Code execution method and device, and storage medium
By performing abstract syntax tree transformation and restricted environment execution on the code, the problem of inaccurate code security checks is solved, and the security and stability of the system's executable code are improved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- INDUSTRIAL AND COMMERCIAL BANK OF CHINA
- Filing Date
- 2026-02-09
- Publication Date
- 2026-05-29
AI Technical Summary
Existing code security inspection methods are not accurate enough, resulting in low security of executable code and poor system stability.
By performing an abstract syntax tree transformation on the code to be executed, a tree-shaped code structure is generated. Each tree node is checked and adjusted to generate the target executable code, which is then executed in a restricted environment. The restricted environment is the code execution environment after the pre-defined list of restricted objects is modified by the detection function.
This improves the accuracy of code security checks, enhances the security of executable code in the system, and thus improves system stability.
Smart Images
Figure CN122111818A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of program security technology, and more specifically, to a code execution method, apparatus, and storage medium. Background Technology
[0002] In the current technological context, code execution environments face increasingly complex code security challenges. Traditional static code analysis methods, while capable of identifying some obvious security vulnerabilities—such as detecting dangerous function calls using regular expressions—lack a deep understanding of code semantics and execution context. This leads to blind spots in security checks; for example, they cannot accurately determine whether certain dynamically generated function calls are safe, nor can they effectively identify and prevent malicious code injected through third-party library dependency chains.
[0003] While existing security checks relying on deep kernel-level integration can prevent the execution of dangerous code, such deep modifications can introduce instability and compatibility issues. This is especially true when the programming language of the execution environment is frequently updated, requiring constant re-adaptation. This not only consumes resources but can also lead to system crashes due to erroneous kernel modifications, thus reducing system stability and user experience. Existing code restriction tools, while able to limit code execution to some extent, are highly restrictive to the environment, lack flexibility, and are often inefficient, as they require rewriting and verifying each piece of code, undoubtedly increasing latency and performance overhead.
[0004] There is currently no effective solution to the problem that the code security inspection methods in related technologies are not accurate enough, resulting in low security of the executable code in the system and poor system stability. Summary of the Invention
[0005] The main objective of this application is to provide a code execution method, apparatus, and storage medium to solve the problems of inaccurate code security inspection methods and low security of executable code in the system, which leads to poor system stability.
[0006] To achieve the above objectives, according to one aspect of this application, a code execution method is provided. The method includes: performing an abstract syntax tree transformation on the code to be executed to obtain a tree-shaped code structure; inspecting each tree node in the tree-shaped code structure to obtain inspection information; adjusting the tree-shaped code structure based on the inspection information to obtain an adjusted tree-shaped code structure; generating target executable code based on the adjusted tree-shaped code structure; and executing the target executable code in a restricted environment, wherein the restricted environment refers to a code execution environment after modifying the detection function according to a preset list of restricted objects.
[0007] Optionally, performing an abstract syntax tree transformation on the code to be executed to obtain a tree-shaped code structure includes: parsing each syntax element in the code to be executed; detecting whether each syntax element has a syntax error; if the syntax element does not have a syntax error, converting the syntax element into a tree node; and integrating the tree nodes corresponding to each syntax element according to the relationship between each syntax element to obtain a tree-shaped code structure.
[0008] Optionally, before executing the target code in the restricted environment, the method further includes: obtaining the user namespace; modifying the detection function in the user namespace according to a preset list of restricted objects to modify the code execution environment and obtain the restricted environment.
[0009] Optionally, executing the target executable code in a restricted environment includes: checking the target executable code using a modified function in the user namespace; terminating the execution of the target executable code if a restricted object is detected in the target executable code; and executing the target executable code in the restricted environment if no restricted object is detected in the target executable code.
[0010] Optionally, checking each tree node in the tree code structure to obtain check information, and adjusting the tree code structure according to the check information to obtain the adjusted tree code structure includes: traversing each tree node in the tree code structure and checking whether each tree node contains abnormal code; if an abnormal code is found in a tree node, then replacing the abnormal code in the tree node if the abnormal code in the tree node meets the replacement condition, thus obtaining the adjusted tree code structure.
[0011] Optionally, traversing each tree node in the tree-shaped code structure and checking whether each tree node contains exception code includes: if the target tree node contains function execution code, then checking whether the name of the function executed in the function execution code is in the restricted object list; if the name of the function executed in the function execution code is in the restricted object list, then it is determined that the target tree node contains exception code; if the target tree node contains property call code, then checking whether the property called in the property call code is in the restricted object list; if the property called in the property call code is in the restricted object list, then it is determined that the target tree node contains exception code; if the target tree node contains module import code, then checking whether the module imported in the module import code is in the restricted object list; if the module imported in the module import code is in the restricted object list, then it is determined that the target tree node contains exception code.
[0012] Optionally, the method further includes: if the code to be executed fails to be transformed into an abstract syntax tree, determining that there is a syntax error in the code to be executed, and terminating the execution of the code to be executed.
[0013] To achieve the above objectives, according to another aspect of this application, a code execution apparatus is provided. The apparatus includes: a conversion unit for performing an abstract syntax tree conversion on the code to be executed to obtain a tree-shaped code structure; an inspection unit for inspecting each tree node in the tree-shaped code structure to obtain inspection information, and adjusting the tree-shaped code structure based on the inspection information to obtain an adjusted tree-shaped code structure; a generation unit for generating target executable code based on the adjusted tree-shaped code structure; and an execution unit for executing the target executable code in a restricted environment, wherein the restricted environment refers to a code execution environment after modifying the detection function according to a preset list of restricted objects.
[0014] According to another aspect of this application, a computer-readable storage medium is provided, which includes a stored program, wherein, when the program is running, it controls the device where the computer-readable storage medium is located to execute any code execution method.
[0015] According to another aspect of this application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include methods for performing any code execution method.
[0016] According to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of a code execution method as described above.
[0017] In this embodiment, an abstract syntax tree transformation is performed on the code to be executed to obtain a tree-shaped code structure. Each tree node in the tree-shaped code structure is inspected to obtain inspection information. The tree-shaped code structure is then adjusted based on the inspection information to obtain an adjusted tree-shaped code structure. Target executable code is generated based on the adjusted tree-shaped code structure. The target executable code is then executed in a restricted environment, where the restricted environment refers to the code execution environment after modifying the detection function according to a preset list of restricted objects. This solves the technical problem in related technologies where code security inspection methods are not accurate enough, resulting in low security of executable code and poor system stability. In this application, the text form of the code is first parsed into a tree-shaped code structure. Next, the tree-shaped code structure is inspected node by node to identify possible abnormal or dangerous elements in the code. Based on the inspection results, the tree-shaped code structure is adjusted to obtain an adjusted tree-shaped code structure. Target executable code is then generated based on the adjusted tree-shaped code structure and executed in a restricted environment. This achieves the technical effect of improving the security of executable code in the system, thereby improving system stability. Attached Figure Description
[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:
[0019] Figure 1 A hardware structure block diagram of a computer terminal for implementing a code execution method is shown;
[0020] Figure 2 This is a flowchart of the code execution method provided according to the embodiments of this application;
[0021] Figure 3 This is a schematic diagram of a code execution method provided according to an embodiment of this application;
[0022] Figure 4 This is a schematic diagram of a code execution device provided according to an embodiment of this application;
[0023] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation
[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.
[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0026] It should be noted that all relevant information (including but not limited to code information, system environment information, etc.) and data (including but not limited to data used for inspection, data used for analysis, etc.) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, if there is an interface between this system and the relevant user or organization, before obtaining the relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information from the aforementioned user or organization.
[0027] Example 1
[0028] According to an embodiment of this application, a method embodiment for code execution is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.
[0029] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a code execution method is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.
[0030] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).
[0031] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the code execution method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby implementing the above-mentioned code execution method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0032] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.
[0033] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).
[0034] Under the aforementioned operating environment, this application provides the following: Figure 2 The code execution method is shown. Figure 2 This is a flowchart of the code execution method according to Embodiment 1 of this application.
[0035] Step S201: Perform abstract syntax tree transformation on the code to be executed to obtain a tree-shaped code structure.
[0036] Optionally, the code to be executed refers to the code segment submitted by the user to the execution environment for interpretation and execution. An abstract syntax tree (AST) is a tree-like data structure used to represent the syntactic structure of source code. Each node in the tree-like code structure represents a syntactic element in the code, such as a function call, variable definition, or arithmetic expression.
[0037] Step S202: Check each tree node in the tree code structure to obtain check information, adjust the tree code structure according to the check information, and obtain the adjusted tree code structure.
[0038] Optionally, a custom SecurityVisitor class can be used to traverse each tree node in the tree-structured code and check for known dangerous behaviors. If a tree node is found to contain functions or modules from the restricted object list, this check information will be recorded for subsequent tree structure adjustments.
[0039] Step S203: Generate the target execution code based on the adjusted tree code structure.
[0040] Optionally, the adjusted tree-structured code can be decompiled back into source code to generate target executable code, which is code that has undergone security checks and adjustments.
[0041] Step S204: Execute the target execution code in a restricted environment, wherein the restricted environment refers to the code execution environment after the detection function is modified according to a preset list of restricted objects.
[0042] Optionally, a restricted environment refers to a code execution environment where specific restrictions are imposed on the code execution environment based on a list of restricted objects before code execution. A restricted environment, through predefined security policies, can prevent attempts to bypass static checks from occurring during execution.
[0043] For example, the `safe_import` function replaces the built-in `_import_` function. Before importing a module, it checks if the module name is in the restricted object list. If it is, a code exception is thrown; otherwise, the original import function is called. The `safe_function` function replaces a built-in function or a restricted function in a module. Functions in the restricted object list will call this function, throwing a safety exception indicating that the call is restricted. Otherwise, the original function is called. The `safe_getattr` function replaces the built-in `getattr` function. It first checks if the attribute name is in the restricted object list; if so, a safety exception is thrown. Then, the original `getattr` is used to retrieve the attribute value. If the retrieved value is callable (i.e., a function or method), its full path (consisting of the object name and attribute name) is further checked to see if it is in the restricted object list; if so, an exception is thrown. Otherwise, the original code is called. Furthermore, if there are custom functions or methods that need to be intercepted, targeted interception restrictions can be implemented.
[0044] The code execution method provided in this application involves: converting the code to be executed into an abstract syntax tree to obtain a tree-shaped code structure; inspecting each node in the tree-shaped code structure to obtain inspection information; adjusting the tree-shaped code structure based on the inspection information to obtain an adjusted tree-shaped code structure; generating target execution code based on the adjusted tree-shaped code structure; and executing the target execution code in a restricted environment. The restricted environment refers to the code execution environment after modifying the detection function according to a preset list of restricted objects. This method solves the technical problem in related technologies where code security inspection methods are not accurate enough, resulting in low security of the executable code in the system and poor system stability. In this application, the text form of the code is first parsed into a tree-shaped code structure. Next, the tree-shaped code structure is inspected node by node to identify possible abnormal or dangerous elements in the code. Based on the inspection results, the tree-shaped code structure is adjusted to obtain an adjusted tree-shaped code structure. Target execution code is generated based on the adjusted tree-shaped code structure, and the target execution code is executed in a restricted environment. This achieves the technical effect of improving the security of the executable code in the system, thereby improving system stability.
[0045] To improve the accuracy of code security checks, optionally, in the code execution method provided in this application embodiment, the code to be executed is subjected to an abstract syntax tree transformation to obtain a tree-shaped code structure, including:
[0046] The first step is to parse each syntax element in the code to be executed.
[0047] Optionally, syntax elements are the basic building blocks of code, such as variable declarations, function calls, loop statements, and conditional statements. By breaking down the textual form of code into a series of syntax elements, each element is independently identified and further processed to construct the basic architecture of an abstract syntax tree.
[0048] The second step is to check if there are any syntax errors in each syntax element. If there are no syntax errors in a syntax element, then the syntax element is converted into a tree node.
[0049] Optionally, after parsing the syntax elements, each syntax element is checked to see if it conforms to the syntax rules, i.e., whether there are any syntax errors. If a syntax element conforms to the syntax rules, it is converted into a tree node and added to the abstract syntax tree being built.
[0050] The third step is to integrate the tree nodes corresponding to each syntax element based on the relationships between them, thus obtaining a tree-shaped code structure.
[0051] Optionally, after all syntax elements are converted into tree nodes, the nodes of the parent element can be connected to the nodes of the child element according to the hierarchical relationship of the syntax elements to form a complete tree code structure that reflects the code structure and logic.
[0052] In summary, by parsing the syntax elements in the code to be executed, detecting the correctness of the syntax elements, and integrating all error-free syntax elements into a tree-like code structure, the accuracy and execution efficiency of code security checks are improved.
[0053] To improve system security and stability, optionally, in the code execution method provided in this application embodiment, before executing the target execution code in a restricted environment, the method further includes:
[0054] The first step is to obtain the user's namespace.
[0055] Optionally, the user namespace can be obtained using the `get_ipython().user_ns` function. The user namespace contains all variables, functions, and classes defined by the user in the code execution environment. Obtaining the user namespace prepares for modifying the execution environment in subsequent steps.
[0056] The second step is to modify the detection function in the user namespace according to the preset list of restricted objects, so as to modify the code execution environment and obtain the restricted environment.
[0057] Optionally, the restricted object list contains a set of functions, modules, or classes considered unsafe or requiring restriction, guiding how to restrict the code execution environment. For example, replacing the default `_import_` function with the `safe_import` function will cause `safe_import` to throw an exception when code attempts to import a module from the restricted object list, preventing further code execution. The `safe_function` and `safe_getattr` functions are also installed into the user's execution environment to restrict calls to functions and access to attributes from the restricted object list.
[0058] In summary, by taking the above two steps, obtaining the user namespace, and dynamically modifying the execution environment according to the preset list of restricted objects, a restricted environment is ultimately constructed, which improves the security of code execution.
[0059] To improve system security, optionally, in the code execution method provided in this application embodiment, executing the target execution code in a restricted environment includes:
[0060] The first step is to examine the target executable code using the modified functions in the user namespace.
[0061] Alternatively, the modified function refers to the function used to detect restricted objects when building a restricted environment, such as safe_import, safe_function, and safe_getattr.
[0062] The second step is to terminate the execution of the target code if it is found that the target execution code contains a restricted object.
[0063] Optionally, if the detection function identifies that the target execution code contains any restricted object, it will immediately terminate the execution of that code to prevent potential security threats from affecting the system.
[0064] The third step is to execute the target code in a restricted environment if no restricted objects are found in the target executable code.
[0065] Optionally, if the target execution code passes the first step of the detection, i.e. no restricted object is found, it can continue to execute the code in the restricted environment.
[0066] In summary, by using the modified detection function to check the target execution code through the above steps, if a restricted object is detected in the target execution code, the code execution is immediately terminated to prevent security threats. If the target execution code passes the detection, the code can be executed safely in a restricted environment, thus improving the controllability and security of the execution process.
[0067] To improve the security of code execution, optionally, in the code execution method provided in this application embodiment, each tree node in the tree code structure is checked to obtain check information, and the tree code structure is adjusted according to the check information to obtain the adjusted tree code structure, including:
[0068] The first step is to traverse each tree node in the tree-structured code and check whether each tree node contains exception code.
[0069] Optionally, a depth-first or breadth-first traversal is performed on each tree node in the abstract syntax tree to check whether each tree node involves an operation on the restricted object list. If a tree node contains an element on the restricted object list, it is marked as an exception code.
[0070] The second step is to replace the abnormal code in the tree node if the abnormal code in the tree node meets the replacement conditions, thus obtaining the adjusted tree code structure.
[0071] Optionally, the replacement condition is the criterion for determining whether the exception code can be replaced, including the rules for how to replace it. The replacement condition can be: replacing it with a safe alternative function, modifying parameters, or completely removing the dangerous operation. For example, if the exception code is a function call on a restricted object list, it can be replaced with a safe alternative function or its parameters can be modified. After replacing the exception code contained in the tree nodes, a tree-structured code structure with eliminated security vulnerabilities can be obtained.
[0072] In summary, by following the steps above, abnormal code is checked by depth-first traversing the tree code structure, and the tree code structure is adjusted based on the check information, resulting in an adjusted tree code structure that retains the functionality of the original code while removing potential security risks.
[0073] To improve the security of the target executable code, optionally, in the code execution method provided in this application embodiment, traversing each tree node in the tree-shaped code structure and checking whether each tree node contains abnormal code includes:
[0074] The first step is to check if the target tree node contains function execution code. If the name of the function in the function execution code is in the list of restricted objects, then it is determined that the target tree node contains exception code.
[0075] Optionally, by identifying function execution nodes in the tree-like code structure, it is checked whether the name of the function called in the function execution node appears in the list of restricted objects. If the function name matches any entry in the list of restricted objects, the function execution node is marked as containing exception code.
[0076] The second step is to check whether the attribute called in the target tree node is in the restricted object list if the attribute called in the attribute called in the attribute called in the attribute called in the attribute called in the restricted object list. If the attribute called in the attribute called in the attribute called in the attribute called in the restricted object list, it is determined that the target tree node contains abnormal code.
[0077] Optionally, for a property call node, it is checked whether the name of the called property is in the restricted object list. If the property name is in the restricted object list, the property call node is marked as containing exception code.
[0078] The third step is to check whether the module imported in the target tree node is in the restricted object list if the module imported in the module imported in the module imported in the module imported in the module imported in the module imported in the module imported in the module imported in the module imported in the restricted object list. If the module imported in the module imported in the module imported in the module imported in the module imported in the module imported in the restricted object list, it is determined that the target tree node contains abnormal code.
[0079] Optionally, for a module import node, it is checked whether the module specified in the module import node exists in the restricted object list. If the imported module is in the restricted object list, the module import node is marked as containing exception code.
[0080] In summary, by following the steps above and examining the tree nodes in the tree-structured code, including function execution, property calls, and module imports, to check for any abnormal code, the security of the target execution code can be improved.
[0081] To improve the security and stability of the system, optionally, in the code execution method provided in the embodiments of this application, the method further includes: if the code to be executed fails to perform abstract syntax tree transformation, it is determined that there is a syntax error in the code to be executed, and the execution of the code to be executed is terminated.
[0082] Optionally, if the code to be executed does not conform to the syntax rules or contains syntax errors during the process of attempting to convert it into an abstract syntax tree, the conversion process will not be completed, and the execution of the code to be executed can be terminated, which can avoid invalid code execution or system exceptions caused by code syntax errors.
[0083] For example, such as Figure 3 The diagram illustrates the code execution process. First, the user's execution environment is modified based on the list of restricted objects to obtain the restricted environment. A hook function is then set, which is triggered before the code execution to execute the corresponding custom code. In the custom code, the code to be executed by the user is transformed using an abstract syntax tree. If the transformation fails, it indicates that the code has a syntax error, and execution is terminated with an error message displayed. If the transformation is successful, the code is checked using the abstract syntax tree to see if there is any dangerous code. If dangerous code is found, execution is terminated; otherwise, the code is executed in the restricted environment.
[0084] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.
[0085] Example 2
[0086] This application also provides a code execution apparatus. It should be noted that the code execution apparatus of this application can be used to execute the code execution method provided in this application. The code execution apparatus provided in this application will be described below.
[0087] According to embodiments of this application, an apparatus for implementing the above-described code execution method is also provided, such as... Figure 4 As shown, the device includes: a conversion unit 401, an inspection unit 402, a generation unit 403, and an execution unit 404.
[0088] Transformation unit 401 is used to perform abstract syntax tree transformation on the code to be executed to obtain a tree-shaped code structure;
[0089] The inspection unit 402 is used to inspect each tree node in the tree code structure, obtain inspection information, adjust the tree code structure according to the inspection information, and obtain the adjusted tree code structure.
[0090] The generation unit 403 is used to generate target executable code based on the adjusted tree code structure;
[0091] Execution unit 404 is used to execute target execution code in a restricted environment, wherein the restricted environment refers to the code execution environment after the detection function is modified according to a preset list of restricted objects.
[0092] The code execution apparatus provided in this application embodiment performs abstract syntax tree conversion on the code to be executed by conversion unit 401 to obtain a tree-shaped code structure; inspection unit 402 inspects each tree node in the tree-shaped code structure to obtain inspection information, and adjusts the tree-shaped code structure according to the inspection information to obtain an adjusted tree-shaped code structure; generation unit 403 generates target execution code according to the adjusted tree-shaped code structure; and execution unit 404 executes the target execution code in a restricted environment, wherein the restricted environment refers to the code execution environment after modifying the detection function according to a preset list of restricted objects. This solves the technical problem in related technologies that the code security inspection method is not accurate enough, the execution code security in the system is low, and the system stability is poor. It achieves the technical effect of improving the security of the execution code in the system, thereby improving the system stability.
[0093] Optionally, in the code execution apparatus provided in this application embodiment, the conversion unit 401 includes: a parsing module, used to parse each syntax element in the code to be executed; a detection module, used to detect whether there is a syntax error in each syntax element, and if there is no syntax error in the syntax element, the syntax element is converted into a tree node; and an integration module, used to integrate the tree nodes corresponding to each syntax element according to the relationship between each syntax element to obtain a tree code structure.
[0094] Optionally, in the code execution apparatus provided in the embodiments of this application, the apparatus further includes: an acquisition unit, configured to acquire a user namespace before executing target execution code in a restricted environment; and a modification unit, configured to modify the detection function in the user namespace according to a preset list of restricted objects, so as to modify the code execution environment and obtain a restricted environment.
[0095] Optionally, in the code execution apparatus provided in this application embodiment, the execution unit 404 includes: a checking module, used to check the target execution code through the modified function in the user namespace; a termination module, used to terminate the execution of the target execution code if the target execution code contains a restricted object; and an execution module, used to execute the target execution code in a restricted environment if the target execution code does not contain a restricted object.
[0096] Optionally, in the code execution apparatus provided in this application embodiment, the checking unit 402 includes: a traversal module, used to traverse each tree node in the tree code structure and check whether each tree node contains abnormal code; and a replacement module, used to replace the abnormal code contained in the tree node if the abnormal code contained in the tree node meets the replacement conditions, so as to obtain the adjusted tree code structure.
[0097] Optionally, in the code execution apparatus provided in this application embodiment, the traversal module includes: a first checking submodule, configured to, if the target tree node contains function execution code, check whether the name of the function executed in the function execution code is in the restricted object list; if the name of the function executed in the function execution code is in the restricted object list, determine that the target tree node contains exception code; a second checking submodule, configured to, if the target tree node contains attribute call code, check whether the attribute called in the attribute call code is in the restricted object list; if the attribute called in the attribute call code is in the restricted object list, determine that the target tree node contains exception code; and a third checking submodule, configured to, if the target tree node contains module import code, check whether the module imported in the module import code is in the restricted object list; if the module imported in the module import code is in the restricted object list, determine that the target tree node contains exception code.
[0098] Optionally, in the code execution apparatus provided in the embodiments of this application, the apparatus further includes: a termination unit, used to terminate the execution of the code to be executed if the abstract syntax tree transformation of the code to be executed fails, determines that there is a syntax error in the code to be executed.
[0099] It should be noted that the conversion unit 401, checking unit 402, generation unit 403, and execution unit 404 mentioned above correspond to steps S201 to S204 in Embodiment 1. The four units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of the device and run in the computer terminal 10 provided in Embodiment 1.
[0100] Example 3
[0101] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.
[0102] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.
[0103] In this embodiment, the computer terminal described above can execute the program code of the following steps in the code execution method: performing an abstract syntax tree transformation on the code to be executed to obtain a tree-shaped code structure; checking each tree node in the tree-shaped code structure to obtain check information; adjusting the tree-shaped code structure according to the check information to obtain an adjusted tree-shaped code structure; generating target execution code according to the adjusted tree-shaped code structure; and executing the target execution code in a restricted environment, wherein the restricted environment refers to the code execution environment after modifying the detection function according to a preset list of restricted objects.
[0104] Optionally, the computer terminal described above can execute program code for the following steps in the code execution method: performing abstract syntax tree transformation on the code to be executed to obtain a tree-shaped code structure, including: parsing each syntax element in the code to be executed; detecting whether there is a syntax error in each syntax element, and if there is no syntax error in the syntax element, converting the syntax element into a tree node; and integrating the tree nodes corresponding to each syntax element according to the relationship between each syntax element to obtain a tree-shaped code structure.
[0105] Optionally, the computer terminal described above can execute program code in the following steps of the code execution method: before executing the target execution code in a restricted environment, the method further includes: obtaining a user namespace; modifying the detection function in the user namespace according to a preset list of restricted objects to modify the code execution environment and obtain a restricted environment.
[0106] Optionally, the computer terminal described above can execute program code for the following steps in the code execution method: executing the target executable code in a restricted environment includes: checking the target executable code using a modified function in the user namespace; terminating the execution of the target executable code if a restricted object is found in the target executable code; and executing the target executable code in a restricted environment if no restricted object is found in the target executable code.
[0107] Optionally, the computer terminal described above can execute the program code for the following steps in the code execution method: checking each tree node in the tree code structure to obtain check information, and adjusting the tree code structure according to the check information to obtain the adjusted tree code structure, including: traversing each tree node in the tree code structure and checking whether each tree node contains abnormal code; if an abnormal code is found in a tree node, then if the abnormal code contained in the tree node meets the replacement condition, the abnormal code contained in the tree node is replaced to obtain the adjusted tree code structure.
[0108] Optionally, the aforementioned computer terminal may execute program code for the following steps in the code execution method: traversing each tree node in the tree-shaped code structure and checking whether each tree node contains exception code, including: if the target tree node contains function execution code, checking whether the name of the function executed in the function execution code is in the restricted object list; if the name of the function executed in the function execution code is in the restricted object list, then it is determined that the target tree node contains exception code; if the target tree node contains attribute call code, checking whether the attribute called in the attribute call code is in the restricted object list; if the attribute called in the attribute call code is in the restricted object list, then it is determined that the target tree node contains exception code; if the target tree node contains module import code, checking whether the module imported in the module import code is in the restricted object list; if the module imported in the module import code is in the restricted object list, then it is determined that the target tree node contains exception code.
[0109] Optionally, the computer terminal described above can execute program code in the following steps of the code execution method: the method further includes: if the code to be executed fails to perform abstract syntax tree transformation, determine that the code to be executed has a syntax error, and terminate the execution of the code to be executed.
[0110] Optionally, Figure 5This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) processor 502, memory 504, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.
[0111] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the code execution method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the aforementioned code execution method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.
[0112] The processor can access the information and application programs stored in the memory via a transmission device to execute the steps described above in the code execution method.
[0113] This application provides a code execution scheme. It involves abstracting the code to be executed into a syntax tree to obtain a tree-like code structure; inspecting each node in the tree-like code structure to obtain inspection information; adjusting the tree-like code structure based on the inspection information to obtain an adjusted tree-like code structure; generating target executable code based on the adjusted tree-like code structure; and executing the target executable code in a restricted environment. This restricted environment refers to the code execution environment after modifying the detection function according to a preset list of restricted objects. This solution addresses the technical problems in related technologies where code security inspection methods are not accurate enough, resulting in low security of executable code and poor system stability. It achieves the technical effect of improving the security of executable code in the system, thereby improving system stability.
[0114] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.
[0115] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.
[0116] Example 4
[0117] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the code execution method provided in Embodiment 1.
[0118] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.
[0119] This application also provides a computer program product that, when executed on a data processing device, is suitable for executing code execution method steps.
[0120] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.
[0121] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0122] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.
[0123] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.
[0124] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0125] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.
[0126] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.
Claims
1. A code execution method, characterized in that, include: The code to be executed is transformed into an abstract syntax tree to obtain a tree-shaped code structure; Each tree node in the tree code structure is examined to obtain examination information. The tree code structure is then adjusted based on the examination information to obtain the adjusted tree code structure. Generate the target execution code based on the adjusted tree code structure; The target execution code is executed in a restricted environment, wherein the restricted environment refers to the code execution environment after the detection function is modified according to a preset list of restricted objects.
2. The method according to claim 1, characterized in that, The code to be executed is transformed into an abstract syntax tree, resulting in a tree-like code structure including: Parse each syntax element in the code to be executed; Check each syntax element for syntax errors. If no syntax error is found, convert the syntax element into a tree node. Based on the relationships between each syntax element, the tree nodes corresponding to each syntax element are integrated to obtain the tree-shaped code structure.
3. The method according to claim 1, characterized in that, Before executing the target executable code in the restricted environment, the method further includes: Get the user's namespace; Based on a preset list of restricted objects, the detection function in the user namespace is modified to change the code execution environment, thus obtaining the restricted environment.
4. The method according to claim 3, characterized in that, Executing the target code in the restricted environment includes: The target executable code is inspected using the modified functions in the user namespace; If the target executable code is found to contain a restricted object, the execution of the target executable code will be terminated. If no restricted object is detected in the target executable code, the target executable code is executed in the restricted environment.
5. The method according to claim 1, characterized in that, Each tree node in the tree code structure is examined to obtain examination information. The tree code structure is then adjusted based on the examination information to obtain the adjusted tree code structure, which includes: Traverse each tree node in the tree-shaped code structure and check whether each tree node contains exception code; If an exception code is detected in a tree node, and the exception code in the tree node meets the replacement conditions, the exception code in the tree node is replaced, resulting in an adjusted tree code structure.
6. The method according to claim 5, characterized in that, Traversing each tree node in the tree-like code structure and checking whether each tree node contains exception code includes: If the target tree node contains function execution code, then check whether the name of the function being executed in the function execution code is in the list of restricted objects. If the name of the function being executed in the function execution code is in the list of restricted objects, then it is determined that the target tree node contains abnormal code. If the target tree node is found to contain attribute calling code, then check whether the attribute called in the attribute calling code is in the restricted object list. If the attribute called in the attribute calling code is in the restricted object list, then it is determined that the target tree node contains abnormal code. If the target tree node contains module import code, then check whether the module imported in the module import code is in the restricted object list. If the module imported in the module import code is in the restricted object list, then it is determined that the target tree node contains abnormal code.
7. The method according to claim 1, characterized in that, The method further includes: If the abstract syntax tree transformation of the code to be executed fails, it is determined that there is a syntax error in the code to be executed, and the execution of the code to be executed is terminated.
8. A code execution device, characterized in that, include: The transformation unit is used to perform abstract syntax tree transformation on the code to be executed, resulting in a tree-shaped code structure. The inspection unit is used to inspect each tree node in the tree code structure, obtain inspection information, and adjust the tree code structure according to the inspection information to obtain the adjusted tree code structure. A generation unit is used to generate target executable code based on the adjusted tree code structure. An execution unit is used to execute the target execution code in a restricted environment, wherein the restricted environment refers to the code execution environment after the detection function is modified according to a preset list of restricted objects.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the code execution method according to any one of claims 1 to 7.
10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the code execution method according to any one of claims 1 to 7.
11. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the code execution method according to any one of claims 1 to 7.