracts its representation in the abstract syntax tree and its contextual information. This information is then organized into a model-understandable format, such as constructing a hint text containing code snippets and contextual descriptions. Next, the system invokes a deployed AI model (such as GPT-4 or DeepSeek models) and sends the constructed hint text as input. Upon receiving the input, the AI ​​model, based on its trained knowledge, analyzes how the dangerous application interface is used in the given context, assesses whether it actually constitutes an exploitable security vulnerability (such as cross-site scripting), and outputs a judgment result. The system receives the AI ​​model's output, thus completing the determination of whether a security vulnerability exists for that code node.

[0063] This application embodiment achieves automated and accurate identification of potential security vulnerabilities in front-end source code by sequentially executing three steps: code parsing, dangerous interface identification, and AI intelligent judgment. This method combines static code analysis with artificial intelligence, not only mechanically searching for dangerous function calls but also intelligently judging their true risk based on context. This effectively reduces false positives, improves the accuracy and efficiency of vulnerability detection, and provides a reliable basis for subsequent automatic remediation processes.

[0064] Optionally, step 103 includes: Step 1031: Based on the type and scope of impact of the vulnerability in the vulnerability report, assign one of three risk levels: high, medium, or low to the security vulnerability.

[0065] In this embodiment, the risk level is a quantitative classification of the potential harm of a security vulnerability by the system, used to distinguish the urgency of the vulnerability and the priority of its remediation. High, medium, and low risk levels correspond to different degrees of harm and corresponding handling strategies.

[0066] The system receives a vulnerability report generated by the vulnerability detection module. The system parses the report, extracting information about the vulnerability type and its impact. Based on a pre-defined rule base, the system comprehensively evaluates both the vulnerability type and its impact. Based on the evaluation results, the system assigns a specific risk level to the security vulnerability, which can be high, medium, or low, and stores this risk level information in the vulnerability report.

[0067] Step 1032: If the risk level of the security vulnerability is high or medium, the automatic repair process is triggered immediately.

[0068] In this embodiment of the application, the automatic repair process is a set of predefined steps that are automatically executed by the machine within the system, designed to generate and apply code patches to eliminate identified security vulnerabilities.

[0069] The system reads the risk level assigned to the security vulnerability. The system then determines whether the risk level is "high" or "medium." If the determination is yes, the system immediately sends a command to the automatic remediation module, triggering a complete automatic remediation process, including generating a patch and other subsequent operations.

[0070] Step 1033: If the risk level of the security vulnerability is low, the vulnerability report is submitted to the manual review process, and a decision is made on whether to start the automatic repair process after manual confirmation.

[0071] In this embodiment of the application, the manual review process is a processing sequence that requires human intervention to make judgments and decisions. In this process, the system presents vulnerability information to the operator and waits for their instructions.

[0072] The system reads the risk level assigned to the security vulnerability. The system determines whether the risk level is "low". If the result is yes, the system submits the vulnerability report and related context information to a pending queue or interface, initiating a manual review process. During this process, the system waits for confirmation from a human operator. Only after receiving confirmation from a human operator to initiate the remediation process will the subsequent automatic remediation process be triggered.

[0073] This application's embodiments achieve differentiated processing of remediation responses by automatically assessing the vulnerability risk level. For high- and medium-risk vulnerabilities, the system immediately initiates automatic remediation, ensuring rapid response and containment of critical security threats and reducing vulnerability exposure time. For low-risk vulnerabilities, the system introduces a manual review process, avoiding the potential impact of unnecessary automated operations on code stability and achieving a balance between security remediation efficiency and code quality assurance.

[0074] Optionally, step 104 includes: Step 1041: Extract the code snippet containing the vulnerability, the vulnerability type, and a description of the remediation suggestions from the vulnerability report.

[0075] In this embodiment, a vulnerability report is a structured data document automatically generated by the system after detecting a security vulnerability in the front-end code, recording detailed information about the vulnerability. A code snippet refers to a portion of the front-end source code containing a potential security vulnerability. The vulnerability type is a classification identifier for the discovered security issue, such as cross-site scripting or cross-site request forgery. The remediation suggestion description is a preliminary textual explanation generated by the system, tailored to a specific vulnerability type and code context, on how to correct the code to eliminate the security risk.

[0076] The system first parses the vulnerability report generated by the vulnerability detection module. Based on a predefined data structure, the system locates and extracts the source code segments (code snippets) identified as potentially at risk from the report. Simultaneously, the system reads the vulnerability classification tags marked in the report to obtain the vulnerability type and retrieves the associated preliminary remediation text (remediation suggestion description). This information is then stored as input data for subsequent processing steps.

[0077] Step 1042: Combine the code snippet with the repair suggestion description into a prompt text and input it into the AI ​​model.

[0078] In this embodiment, the prompt text is a piece of natural language or structured instruction text that the system combines code snippets and repair suggestion descriptions according to specific format rules, used to guide the AI ​​model to perform a specific task. The AI ​​model refers to a deep learning model that has been trained to understand code semantics and security rules and generate code.

[0079] The system uses the extracted code snippets and remediation suggestion descriptions as basic elements. It combines these elements according to a preset template, generating a formatted string like "The following JS code contains a [vulnerability type] vulnerability. The remediation suggestion is [remediation suggestion description]. Please generate the remediated code: [code snippet]", thus forming a complete prompt text. Subsequently, the system calls the AI ​​model service through an application programming interface (API) and sends the constructed prompt text as input to the AI ​​model.

[0080] Step 1043: Receive the modified code snippet output by the AI ​​model as the repair patch code.

[0081] In this embodiment, the modified code snippet is a new version of source code generated by the AI ​​model after analyzing and reasoning based on the input prompt text, which corrects the security vulnerabilities in the original code. The patch code specifically refers to this modified code snippet, and its purpose is to directly replace or correct the insecure parts of the original code.

[0082] After submitting the hint text to the AI ​​model, the system enters a waiting state. Once the AI ​​model processes the hint text, it returns a response containing the corrected code. The system receives this response and parses the modified code snippet generated by the AI ​​model from the response data. The system identifies this code snippet as the patch code for the current vulnerability and caches it, preparing it for subsequent packaging and application steps.

[0083] Step 1044: Encapsulate the repair patch code into a patch file format that conforms to the version management tool specifications.

[0084] In this embodiment, the version management tool is software used to track and manage the history of source code changes, such as Git. The patch file format is a standardized file format used to describe the differences between different versions of source code files. It typically includes information such as the changes, target file paths, and line numbers, so that the version management tool can identify and apply these changes.

[0085] Optionally, step 1044 includes: Step 10441: Associate the patch code with the code location information recorded in the vulnerability report.

[0086] In this embodiment, the patch code refers to the code snippet generated by the automatic patching module using an AI model to correct identified security vulnerabilities in the front-end code. The vulnerability report is structured data generated by the vulnerability detection module, containing information such as vulnerability type, code location, and impact level. The code location information specifically refers to the exact file path where the vulnerability is located in the code repository, along with the line number within that file.

[0087] The system performs a correlation operation. First, it retrieves the generated patch code from the output of the automatic patching module. Simultaneously, it extracts pre-recorded code location information from the vulnerability report that triggered the automatic patching. This information precisely points to the file and line number in the source code repository that needs to be modified. The system then establishes a mapping between the patch code and this code location information, ensuring that each patch code snippet clearly corresponds to the specific location in the source code that needs to be replaced or inserted. This correlation process provides precise location data for subsequent code changes and injection operations.

[0088] Step 10442: Generate a difference file containing code changes, which describes the differences between the original code and the repaired code.

[0089] In this embodiment, the difference file is a standard format file that clearly displays the specific differences, such as additions, deletions, and modifications, between the original code file and the modified code file in text form. The code changes refer to the set of changes that occur in the completely new version of the code after the patch code is applied to a specified location in the original code, compared to the original version.

[0090] The system generates a diff file. Based on established relationships, the system builds a new version of the source code file, applying the patch code, in memory or temporary storage. Using the built-in diff comparison functionality of version control tools (such as Git), the system performs a line-by-line comparison and analysis between the newly built source code file and the original source code file extracted from the code repository. The system organizes and encodes all changes identified in the comparison and analysis according to a predefined diff file format (such as Git's diff format), ultimately generating a structured diff file. This file precisely records every modification made to the original code to fix the vulnerability.

[0091] Step 10443: Inject the difference file into a specific branch of the code repository through the hook mechanism of the version control system.

[0092] In this embodiment, a version control system is a software tool, such as Git, used to track and manage the history of all changes to source code files. A hook mechanism is an event-triggered interface provided by the version control system, allowing custom scripts to be executed automatically when a specific operation (such as committing code) occurs. A specific branch is an independent code line in the version control system used to isolate development work, such as a "test" branch for testing or an "integration" branch for integration.

[0093] The system performs code injection. It calls the version control system's command-line interface or API, taking the difference file generated in step 10442 as input. Utilizing the version control system's hook mechanisms, such as the `pre-commit` hook triggered before a code commit or the `commit-msg` hook triggered when preparing a commit message, the system automatically executes a predefined injection script. This script receives the difference file and automatically applies its contents as a new set of code changes (i.e., a patch) to a pre-configured specific branch (such as a test branch) in the code repository. This process automates the integration of code fixes, eliminating the need for manual merge operations.

[0094] This application's embodiments ensure the accuracy of modifications by associating patches with vulnerability locations, standardize change descriptions by generating difference files, and finally achieve seamless and automatic injection of fix code into the development process through a hook mechanism. This series of operations quickly and reliably transforms AI-generated fixes into actual changes in the code repository, greatly improving the automation and efficiency from vulnerability identification to code repair, reducing manual intervention and potential errors, and ensuring the timely implementation of security fixes.

[0095] Optionally, step 105 includes: Step 1051: Deploy a copy of the front-end application containing the fix patch code in an isolated sandbox environment.

[0096] In this embodiment, the sandbox environment is a controlled computing environment isolated from the production environment, used to securely execute and test unverified code or programs, preventing them from affecting the main system. A front-end application copy refers to a complete application version that has been copied from the original front-end application code and has integrated the aforementioned patch code.

[0097] The system first creates an isolated sandbox environment. Next, the system deploys the complete front-end application code, with the patched code integrated, into this sandbox environment. This deployment process includes configuring the necessary runtime environment, installing dependencies, and starting a copy of the front-end application to ensure it can run independently within the sandbox, preparing it for subsequent verification steps.

[0098] Step 1052: Execute predefined automated test cases to verify whether the functionality of the front-end application copy is normal.

[0099] In this embodiment, an automated test case is a pre-written set of instructions used to automatically verify whether a specific function or behavior of the software is correct. Normal functionality means that the various operations, interactions, and business logic of the front-end application copy can be executed as expected according to the design and specifications, without producing errors or abnormal behavior.

[0100] The system invokes an automated testing framework to load a predefined set of test cases for the front-end application. The system automatically executes these test cases in a sandbox environment, simulating user actions and checking application responses. The system compares the actual execution results with the expected results to determine whether each function of the front-end application replica is functioning correctly and records the verification status of each function.

[0101] Step 1053: Simulate attack behavior against the patched vulnerability to verify whether the security vulnerability has been successfully eliminated.

[0102] In this application's embodiments, an attack behavior refers to a sequence of operations that simulates a malicious user or program using typical methods to probe or damage the system by exploiting known security vulnerabilities. Successful removal of a security vulnerability means that, after being patched, the front-end application can effectively resist the corresponding attack attempts and no longer exhibits the original security flaws.

[0103] Based on the vulnerability type in the vulnerability report, the system constructs and injects corresponding attack payloads or executes specific attack sequences. These simulated attacks are triggered on a copy of the front-end application running in a sandbox environment. The system monitors the application's responses, network requests, DOM state, and console output to analyze for signs of successful vulnerability exploitation, thereby confirming whether the security vulnerability has been effectively patched by the fix code.

[0104] Step 1054: Record the execution results and system logs during the test process, and generate a test verification report.

[0105] In this embodiment, the execution result refers to the pass, fail, or error status information generated by the automated test cases and simulated attack verification steps. The system log is a file or data stream automatically generated during software operation, recording its internal events, state changes, and error information. The test verification report is a structured document summarizing the results, conclusions, and related evidence of all verification activities.

[0106] The system continuously collects and stores the execution results of each test case, the verification results of simulated attacks, and detailed system logs generated in the sandbox environment. The system then organizes, analyzes, and summarizes this data, generating a structured test verification report according to a preset template. This report includes a verification overview, detailed results data, log summaries, and final conclusions regarding the effectiveness and security of the patch.

[0107] This application's embodiments enable comprehensive functional regression testing and security effectiveness verification of front-end applications integrated with patched security measures within a secure sandbox isolated from the actual production environment. This automated process ensures that the patch not only does not break the application's original functionality but also effectively eliminates the target security vulnerabilities. This provides reliable quality and security assurance before applying the patch to the production environment, reducing the risk of introducing new problems or rendering the patch ineffective.

[0108] Optionally, the main objective of this application is to provide an automatic repair system and implementation method for front-end code security vulnerabilities based on an AI model, aiming to achieve the following objectives: Real-time detection: Utilize AI models to perform real-time vulnerability scanning on web front-end code (especially in web video conferencing systems) to quickly identify security risks; Automated repair: Based on the detection results, AI automatically generates repair patches, reducing manual intervention; Dynamic feedback and self-learning: By collecting feedback data during system operation, the AI ​​model and repair strategy are continuously optimized to improve repair accuracy and system security.

[0109] The core innovation of this application lies in the process of using AI models to automatically detect security vulnerabilities in front-end code and generate remediation solutions.

[0110] This application constructs an automated security remediation system, mainly including a vulnerability detection module, an automatic remediation module, a verification and feedback module, and a model update module. The system is deployed in a web front-end system environment, capable of real-time monitoring of the front-end code, rapidly generating patches for detected security vulnerabilities, automatically verifying the patch effects in the background, and ultimately completing the code update. The overall system architecture is attached. Figure 2 As shown in the attached flowchart Figure 3 As shown in the attached diagram, the interaction is as follows. Figure 4 As shown in the attached scene diagram. Figure 5 As shown.

[0111] The system in some embodiments of this application includes: Vulnerability detection module: Integrated into the front-end code deployment environment, it uses a pre-trained AI model to perform static and dynamic scanning of the front-end code to identify potential security vulnerabilities.

[0112] Automatic Repair Module: Upon receiving vulnerability information, this module uses an AI model to generate corresponding repair code. It supports various repair strategies, such as code injection correction, enhanced input filtering, and DOM manipulation security hardening.

[0113] Verification and feedback module: Automatically executes tests on the fixed code in a sandbox environment to check whether the vulnerability has been completely eliminated, while ensuring that no new errors are introduced.

[0114] Model update module: Collects actual repair effects and user feedback to update the parameters and knowledge base of the AI ​​model, enabling continuous self-learning and optimization.

[0115] Integration Management Module: Responsible for interfacing with the web front-end system and deployment platform to achieve automated management of the entire process.

[0116] Some embodiments of this application include: Real-time vulnerability detection: During the submission, deployment, and operation of the front-end code, the vulnerability detection module continuously scans the page.

[0117] The process of static code analysis and AI recognition during the deployment phase is as follows: First, the Babel Parser library is used to parse the front-end JS source code into an AST (Abstract Syntax Tree). Then, the BabelTraverse library is used to traverse the nodes to find dangerous code (such as innerHTML, document.write, etc.). Finally, an AI model (such as GPT-4, DeepSeek-R1 / V3) is used to take the AST context as the Prompt input for vulnerability identification.

[0118] The runtime vulnerability detection process is as follows: First, use Puppeteer to launch the HeadLess browser to simulate user behavior (clicking, entering malicious scripts, etc.). <script>alert(1)< / script>Then, the Chrome DevTools Protocol is used to monitor DOM changes and abnormal operations. Finally, AI models (such as GPT-4 and DeepSeek-R1 / V3) are used to analyze behavior logs, monitor events, and identify potential DOM injection / XSS vulnerabilities.

[0119] The WebRTC security testing process is as follows: Collect STUN / TURN / ICE information using WebRTC Internals (a built-in Chrome page, accessed via chrome: / / webrtc-internals / ): whether the SDP contains "a=crypto" (encrypted signaling), use Wireshark to capture WebRTC data streams and combine with AI models to analyze whether SRTP (encrypted RTP) is used, whether DTLS-SRTP is enabled, whether there is raw RTP transmission, whether there is a MITM attack, whether there is unauthorized access, etc., and use the OpenTelemetry JS SDK to monitor WebRTC API calls and upload logs.

[0120] The process of security testing for communication APIs (WebSocket / MCP) is as follows: WebSocket: Intercept WebSocket messages using browser tools such as Chrome DevTools Protocol, then use AI to analyze whether they contain sensitive information (token, user_id, etc.). MCP Protocol: Use the OpenTelemetryJS SDK and AI to train models to identify abnormal behavior patterns in the protocol message structure (such as DOS attacks, repeated heartbeats, excessively long payloads).

[0121] Vulnerability Reporting and Automatic Repair Trigger Mechanism: When the detection module discovers a security vulnerability, it automatically generates a vulnerability report. The system determines whether the vulnerability needs to be automatically repaired based on preset rules. If the threshold is reached, the automatic repair module is triggered; if the threshold is not reached, manual review is triggered.

[0122] The process of automatically generating vulnerability reports is as follows: The vulnerability report structure includes the vulnerability type (XSS, CSRF, etc.), code location (filename + line and column number), and impact level (combined with AI to determine the scope of impact). Then, the ESLint plugin is used to dynamically mark risky code nodes, store them in a JSON data structure, and report them to the server. The JSON structure is: {"type": "XSS", "file": "index.js", "line": 23, "recommendation": "Use textContent instead of innerHTML"} The process of triggering the strategy is as follows: Configurable rules currently include: medium- and high-risk vulnerabilities will trigger immediate repair; low-risk vulnerabilities will trigger manual review and manual confirmation before a decision is made on whether to repair them; and multiple occurrences (>3) or company feedback on the impact will trigger immediate repair.

[0123] Automatically generate patch: The automatic patching module calls the AI ​​model to generate corresponding patch code based on the vulnerability report, and finally automatically applies it to the test version via Git Hooks.

[0124] The process of generating AI patch fixes is as follows: If using foreign AI models (such as GPT-4), you can use Codex; if using DeepSeek models, you can use DeepSeekCoder to call the model and input the vulnerability context and remediation target into the AI ​​model (e.g., "The following JS code has an XSS vulnerability. Please generate the remediated code and use textContent instead of innerHTML: let input = userInput; div.innerHTML = input;").

[0125] The repair process is as follows: Replace dangerous APIs (such as innerHTML) Add textContent, add input validation (such as escapeHTML(), regular expression restrictions), and encrypt transmission parameters (such as forcing encryption in SDP configuration).

[0126] The process of integrating code injection with Git Hooks is as follows: The generated fix code serves as a patch, which is then injected into the test branch via a git commit-msg hook or CI pipeline. The sandbox environment validation process is as follows: You can choose appropriate automated testing tools. Here, we choose Jest (a unit testing framework) and Puppeteer (a browser automation tool) to perform automated testing to see if the functionality of the fixed code is affected and to verify whether the vulnerability has been resolved. If it is resolved, the results are fed back to the platform (the platform will decide whether to merge this patch into the official version). If it is not resolved, the patch is automatically rolled back (git revert) and the current abnormal samples are recorded for AI retraining.

[0127] Dynamic feedback and model self-learning: The system collects operational data after vulnerability patching, feedback from testers, and security event logs in real time. Finally, the model update module trains the AI ​​model online based on the feedback data, optimizes vulnerability identification and patching strategies, and forms a closed-loop learning mechanism.

[0128] The data sourcing process is as follows: Manual feedback (click the "Repair Invalid" button), cases that the AI ​​model failed to fix, sandbox test failures, and new attack samples (such as XSS payloads) added during system operation.

[0129] The process of continuous model training is as follows: Clean the data → Fine-tune the model (e.g., fine-tune DeepSeek-V3) → Roll out the model (A / B testing the effect of the new model).

[0130] Fine-tune the model's recommendation strategy by incorporating RLHF (Human Feedback Reinforcement Learning).

[0131] Real-time web front-end vulnerability detection mechanism: Deploy a real-time monitoring module on the front end, and use AI models to perform static and dynamic analysis of the code to quickly identify vulnerabilities, significantly shorten the vulnerability discovery time, eliminate security risks in a timely manner, and ensure the safe and stable operation of the system.

[0132] AI-based automated patching: Utilizing AI models to automatically generate patching based on vulnerability reports enables code self-healing, which can significantly reduce manual maintenance costs and improve the level of front-end security automation.

[0133] Sandbox environment verification and dynamic feedback mechanism: The patch is automatically applied after being verified in the sandbox, and the verification results are fed back to the model update module to achieve closed-loop optimization, ensuring that the patch is effective and does not introduce new problems, and realizing system self-learning and continuous improvement.

[0134] Multi-level remediation strategy: For vulnerabilities of different risk levels, the system can provide a tiered remediation plan. Low-risk vulnerabilities are patched with hot updates, while high-risk vulnerabilities require manual confirmation before being merged into the official release package.

[0135] Based on the foregoing embodiments, this application provides an automatic repair device for front-end code security vulnerabilities. The device includes various units and modules included in each unit, which can be implemented by a processor in a computer device; of course, it can also be implemented by specific logic circuits. In the implementation process, the processor can be a central processing unit (CPU), a microprocessor unit (MPU), a digital signal processor (DSP), or a field programmable gate array (FPGA), etc.

[0136] Figure 6 A schematic diagram illustrating the composition of an automatic front-end code security vulnerability repair device provided in this application embodiment is shown below. Figure 6 As shown, the automatic front-end code security vulnerability repair device 20 includes: The identification module 201 is used to perform static analysis and dynamic behavior monitoring of the front-end code in the front-end code deployment and operation environment using a pre-trained AI model to identify security vulnerabilities in the front-end code. Based on the type and impact level of the identified security vulnerabilities, an automatic vulnerability report is generated, which includes the vulnerability type, code location, and remediation suggestions. Based on the risk level of the vulnerability in the vulnerability report and the preset triggering strategy, determine whether to start the automatic remediation process; The repair module 202 is used to call the AI ​​model and generate repair patch code for the security vulnerability based on the repair suggestions in the vulnerability report when the automatic repair process is started. The patch code was automatically tested and verified in a sandbox environment to ensure that the security vulnerability was eliminated and no new functional anomalies were introduced. Based on the verification results of the sandbox environment and the feedback data collected during the operation, the AI ​​model is continuously trained and optimized. The integrated management module automatically integrates verified patch code into the front-end code version management, completing the closed-loop repair of vulnerabilities and system updates.

[0137] Optionally, the identification module 201 is further configured to: Use code parsing tools to parse the front-end code into an abstract syntax tree structure, and traverse the nodes in the abstract syntax tree structure to locate potentially dangerous code fragments; During the execution of the front-end code, user interaction behavior is simulated and test scripts are injected through browser automation tools to monitor changes and abnormal events in the document object model. For the front-end code that uses the real-time communication protocol, the signaling and data transmission information in the communication protocol is collected, and the AI ​​model is used to analyze whether there is a risk of missing encryption or unauthorized access. For the front-end code using the WebSocket or MCP protocol, intercept and analyze the communication message content to identify whether there is leakage of sensitive information or abnormal behavior patterns.

[0138] Optionally, the identification module 201 is further configured to: The source code of the front-end code is input into the code parsing library to generate the corresponding abstract syntax tree representation; Traverse each node in the abstract syntax tree to identify code nodes containing dangerous application programming interface calls; The code node containing the dangerous application interface call and its context information are input into the AI ​​model, which then determines whether the code node constitutes a security vulnerability.

[0139] Optionally, the identification module 201 is further configured to: Based on the type and scope of impact of the vulnerability in the vulnerability report, the security vulnerability is assigned one of three risk levels: high, medium, or low. If the risk level of the security vulnerability is high or medium, the automatic repair process will be triggered immediately. If the risk level of the security vulnerability is low, the vulnerability report will be submitted to the manual review process, and a decision will be made on whether to start the automatic repair process after manual confirmation.

[0140] Optionally, the repair module 202 is further configured to: Extract the code snippet containing the vulnerability, the vulnerability type, and a description of the suggested remediation from the vulnerability report; The code snippet and the repair suggestion description are combined into a prompt text, which is then input into the AI ​​model; The modified code snippet output by the AI ​​model is received as the repair patch code; The fix patch code is packaged into a patch file format that conforms to the version control tool specifications.

[0141] Optionally, the repair module 202 is further configured to: Associate the patch code with the code location information recorded in the vulnerability report; Generate a difference file containing code changes, which describes the differences between the original code and the fixed code; The difference file is injected into a specific branch of the code repository through the version control system's hook mechanism.

[0142] Optionally, the repair module 202 is further configured to: Deploy a copy of the front-end application containing the patch code in an isolated sandbox environment; Execute predefined automated test cases to verify whether the functionality of the front-end application copy is normal; Simulate attack behaviors targeting patched vulnerabilities to verify whether the security vulnerabilities have been successfully eliminated; Record the execution results and system logs during the testing process, and generate a test verification report.

[0143] This application's embodiments utilize AI models to detect front-end code vulnerabilities in real time and automatically assess risks. Subsequently, a remediation process is triggered based on a strategy, with AI generating remediation code. The effectiveness and security of the remediation are then verified in a secure, isolated sandbox. Upon successful verification, the remediation is automatically integrated into the codebase, and the AI ​​model is continuously optimized using feedback data generated throughout the process. This series of steps works collaboratively to achieve rapid discovery, automatic remediation, reliable verification, and continuous learning of front-end security vulnerabilities, significantly improving the automation level and response efficiency of front-end application security protection, while reducing manual maintenance costs and security risks.

[0144] The descriptions of the apparatus embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. In some embodiments, the functions or modules included in the apparatus provided in this application can be used to perform the methods described in the method embodiments above. For technical details not disclosed in the apparatus embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0145] If the technical solution of this application involves personal information, the product using this technical solution has clearly informed the user of the personal information processing rules and obtained the user's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using this technical solution has obtained the user's separate consent before processing the sensitive personal information, and also meets the requirement of "express consent". For example, at personal information collection devices such as cameras, clear and prominent signs are set up to inform users that they have entered the scope of personal information collection and that personal information will be collected. If an individual voluntarily enters the collection scope, it is deemed that they have agreed to the collection of their personal information; or on the personal information processing device, the personal information processing rules are clearly informed through signs / information, and authorization is obtained through pop-up information or by asking the individual to upload their personal information; wherein, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the types of personal information processed.

[0146] It should be noted that, in the embodiments of this application, if the above-mentioned automatic repair method for front-end code security vulnerabilities is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, mobile hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware, software, or firmware, or any combination of hardware, software, and firmware.

[0147] This application provides a computer device including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements some or all of the steps in the above-described method.

[0148] This application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described method. The computer-readable storage medium can be transient or non-transient.

[0149] This application provides a computer program including computer-readable code, wherein when the computer-readable code is executed in a computer device, a processor in the computer device performs some or all of the steps in the above-described method.

[0150] This application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, it implements some or all of the steps in the above-described method. This computer program product can be implemented specifically through hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium; in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0151] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between them, while their similarities or commonalities can be referred to interchangeably. The descriptions of the above embodiments of the device, storage medium, computer program, and computer program product are similar to the descriptions of the above method embodiments and have similar beneficial effects. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0152] It should be noted that, Figure 7 This is a schematic diagram of a hardware entity of a computer device in an embodiment of this application, such as... Figure 7 As shown, the hardware entity of the computer device 700 includes: one or more processors 701, a communication interface 702, and a memory 703, wherein: Processor 701 typically controls the overall operation of computer device 700.

[0153] Communication interface 702 enables computer devices to communicate with other terminals or servers over a network.

[0154] The memory 703 is configured to store instructions and applications executable by the processor 701, and can also cache data to be processed or already processed (e.g., image data, audio data, voice communication data, and video communication data) in the processor 701 and various modules in the computer device 700. It can be implemented using flash memory or random access memory (RAM). Data transfer between the processor 701, the communication interface 702, and the memory 703 can be performed via bus 704. Only one processor is shown in the figure; each processor 100 includes one or more cores.

[0155] It should be noted that the computer device may include multiple processors 701, and each processor 701 can interact with each other through aggregated communication methods such as all-to-all, all-gather, or all-reduce. The processors 701 may be central processing units (CPUs), graphics processing units (GPUs), embedded neural network processing units (NPUs), tensor processing units (TPUs), data processing units (DPUs), accelerated processing units (APUs), floating-point processing units (FPUs), or application-specific integrated circuits (ASICs). The processors may also be single-core or multi-core processors. The processor may consist of a CPU and hardware chips. The hardware chips may be ASICs, PLDs, or combinations thereof. The PLDs may be complex programmable logic devices (CPLDs), FPGAs, generic array logic (GALs), or any combination thereof. The processor can also be implemented using logic devices with built-in processing logic, such as FPGAs or digital signal processors (DSPs).

[0156] The communication interface 702 can be a wired interface or a wireless interface, used to communicate with other modules or devices. The wired interface can be an Ethernet interface, a local interconnect network (LIN), etc., and the wireless interface can be a cellular network interface or a wireless LAN interface, etc.

[0157] Memory 703 can be non-volatile memory, such as read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Memory 703 can also be volatile memory, which can be random access memory (RAM) used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synclink dynamic random access memory (SLDRAM), and direct rambus RAM (DRRAM), direct rambus DRAM (DRDRAM), and rambus DRAM.

[0158] The 704 bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc.

[0159] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above steps / processes do not imply a sequential order of execution; the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above embodiments of this application are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0160] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0161] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0162] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0163] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0164] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0165] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, magnetic disks, or optical disks.

[0166] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. An automatic repair method for front-end code security vulnerabilities, characterized in that, The method includes: In the front-end code deployment and runtime environment, a pre-trained AI model is used to perform static analysis and dynamic behavior monitoring on the front-end code to identify security vulnerabilities in the front-end code. Based on the type and impact level of the identified security vulnerabilities, an automatic vulnerability report is generated, which includes the vulnerability type, code location, and remediation suggestions. Based on the risk level of the vulnerability in the vulnerability report and the preset triggering strategy, determine whether to start the automatic remediation process; When the automatic remediation process is initiated, the AI ​​model is invoked and, based on the remediation suggestions in the vulnerability report, remediation patch code for the security vulnerability is generated; The patch code was automatically tested and verified in a sandbox environment to ensure that the security vulnerability was eliminated and no new functional anomalies were introduced. Based on the verification results of the sandbox environment and the feedback data collected during the operation, the AI ​​model is continuously trained and optimized. The integrated management module automatically integrates verified patch code into the front-end code version management, completing the closed-loop repair of vulnerabilities and system updates.

2. The method according to claim 1, characterized in that, The method of using a pre-trained AI model to perform static analysis and dynamic behavior monitoring of front-end code to identify security vulnerabilities in the front-end code includes: Use code parsing tools to parse the front-end code into an abstract syntax tree structure, and traverse the nodes in the abstract syntax tree structure to locate potentially dangerous code fragments; During the execution of the front-end code, user interaction behavior is simulated and test scripts are injected through browser automation tools to monitor changes and abnormal events in the document object model. For the front-end code that uses the real-time communication protocol, the signaling and data transmission information in the communication protocol is collected, and the AI ​​model is used to analyze whether there is a risk of missing encryption or unauthorized access. For the front-end code using the WebSocket or MCP protocol, intercept and analyze the communication message content to identify whether there is leakage of sensitive information or abnormal behavior patterns.

3. The method according to claim 2, characterized in that, The step of using a code parsing tool to parse the front-end code into an abstract syntax tree structure, and traversing the nodes in the abstract syntax tree structure to locate potentially dangerous code fragments, includes: The source code of the front-end code is input into the code parsing library to generate the corresponding abstract syntax tree representation; Traverse each node in the abstract syntax tree to identify code nodes containing dangerous application programming interface calls; The code node containing the dangerous application interface call and its context information are input into the AI ​​model, which then determines whether the code node constitutes a security vulnerability.

4. The method according to claim 1, characterized in that, The step of determining whether to initiate an automatic remediation process based on the risk level of the vulnerability in the vulnerability report and the preset triggering strategy includes: Based on the type and scope of impact of the vulnerability in the vulnerability report, the security vulnerability is assigned one of three risk levels: high, medium, or low. If the risk level of the security vulnerability is high or medium, the automatic repair process will be triggered immediately. If the risk level of the security vulnerability is low, the vulnerability report will be submitted to the manual review process, and a decision will be made on whether to start the automatic repair process after manual confirmation.

5. The method according to claim 1, characterized in that, The step of calling the AI ​​model and generating patch code for the security vulnerability based on the remediation suggestions in the vulnerability report includes: Extract the code snippet containing the vulnerability, the vulnerability type, and a description of the suggested remediation from the vulnerability report; The code snippet and the repair suggestion description are combined into a prompt text, which is then input into the AI ​​model; The modified code snippet output by the AI ​​model is received as the repair patch code; The fix patch code is packaged into a patch file format that conforms to the version control tool specifications.

6. The method according to claim 5, characterized in that, The step of encapsulating the patch code into a patch file format conforming to version control tool specifications includes: Associate the patch code with the code location information recorded in the vulnerability report; Generate a difference file containing code changes, which describes the differences between the original code and the fixed code; The difference file is injected into a specific branch of the code repository through the version control system's hook mechanism.

7. The method according to claim 1, characterized in that, The automated testing and verification of the patch code in a sandbox environment includes: Deploy a copy of the front-end application containing the patch code in an isolated sandbox environment; Execute predefined automated test cases to verify whether the functionality of the front-end application copy is normal; Simulate attack behaviors targeting patched vulnerabilities to verify whether the security vulnerabilities have been successfully eliminated; Record the execution results and system logs during the testing process, and generate a test verification report.

8. An automatic repair device for front-end code security vulnerabilities, characterized in that, The device includes: The identification module is used to perform static analysis and dynamic behavior monitoring of front-end code in the front-end code deployment and runtime environment using a pre-trained AI model to identify security vulnerabilities in the front-end code. Based on the type and impact level of the identified security vulnerabilities, an automatic vulnerability report is generated, which includes the vulnerability type, code location, and remediation suggestions. Based on the risk level of the vulnerability in the vulnerability report and the preset triggering strategy, determine whether to start the automatic remediation process; The repair module is used to call the AI ​​model and generate repair patch code for the security vulnerability based on the repair suggestions in the vulnerability report when the automatic repair process is started. The patch code was automatically tested and verified in a sandbox environment to ensure that the security vulnerability was eliminated and no new functional anomalies were introduced. Based on the verification results of the sandbox environment and the feedback data collected during the operation, the AI ​​model is continuously trained and optimized. The integrated management module automatically integrates verified patch code into the front-end code version management, completing the closed-loop repair of vulnerabilities and system updates.

9. A computer device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the automatic repair method for front-end code security vulnerabilities as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps in the automatic repair method for front-end code security vulnerabilities as described in any one of claims 1 to 7.

Images