Source code processing method, computer device and program product

Abstract

The application discloses a source code processing method, computer equipment and program product, and relates to the technical field of computer program code analysis, and the method is characterized in that: an abstract syntax tree is converted into a hybrid code tree that integrates data semantics and control logic, unified standard node basic attributes and semantic information of data nodes and control nodes that inherit a unified base class are relied on, multiple independent intermediate representations are avoided to be built, and operation overhead in a code analysis process is reduced; the original parent-child hierarchical relationship of the abstract syntax tree is completely retained in a conversion process by using the hybrid code tree, sibling nodes in the same layer are arranged according to a source code lexical analysis sequence, and syntax, data and control semantic information are integrated into a hierarchical clear tree structure by combining the design of the data nodes and the control nodes in the hybrid code tree, without additionally adding jump edges, control flow edges and data flow edges, so that the query overhead of the analysis process and the system maintenance complexity are reduced, and the method is suitable for various source code analysis application scenarios such as vulnerability detection and compliance audit.

Description

Technical Field

[0001] This disclosure generally relates to the field of computer program code analysis technology, and in particular to a source code processing method, computer equipment, and program product. Background Technology

[0002] To support static analysis tasks such as vulnerability detection, compliance auditing, and dependency analysis, source code typically needs to be transformed into multiple machine-processable intermediate representations (IRs), such as abstract syntax trees, control flow graphs, and data dependency graphs. Since different intermediate representations differ in their modeling objectives and structural forms, they are organized using different data structures. For example, abstract syntax trees typically use a tree structure to represent syntactic hierarchies, while control flow graphs and data dependency graphs typically use graph structures to represent program execution paths and variable dependencies.

[0003] Because the aforementioned intermediate representations are structurally independent, analysis tools often need to establish node mapping relationships and perform joint queries between multiple intermediate representations when performing program analysis tasks. For example, when performing security analysis or program understanding, the analyzer may first locate the target statement related to security analysis or program understanding in the abstract syntax tree, then determine the control execution path of the target statement through the control flow graph, and further analyze the data propagation relationship of variables related to the control execution path in the data dependency graph, that is, the relationship of variables from definition to assignment to propagation to the target statement.

[0004] However, the entire analysis process of static analysis requires frequent cross-intermediate representation association queries to obtain the complete semantic context. Therefore, in complex program analysis or large-scale codebase scenarios, it can easily lead to additional query overhead and system maintenance complexity, thereby increasing the implementation complexity of the analysis process. Summary of the Invention

[0005] In view of the aforementioned defects or deficiencies in the existing technology, it is desirable to provide a source code processing method, computer device, and program product. This method transforms an abstract syntax tree into a hybrid code tree that integrates data semantics and control logic. By relying on the inheritance of a unified base class, the basic attributes and semantic information of data nodes and control nodes are standardized, avoiding the construction of multiple independent intermediate representations and reducing the computational overhead in the code analysis process. The hybrid code tree fully preserves the original parent-child hierarchical relationship of the abstract syntax tree during the conversion process, arranges sibling nodes at the same level according to the lexical parsing order of the source code, and integrates the syntax, data, and control semantic information into a clear tree structure in combination with the design of data nodes and control nodes in the hybrid code tree. This avoids the addition of extra jump edges, control flow edges, and data flow edges, reducing the query overhead and system maintenance complexity in the analysis process, and making it suitable for various source code analysis application scenarios such as vulnerability detection and compliance auditing.

[0006] Firstly, this application provides a method comprising: Obtain the Abstract Syntax Tree (AST) corresponding to the source code to be analyzed, and transform the AST to generate a hybrid code tree for source code semantic analysis. The hybrid code tree completely retains the original parent-child hierarchical relationship of the AST, and sibling nodes at the same level are arranged according to the lexical parsing order of the source code, without adding any additional jump edges, control flow edges, or data flow edges. The hybrid code tree includes data nodes and control nodes that inherit from a unified base class. The unified base class has a unique node identifier, source code location information, and parent-child node association attributes. The data nodes correspond to the data operation syntax nodes in the AST, are configured with data semantic types and input variable sets, and can optionally configure output variable sets. The control nodes correspond to the control logic syntax nodes in the AST, are configured with control semantic types and control logic code segments, and can optionally configure a list of branch child nodes. Static analysis is performed on the source code to be analyzed based on the hybrid code tree to obtain the analysis results.

[0007] In conjunction with the first aspect, in one possible implementation, the transformation of the AST into a hybrid code tree for source code semantic analysis includes: For the first syntax node of the expression type in the AST, obtain the types of each child node contained in the first syntax node; Based on the text content of the left operand child node, right operand child node, and direct child node of the identifier type, determine the set of input variables for the data node corresponding to the first syntax node; or, convert the left operand child node of the binary expression type or the left operand child node of the expression type to generate a left-side data node, and determine the set of input variables for the data node corresponding to the first syntax node based on the set of input variables and the set of output variables of the left-side data node; convert the right operand child node of the binary expression type or the right operand child node of the expression type to generate a right-side data node, and determine the set of input variables and the set of output variables for the data node corresponding to the first syntax node based on the set of input variables and the set of output variables of the right-side data node. If the operator child nodes contained in the first syntax node are comparison operators or logical operators, then the set of output variables of the data node corresponding to the first syntax node is determined according to the Boolean type, and the data semantic type of the data node corresponding to the first syntax node is set to a known type; Based on the set of input variables of the data node corresponding to the first syntax node, the set of output variables of the data node corresponding to the first syntax node, and the known data semantic type, the first syntax node and its child nodes are transformed to generate corresponding data nodes.

[0008] In conjunction with the first aspect, in one possible implementation, the transformation of the AST into a hybrid code tree for source code semantic analysis includes: For the second syntax node of the function call type in the AST, obtain the type of each child node contained in the second syntax node; If the first direct child node of the second syntax node is an identifier type, then the first direct child node is taken as the called function node, the text content of the called function node is determined as the called function name, and the function name field of the corresponding data node of the second syntax node is determined according to the called function name. Filter out the direct child nodes of the parameter list type from the direct child nodes of the second syntax node as the parameter list node. Based on the text content of the direct child nodes of the identifier type, the formatting result of the text content of the direct child nodes of the literal type or string literal type in the parameter list node, and the set of input variables of the sub-call data node generated by the conversion of the direct child nodes of the expression type, determine the set of input variables of the data node corresponding to the second syntax node. If the called function name fails to match the preset built-in function rule base, the data semantic type of the data node corresponding to the second syntax node is set to the call type; the built-in function rule base is used to provide a unified parsing basis for the input and output variable set, return value dependency relationship and taint propagation behavior based on the preset function name, parameter position configuration and taint propagation flag when generating data nodes for function call syntax nodes; Based on the set of input variables of the data node corresponding to the second syntax node and the data semantic type of the call type, the second syntax node and its child nodes are transformed into data nodes of the call type.

[0009] In conjunction with the first aspect, in one possible implementation, the method further includes: If the called function name matches the built-in function rule library, the input parameter position configuration and output parameter position configuration are read from the matched target built-in function rule; Based on the number of variables in the parsed parameter variable set, the input parameter position configuration and the output parameter position configuration are respectively parsed into an input parameter position set and an output parameter position set; the parsed parameter variable set includes the input variable set of the data node corresponding to the second syntax node; Iterate through each parameter variable in the set of parsed parameter variables in the order in which the variables appear, and read the parameter position of the traversed parameter variable in the set of parsed parameter variables; If the parameter position exists in the set of input parameter positions, then the parameter variable that is traversed to the corresponding position is determined as the rule input variable; if the parameter position exists in the set of output parameter positions, then the parameter variable that is traversed to the corresponding position is determined as the rule output variable. If the target built-in function rule defines a return value dependency relationship, then the return value dependency relationship configuration in the target built-in function rule is read, and the return value dependency relationship configuration is parsed into a set of return value dependent parameter positions according to the number of variables in the parsed parameter variable set. The parameter variables that the return result of the second syntax node depends on are determined according to the set of return value dependent parameter positions, and the return value associated fields of the data node of the call type are determined according to the parameter variables that the return result depends on. Read the taint propagation flag in the target built-in function rule, determine the taint propagation flag field of the data node of the call type according to the taint propagation flag, and set the data semantic type of the data node of the call type to the built-in type; Based on the rule input variables, rule output variables, return value association field, taint propagation flag field, and the data semantic type of the built-in type, the data node of the call type is converted into a built-in function data node.

[0010] In conjunction with the first aspect, in one possible implementation, generating a hybrid code tree for source code semantic analysis from the AST includes: For the third syntax node of the size evaluation expression type in the AST, select the first target child node of the type descriptor type and the second target child node of the identifier type from each child node contained in the third syntax node; Based on the text content formatting results of the first target sub-node and the second target sub-node, determine the set of input variables for the data node corresponding to the third syntax node, and set the data semantic type of the data node corresponding to the third syntax node to a known type; Based on the set of input variables of the data node corresponding to the third syntax node and the known data semantic type, the third syntax node and its child nodes are transformed to generate the corresponding data node.

[0011] In conjunction with the first aspect, in one possible implementation, the transformation of the AST into a hybrid code tree for source code semantic analysis includes: For the fourth syntax node of the increment / decrement expression type in the AST, find the identifier type child node from each child node contained in the fourth syntax node as the target variable AST node; Based on the text content of the target variable AST node, determine the input variable set and output variable set of the data node corresponding to the fourth syntax node, and set the data semantic type of the data node corresponding to the fourth syntax node to a known type; Based on the set of input variables and the set of output variables of the data node corresponding to the fourth syntax node, and the known data semantic type, the fourth syntax node and its child nodes are transformed to generate the corresponding data node.

[0012] In conjunction with the first aspect, in one possible implementation, the transformation of the AST into a hybrid code tree for source code semantic analysis includes: For the fifth syntax node of the conditional statement type in the AST, a depth-first traversal is performed on the node tree of the fifth syntax node, and the first node of the binary expression type, call expression type, identifier type, bracket expression type, unary expression type or ternary expression type is taken as the condition target node, and the control semantic type of the control node corresponding to the fifth syntax node is set to the condition type. Traverse the direct child nodes of the fifth syntax node in the order of the source code, and take the first direct child node of the statement type encountered as the condition-true branch statement node, and take the first direct child node of the other branch type encountered as the condition-false branch node. Iterate through the direct child nodes of the branch node where the condition is not true, and take the first direct child node of the otherwise branch type as the branch statement node where the condition is not true. The condition-true branch statement node is converted into a condition-true branch result node, and the condition-false branch statement node is converted into a condition-false branch result node. Based on the condition-true branch result node and the condition-false branch result node, the list of true branch child nodes and the list of false branch child nodes of the control node corresponding to the fifth syntax node are determined, and the parent node field of the condition-true branch result node and the condition-false branch result node are set respectively. Based on the control logic code segment of the conditional target child node, the list of true branch child nodes, the list of false branch child nodes, and the set parent node fields, the fifth syntax node and its child nodes are transformed into corresponding control nodes.

[0013] In conjunction with the first aspect, in one possible implementation, the transformation of the AST into a hybrid code tree for source code semantic analysis includes: For the sixth syntax node of the exit statement type in the AST, set the control semantic type of the control node corresponding to the sixth syntax node to the exit type, delete the direct child nodes corresponding to the exit identifier and the end symbol from the direct child nodes of the sixth syntax node, and use the remaining first direct child node as the return expression node. Based on the control semantic type of the exit type and the control logic code segment of the return expression node, the sixth syntax node and its child nodes are transformed to generate the corresponding control node.

[0014] Secondly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the source code processing method described in the first aspect.

[0015] Thirdly, this application also provides a computer program product. This computer program product stores a computer program, which, when executed by a processor, implements the source code processing method described in the first aspect.

[0016] This application provides a source code processing method, computer device, and program product. The source code processing method converts the standard abstract syntax tree of the source code into a hybrid code tree that integrates data semantics and control logic. It relies on data nodes and control nodes inherited from a unified base class to standardize the basic attributes and semantic information of nodes, avoiding the construction of multiple independent intermediate representations and eliminating the need for node mappings and cross-structure joint queries between different intermediate representations. This effectively reduces the computational overhead during code analysis and lowers the complexity of system development and maintenance. The hybrid code tree fully preserves the original parent-child hierarchical relationship of the abstract syntax tree during the conversion process and arranges sibling nodes at the same level according to the lexical parsing order of the source code, ensuring the integrity of the syntactic structure and code order. Furthermore, by combining the design of data nodes and control nodes in the hybrid code tree, the semantic information of data operation and control logic is directly embedded into the tree structure without adding additional jump edges, control flow edges, and data flow edges. This integrates syntax, data, and control semantic information into a hierarchical tree structure, enabling analysis tools to access and analyze multi-dimensional semantic information on a single structure. This avoids the necessity of frequent cross-intermediate representation association queries in traditional methods, significantly reducing the query overhead and system maintenance complexity of the analysis process, and improving the controllability of the analysis process. As a result, it significantly improves the overall efficiency and accuracy of static source code analysis, and better adapts to various source code analysis application scenarios such as vulnerability detection and compliance auditing. Attached Figure Description

[0017] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is one of the flowcharts illustrating the source code processing method in one embodiment; Figure 2 This is a second flowchart illustrating the source code processing method in one embodiment; Figure 3 This is the third flowchart of a source code processing method in one embodiment; Figure 4 This is the fourth flowchart illustrating the source code processing method in one embodiment; Figure 5 This is the fifth flowchart illustrating the source code processing method in one embodiment; Figure 6 This is the sixth flowchart of a source code processing method in one embodiment; Figure 7 This is the seventh flowchart of a source code processing method in one embodiment; Figure 8 This is the eighth flowchart of a source code processing method in one embodiment; Figure 9A system block diagram is constructed for a hybrid code tree in one embodiment; Figure 10 This is a schematic diagram of a hybrid code tree in one embodiment; Figure 11 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0018] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of this invention can be combined with each other. The invention will now be described in detail with reference to the accompanying drawings and embodiments. Furthermore, the term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The terms "first" and "second," etc., in the specification and claims of the embodiments of this invention are used to distinguish different objects, not to describe a specific order of objects.

[0020] In the field of static source code analysis, to support tasks such as vulnerability detection, compliance auditing, and dependency analysis, it is typically necessary to transform the source code into multiple intermediate representations (IRs) that can be processed by machines, such as abstract syntax trees (APIs), control flow graphs (DFTs), and data dependency graphs (DDPs). Because different intermediate representations differ in their modeling objectives and structural forms, they are organized using different data structures. For example, APIs usually represent syntactic hierarchies using a tree structure, while DFTs and DDPs typically use graph structures to represent program execution paths and variable dependencies.

[0021] Because the different intermediate representations (IRs) differ in their modeling objectives and structural forms, they are typically organized using different data structures. For example, Abstract Syntax Trees (ASTs) usually represent syntactic hierarchies in a tree structure, while Control Flow Graphs (CFGs) and Program Dependence Graphs (PDGs) typically use graph structures to represent program execution paths and variable dependencies. Since these intermediate representations are structurally independent, analysis tools often need to establish node mappings and perform joint queries across multiple intermediate representations when performing program analysis tasks, thus increasing system implementation complexity. For example, in security analysis or program understanding, the analyzer may need to first locate the target statement in the AST, then determine the execution path location of the target statement through the CFG, and further analyze the data propagation relationships of related variables in the PDG. Because the analysis process requires frequent cross-representation join queries, this can lead to additional query overhead and system maintenance complexity in complex program analysis or large-scale codebase scenarios.

[0022] Since AST primarily describes syntactic nesting relationships, while CFG and PDG focus on program execution paths and variable dependencies respectively, the semantic information carried by different intermediate representations (IRs) has different emphases. Therefore, in some analysis tasks, the analyzer needs to repeatedly switch between different intermediate representations (IRs) to obtain the complete semantic context. For example, in security auditing or taint propagation analysis, the analyzer typically needs to simultaneously obtain the syntactic structure of statements, execution conditions, and variable data dependencies. Because this information is distributed across different intermediate representations (IRs), analysis tools often need to use combined queries or multi-stage analysis to correlate relevant information, thus increasing the complexity of the analysis process.

[0023] Furthermore, during program control flow analysis, when the source code contains multi-level conditional branches, loop structures, or abnormal control flows, a large number of feasible execution paths may appear in the CFG. Since CFG is essentially a graph structure and allows back edges and multi-branch paths, the number of paths may grow rapidly during execution path-sensitive analysis. As the program size increases, the increase in the number of paths can lead to a significant increase in analysis computation costs. Therefore, in practical engineering applications, some static analysis tools need to control analysis complexity through strategies such as path pruning, depth constraints, or approximate analysis, thereby striking a trade-off between analysis accuracy and efficiency.

[0024] For example, an AST (Abstract Syntax Tree) is extracted from the source code using open-source tools, and a CFG (Content Graph) is constructed based on the AST. A Control Dependence Graph (CDG) and a Data Dependence Graph (DDG) are further derived from the CFG, and the CDG and DDG are merged to generate a PDG (Property Graph). Using statement nodes as the fusion center, the semantic information of the AST, CFG, CDG, DDG, and PDG is integrated into an initial Code Property Graph (CPG). Function call relationships and natural control flow sequences are supplemented using text recognition technology, and these relationships are added as edges to the CPG to form the final fused code property graph. The GloVe model is used to embed nodes and edges of different dimensions in the fused code property graph to obtain graph embedding features. These features are then extracted using a Multi-dimensional Feature Network (MUIT-FN) to extract the local natural word order, syntactic structure, and contextual features of each statement node in the graph embedding features. Finally, attention-enhanced bidirectional gated recurrent units (GGs) are used to further refine these features. The BiGRU (BiGRU) network fuses extracted local natural word order features, grammatical structure features, and contextual features to generate graph-encoded features. These graph-encoded features are then input into a vulnerability detection model built on graph convolutional networks and attention mechanisms to output vulnerability detection results. Finally, an improved interpretable model is used to provide fine-grained attribution explanations for the vulnerability detection results.

[0025] In summary, existing source code static analysis techniques suffer from several technical problems, including program semantic information being scattered across multiple intermediate representations, high complexity in cross-structure correlation analysis, and high computational overhead in path-sensitive analysis. To address these issues, this application provides a source code processing method, computer device, and program product. By organizing program syntax structure, control relationships, and data dependencies within a unified data structure, related semantic information can be expressed within the same intermediate representation framework. This reduces the need for conversion and correlation operations between different intermediate representations, enabling analysis tools to access and analyze multi-dimensional semantic information on a single structure. Furthermore, based on this hybrid code tree structure, analysis tasks such as program syntax parsing, control relationship modeling, data dependency tracing, and source code sequence correlation can be supported under a unified representation structure, providing a structured unified intermediate representation for applications such as static analysis, security auditing, and program understanding. It natively supports the four essential requirements of static analysis—syntax parsing, control flow modeling, data flow tracing, and sequential auditing—without requiring cross-representation mapping. This achieves the following verifiable, quantifiable, and feasible application results: (1) Reduce semantic synchronization overhead and improve semantic consistency maintenance efficiency: The hybrid code tree uses statements as atomic nodes, encapsulates basic attributes such as node number, source code location, and child node list through a unified base class, and derives data nodes (including input and output lists) and control nodes (including child node lists of true and false branches) according to semantic responsibilities; the syntax structure, control relationship, and data dependency are uniformly expressed in the same node object, thereby reducing the state maintenance and semantic synchronization overhead between multiple intermediate representations. (2) Enhance the structured association capability of control relationship and data relationship: The set of child nodes of the control node represents the statement nodes in its control domain, and each statement node contains the corresponding data input and output information. When performing taint propagation or dependency tracing analysis, the control context can be obtained through the node hierarchy relationship, and the data dependency attributes inside the node can be analyzed, thereby reducing the combined query of complex graph structure and multi-type edge relationship. (3) Maintain consistency of source code order and support precise source code location association: The set of child nodes at each level is organized according to the lexical order of the source code, and the corresponding source code location information is recorded in the node attributes, including the start and end line numbers, column numbers or byte offsets, etc., thereby supporting the direct mapping between analysis nodes and source code, which is convenient for source code-level analysis and auditing. (4) Improve the controllability of the analysis process by organizing control relationships through tree structure: The hybrid code tree uses a hierarchical structure with statement nodes as the core to express the semantic information of the program. It avoids a large number of cross edges and multiple incoming edges at the representation level, so that some static analysis tasks can be processed hierarchically or sequentially based on the tree structure, thereby reducing the analysis complexity to a certain extent.

[0026] The following is combined Figures 1 to 11 This application describes a source code processing method, computer device, and program product. The execution entity of the source code processing method can be a computer device, which has at least a built-in tree-sitter, and can be a personal computer, server, embedded system, or other device. This application does not specifically limit this. The following description uses a computer device as an example to illustrate the source code processing method.

[0027] To facilitate understanding of the source code processing method provided in the embodiments of this application, the following examples will provide a detailed description of the source code processing method provided in this application. It is understood that the following examples can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0028] Reference Figure 1 This is a flowchart illustrating the source code processing method provided in an embodiment of this application, as shown below. Figure 1 As shown, the source code processing method includes the following steps 101 and 102.

[0029] Step 101: Obtain the Abstract Syntax Tree (AST) corresponding to the source code to be analyzed, and convert the AST to generate a hybrid code tree for source code semantic analysis. The hybrid code tree completely retains the original parent-child hierarchical relationship of the AST, and the sibling nodes at the same level are arranged according to the lexical parsing order of the source code, without adding any additional jump edges, control flow edges, or data flow edges.

[0030] The hybrid code tree includes data nodes and control nodes that inherit from a unified base class. The unified base class has a unique node identifier, source code location information, and parent-child node association attributes. Data nodes correspond to data operation syntax nodes in the AST, are configured with data semantic types and input variable sets, and can optionally configure output variable sets. Control nodes correspond to control logic syntax nodes in the AST, are configured with control semantic types and control logic code segments, and can optionally configure a list of branch child nodes.

[0031] The source code of the task to be analyzed is C / C++ source code text, for example, the source code of the task to be analyzed is a .c / .h file, where .c / .h indicates that the source code of the task to be analyzed is a C language source code file or a program header file.

[0032] The source code to be analyzed is used for vulnerability detection, compliance auditing, dependency analysis, security analysis or program understanding, security auditing or taint propagation, execution path sensitivity analysis and other static analyses.

[0033] The hybrid code tree can be in either text or graphical format; that is, the generated hybrid code tree supports two export formats, including text export and graphical export.

[0034] Text-based export outputs structured node descriptions in JavaScript Object Notation (JSON) / eXtensible Markup Language (XML) format, including all node attributes and structural relationships, for direct reading by downstream analysis modules. Graphical export supports conversion to Microsoft Word Document Template (DOT) format for graphical descriptions, which can be rendered as visual tree diagrams for code structure display, analysis process debugging, and result verification.

[0035] The unified base class possesses a unique node identifier, which is the node number of the syntax node in the abstract syntax tree. It is a globally unique node identifier used for node indexing and relationship tracing.

[0036] The parent-child node association attributes include a list of child nodes and a parent node. The list of child nodes consists of references to child nodes arranged in lexical order, implementing a nested parent-child structure. The parent node is a reference to the node at the next higher level, supporting bidirectional traversal of the tree structure.

[0037] Specifically, after receiving the source code of the task to be analyzed, the computer device first calls the Tree-sitter parser to perform syntax analysis on the source code, generating a standard Abstract Syntax Tree (AST). The generated AST satisfies the following syntax constraints: each syntax node carries a source code location triple <source file path, start byte offset, end byte offset>, and the byte range indicated by the triple is completely consistent with the actual literal range of the source code text corresponding to the syntax node, without any range deviation or loss; under this syntax constraint, all syntax nodes and all level child nodes in the abstract syntax tree carry source code location triples. The physical meaning of the source code location triple is to uniquely identify the physical file and continuous byte range of the syntax node in the source code. Its actual function is to obtain source code location information to achieve precise location and bidirectional mapping between syntax nodes and source code text.

[0038] Subsequently, data node transformation is performed on data operation statements such as assignment, calculation, and function call in the abstract syntax tree, and control node transformation is performed on control logic statements such as condition, loop, and jump in the abstract syntax tree. All data nodes and all control nodes inherit the unified base class attributes and extend the control flow semantics and data flow semantics attributes respectively. The program logic is expressed by replacing the jump edges of the traditional CFG with a tree structure. This process continues until the abstract syntax tree is transformed into a hybrid code tree for source code semantic analysis.

[0039] It should be noted that each data node's attributes must include at least the data semantic type and the set of input variables. Furthermore, the attribute content of the corresponding data node will differ depending on the type of data operation statement. For example, the data node generated for a function call syntax node will include not only the node type and the set of input variables, but also the set of output variables and a list of child nodes; similarly, the data node generated for an increment / decrement expression syntax node will include not only the node type and the set of input variables, but also the set of output variables.

[0040] Similarly, each control node's attributes must include at least the control semantic type and the control logic code segment. Moreover, the attribute content of the corresponding control node will differ depending on the type of the control logic statement. For example, the control node generated from a conditional statement syntax node will include not only the control semantic type but also a list of branch child nodes.

[0041] For example, the attribute definitions of the unified base class are shown in Table 1, the attribute definitions of the data nodes are shown in Table 2, and the attribute definitions of the control nodes are shown in Table 3; wherein the node types in Table 2 correspond to the data semantic types, the sub-function list in Table 2 corresponds to the sub-node list, the node types in Table 3 correspond to the control semantic types, and the return expression text in Table 3 corresponds to the control logic code segment.

[0042] Table 1

[0043] Table 2

[0044] Table 3

[0045] Step 102: Perform static analysis on the source code to be analyzed based on the hybrid code tree to obtain the analysis results.

[0046] Specifically, for a constructed hybrid code tree, each data node and control node within the hybrid code tree can be traversed. Starting from a preset taint source node, and based on the input and output variable sets configured in the data nodes, the variable assignment, data transfer, and variable rewriting links are traced level by level. Then, combined with the control logic and branch jump relationships recorded in the control nodes, the propagation path, propagation range, and final convergence node of tainted data in the program are determined. It is then determined whether the tainted data flows to dangerous execution interfaces or high-risk function call locations, thus completing the source code taint propagation analysis and outputting the taint propagation link, the list of tainted variables, and the risk trigger points; thus completing the taint analysis.

[0047] Alternatively, based on the list of branch child nodes and control logic code segments of the control nodes in the hybrid code tree, the full executable branch paths of the program can be reconstructed. Then, by combining the variable values ​​and data dependencies of the data nodes, the variable running status and data usage conditions under different branch paths can be matched to distinguish the differences in code behavior corresponding to different execution paths. Finally, target execution paths that meet specific conditions are selected, the legality of code execution logic and the compliance of variable usage within the path are verified, and logical defects, boundary anomalies and illegal operation behaviors within the path are identified to complete the semantic verification of the path-sensitive layer of the program. This completes the path sensitivity analysis.

[0048] It should be noted that cyclomatic complexity calculation and function call graph generation can also be performed based on the hybrid code tree. For example, by traversing control nodes and counting the number of branches, the cyclomatic complexity of the program can be calculated directly without traversing the edges and nodes of the CFG; thus, the cyclomatic complexity calculation can be completed. Similarly, by using the sub-function list and function name attribute of data nodes, function call relationships can be extracted directly without additional function call identification; thus, a function call graph can be generated.

[0049] The source code processing method provided in this application converts the standard abstract syntax tree of the source code into a hybrid code tree that integrates data semantics and control logic. It relies on data nodes and control nodes inherited from a unified base class to standardize the basic attributes and semantic information of nodes, avoiding the construction of multiple independent intermediate representations and eliminating the need for node mappings and cross-structure joint queries between different intermediate representations. This effectively reduces the computational overhead during code analysis and lowers the complexity of system development and maintenance. The hybrid code tree fully preserves the original parent-child hierarchical relationship of the abstract syntax tree during the conversion process and arranges sibling nodes at the same level according to the lexical parsing order of the source code, ensuring the integrity of the syntax structure and code order. Furthermore, combined with the hybrid code tree… The design of data nodes and control nodes in the tree directly embeds the semantic information of data operation and control logic into the tree structure without adding additional jump edges, control flow edges, and data flow edges. This integrates syntactic, data, and control semantic information into a hierarchical tree structure, enabling analysis tools to access and analyze multi-dimensional semantic information on a single structure. This avoids the need for frequent cross-intermediate representation association queries in traditional methods, significantly reducing query overhead and system maintenance complexity in the analysis process, and improving the controllability of the analysis process. As a result, it significantly improves the overall efficiency and accuracy of static source code analysis, and better adapts to various source code analysis application scenarios such as vulnerability detection and compliance auditing.

[0050] In one example embodiment, step 101 involves transforming the AST to generate a hybrid code tree for source code semantic analysis. The specific process in this embodiment can be achieved through... Figure 2 Steps 201 to 204 shown are implemented.

[0051] Step 201: For the first syntax node of the expression type in the AST, obtain the types of each child node contained in the first syntax node.

[0052] Step 202: Based on the text content of the left operand child node, right operand child node, and direct child node of the identifier type, determine the set of input variables for the data node corresponding to the first syntax node; or, convert the left operand child node of the binary expression type or the left operand child node of the expression type to generate a left-side data node, and determine the set of input variables for the data node corresponding to the first syntax node based on the set of input variables and the set of output variables of the left-side data node; convert the right operand child node of the binary expression type or the right operand child node of the expression type to generate a right-side data node, and determine the set of input variables and the set of output variables for the data node corresponding to the first syntax node based on the set of input variables and the set of output variables of the right-side data node.

[0053] Step 203: If the operator child nodes contained in the first syntax node are comparison operators or logical operators, then determine the set of output variables of the data node corresponding to the first syntax node according to the Boolean type, and set the data semantic type of the data node corresponding to the first syntax node to a known type.

[0054] Step 204: Based on the set of input variables of the data node corresponding to the first syntax node, the set of output variables of the data node corresponding to the first syntax node, and the data semantic type of the known type, convert the first syntax node and its child nodes into corresponding data nodes.

[0055] The first syntax node is the binary expression syntax node in the abstract syntax tree.

[0056] Specifically, by reading the binary expression (binary_expression) type syntax node in the abstract syntax tree, the types of each child node contained in the binary_expression syntax node are obtained, such as the left operand child node, the right operand child node, and the operator child node. Then, an empty target data node data structure is created for the binary_expression syntax node, and the following pre-defined recursive processing is performed on the binary_expression syntax node: a. Read the first direct child node of the binary_expression syntax node as the left operand AST child node.

[0057] b. Read the second direct child node of the binary_expression syntax node as the operator AST child node.

[0058] c. Read the third direct child node of the binary_expression syntax node as the right operand AST child node.

[0059] d. Based on the type in the AST child node attribute of the left operand, perform the following processing: d1. When the type of the left operand AST child node is an identifier, add the text content of the left operand AST child node to the input variable set of the target data node, and go to step e.

[0060] d2. When the type of the left operand AST child node is other expression type, perform pre-defined recursive processing on the left operand AST child node until it is converted to generate the left data node, then proceed to step e.

[0061] e. Based on the node type in the AST node attributes of the right operand, perform the following processing: e1. When the type of the right operand AST node is `identifier`, add the text content of the right operand AST node to the input variable set of the target data node, and proceed to step j.

[0062] e2. When the type of the right operand AST node is other expression type, perform pre-defined recursive processing on the right operand AST node until it is transformed to generate the right data node, and then proceed to step j.

[0063] j. Traverse the direct child AST nodes of the binary_expression syntax node, filter the target AST nodes of type `identifier` from the direct child AST nodes of the binary_expression syntax node, and add the text of the target AST node of type `identifier` to the input variable set of the target data node.

[0064] k. When the text content of the operator AST child node is a comparison operator or a logical operator, a Boolean type (`BOOL!`) is added to the output variable set of the target data node.

[0065] l. Set the data semantic type of the target data node to a known (`KNOWN`) type.

[0066] m. Complete the data filling of the target data node. That is, each binary expression left operand AST node, each expression type left operand AST node, each binary expression type right operand AST node, or each expression type right operand AST node will perform a preset recursive process and be transformed into its corresponding left or right data node. The input and output variables of each left or right data node are collected and merged into the input and output variable sets of the target data node corresponding to its parent binary_expression syntax node, thereby transforming the binary_expression syntax node and its child nodes into a single target data node.

[0067] In one example embodiment, step 101 involves transforming the AST to generate a hybrid code tree for source code semantic analysis. The specific process in this embodiment can be achieved through... Figure 3 Steps 301 to 305 shown are implemented.

[0068] Step 301: For the second syntax node of the function call type in the AST, obtain the type of each child node contained in the second syntax node.

[0069] Step 302: If the first direct child node of the second syntax node is an identifier type, then the first direct child node is taken as the called function node, the text content of the called function node is determined as the called function name, and the function name field of the corresponding data node of the second syntax node is determined according to the called function name.

[0070] Step 303: Select the direct child nodes of the parameter list type from the direct child nodes of the second syntax node as parameter list nodes. Based on the text content of the direct child nodes of the identifier type, the formatting result of the text content of the direct child nodes of the literal type or string literal type in the parameter list node, and the set of input variables of the sub-call data nodes generated by the conversion of the direct child nodes of the expression type, determine the set of input variables of the data node corresponding to the second syntax node.

[0071] Step 304: If the called function name fails to match the preset built-in function rule base, the data semantic type of the data node corresponding to the second syntax node is set to the call type. The built-in function rule base is used to provide a unified parsing basis for the input and output variable set, return value dependency and taint propagation behavior based on the preset function name, parameter position configuration and taint propagation flag when generating data nodes for function call syntax nodes.

[0072] Step 305: Based on the set of input variables of the data node corresponding to the second syntax node and the data semantic type of the call type, convert the second syntax node and its child nodes into data nodes of the call type.

[0073] The second syntax node is the function call expression syntax node in the abstract syntax tree.

[0074] Specifically, by reading the syntax node of type function call expression (call_expression) in the abstract syntax tree, the types of each child node contained in the call_expression syntax node are obtained. Then, an empty target data node data structure is created for the call_expression syntax node, and the following processing is performed on the call_expression syntax node: a. Read the first direct child AST node of the call_expression syntax node.

[0075] b. When the first direct child AST node of the call_expression syntax node is of type `identifier`, the first direct child AST node is used as the called function AST node, and the text content of the called function AST node is used as the called function name.

[0076] c. Search for AST nodes of type `argument_list` in the direct child AST nodes of the `call_expression` syntax node, and use the found `argument_list` type AST nodes as the parameter list AST nodes.

[0077] d. Write the name of the function to be called into the function name field of the target data node.

[0078] e. Traverse the direct child AST nodes of the parameter list AST node, and perform the following processing based on the attributes of the direct child AST nodes of the parameter list AST node: e1. When the direct child AST node of the parameter list AST node is of type `,`, `(` or `)`, skip that direct child AST node of the parameter list AST node.

[0079] e2. When the direct child AST node of the parameter list AST node is of type `identifier`, add the text content of the direct child AST node of the parameter list AST node to the input variable set of the target data node.

[0080] e3. When the direct child AST node of the parameter list AST node is a literal type node or a string literal type node, the text content of the direct child AST node of the parameter list AST node is formatted as `CONST:<text of direct child AST node>` and added to the input variable set of the target data node.

[0081] e4. When the direct child AST node of the parameter list AST node is of other expression type, convert the direct child AST node of other expression type to generate child call data node (such as performing preset recursive processing).

[0082] f. When the called function name does not match any built-in function rule in the built-in function rule base, set the data semantic type of the target data node to the call (`CALL`) type.

[0083] g. Complete the data filling of the target data node. That is, for each parameter AST node of type `call_expression`, each parameter AST node of type expression, or each sub-call AST node of type `call_expression`, a pre-defined recursive process is performed to generate the corresponding parameter data node or sub-call data node; the input variable set of each parameter data node is collected into the input variable set of the target data node corresponding to the current call_expression syntax node; the input variable set of each sub-call data node is collected into the input variable set of the target data node corresponding to the current call_expression syntax node; the sub-call data nodes are collected into the sub-call list field of the target data node corresponding to the current call_expression syntax node; and `RET:<called function name of the sub-call result data node>` is collected into the input variable set of the target data node corresponding to the current call_expression syntax node; thus, the call_expression syntax node and its child nodes are transformed into a single target data node.

[0084] It should be noted that the built-in function rule base contains a structure including a function name field, a description field, input parameter position configuration, output parameter configuration, return value dependency configuration, return value existence flag field, and taint propagation flag field.

[0085] The function name field records the name of the built-in function and serves as the rule matching key in the built-in function rule base; the description field records the semantic description of the built-in function rule; the input parameter position configuration defines the position of the parameters that should be written into the target data node's input variable set in the current function call; the output parameter position configuration defines the position of the parameters that should be written into the target data node's output variable set in the current function call; the return value dependency configuration defines the position of the parameters that the return result of the current function call depends on; the return value existence flag field marks whether the current built-in function has a return value; and the taint propagation flag field marks whether the current built-in function supports taint propagation.

[0086] The built-in function rule file is organized according to the structure described above. By reading the contents of the built-in function rule file, a built-in function rule library can be constructed, using built-in function names as matching keys and built-in function rules as matching results.

[0087] In one example embodiment, if the called function name matches a preset built-in function rule base, the `call_expression` syntax node and its child nodes need to be converted into a single target data node. Then, according to the matched target built-in function rules, the input variable set, output variable set, return value associated field, taint propagation flag field, and data semantic type are reconstructed. In this embodiment, this reconstruction process can be achieved through... Figure 4 Steps 401 to 407 shown are implemented.

[0088] Step 401: If the called function name matches the built-in function rule library, then read the input parameter position configuration and output parameter position configuration from the matched target built-in function rule.

[0089] Step 402: Based on the number of variables in the parsed parameter variable set, parse the input parameter position configuration and output parameter position configuration into input parameter position set and output parameter position set, respectively; the parsed parameter variable set includes the input variable set of the data node corresponding to the second syntax node.

[0090] Step 403: Traverse each parameter variable in the set of parsed parameter variables in the order of their appearance, and read the parameter position of the traversed parameter variable in the set of parsed parameter variables.

[0091] Step 404: If the parameter position exists in the set of input parameter positions, then the corresponding traversed parameter variable is determined as the rule input variable; if the parameter position exists in the set of output parameter positions, then the corresponding traversed parameter variable is determined as the rule output variable.

[0092] Step 405: If the target built-in function rule defines a return value dependency relationship, then read the return value dependency relationship configuration in the target built-in function rule, parse the return value dependency relationship configuration into a return value dependent parameter position set according to the number of variables in the parsed parameter variable set, determine the parameter variables that the return result of the second syntax node depends on according to the return value dependent parameter position set, and determine the return value associated field of the data node of the call type according to the parameter variables that the return result depends on.

[0093] Step 406: Read the taint propagation flag in the target built-in function rule, determine the taint propagation flag field of the data node of the call type based on the taint propagation flag, and set the data semantic type of the data node of the call type to the built-in type.

[0094] Step 407: Based on the input variables of each rule, the output variables of each rule, the return value associated fields, the taint propagation flag fields, and the data semantic types of built-in types, convert the data nodes of the call type into built-in function data nodes.

[0095] Specifically, the data node of the call type is the target data node of the call type.

[0096] Specifically, the conversion of a `call` type data node into a built-in function data node involves inputs including the called function name, the set of resolved parameter variables, and the `call` type data node. The conversion process includes the following steps: a. When the called function name matches the built-in function rule library, the matched built-in function rule is used as the target built-in function rule.

[0097] b. Read the input parameter position configuration and output parameter position configuration in the target built-in function rule.

[0098] c. Based on the number of parameters in the parsed parameter variable set, parse the input parameter position configuration and output parameter position configuration into an input parameter position set and an output parameter position set.

[0099] d. Create an empty set of rule input variables and an empty set of rule output variables.

[0100] e. Traverse each parameter variable in the set of parsed parameter variables in the order of their appearance, take the parameter variable obtained in this traversal as the parameter variable to be determined, and read the parameter position of the parameter variable to be determined in the set of parsed parameter variables.

[0101] f. When the parameter position of the variable to be determined exists in the set of input parameter positions, add the variable to be determined as an old value parameter variable to the set of rule input variables.

[0102] g. When the parameter position of the variable to be determined exists in the set of output parameter positions, add the variable to be determined as a new value parameter variable to the set of rule output variables.

[0103] h. Write the set of rule input variables into the set of input variables of the call type target data node.

[0104] i. Write the set of rule output variables into the set of output variables of the call type target data node.

[0105] j. When the target built-in function rule defines a return value dependency relationship, read the return value dependency configuration in the target built-in function rule, parse the return value dependency configuration into a set of return value dependency parameter positions based on the number of parameters in the parsed parameter variable set, and determine the parameter variables that the return result of the current function call depends on based on the set of return value dependency parameter positions.

[0106] k. When the target built-in function rule defines a return value dependency, write the parameter variables that the return result depends on into the return value association field of the call type target data node; when the call type target data node does not have a return value association field, retain the rule output variable set as the output variable set of the call type target data node.

[0107] l. Read the taint propagation flag from the target built-in function rule and write the taint propagation flag to the taint propagation flag field of the call type target data node.

[0108] m. Sets the data semantic type of the call type target data node to the built-in (`BUILTIN`) type.

[0109] n. Output the processing results that match the target built-in function rules. That is, the call type target data node completes the reconstruction of the input variable set, output variable set, return value associated fields, taint propagation flag fields, and data semantic types according to the target built-in function rules, thereby realizing the conversion from call type target data node to built-in function data node.

[0110] In one example embodiment, step 101 involves transforming the AST to generate a hybrid code tree for source code semantic analysis. The specific process in this embodiment can be achieved through... Figure 5 Steps 501 to 503 shown are implemented.

[0111] Step 501: For the third syntax node of the size evaluation expression type in the AST, select the first target child node of the type descriptor type and the second target child node of the identifier type from the child nodes contained in the third syntax node.

[0112] Step 502: Based on the text content formatting results of the first target child node and the second target child node, determine the set of input variables for the data node corresponding to the third syntax node, and set the data semantic type of the data node corresponding to the third syntax node to a known type.

[0113] Step 503: Based on the set of input variables of the data node corresponding to the third syntax node and the known data semantic type, convert the third syntax node and its child nodes to generate the corresponding data node.

[0114] The third syntax node is the sizeof_expression syntax node in the abstract syntax tree.

[0115] Specifically, by traversing the child AST nodes of the sizeof_expression syntax node, and based on the attributes of the child AST nodes of the sizeof_expression syntax node, the first target child AST node of type `identifier` and the second target child AST node of type `type_descriptor` are selected from the child AST nodes of sizeof_expression.

[0116] Subsequently, the text content of the first and second target sub-AST nodes, obtained through filtering, is formatted as `SIZEOF:<text of the target sub-AST node>` and added to the input variable set of the target data node corresponding to the sizeof_expression syntax node. Furthermore, the data semantic type of the target data node corresponding to the sizeof_expression syntax node is set to `KNOWN`.

[0117] At this point, the data filling of the target data node corresponding to the sizeof_expression syntax node is completed. That is, the text content of the first target sub-AST node of type `identifier` and the second target sub-AST node of type `type_descriptor` in the sizeof_expression syntax node are formatted and collected into the input variable set of the target data node corresponding to the current sizeof_expression syntax node. Thus, the sizeof_expression syntax node and its child nodes are transformed into a single target data node.

[0118] In one example embodiment, step 101 involves transforming the AST to generate a hybrid code tree for source code semantic analysis. The specific process in this embodiment can be achieved through... Figure 6 Steps 601 to 603 shown are implemented.

[0119] Step 601: For the fourth syntax node of the auto-incrementing and auto-decrementing expression type in the AST, find the child node of the identifier type from each child node contained in the fourth syntax node as the target variable AST node.

[0120] Step 602: Determine the set of input variables and the set of output variables of the data node corresponding to the fourth syntax node based on the text content of the target variable AST node, and set the data semantic type of the data node corresponding to the fourth syntax node to a known type.

[0121] Step 603: Based on the input variable set and output variable set of the data node corresponding to the fourth syntax node, and the known data semantic type, transform the fourth syntax node and its child nodes to generate the corresponding data node.

[0122] The fourth syntax node is the update_expression syntax node in the abstract syntax tree.

[0123] Specifically, by traversing the sub-ASTs of the update_expression syntax node, we search for AST nodes of type `identifier`, and use the found AST nodes of type `identifier` as the target variable AST node.

[0124] Subsequently, the text content of the target variable AST node is added to the input variable set and output variable set of the target data node, respectively; furthermore, the data semantic type of the target data node is set to the `KNOWN` type.

[0125] At this point, the data filling of the target data node is completed. That is, the relevant information of the target variable AST node in the update_expression syntax node is written into the corresponding input variable set and output variable set, thereby transforming the update_expression syntax node and its child nodes into a single target data node.

[0126] In one example embodiment, step 101 involves transforming the AST to generate a hybrid code tree for source code semantic analysis. The specific process in this embodiment can be achieved through... Figure 7 Steps 701 to 705 shown are implemented.

[0127] Step 701: For the fifth syntax node of the conditional statement type in the AST, perform a depth-first traversal of the node tree of the fifth syntax node, and take the first node of the binary expression type, call expression type, identifier type, bracket expression type, unary expression type or ternary expression type as the condition target node, and set the control semantic type of the control node corresponding to the fifth syntax node to the condition type.

[0128] Step 702: Traverse the direct child nodes of the fifth syntax node in the order of the source code, and take the first direct child node of the statement type that is traversed as the condition-true branch statement node, and take the first direct child node of the other branch type that is traversed as the condition-false branch node.

[0129] Step 703: Traverse the direct child nodes of the "condition is not true" branch node, and take the first direct child node of the "otherwise" branch type encountered as the "condition is not true" branch statement node.

[0130] Step 704: Convert the condition-true branch statement node into a condition-true branch result node, and convert the condition-false branch statement node into a condition-false branch result node. Based on the condition-true and condition-false branch result nodes, determine the list of true branch child nodes and the list of false branch child nodes of the control node corresponding to the fifth syntax node, and set the parent node field of each condition-true and condition-false branch result node.

[0131] Step 705: Based on the control logic code segment of the condition target child node, the list of true branch child nodes, the list of false branch child nodes, and the set parent node fields, convert the fifth syntax node and its child nodes into corresponding control nodes.

[0132] Specifically, the fifth syntax node is the conditional statement (if_statement) syntax node in the abstract syntax tree. The following processing is performed on the if_statement syntax node: a. Create a new empty target control node data structure.

[0133] b. Perform a depth-first traversal of the node tree of the if_statement syntax node, and take the first matched binary expression (`binary_expression`) type AST node as the condition target AST node.

[0134] c. When the first AST node of type `binary_expression` does not exist, perform a depth-first traversal of the node tree of the if_statement syntax node, and take the first AST node of type `call_expression` that is matched as the condition target AST node.

[0135] d. When the first AST node of type `binary_expression` and the first AST node of type `call_expression` do not exist, perform a depth-first traversal of the node tree of the if_statement syntax node and take the first matched AST node of type `identifier` as the condition target AST node.

[0136] e. When the first AST node of type `binary_expression`, the first AST node of type `call_expression`, and the first AST node of type `identifier` do not exist, perform a depth-first traversal on the node tree of the if_statement syntax node, and take the first matched AST node of type `parenthesized_expression` as the condition target AST node.

[0137] f. When the first AST node of type `binary_expression`, the first AST node of type `call_expression`, the first AST node of type `identifier`, and the first AST node of type `parenthesized_expression` do not exist, perform a depth-first traversal of the node tree of the if_statement syntax node, and take the first matched unary expression (`unary_expression`) type AST node as the condition target AST node.

[0138] g. When the first AST node of type `binary_expression`, the first AST node of type `call_expression`, the first AST node of type `identifier`, the first AST node of type `parenthesized_expression`, and the first AST node of type `unary_expression` do not exist, perform a depth-first traversal of the node tree of the if_statement syntax node, and take the first matched AST node of type `conditional_expression` as the condition target AST node.

[0139] h. When the conditional target AST node exists, write the text content of the conditional target AST node into the conditional field of the target control node.

[0140] i. Set the control semantic type of the target control node to the conditional (`IF`) type.

[0141] j. Traverse the direct child AST nodes of the if_statement syntax node in the order of the source code, find the first direct child AST node of type `_statement`, and use the found direct child AST node as the AST node of the condition-true branch statement.

[0142] k. When the condition-true branch statement AST node exists, the condition-true branch statement AST node is transformed into the corresponding condition-true branch result node. The transformation process is the same as the method for processing statement AST nodes in this embodiment.

[0143] m. Traverse the direct child AST nodes of the if_statement syntax node, and take the first matched AST node of type `else_clause` as the AST node of the condition not being true.

[0144] n. When a condition-false branch AST node exists, traverse the direct child AST nodes of the condition-false branch AST node, and take the first matched AST node of type `statement` as the condition-false branch statement AST node.

[0145] o. When a condition-false branch statement AST node exists, the condition-false branch statement AST node is transformed into a corresponding condition-false branch result node. The transformation process is the same as the method for processing statement AST nodes in this embodiment.

[0146] q. Complete the data population of the target control node. That is, perform preset processing on the AST nodes of the condition-true branch statement and the condition-false branch statement and generate the corresponding branch result nodes; collect the condition-true branch result nodes into the true branch child node list field of the target control node corresponding to the current if_statement syntax node, collect the condition-false branch result nodes into the false branch child node list field of the target control node corresponding to the current if_statement syntax node, and set the parent node field of the corresponding branch result node to the target control node; the order of the nodes in the true branch child node list field and the false branch child node list field respectively represent the sibling order within the corresponding branch, thereby converting the if_statement syntax node and its child nodes into a single target control node.

[0147] In one example embodiment, step 101 involves transforming the AST to generate a hybrid code tree for source code semantic analysis. The specific process in this embodiment can be achieved through... Figure 8 Steps 801 and 802 shown are implemented.

[0148] Step 801: For the sixth syntax node of the exit statement type in the AST, set the control semantic type of the control node corresponding to the sixth syntax node to the exit type, and delete the direct child nodes corresponding to the exit identifier and the end symbol from the direct child nodes of the sixth syntax node, and use the remaining first direct child node as the return expression node.

[0149] Step 802: Based on the control semantic type of the exit type and the control logic code segment of the return expression node, convert the sixth syntax node and its child nodes into corresponding control nodes.

[0150] Specifically, the sixth syntax node is the return_statement syntax node in the abstract syntax tree. The following processing is performed on the return_statement syntax node: a. Create a new empty target control node data structure.

[0151] b. Set the control semantic type of the target control node to the exit (`RETURN`) type.

[0152] c. Traverse the direct child AST nodes of the return_statement syntax node.

[0153] d. Filter out the AST nodes corresponding to `return` and `;` from the direct child AST nodes of the return_statement syntax node, and use the first remaining direct child AST node as the return expression AST node.

[0154] e. When the return expression AST node exists, write the control logic code segment of the return expression AST node into the return expression field of the target control node.

[0155] f. Complete the data population of the target control node. That is, write the control logic code segment of the return expression AST node into the return expression field of the target control node corresponding to the current return_statement syntax node, thereby transforming the return_statement syntax node and its child nodes into a single target control node.

[0156] It should be noted that for AST nodes of type assignment expression in the abstract syntax tree, they can be denoted as assignment_expression type AST nodes, where assignment_expression is the assignment expression. Assignment_expression type AST nodes can be transformed into single target data nodes by performing the following processing.

[0157] a. Read the first direct child AST node of the assignment_expression type AST node, and use the first direct child AST node as the lvalue AST node.

[0158] b. Read the text content of the left-value AST node. If the text of the left-value AST node begins with ` If the string starts with ` or `&`, then delete the first ` in the text content of the left-value AST node. The ` or `&` character retrieves the target text content of the left-hand AST node.

[0159] c. Read the second direct child AST node of the assignment_expression type AST node, and use the second direct child AST node as the assignment operator AST node.

[0160] d. Read the third direct child AST node of the assignment_expression type AST node, treat the third direct child AST node as the rvalue AST node, and perform the following processing according to the node type in the rvalue AST node's attributes: d1. When the type of the rvalue AST node is `call_expression`, the following processing is performed: d1.1. Convert the rvalue AST node of type call_expression into a function call result data node. The specific conversion process can be referred to the aforementioned preset recursive process.

[0161] d1.2. Use the target text content of the left-value AST node as the output variable to be written.

[0162] d1.3. When the data semantic type of the result data node of the function call is `BUILTIN`, the data semantic type of the target data node is set to `BUILTIN`; otherwise, the data semantic type of the target data node is set to `CALL`.

[0163] d1.4. Complete the data filling of the target data node. That is, perform the preset recursive processing on the rvalue AST node and generate the corresponding function call result data node; collect the input variable set and output variable set, function name field and sub-call list field of the function call result data node into the corresponding fields of the target data node corresponding to the current assignment_expression type AST node, and collect the output variables to be written into the output variable set of the target data node corresponding to the current assignment_expression type AST node, thereby completing the transformation of the current assignment_expression type AST node and its child nodes into a single target data node.

[0164] d2. When the type of the rvalue AST node is `binary_expression`, perform the following processing: d2.1. Convert the rvalue AST node of type binary_expression into a binary result data node. The specific conversion process can be referred to the aforementioned preset recursive process.

[0165] d2.2. When the output variable set of a binary result data node contains the special Boolean flag `BOOL!`, use `BOOL:<target text of the lvalue AST node>` as the output variable to be written.

[0166] d2.3. When the output variable set of the binary result data node does not contain the special Boolean flag `BOOL!`, the target text of the lvalue AST node is used as the output variable to be written.

[0167] d2.4. Set the data semantic type of the target data node to `KNOWN`. d2.5. Complete the data filling of the target data node. That is, perform the preset recursive processing on the rvalue AST node and generate the corresponding binary result data node; collect the input variable set of the binary result data node into the input variable set of the target data node corresponding to the current assignment_expression type AST node, and collect the output variables to be written into the output variable set of the target data node corresponding to the current assignment_expression type AST node, thereby completing the transformation of the current assignment_expression type AST node and its child nodes into a single target data node.

[0168] d3. When the type of the rvalue AST node is assignment_expression, the following processing is performed: d3.1. Convert the rvalue AST node of type assignment_expression to generate the assignment result data node. The specific conversion process can be referred to the aforementioned preset recursive process.

[0169] d3.2. Use the target text content of the left-value AST node as the output variable to be written.

[0170] d3.3. Set the data semantic type of the target data node to `KNOWN` type.

[0171] d3.4. Complete the data filling of the target data nodes. That is, perform the preset recursive processing on the rvalue AST nodes and generate the corresponding assignment result data nodes; The input and output variable sets of the assigned result data node are respectively collected into the input and output variable sets of the target data node corresponding to the current assignment_expression type AST node, and the output variables to be written are collected into the output variable set of the target data node corresponding to the current assignment_expression type AST node. This completes the transformation of the current assignment_expression type AST node and its child nodes into a single target data node.

[0172] d4. When the type of the rvalue AST node is other expression type, the following processing is performed: d4.1. Convert the rvalue AST node of expression type to generate rvalue result data node. The specific conversion process can be referred to the aforementioned preset recursive process.

[0173] d4.2. Use the target text content of the left-value AST node as the output variable to be written.

[0174] d4.3. When the text content of the assignment operator AST node is a compound assignment operator, the target text content of the lvalue AST node is added to the input variable set of the target data node.

[0175] d4.4. Set the data semantic type of the target data node to `KNOWN`. d4.5. Complete the data filling of the target data nodes. That is, perform the preset recursive processing on the rvalue AST nodes and generate the corresponding rvalue result data nodes; The input and output variable sets of the rvalue result data node are respectively collected into the input and output variable sets of the target data node corresponding to the current assignment_expression type AST node, and the output variables to be written are collected into the output variable set of the target data node corresponding to the current assignment_expression type AST node; when the text of the assignment operator AST node belongs to the compound assignment operator, the target text of the lvalue AST node is collected into the input variable set of the target data node corresponding to the current assignment_expression type AST node, thereby completing the transformation of the current assignment_expression type AST node and its child nodes into a single target data node.

[0176] Furthermore, AST nodes of type unary expression, subscript expression, field expression, pointer expression, or cast expression in the abstract syntax tree can be denoted as expression type AST nodes, and the following processing is performed on expression type AST nodes: a. Traverse the child AST nodes of the expression type AST node, and based on the attributes of the child AST nodes of the expression type AST node, filter out the target expression child AST nodes of type `identifier` from the child AST nodes of the expression type AST node.

[0177] b. Add the text content of the target expression sub-AST node to the input variable set of the target data node.

[0178] c. Set the data semantic type of the target data node to `KNOWN`.

[0179] d. Complete the data filling of the target data node. That is, the text content of the target expression sub-AST node of type `identifier` in the current expression type AST node is collected into the input variable set of the target data node corresponding to the current expression type AST node, thereby transforming the current expression type AST node and its child nodes into a single target data node.

[0180] Furthermore, AST nodes of type comma expression in the abstract syntax tree can be denoted as comma_expression type syntax nodes. The following processing is performed on comma_expression type syntax nodes: a. Traverse the direct child AST nodes of the comma_expression type syntax node in source code order.

[0181] b. Filter out the AST nodes corresponding to the comma separator from the direct child AST nodes of the comma_expression type syntax node, and use the remaining direct child AST nodes as the expression AST nodes to participate in the calculation.

[0182] c. Transform each expression AST node involved in the operation into a corresponding local result data node. The specific transformation and generation process can refer to the aforementioned preset recursive process.

[0183] d. Set the data semantic type of the target data node to `KNOWN`.

[0184] e. Complete the data filling of the target data node. That is, perform a preset recursive process on each expression AST node participating in the calculation and generate a corresponding local result data node; collect the input variable set and output variable set of each local result data node into the input variable set and output variable set of the target data node corresponding to the current comma_expression type syntax node, thereby converting the comma_expression type syntax node and its child nodes into a single target data node.

[0185] In addition, it should be noted that AST nodes of the conditional expression type in the abstract syntax tree can be denoted as conditional_expression syntax nodes.

[0186] The following processing is performed on the conditional_expression syntax node: a. Traverse the direct child AST nodes of the conditional_expression syntax node. When traversing to a direct child AST node of type `?`, take the previous direct child AST node of the `?` type direct AST node as the conditional expression AST node.

[0187] b. Traverse the direct child AST nodes of the conditional_expression syntax node. When traversing to a direct child AST node of type `:`, take the previous direct child AST node of the `:` type direct AST node as the truth branch expression AST node, and take the next direct child AST node of the `:` type direct AST node as the false branch expression AST node.

[0188] c. If the conditional expression AST node, the truth branch expression AST node, and the false branch expression AST node cannot be identified simultaneously, and the number of direct child AST nodes of the conditional_expression syntax node is not less than 5, then the first direct child AST node of the conditional_expression syntax node is taken as the conditional expression AST node, the third direct child AST node is taken as the truth branch expression AST node, and the fifth direct child AST node is taken as the false branch expression AST node.

[0189] d. When the conditional expression AST node exists, process the conditional expression AST node according to the preset recursive process shown in the aforementioned embodiment.

[0190] e. When the truth branch expression AST node exists, process the truth branch expression AST node according to the preset recursive process shown in the aforementioned embodiment.

[0191] f. When the falsity branch expression AST node exists, process the falsity branch expression AST node according to the preset recursive process shown in the aforementioned embodiment.

[0192] g. Set the data semantic type of the target data node to `KNOWN` type.

[0193] h. Complete the data filling of the target data node. That is, perform preset recursive processing on the conditional expression AST node, the truth branch expression AST node, and the false value branch expression AST node to generate the corresponding conditional result data node, truth branch result data node, and false value branch result data node; collect the input variable sets of the conditional result data node, the truth branch result data node, and the false value branch result data node into the input variable set of the target data node corresponding to the current conditional_expression syntax node, and collect the output variable sets of the truth branch result data node and the false value branch result data node into the output variable set of the target data node corresponding to the current conditional_expression syntax node, thereby transforming the conditional_expression syntax node and its child nodes into a single target data node.

[0194] Furthermore, it should be noted that AST nodes in the abstract syntax tree that do not belong to any of the following types: binary expression, function call expression, assignment expression, increment / decrement expression, preset expression, size evaluation expression, comma expression, and conditional expression, can be recorded as other AST nodes. Preset expression types include unary expression, subscript expression, field expression, pointer expression, or cast expression. Other AST nodes are processed as follows: a. Recursively extract target AST nodes of type `identifier` from other AST nodes and their child AST nodes.

[0195] b. Add the extracted text of the target AST node of type `identifier` to the input variable set of the target data node.

[0196] c. Set the output variable set of the target data node to an empty set.

[0197] d. Set the data semantic type of the target data node to `KNOWN`.

[0198] e. Complete the data filling of the target data node. That is, collect the target AST nodes of type `identifier` from the child AST nodes of other AST nodes into the input variable set of the target data node corresponding to the other AST nodes according to the preset recursive extraction rules, thereby transforming other AST nodes and child nodes into a single target data node.

[0199] Furthermore, it should be noted that AST nodes of initialization declarator types in the abstract syntax tree can be denoted as init_declarator syntax nodes. The following processing is performed on init_declarator syntax nodes: a. Create a new empty target data node data structure.

[0200] b. Perform a depth-first traversal of the AST node tree of the init_declarator syntax node, and find the first AST node whose node type matches `identifier` in the traversal order. Use the found AST node as the AST node of the declared variable.

[0201] c. When the AST node of the declared variable exists, the text content of the AST node of the declared variable is used as the name of the declared variable; when the AST node of the declared variable does not exist, the name of the declared variable is set to the unknown type.

[0202] d. Traverse the direct child AST nodes of the init_declarator syntax node. If the direct child AST node of the traversed AST node is not of type `identifier`, `=`, or `pointer_declarator`, then use the direct child AST node of the traversed AST node as the initialization expression AST node, and stop traversing the direct child AST nodes of subsequent AST nodes; if all direct child AST nodes are skipped, then it is determined that the initialization expression AST node does not exist.

[0203] e. When the initialization expression AST node does not exist, the declared variable name is added to the output variable set of the target data node, the data semantic type of the target data node is set to `KNOWN`, and the data is populated into the target data node. That is, the relevant information of the declared variable AST node is aggregated into the target data node corresponding to the current init_declarator syntax node, thereby transforming the init_declarator syntax node and its child nodes into a single target data node.

[0204] f. When the initialization expression AST node exists, perform the following processing based on the node type in the initialization expression AST node attribute: f1. When the type of the initialization expression AST node is `call_expression`, the initialization expression AST node will be treated as a direct function call AST node.

[0205] f2. When the type of the initialization expression AST node is `cast_expression`, each direct child AST node is traversed in the order of its direct child AST nodes. Direct child AST nodes of type `(`, `)` or `type_descriptor` are skipped. A depth-first traversal is performed on the AST node tree of the remaining direct child AST nodes to find the first `call_expression` type AST node. The found `call_expression` type AST node is used as the direct function call AST node.

[0206] g. When a direct function call AST node exists, the direct function call AST node is processed in accordance with the method for processing function call expression syntax nodes in the aforementioned embodiment until the corresponding function call result data node is obtained.

[0207] h. When the result data node of the function call exists, the declared variable name is added to the output variable set of the target data node, and the data semantic type of the target data node is set to the data semantic type of the result data node of the function call.

[0208] i. When the direct function call AST node does not exist but the initialization expression AST node does exist, process the initialization expression AST node according to the preset recursive process shown in the aforementioned embodiment until the corresponding initialization expression result data node is obtained.

[0209] j. When the result data node of the initialization expression exists, the declared variable name will be added to the output variable set of the target data node.

[0210] k. When the result data node of the initialization expression exists, set the data semantic type of the target data node to `KNOWN` type.

[0211] 1. When the initialization expression AST node exists, complete the data filling of the target data node. That is, the direct function call AST node or the initialization expression AST node performs preset processing and generates the corresponding function call result data node or initialization expression result data node; the input variable set, output variable set, function name field, sub-call list field, and taint propagation flag field of the corresponding result data node are collected as needed into the target data node corresponding to the current init_declarator syntax node, and the declared variable names are collected into the output variable set of the target data node corresponding to the current init_declarator syntax node, thereby completing the transformation of the current init_declarator syntax node and its child nodes into a single target data node.

[0212] Furthermore, it should be noted that AST nodes declaring types in the abstract syntax tree can be denoted as declaration syntax nodes. The following processing is performed on declaration syntax nodes: a. Perform a depth-first traversal of the AST node tree of the declaration syntax node, find all AST nodes of type `init_declarator`, and use the found AST nodes of type `init_declarator` as the set of initialization declaration AST nodes.

[0213] b. Traverse the direct AST nodes of the declaration syntax node, filter the direct child AST nodes of type `identifier`, and use the filtered direct child AST nodes of type `identifier` as the set of direct declaration variable AST nodes.

[0214] c. When the sum of the number of nodes in the initialized AST node set and the number of nodes in the directly declared variable AST node set is greater than 1, create a new empty target data node data structure and perform the following processing: c1. Iterate through each `init_declarator` type AST node in the set of initialization declaration AST nodes, and take the currently traversed `init_declarator` type AST node as the current initialization declaration AST node.

[0215] c2. Call the method procedure for processing the init_declarator syntax node in the aforementioned embodiment to process the initialization declaration AST node until the corresponding current initialization result data node is obtained.

[0216] c3. Iterate through each `identifier` type AST node in the AST node set of directly declared variables, and read the text content of the current directly declared variable AST node as the name of the current directly declared variable.

[0217] c4. If the currently declared variable name does not already exist in the output variable set of the target data node, then add the currently declared variable name to the output variable set of the target data node.

[0218] c5. Set the data semantic type of the target data node to `KNOWN`. c6. Complete the data filling of the target data node. That is, for each `init_declarator` type AST node, a preset recursive processing procedure is executed to generate a corresponding initialization result data node. The input variable set and output variable set of each initialization result data node are collected into the target data node corresponding to the current declaration syntax node, and the variable names corresponding to the directly declared variable AST node are collected into the output variable set. Thus, the declaration syntax node and its child nodes are transformed into a single target data node.

[0219] d. If an AST node of type `init_declarator` exists, and the sum of the number of nodes in the initialized AST node set and the number of nodes in the directly declared variable AST node set is not greater than 1, then the first AST node of type `init_declarator` is used as the target initialized AST node, and the following processing is performed: d1. Call the method process for processing the init_declarator syntax node in the aforementioned embodiment to process the target initialization declaration AST node until the corresponding initialization declaration result data node is obtained.

[0220] d2. Return the initialization declaration result data node directly as the transformation result of the `declaration` type AST node. In this case, no new wrapper data node is created. The `declaration` type AST node and the target initialization declaration AST node are merged and transformed into a single initialization declaration result data node. e. If an `init_declarator` type AST node does not exist but a directly declared variable AST node does exist, then the first directly declared variable AST node is used as the declared variable AST node, and the following processing is performed: e1. Create a new empty target data node data structure.

[0221] e2. Use the text content of the AST node to be declared as the name of the variable.

[0222] e3. Add the declared variable name to the output variable set of the target data node.

[0223] e4. Set the data semantic type of the target data node to `KNOWN` type.

[0224] e5. Complete the data filling of the target data node. That is, the relevant information of the declared variable AST node is collected into the target data node corresponding to the current declaration syntax node, thereby transforming the declaration syntax node and its child nodes into a single target data node.

[0225] f. When an AST node of type `init_declarator` does not exist and the AST node of the directly declared variable does not exist, the target data node is not generated.

[0226] In addition, it should be noted that for statement AST nodes in the abstract syntax tree, the following processing is performed according to the node type in the statement AST node attributes: A. For AST nodes of expression / statement type in the abstract syntax tree, they can be denoted as expression_statement syntax nodes. The following processing is performed on expression_statement syntax nodes: Aa. Traverse the direct child AST nodes of the expression_statement syntax node.

[0227] Ab. Select expression type AST nodes from the direct child AST nodes of the expression_statement syntax node that are neither semicolons `;` nor expressions.

[0228] Ac. Use the filtered expression type AST node as the target expression AST node.

[0229] Ad. The preset recursive process in the aforementioned embodiments is invoked to process the target expression AST node until the corresponding expression statement result data node is obtained.

[0230] Ae. Returns the expression statement result data node directly as the transformation result of the expression_statement syntax node. At this time, no new wrapper data node is created. The expression_statement syntax node and its core expression AST node are merged and transformed into a single expression statement result data node.

[0231] B. For AST nodes in the abstract syntax tree that are of the compound statement type and are not the root node of a function body, they can be denoted as compound_statement syntax nodes. The following processing is performed on compound_statement syntax nodes: Ba. Create a new empty block-level target data node data structure.

[0232] Bb. Set the data semantic type of the block-level target data node to `KNOWN` type.

[0233] Bc. Set the expression field of the block-level target data node to `{ ...}`.

[0234] Bd. Traverse all direct child AST nodes of the compound_statemen syntax node in source code order.

[0235] Be. If the type of a direct child AST node encountered during traversal is `{` or `}`, then skip that direct child AST node.

[0236] Bf. When the type of the direct child AST node encountered during traversal is not `{` or `}`, the method procedure for processing the statement AST node is called to process the direct child AST node.

[0237] Bg. Complete the data filling of the block-level target data node. That is, each direct child AST node performs a preset processing procedure and generates a corresponding sub-hybrid tree node; each sub-hybrid tree node is sequentially collected into the child node list field of the block-level target data node corresponding to the current compound_statemen syntax node, and the parent node field of each sub-hybrid tree node is set to the block-level target data node; the order of the sub-hybrid tree nodes in the child node list field indicates the sibling order between these sub-hybrid tree nodes, thereby transforming the compound_statemen syntax node and its child nodes into a single block-level target data node.

[0238] C. For while loops (`while_statement`), for loops (`for_statement`), or do-do loops (`do_statement`) in the abstract syntax tree, they can be marked as loop statement syntax nodes. The following processing is performed on loop statement syntax nodes: Ca. Create a new empty target control node data structure.

[0239] Cb. Based on the node type in the loop statement syntax node attributes, set the control semantic type of the target control node to `WHILE`, `FOR`, or `DO_WHILE`.

[0240] Cc. When the loop statement syntax node is `while_statement` or `do_statement`, according to steps b to g in the processing of the if_statement syntax node in the previous embodiment, the node tree of the loop statement syntax node is processed to identify the condition target AST node, and the identification result is used as the condition target AST node; when the condition target AST node exists, the text content of the condition target AST node is written into the condition field of the target control node.

[0241] Cd. When the loop statement syntax node type is `for_statement`, the following processing is performed: Cd1. Creates empty initialization data nodes, conditional data nodes, update data nodes, initialization text, conditional text, and update text. Cd2. Traverse the direct child AST nodes of the `for_statement` type AST node in the order of the source code, and set the currently traversed direct child AST node as the current direct child AST node. Cd3. If the current direct child AST node type is a declaration node, then the method procedure for processing declaration syntax nodes in this embodiment is called to process the direct child AST node until the corresponding initialization data node is obtained, and the text content of the current direct child AST node is written into the initialization text.

[0242] Cd4. If the current direct child AST node type is `binary_expression`, `identifier`, or `call_expression`, and the conditional data node does not exist, call the aforementioned preset recursive processing procedure to process the direct child AST node until the corresponding conditional data node is obtained, and at the same time write the text content of the current direct child AST node into the conditional text.

[0243] Cd5. If the current direct child AST node type is `update_expression`, call the method procedure for processing update_expression syntax nodes in the previous embodiment to process the current direct child AST node until the corresponding updated data node is obtained, and write the text content of the current direct child AST node into the updated text.

[0244] Cd6. If the current direct child AST node type is `assignment_expression` and the initialization data node does not exist, call the method procedure for processing assignment_expression syntax nodes in the previous embodiment to process the current direct child AST node until the corresponding initialization data node is obtained, and write the text content of the current direct child AST node into the initialization text.

[0245] Cd7. If the current direct child AST node type is `assignment_expression`, and the initialization data node exists, but the update data node does not exist, call the method procedure for processing assignment_expression syntax nodes in the aforementioned embodiment to process the current direct child AST node until the corresponding update data node is obtained, and at the same time write the text content of the current direct child AST node into the update text.

[0246] Cd8. Creates a new empty set of loop condition fragments.

[0247] Cd9. When the initialization data node exists, read the expression field of the initialization data node as the initialization information; when the output variable set of the initialization data node is not empty, format the output variable set of the initialization data node as `[declares:<output variable set>]` and append it to the initialization information; format the initialization information as `init:<initialization information>` and add it to the loop condition fragment set.

[0248] Cd10. When the initialization data node does not exist but the initialization text exists, format the initialization text as `init:<initialization text>` and add it to the loop condition fragment set.

[0249] Cd11. When a condition data node exists, read the expression field of the condition data node as condition information; when the input variable set of the condition data node is not empty, format the input variable set of the condition data node as `[uses:<input variable set>]` and append it to the condition information; format the condition information as `condition:<condition information>` and add it to the loop condition fragment set.

[0250] Cd12. When the condition data node does not exist but the condition text exists, format the condition text as `condition:<condition text>` and add it to the loop condition fragment set.

[0251] Cd13. When the update data node exists, read the expression field of the update data node as the update information; when the output variable set of the update data node is empty and not empty, format the output variable set of the update data node as `[affects:<output variable set>]` and append it to the update information; format the update information as `update:<update information>` and add it to the loop condition fragment set.

[0252] Cd14. When the update data node does not exist but the update text exists, format the update text as `update:<update text>` and add it to the loop condition fragment set.

[0253] Cd15. When the set of loop condition fragments is not empty, use `;` to connect each loop condition fragment in the set in the order they were added, and use the connection result as the body text of the loop condition.

[0254] Cd16. When the set of loop condition fragments is not empty, format the loop condition body text as `for (<loop condition body text>)` and use it as the loop condition text.

[0255] Cd17. When the set of loop condition fragments is empty, use `for (...)` as the loop condition text.

[0256] Cd18. Writes the loop condition text into the condition field of the target control node. Cg. Traverse the direct child AST nodes of the loop statement syntax node, and take the first matched AST node of type `statement` as the loop body statement AST node.

[0257] Ch. When the loop body statement AST node exists, the method procedure for processing the statement AST node is called to process the loop body statement AST node.

[0258] Ci. Complete the data filling of the target control node. That is, the initialization data node, condition data node, loop body result node, and update data node are generated and collected as needed according to the preset processing results into the true branch child node list field of the target control node corresponding to the current loop statement syntax node, and the parent node field of the corresponding node is set to the target control node; when the AST node type is `for_statement`, the nodes in the true branch child node list field are arranged in the order of initialization data node, condition data node, loop body result node, and update data node, where the order represents the sibling order within the loop body; thereby converting the current loop statement syntax node and its child nodes into a single target control node.

[0259] D. For the multi-branch selection statement (switch_statement) syntax node in the abstract syntax tree, perform the following processing: Da. Create a new empty target control node data structure.

[0260] Db. Following steps b to g in the if_statement syntax node processing process described in the foregoing embodiment, perform condition target AST node identification processing on the node tree of the switch_statement syntax node; when a condition target AST node is identified, write the text content of the condition target AST node into the condition field of the target control node.

[0261] Dc. Set the control semantic type of the target control node to the multi-branch selection (`SWITCH`) type.

[0262] Dd. Iterate through the direct child AST nodes of the switch_statement syntax node, and match the first AST node of type `compound_statement` as the switch body AST node.

[0263] De. When the main AST node of the switch exists, traverse the direct child AST nodes of the main AST node of the switch, and perform the following processing according to the node type in the attribute of the current direct child AST node: De1. If the current direct child AST node type is `case_statement`, match the first AST node in the current direct child AST node whose type is neither `case` nor `:` as the current switch branch label.

[0264] De2. If the current direct child AST node type is `default_statement`, set the current switch branch label to the default branch (`default`).

[0265] De3. If the current switch branch label exists, and the current direct child AST node type is not `{`, `}`, `case_statement`, or `default_statement`, call the method procedure for processing the statement AST node to process the current direct child AST node.

[0266] Df. Complete the data filling of the target control node. That is, perform preset processing on the AST nodes of each branch statement in the main AST node of the switch and generate the corresponding current branch result node; collect each current branch result node into the branch child node list field corresponding to the switch branch label in the target control node corresponding to the current switch_statement syntax node, and set the parent node field of each current branch result node to the target control node; the order of nodes in the branch child node list field corresponding to the same switch branch label indicates the sibling order within the switch branch, thereby converting the switch_statement syntax node and its child nodes into a single target control node.

[0267] E. For break / exit statement syntax nodes in the abstract syntax tree, perform the following processing: Ea. Create a new empty target control node data structure.

[0268] Eb. Set the control semantic type of the target control node to the interrupt (`BREAK`) type.

[0269] Ec. Complete the data population of the target control node. That is, write the control logic code segment of the break_statement syntax node into the corresponding target control node, thereby transforming the break_statement syntax node into a single target control node.

[0270] F. For the `continue_statement` syntax node in the abstract syntax tree, perform the following processing: Fa. Create a new empty target control node data structure.

[0271] Fb. Set the control semantic type of the target control node to the `CONTINUE` type.

[0272] Fc. Complete the data population of the target control node. That is, write the control logic code segment of the continue_statement syntax node into the corresponding target control node, thereby transforming the continue_statement syntax node into a single target control node.

[0273] G. For the goto_statement syntax node in the abstract syntax tree, perform the following processing: Ga. Create a new empty target control node data structure.

[0274] Gb. Set the control semantic type of the target control node to jump (`GOTO`) type.

[0275] Gc. Search for the first `identifier` type AST node in the goto_statement syntax node and its child AST nodes, and use the found `identifier` type AST node as the jump label AST node.

[0276] Gd. When a jump label AST node exists, write the control logic code segment of the jump label AST node into the label field of the target control node.

[0277] Ge. Complete the data population of the target control node. That is, write the control logic code segment of the jump label AST node into the label field of the target control node corresponding to the current goto_statement syntax node, thereby converting the goto_statement syntax node and its child nodes into a single target control node.

[0278] H. For declaration syntax nodes in the abstract syntax tree, perform the following processing: Ha. Process the current declaration syntax node according to the aforementioned method for processing declaration syntax nodes until the corresponding current statement transformation result node is obtained.

[0279] Hb. outputs the current statement transformation result node, thus completing the transformation from the declaration syntax node to the data node.

[0280] I. For an AST node in the abstract syntax tree that does not belong to any of steps A through H, nor to either the `return_statement` syntax node or the `if_statement` syntax node, it can be designated as the current statement AST node. For the current statement AST node, the following processing is performed: Ia. Create a new empty target data node data structure.

[0281] Ib. Recursively extract the target AST node of type `identifier` from the current statement's AST node and its child AST nodes.

[0282] Ic. Add the extracted text content of the target AST node of type `identifier` to the input variable set of the target data node.

[0283] Id. Sets the set of output variables for the target data node to an empty set.

[0284] Ie. Writes the text content of the current statement's AST node into the expression field of the target data node.

[0285] If so, set the data semantic type of the target data node to `KNOWN`.

[0286] Ig. Complete the data filling of the target data node. That is, collect the target AST nodes of type `identifier` from the current statement AST node and its child AST nodes into the input variable set of the target data node corresponding to the current statement AST node according to the preset recursive extraction rules, thereby transforming the current statement AST node and its child nodes into a single target data node.

[0287] For example, refer to Figure 9 The diagram shown illustrates the hybrid code tree construction system block diagram, as follows: Figure 9 As shown, the hybrid code tree construction system includes an input module, a lexical and syntax analysis module, a hybrid code tree construction module, and a downstream analysis module. The input module is used to input source code text (i.e., the source code to be analyzed in the aforementioned embodiments). The lexical and syntax analysis module is used to perform tree-sitter parsing and element extraction on the source code text to obtain a standard abstract syntax tree and base class objects. The hybrid code tree construction module is used to perform statement classification and expression classification on the abstract syntax tree to obtain data nodes and control nodes of corresponding types, thereby generating a hybrid code tree. The downstream analysis module is used to perform static analysis such as taint analysis, complexity calculation, and function call graph generation in conjunction with the hybrid code tree. The specific processes involved can be referred to in the aforementioned embodiments. They will not be repeated here.

[0288] For example, for the following source code to be analyzed, the hybrid code tree generated using the method of this application can be referred to... Figure 10 As shown.

[0289] Source code example int complex_function(int x, int y) { int result = 0; if (x>0) { if (y>0) { / / Nested if statements for (int i = 0; i <x; i++) { if (i % 2 == 0) { result += y; } else { result -= y; } } } else { / / while loop int count = 0; while (count <x) { result += count; count++; if (result>100) { break } } } } else { / / do-while loop int temp = 1; do { result += temp; temp = 2; while (temp < 10 && result < 50); } return result; } Therefore, compared with traditional solutions, the method of this application has the following technical advantages: (1) Eliminate semantic synchronization overhead between multiple IRs. Compared with CN119646817A, which relies on five heterogeneous graph structures (AST, CFG, CDG, DDG, and PDG) to work together, this application uses a unified base class encapsulation and derived node types to ensure that the same statement corresponds to only one data node object in the hybrid code tree. Its input list, output list, taint propagation state, source code location, and other attributes are all stored inside the object. Modifying any attribute will take effect globally without cross-structure lookup and synchronization.

[0290] (2) The association between control flow and data flow is downgraded from "graph traversal deduction" to "direct lookup of parent-child relationship", achieving deterministic and low-overhead binding. Compared with CN119646817A, to determine whether "y = src; is executed in the true branch of if (x>0)", the following steps are required: ① Locate the assignment node in the AST → ② Traverse the parent node of the AST upwards to the nearest if_statement → ③ Query the BasicBlock corresponding to the if_statement in the CFG → ④ Confirm in the CFG whether the BasicBlock belongs to the true branch path → ⑤ Query the pollution status of src in the DDG; the whole process involves at least 3 data structures and 4 cross-structure jumps. In this application, y = src; is converted into a data node, and its parent node must be the IF_STMT control node; the list of true branch child nodes of the control node directly contains the reference of the data node. Therefore, only one pointer dereference is needed to 100% confirm the execution context.

[0291] (3) The execution sequence is solidified by lexical order, achieving O(1) precise alignment from source code line number to execution context, eliminating the cost of manual comparison. In contrast, the CFG in CN119646817A is essentially a jump graph, and the nodes have no inherent order (e.g., the if true branch block may be located after the false branch block in memory). When auditors view line 42 of the code, they need to manually search for the corresponding BasicBlock in the CFG graph and then trace back its predecessor / successor block. However, this application mandates that "sibling nodes under the same parent node are arranged in the order of appearance in the source code, and the list of child nodes strictly follows the lexical order"; and the source code positioning field of each node is accurate to the byte offset.

[0292] (4) A strictly directed acyclic tree structure is used instead of a graph model to avoid path explosion at its source, ensuring the controllability and scalability of path sensitivity analysis. Compared with the PDG / CPPG in CN119646817A, which contains loops, cross edges (goto), and multiple incoming edges (if-else merging points), resulting in an exponential increase in path traversal, it has to adopt compromise strategies such as pruning and sampling, sacrificing accuracy. In contrast, the hybrid code tree in this application is acyclic, has no cross edges, and has no multiple incoming edges. At this time, the "path" is redefined as a parent-child chain from the root node to the leaf node, and its number is equal to the number of leaf nodes (i.e., the total number of statements), regardless of the nesting depth.

[0293] It should be noted that the tree structure in the hybrid code tree, in which all nodes inherit from a unified base class and contain a list of parent nodes and child nodes, can be replaced by a doubly linked list nested tree structure. In the doubly linked list nested tree structure, each node, in addition to the parent node pointer, adds a predecessor node (prev) and a successor node (next) pointer to form a doubly linked list of sibling nodes at the same level. The child node list no longer stores a reference array / list, but is linked together by the first_child pointer of the first node and the next_sibling pointer of each child node. The parent node field is still retained for upward traversal. The prev / next pointers are used to strictly maintain the lexical order, support O(1) insertion / deletion of sibling nodes, and facilitate local reconstruction in incremental parsing scenarios.

[0294] The unified base class has fixed fields such as unique node identifiers, source code location information, and parent-child node association attributes. These can be replaced by sparse attribute maps instead of fixed fields. The implementation difference is that all nodes use a custom compact hash table to store attributes; attribute names (such as "input_list", "condition_text") serve as keys, and values ​​are serialized type-safe data (such as vectors). <string>、bool、optional <string>The required and optional attributes of each node type are declared through a predefined AttributeSchema registry and validated during construction. The node type enumeration value determines which schemas are loaded, avoiding memory waste (especially for a large number of simple expression nodes).

[0295] It should be noted that although the operations of the method of the present invention are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart may be performed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0296] The following is for reference. Figure 11 It shows a schematic diagram of the structure of a computer system 900 suitable for implementing computer devices or servers in the embodiments of this application.

[0297] like Figure 11 As shown, the computer system 900 includes a central processing unit (CPU) 901, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 902 or programs loaded from storage section 908 into random access memory (RAM) 903. The RAM 903 also stores various programs and data required for the operation of the system 900. The CPU 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0298] The following components are connected to I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 910 as needed so that computer programs read from it can be installed into storage section 908 as needed.

[0299] Specifically, according to embodiments of this application, the above references Figure 1 The described process can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing instructions for performing... Figure 1 The program code for the method. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 909, and / or installed from removable media 911.

[0300] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0301] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0302] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be located in a processor. The names of these units or modules do not, in certain circumstances, constitute a limitation on the unit or module itself.

[0303] On the other hand, this application also provides a computer-readable storage medium, which may be included in the computer device described in the above embodiments, or may exist independently and not assembled into the computer device. The aforementioned computer-readable storage medium stores one or more programs that, when used by one or more processors, execute the methods described in this application. For example, it may execute... Figure 1 The steps of the method shown.

[0304] This application provides a computer program product including instructions that, when executed, cause the method described in this application to be performed. For example, it can execute... Figure 1 The steps of the method shown.

[0305] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0306] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.< / string> < / string>

Claims

1. A source code processing method, characterized in that, The method includes: Obtain the Abstract Syntax Tree (AST) corresponding to the source code to be analyzed, and transform the AST to generate a hybrid code tree for source code semantic analysis. The hybrid code tree completely retains the original parent-child hierarchical relationship of the AST, and sibling nodes at the same level are arranged according to the lexical parsing order of the source code, without adding any additional jump edges, control flow edges, or data flow edges. The hybrid code tree includes data nodes and control nodes that inherit from a unified base class. The unified base class has a unique node identifier, source code location information, and parent-child node association attributes. The data nodes correspond to the data operation syntax nodes in the AST, are configured with data semantic types and input variable sets, and can optionally configure output variable sets. The control nodes correspond to the control logic syntax nodes in the AST, are configured with control semantic types and control logic code segments, and can optionally configure a list of branch child nodes. Static analysis is performed on the source code to be analyzed based on the hybrid code tree to obtain the analysis results.

2. The method according to claim 1, characterized in that, The process of transforming the AST to generate a hybrid code tree for source code semantic analysis includes: For the first syntax node of the expression type in the AST, obtain the types of each child node contained in the first syntax node; Based on the text content of the left operand child node, right operand child node, and direct child node of the identifier type, determine the set of input variables for the data node corresponding to the first syntax node; or, convert the left operand child node of the binary expression type or the left operand child node of the expression type to generate a left-side data node, and determine the set of input variables for the data node corresponding to the first syntax node based on the set of input variables and the set of output variables of the left-side data node; convert the right operand child node of the binary expression type or the right operand child node of the expression type to generate a right-side data node, and determine the set of input variables and the set of output variables for the data node corresponding to the first syntax node based on the set of input variables and the set of output variables of the right-side data node. If the operator child nodes contained in the first syntax node are comparison operators or logical operators, then the set of output variables of the data node corresponding to the first syntax node is determined according to the Boolean type, and the data semantic type of the data node corresponding to the first syntax node is set to a known type; Based on the set of input variables of the data node corresponding to the first syntax node, the set of output variables of the data node corresponding to the first syntax node, and the known data semantic type, the first syntax node and its child nodes are transformed to generate corresponding data nodes.

3. The method according to claim 1, characterized in that, The process of transforming the AST to generate a hybrid code tree for source code semantic analysis includes: For the second syntax node of the function call type in the AST, obtain the type of each child node contained in the second syntax node; If the first direct child node of the second syntax node is an identifier type, then the first direct child node is taken as the called function node, the text content of the called function node is determined as the called function name, and the function name field of the corresponding data node of the second syntax node is determined according to the called function name. Filter out the direct child nodes of the parameter list type from the direct child nodes of the second syntax node as the parameter list node. Based on the text content of the direct child nodes of the identifier type, the formatting result of the text content of the direct child nodes of the literal type or string literal type in the parameter list node, and the set of input variables of the sub-call data node generated by the conversion of the direct child nodes of the expression type, determine the set of input variables of the data node corresponding to the second syntax node. If the called function name fails to match the preset built-in function rule base, the data semantic type of the data node corresponding to the second syntax node is set to the call type; the built-in function rule base is used to provide a unified parsing basis for the input and output variable set, return value dependency relationship and taint propagation behavior based on the preset function name, parameter position configuration and taint propagation flag when generating data nodes for function call syntax nodes; Based on the set of input variables of the data node corresponding to the second syntax node and the data semantic type of the call type, the second syntax node and its child nodes are transformed into data nodes of the call type.

4. The method according to claim 3, characterized in that, The method further includes: If the called function name matches the built-in function rule library, the input parameter position configuration and output parameter position configuration are read from the matched target built-in function rule; Based on the number of variables in the parsed parameter variable set, the input parameter position configuration and the output parameter position configuration are respectively parsed into an input parameter position set and an output parameter position set; the parsed parameter variable set includes the input variable set of the data node corresponding to the second syntax node; Iterate through each parameter variable in the set of parsed parameter variables in the order in which the variables appear, and read the parameter position of the traversed parameter variable in the set of parsed parameter variables; If the parameter position exists in the set of input parameter positions, then the parameter variable that is traversed to the corresponding position is determined as the rule input variable; if the parameter position exists in the set of output parameter positions, then the parameter variable that is traversed to the corresponding position is determined as the rule output variable. If the target built-in function rule defines a return value dependency relationship, then the return value dependency relationship configuration in the target built-in function rule is read, and the return value dependency relationship configuration is parsed into a set of return value dependent parameter positions according to the number of variables in the parsed parameter variable set. The parameter variables that the return result of the second syntax node depends on are determined according to the set of return value dependent parameter positions, and the return value associated fields of the data node of the call type are determined according to the parameter variables that the return result depends on. Read the taint propagation flag in the target built-in function rule, determine the taint propagation flag field of the data node of the call type according to the taint propagation flag, and set the data semantic type of the data node of the call type to the built-in type; Based on the rule input variables, rule output variables, return value association field, taint propagation flag field, and the data semantic type of the built-in type, the data node of the call type is converted into a built-in function data node.

5. The method according to claim 1, characterized in that, The step of generating a hybrid code tree for source code semantic analysis from the AST includes: For the third syntax node of the size evaluation expression type in the AST, select the first target child node of the type descriptor type and the second target child node of the identifier type from each child node contained in the third syntax node; Based on the text content formatting results of the first target sub-node and the second target sub-node, determine the set of input variables for the data node corresponding to the third syntax node, and set the data semantic type of the data node corresponding to the third syntax node to a known type; Based on the set of input variables of the data node corresponding to the third syntax node and the known data semantic type, the third syntax node and its child nodes are transformed to generate the corresponding data node.

6. The method according to claim 1, characterized in that, The process of transforming the AST to generate a hybrid code tree for source code semantic analysis includes: For the fourth syntax node of the increment / decrement expression type in the AST, find the identifier type child node from each child node contained in the fourth syntax node as the target variable AST node; Based on the text content of the target variable AST node, determine the input variable set and output variable set of the data node corresponding to the fourth syntax node, and set the data semantic type of the data node corresponding to the fourth syntax node to a known type; Based on the set of input variables and the set of output variables of the data node corresponding to the fourth syntax node, and the known data semantic type, the fourth syntax node and its child nodes are transformed to generate the corresponding data node.

7. The method according to claim 1, characterized in that, The process of transforming the AST to generate a hybrid code tree for source code semantic analysis includes: For the fifth syntax node of the conditional statement type in the AST, a depth-first traversal is performed on the node tree of the fifth syntax node, and the first node of the binary expression type, call expression type, identifier type, bracket expression type, unary expression type or ternary expression type is taken as the condition target node, and the control semantic type of the control node corresponding to the fifth syntax node is set to the condition type. Traverse the direct child nodes of the fifth syntax node in the order of the source code, and take the first direct child node of the statement type encountered as the condition-true branch statement node, and take the first direct child node of the other branch type encountered as the condition-false branch node. Iterate through the direct child nodes of the branch node where the condition is not true, and take the first direct child node of the otherwise branch type as the branch statement node where the condition is not true. The condition-true branch statement node is converted into a condition-true branch result node, and the condition-false branch statement node is converted into a condition-false branch result node. Based on the condition-true branch result node and the condition-false branch result node, the list of true branch child nodes and the list of false branch child nodes of the control node corresponding to the fifth syntax node are determined, and the parent node field of the condition-true branch result node and the condition-false branch result node are set respectively. Based on the control logic code segment of the conditional target child node, the list of true branch child nodes, the list of false branch child nodes, and the set parent node fields, the fifth syntax node and its child nodes are transformed into corresponding control nodes.

8. The method according to claim 1, characterized in that, The process of transforming the AST to generate a hybrid code tree for source code semantic analysis includes: For the sixth syntax node of the exit statement type in the AST, set the control semantic type of the control node corresponding to the sixth syntax node to the exit type, delete the direct child nodes corresponding to the exit identifier and the end symbol from the direct child nodes of the sixth syntax node, and use the remaining first direct child node as the return expression node. Based on the control semantic type of the exit type and the control logic code segment of the return expression node, the sixth syntax node and its child nodes are transformed to generate the corresponding control node.

9. A computer device, comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the source code processing method according to any one of claims 1 to 8.

10. A computer program product having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the source code processing method according to any one of claims 1 to 8.

Images