Code control flow compliance detection method and device based on graph structure
Patent Information
- Application Number
- CN202611400524.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-10
- Publication Date
- 2026-10-16
Smart Images
Figure CN122925246A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of software testing technology, and specifically to a method and apparatus for code control flow compliance detection based on graph structure. Background Technology
[0002] Control flow compliance testing is a core component of static software testing, primarily ensuring that the program's control structure conforms to the basic requirements of structured programming. Control flow analysis systematically examines the control structure of the program under test using control flow diagrams, checking the program structure according to structured programming rules and basic program structure requirements. Control flow compliance testing requires that the program under test should not contain the following defects: redirection to non-existent statement labels; unused statement labels; unused subroutine definitions; calls to non-existent subroutines; statements that cannot be reached after entering the program; and statements that cannot reach the stop statement.
[0003] Existing comprehensive commercial static analysis tools for control flow compliance detection (such as LDRA Testbed and Coverity) typically include a large rule base covering coding standards, quality rules, and security vulnerabilities, encompassing basic control flow analysis. Their advantages lie in high functional integration, standardized reporting, and user-friendly interfaces. However, their limitations include black-box nature and difficulty in customization; the core analysis engine and rule base are usually closed, making it difficult for users to modify or extend the underlying detection logic to meet specific needs. Open-source static analysis frameworks for software code (such as Joern and CodeQL) transform source code into rich intermediate representations and provide powerful programmatic query interfaces. However, existing technologies like LDRA and Coverity employ black-box rule engines, coupling rules with detection logic; Joern / CodeQL provides general graph query capabilities but requires users to write complex queries themselves. For ordinary software developers, these tools cannot be directly and conveniently applied to actual control flow compliance defect detection scenarios. Therefore, there is currently a lack of integrated technical solutions that can directly, automatically, and systematically complete program defect detection. Summary of the Invention
[0004] To overcome the shortcomings of the existing technology, the present invention provides a graph-based code control flow compliance detection method and apparatus, which can be used to detect basic control flow compliance defects in specific categories of program source code, and is simple to operate.
[0005] In a specific implementation of this invention, the Joern tool is used to generate and optimize the code control flow graphs of all functions and the function call graph of the entire project. Then, a control flow compliance rule mapping model is constructed based on the control flow compliance detection rules, and a detection rule engine is designed. The control flow compliance rule mapping model is loaded into the detection rule engine, and the source code of each function, the generated code control flow graph, and the function call graph of the project are input into the detection rule engine. The detection results are output, and finally, a control flow compliance detection report is generated.
[0006] The technical solution of the present invention is as follows:
[0007] A graph-based code control flow compliance detection method categorizes control flow compliance defects (six types) and abstractly designs precise mapping rules on a graph structure, establishing a one-to-one mapping relationship of "defect type → graph feature → detection algorithm" to achieve automated detection. The method includes the following steps:
[0008] Step 1) Generate a function call graph and optimize the source code control flow graph based on a node merging strategy, including:
[0009] 11) Generate code control flow graphs and call graphs based on code analysis tools (such as Joern static analysis tool).
[0010] Obtain the source code to be inspected (e.g., C / C++ source code), import it into the Joern static analysis tool configured as a Windows system runtime environment, and trigger the parsing process via a .bat script. The tool automatically analyzes the control flow logic of the source code, generating an initial code control flow graph (CFG) and function call graph (CG) in DOT format. This initial code control flow graph contains a set of nodes and a set of transition edges. Each node in the code control flow graph carries three core attributes: node type (e.g., METHOD, METHOD_RETURN, RETURN, etc.), the corresponding line number of the source code (used for locating the violation), and the source code content of the node (used for defect correlation analysis), ensuring accurate association between the source code and the code control flow graph nodes during the inspection process; the function call graph includes function call graphs containing all functions and function call graphs containing only program-defined functions.
[0011] 12) Optimize the code control flow graph based on node merging strategy:
[0012] Because the Joern tool may split a single statement into multiple redundant nodes in the code control flow graph with the same line number and sequential linking during parsing, and because consecutive, branchless, sequentially executed nodes increase the complexity of the code control flow graph structure, a node merging strategy is needed for dual optimization: First, for redundant nodes, clusters of nodes with the same line number and sequential linking are identified, the node with the longest source code content is retained, and the remaining redundant nodes are deleted, while maintaining the node's position and transition edge relationships in the code control flow graph. Second, for consecutive, branchless node sequences, continuous chain chains of nodes where all nodes contain no branching statements are identified and merged into a single node, simplifying the topology of the code control flow graph. During the node merging process, the position and transition edge relationships of this series of nodes in the overall code control flow graph are strictly maintained to ensure the accuracy of the control flow logic. The optimized code control flow graph retains the core control logic while reducing the computational complexity of subsequent detection.
[0013] Step 2) Describe defect types using a graph structure and construct a graph-based control flow compliance rule mapping model.
[0014] To automate the detection process, six types of defects are transformed into abnormal features on a graph structure. A mapping relationship of "defect type - graph structure feature - detection algorithm" is established, forming a standardized control flow compliance rule mapping model. The six target defect types in the source code include: redirection to a non-existent statement label, unused statement label, unused subroutine definition, calling a non-existent subroutine, a statement that cannot be reached after entering the program, and a statement that cannot reach the stop statement.
[0015] For each type of defect, design corresponding graph structure mapping rules:
[0016] (1) Jump to the label of a non-existent statement:
[0017] Code control flow graph structural characteristics: The code control flow graph contains nodes with an out-degree of 0 and that are not terminating.
[0018] Detection algorithm: Traverse the nodes of the code control flow graph and identify the nodes that satisfy the above code control flow graph structural features;
[0019] (2) Unused statement labels:
[0020] Graph structure characteristics: There are unmatched label definitions in the association between label definitions and goto references;
[0021] Detection algorithm: Extract the label definition set and the goto reference set using regular expressions, and calculate the difference;
[0022] (3) Unused subroutine definitions:
[0023] Graph structure characteristics: In a function call graph, there exist function nodes that are unreachable from the entry function node;
[0024] Detection algorithm: Starting from the main function, perform a forward traversal of the function call graph using a breadth-first search (BFS) method, mark reachable nodes, and identify unmarked nodes;
[0025] (4) Calling a non-existent subroutine:
[0026] Graph structure characteristics: In a call graph, there exist nodes that call edges point to that belong neither to the function call graph node set nor to the standard library function node set;
[0027] Detection algorithm: Set inclusion determination;
[0028] (5) Unreachable entry point statement:
[0029] Graph structure characteristics: In the code control flow graph, there are nodes that are unreachable from the entry node of type METHOD;
[0030] Detection algorithm: Perform a forward BFS traversal of the graph starting from the METHOD node, mark reachable nodes, and identify unmarked nodes;
[0031] (6) Unable to reach the stop statement:
[0032] Graph structure characteristics: In the code control flow graph, there are nodes that cannot be reached in reverse from the METHOD_RETURN type termination node;
[0033] Detection algorithm: Perform a reverse BFS traversal of the graph starting from the METHOD_RETURN node, mark reachable nodes, and identify unmarked nodes;
[0034] Through the above mapping, abstract standard requirements are transformed into machine-executable detection logic, forming a complete control flow compliance rule mapping model.
[0035] Step 3) Construct a graph-based detection rule engine to drive code control flow compliance detection.
[0036] Using functions in the code as units, the control flow compliance rule mapping model constructed in step 2 is loaded into the dedicated detection rule engine designed in this invention. The mappings are loaded sequentially, and detection is performed on the optimized code control flow graph. The detection rule engine constructed in this invention consists of six functional units:
[0037] The first unit is the data loading unit, which is responsible for reading the optimized code control flow graph and function call graph generated in step 1. The optimized code control flow graph and function call graph are stored in DOT format files. This unit parses the DOT files and converts the nodes and edges in the code control flow graph into an adjacency list structure in the program's memory.
[0038] The second unit is the rule scheduling unit. This unit maintains a rule queue containing six detection rules arranged in a fixed order. The unit retrieves rules from the queue sequentially and triggers the third, fourth, or fifth unit to execute specific detection operations based on the rule type. After the execution is completed, it retrieves the next rule, and so on, until all six rules have been executed.
[0039] The third unit is the code control flow graph and function call graph traversal unit. This unit receives trigger instructions from the rule scheduling unit and performs traversal operations on the code control flow graph and function call graph. This unit includes three functions: breadth-first forward traversal, breadth-first backward traversal, and node out-degree statistics. After execution, this unit returns the traversal results to the rule scheduling unit.
[0040] The fourth unit is the source code regular expression matching unit. This unit receives trigger instructions from the rule scheduling unit and performs regular expression matching on the source code string in memory. This unit maintains two regular expression patterns: one pattern is used to match label definitions, i.e., an identifier at the beginning of a line followed by a colon; the other pattern is used to match goto references, i.e., the goto keyword followed by an identifier and a semicolon. After performing the matching, this unit extracts all matched label names and their corresponding line numbers, stores them in the label definition set and the goto reference set respectively, and returns them to the rule scheduling unit.
[0041] The fifth unit is the set operation unit. This unit receives trigger instructions from the rule scheduling unit and performs operations on two sets. This unit implements three types of operations: first, difference operation, which finds elements in set A that are not in set B; second, inclusion determination, which determines whether a specified element belongs to the set; and third, reachability determination, which determines whether a specified node has been marked as reachable by the traversal operation of the third unit. After the unit completes its execution, it returns the operation result to the rule scheduling unit.
[0042] The sixth unit is the result collection unit. This unit receives the abnormal node information summarized by the rule scheduling unit, reads the source code line number and source code content from the attributes of the abnormal node, assembles the three pieces of information—defect type, violation line number, and violation code content—into a detection result record, and stores it in the detection result list. After all rules have been executed, this unit outputs the complete detection result list.
[0043] The detection rule engine designed in this invention takes the source code of the function to be detected, the optimized code control flow graph and function call graph obtained from step 1) as input, and outputs the nodes of the code control flow graph that detect violations, recording the source code line number and code content corresponding to the nodes.
[0044] Step 4) Map the graph structure attributes to code compliance and generate a code control flow compliance inspection report, including:
[0045] 41) Map graph structure attributes to code compliance, and generate JSON-formatted code compliance detection data based on the line number attributes of the code control flow graph and their corresponding source code locations.
[0046] Based on the line number attribute of the code control flow graph nodes, a precise correspondence between violations and their source code locations is established. Each violation includes four core pieces of information: violation location (accurate to the source code line number), defect type, corresponding rule number, and violation code content. All violations are categorized by defect type and organized into a JSON file for easy automation, data statistics, or integration with other development tools.
[0047] 42) Generate and integrate code compliance detection datasets through control flow visualization to produce a Word-format code compliance analysis and detection report.
[0048] The Graphviz tool is used to render the optimized code control flow graph in DOT format, generating an intuitive control flow visualization that clearly shows node relationships and transition paths. The visualization, along with violation details (including line numbers, code content, and defect descriptions) from the JSON report, are integrated and embedded into a Word document to generate a complete visualization report. This allows developers to intuitively associate violations with the control flow structure and quickly pinpoint the root cause of problems.
[0049] In specific implementation, this invention provides a graph-based code control flow compliance detection device, comprising: a source code control flow graph parsing module; a rule engine construction module; a code control flow graph compliance detection module; and a detection report generation module; wherein:
[0050] The source code control flow graph parsing module is used to import C / C++ source code and generate an initial code control flow graph and call graph. It performs node merging optimization on the initial code control flow graph to obtain an optimized code control flow graph.
[0051] The rules engine building module is used to build a control flow compliance rule mapping model, generate compliance detection rule check statements corresponding to the six types of defects, and load them into the rules engine;
[0052] The code control flow graph compliance detection module is used to call the rule engine to perform detection on the optimized code control flow graph on a function-by-function basis, and to identify and output all violations.
[0053] The test report generation module is used to generate compliance test reports and optimized code control flow diagrams in Word format.
[0054] The present invention also provides a computer device, including a processor and a readable storage medium, the readable storage medium being used to store a computer program, which, when executed by the processor, implements the control flow compliance detection method based on graph structure rule mapping provided by the present invention.
[0055] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0056] This invention provides a graph-based code control flow compliance detection method and apparatus. It generates and optimizes the code control flow graphs of all functions and the function call graph of the entire project using the Joern tool. Then, a control flow compliance rule mapping model is constructed based on control flow compliance detection rules. This model is loaded into a rule engine, which inputs the source code of each function, the generated code control flow graph, and the project's function call graph into the rule engine. The engine outputs the detection results and ultimately generates a control flow compliance detection report, achieving automated detection. This method can be used to detect specific categories of basic control flow compliance defects and is simple to operate. Attached Figure Description
[0057] Figure 1 This is a flowchart of a control flow compliance detection method based on a graph structure according to an embodiment of the present invention.
[0058] Figure 2 This is a flowchart of a method for constructing a graph-based control flow compliance rule mapping model according to an embodiment of the present invention.
[0059] Figure 3 This is a structural block diagram of a graph-based code control flow compliance detection device according to an embodiment of the present invention.
[0060] Figure 4 This is a schematic diagram of an electronic device structure for control flow compliance detection based on a graph structure, according to an embodiment of the present invention. Detailed Implementation
[0061] The present invention will be further described below with reference to the accompanying drawings and embodiments, but the scope of the invention is not limited in any way.
[0062] This invention addresses the lack of simple and directly usable tools in open-source static analysis frameworks for specifically detecting fundamental control flow compliance defects. It provides a control flow compliance detection method and apparatus based on graph structure rule mapping. The overall process of this invention is as follows: Figure 1 As shown, the specific implementation includes steps S1) to S4).
[0063] Step S1) Generate a function call graph and optimize the source code control flow graph based on a node merging strategy, including:
[0064] S11) Generation of control flow graph and call graph based on Joern static analysis tool
[0065] For the source code set of the project to be tested, S={s1,s2,…,s…} n}, where each source file s contains a set of functions F(s) = {f1, f2, ..., f m}, where f i Let represent the functions contained in a source file s. For any function f∈F, generate an initial code control flow graph G using the Joern static analysis tool.
[0066] The node v in the code control flow graph G is specifically:
[0067] v=(id,lable={operator,line,code})
[0068] Each node v has two attributes: id, which is its unique identifier, and label, which represents its attributes. The attributes specifically include the node's parsed type operator, the line number in the source code, and the corresponding source code code.
[0069] The operator includes: function / code entry point in the control flow graph; function / code exit point in the control flow graph; and the return statement in the corresponding code.
[0070] Generate function call graphs (CG) from source code set S using the Joern tool. full =(F full ,F f_call ) and function call graph CG containing only custom functions of project S simple =(F simple ,F f_call ). Among them, F full F represents the set of all functions of the item to be detected. f_call ={(f a ,f b )| f a Call f b} represents F full Function call transfer relationships; F simple F represents the set of program-defined functions. simple All functions in the project file are functions that are explicitly declared and defined. f_call This corresponds to the function call transfer relationship.
[0071] S12) Control flow graph optimization based on node merging strategy
[0072] The optimized code control flow graph G′ is generated using the following strategy:
[0073] 1) Redundant node removal:
[0074] For all nodes with the same line number and sequential links, only the node with the longest code attribute is retained, i.e., the node with the most complete source code is retained, and the rest of the nodes are deleted; the retained nodes inherit the edge relationships of all nodes.
[0075] 2) Merging consecutive unbranched nodes:
[0076] For a continuous sequence of nodes without branching statements (i.e., consecutive nodes with an in-degree and out-degree of 1), merge these nodes into a single node. Use the ID of the first node in the sequence as the ID attribute of the new merged node, and the label attribute of the new node is the sum of the label attributes of all nodes in the sequence. Inherit the in-edge relationships of the first node and the out-edge relationships of the last node in the sequence.
[0077] Step S2) Describe the defect types using a graph structure and construct a graph-based control flow compliance rule mapping model.
[0078] like Figure 2 As shown, for any function f to be detected, after obtaining the control flow graph of f based on the optimized code, six types of defect detection are performed according to the following steps:
[0079] 1) Detect statement labels where redirection is not found:
[0080] For any node v, if the following conditions are met:
[0081]
[0082] Among them, deg + (v) represents the out-degree of node v, operator v This represents the operator attribute of node v.
[0083] If the statement corresponding to v has a "redirection to a non-existent statement label" defect, that is, when the out-degree of the node is 0 and it is not a terminating node, the node is determined to have this defect.
[0084] 2) Detect unused statement labels:
[0085] First, collect functions. All labels and Reference collections, label-defined collections The matching regular expression is: goto refers to collection L goto The regular expression is Each matches the label name l of the corresponding set. name And record the corresponding row number l line For any label ,determination The corresponding statement has a "statement label not used" defect.
[0086] 3) Detect unused subroutine definitions:
[0087] Call graph CG generated by Joern full The entry point of the C / C++ code is `main`, and the set of reachable functions `F` is obtained through BFS traversal. reach If the function to be detected If the source code corresponding to function f has a "unused subroutine definition" defect, then it is determined that the source code of function f has a defect.
[0088] 4) Detect calls to non-existent subroutines:
[0089] Call graph CG generated by Joern simple With CG full The set of user-defined functions F is obtained. simple With the complete set of functions F full If the function to be detected If f is found to be a defect of "detecting a non-existent subroutine call", then F is determined to be a defect. std ={print,malloc,free,…} is a set of C / C++ standard library functions.
[0090] 5) Detect statements that cannot be reached after entering from the entry point:
[0091] The code controls the entry node of the flow graph, setting its operator attribute to METHOD. It then uses the BFS algorithm to traverse G′ in a forward direction to obtain the set of reachable nodes V. reach ;like If the statement corresponding to node v is determined to be a defect of "a statement that cannot be reached after entering from the entry point".
[0092] 6) Detect statements that cannot reach the stop statement.
[0093] The method is similar to that in 5), which uses the BFS algorithm in reverse from the exit node of the code control flow graph (with the attribute operator set to METHOD_RETURN) to finally obtain the node with the defect of "the statement that cannot be reached after entering from the entry point".
[0094] Step S3) Build a graph-based rule engine to drive code control flow compliance detection.
[0095] After inputting the item S to be detected, Joern generates the corresponding CG for S. full With CG simple Then, for each function f in S, six rules from the rule engine are loaded and tested sequentially to obtain the test result R. f ={<defect type, defect location, defect description>}, the detection result is output in the form of a triple, which includes the defect type, defect location and defect description. The defect location includes the line number where the error is located and the file name of the detection function. The defect description is a detailed description of the violation of the detection function for the specific error type and violation location.
[0096] Step S4) Map the graph structure attributes to code compliance and generate a code control flow compliance detection report, including:
[0097] S41) Map the graph structure attributes to code compliance and generate JSON-formatted code compliance detection data.
[0098] Based on the control flow compliance rule mapping model and the generated code control flow graph and call graph, a precise location mapping relationship between violations and source code is established. Using the line number of the violation node and its associated file name as anchor points, the detection results are bound to the source code location, achieving line-level defect localization accuracy. For each function... The test result R f Generate a JSON structured report. Rf The specific JSON format is as follows:
[0099] {
[0100] "Detection function": "function name",
[0101] Test Result: "Pass" | "Fail"
[0102] "Total Defects": |Total Defects|,
[0103] Defect Details:
[0104] [ { "Defect Type": "Six type names, such as: redirection to a non-existent statement label",
[0105] "Violation Location": {"Line Number","File Name of Function"},
[0106] "Defect Description": "Describes the specific details of the violation in the detection function, specifying the error type and location of the violation." ...
[0108] ]}
[0109] S42) Generate and integrate code compliance detection datasets through control flow visualization graphics to produce a Word-format code compliance analysis and detection report.
[0110] For each function f, the optimized code control flow graph G′ in DOT format is rendered using the Graphviz tool to generate a visual PNG image. f , will PNG f With JSON Rf The structured results are embedded in a Word document to generate a complete report that includes code control flow diagram visualization, defect location annotations, and detection rule descriptions.
[0111] In specific implementation, such as Figure 3 As shown, this invention implements a code control flow compliance detection device based on a graph structure, comprising: a source code control flow graph parsing module; a rule engine construction module; a code control flow graph compliance detection module; and a detection report generation module; wherein:
[0112] The source code control flow graph parsing module is used to import C / C++ source code and generate an initial code control flow graph and call graph. It performs node merging optimization on the initial code control flow graph to obtain an optimized code control flow graph.
[0113] The rules engine building module is used to build a control flow compliance rule mapping model, generate compliance detection rule check statements corresponding to the six types of defects, and load them into the rules engine;
[0114] The code control flow graph compliance detection module is used to call the rule engine to perform detection on the optimized code control flow graph on a function-by-function basis, and to identify and output all violations.
[0115] The test report generation module is used to generate compliance test reports and optimized code control flow diagrams in Word format.
[0116] This invention also provides an electronic device for control flow compliance detection based on graph structure rule mapping, such as... Figure 4 As shown, it includes: a processor, memory, a bus, and a computer program stored in the memory and capable of running on the processor; wherein, the processor and memory communicate with each other through the bus; when the processor executes the computer program, it implements the method described above. This method focuses on using functions as the detection granularity and is based on graph structure rule mapping to achieve automated compliance detection of six types of control flow defects in C / C++ code. Specifically, it includes: source code control flow graph parsing steps, code control flow graph optimization steps, rule engine construction and loading steps, code control flow graph traversal and violation identification steps, and detection report and optimization graph generation steps.
[0117] It should be noted that the purpose of disclosing the embodiments is to help further understand the present invention. However, those skilled in the art will understand that various substitutions and modifications are possible without departing from the scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the content disclosed in the embodiments, and the scope of protection of the present invention is defined by the scope of the claims.
Claims
1. A code control flow compliance detection method based on graph structure, characterized in that, Based on the precise mapping rules on the graph structure generated by the control flow compliance defect design, a mapping relationship of "defect type → graph feature → detection algorithm" is established to realize automated detection of code control flow compliance; including the following steps: 1) Obtain the source code to be detected, generate a function call graph and an initial code control flow graph; optimize the initial code control flow graph, the optimized code control flow graph retains the core control logic and reduces the detection computational complexity; 2) Describe source code defect types using graph structures, design corresponding graph structure mapping rules for each defect type, and construct a graph-based control flow compliance rule mapping model to represent the mapping relationship between "defect type - graph structure features - detection algorithm"; 3) Construct a graph-based detection rule engine to drive code control flow compliance detection; Using functions in the source code to be detected as units, the constructed graph-based control flow compliance rule mapping model is loaded into the constructed graph-based detection rule engine. By loading the mapping, the optimized code control flow graph is detected. The graph-based detection rule engine takes the source code to be detected, the optimized code control flow graph, and the function call graph as inputs, and outputs the detected non-compliant code control flow graph nodes, recording the source code line number and code content corresponding to the nodes. 4) Map the graph structure attributes to code compliance, convert the optimized control flow graph into a visual graph, and generate a code control flow compliance detection report.
2. The code control flow compliance detection method based on graph structure as described in claim 1, characterized in that, Step 1) Generate a function call graph and optimize the code control flow graph based on a node merging strategy, including: 11) Generate code control flow graphs and function call graphs based on code analysis tools: Analyze the control flow logic of the source code to be tested using code analysis tools to generate initial code control flow graphs and function call graphs in DOT format; The initial code control flow graph contains a set of nodes and a set of transition edges. Each node in the code control flow graph has attributes including: node type, the corresponding source code line number, and the source code content of the node; the function call graph includes: a function call graph containing all functions and a simplified function call graph containing only program-defined functions; 12) Optimize the code control flow graph based on node merging strategies, including: First, for redundant nodes, identify clusters of nodes with the same line number and sequential links, retain the node with the longest source code content, delete the remaining redundant nodes, and at the same time keep the position of the nodes in the code control flow graph and the relationship of the transition edges unchanged. Secondly, for continuous unbranched node sequences, continuous node chains in which all nodes have no branched statements are identified and merged into a single node to optimize the topology of the code control flow graph. During the node merging process, the positions and transition edge relationships of the series of nodes in the code control flow graph remain unchanged to ensure the accuracy of the control flow logic.
3. The code control flow compliance detection method based on graph structure as described in claim 2, characterized in that, In step 11), the code analysis tool is specifically the Joern static analysis tool configured as a Windows system runtime environment.
4. The code control flow compliance detection method based on graph structure as described in claim 1, characterized in that, In step 2), the defect types in the source code include: redirecting to a non-existent statement label, an unused statement label, an unused subroutine definition, calling a non-existent subroutine, a statement that cannot be reached after entering the program from the entry point, and a statement that cannot reach the stop statement.
5. The code control flow compliance detection method based on graph structure as described in claim 4, characterized in that, For each type of defect, design corresponding graph structure mapping rules, including: 21) For statement labels where the redirection does not exist, the graph structure features are: there are nodes with an out-degree of 0 and that are not of the terminating type in the code control flow graph; the corresponding detection algorithm is: traverse the graph nodes and identify nodes that satisfy the above graph structure features. 22) For unused statement labels, the graph structure feature is: there are unmatched label definitions in the association between label definitions and goto references; the corresponding detection algorithm is: extract the label definition set and the goto reference set using regular expressions, and find the difference set; 23) For unused subroutine definitions, the graph structure characteristics are: in the function call graph, there are function nodes that are unreachable from the entry function node; the corresponding detection algorithm is: perform a forward BFS traversal of the function call graph starting from the main function, mark reachable nodes, and identify unmarked nodes; 24) For calling a non-existent subroutine, the graph structure characteristics are: in the function call graph, there exist nodes pointed to by call edges that do not belong to the simplified call graph node set or the standard library function node set; the corresponding detection algorithm is: set inclusion determination. 25) For statements that are unreachable from the entry point, the graph structure features are: In the code control flow graph, there are nodes that are unreachable from the entry point of type METHOD; the corresponding detection algorithm is: perform a forward BFS traversal of the graph starting from the METHOD node, mark reachable nodes, and identify unmarked nodes; 26) For a stop statement that cannot be reached, the graph structure features are: in the code control flow graph, there are nodes that cannot be reached in reverse from the METHOD_RETURN type termination node; the corresponding detection algorithm is: perform a reverse BFS traversal of the graph starting from the METHOD_RETURN node, mark reachable nodes, and identify unmarked nodes. This leads to the construction of a complete control flow compliance rule mapping model.
6. The code control flow compliance detection method based on graph structure as described in claim 5, characterized in that, The constructed graph-based detection rule engine includes: a data loading unit, a rule scheduling unit, a code control flow graph and function call graph traversal unit, a source code regular expression matching unit, a set operation unit, and a result collection unit; among which: The data loading unit is used to read and parse the optimized code control flow graph and function call graph; and to convert the nodes and edges in the code control flow graph into an adjacency list structure in the program memory. The rule scheduling unit is used to maintain a rule queue, in which detection rules are arranged in a fixed order. Rules are taken out from the queue one by one, and the corresponding detection operation instructions are triggered and executed according to the rule type. The code control flow graph and function call graph traversal unit is used to receive rule triggering instructions, execute traversal operations on the graph, and obtain traversal results; The source code regular expression matching unit is used to receive rule triggering instructions and perform regular expression matching on the source code string in memory. This unit maintains two regular expression patterns: one pattern is used to match label definitions; the other pattern is used to match goto references. After the matching is performed, all matched label names and their line numbers are extracted and stored in the label definition set and the goto reference set, respectively, and returned to the rule scheduling unit. The set operation unit is used to receive rule triggering instructions and perform operations on two sets, including set difference operation, inclusion determination and reachability determination; The result collection unit receives the abnormal node information summarized by the rule scheduling unit, reads the source code line number and source code content from the attributes of the abnormal node, assembles the defect type, violation line number, and violation code content information into a detection result record, and stores it in the detection result list; after all rules are executed, the complete detection result list is output.
7. The code control flow compliance detection method based on graph structure as described in claim 6, characterized in that, In the source code regular expression matching unit, the pattern used to match the label definition is the identifier at the beginning of the line followed by a colon; the pattern used to match the goto reference is the goto keyword followed by an identifier and a semicolon; in the set operation unit, the difference operation is to find the elements in set A that do not belong to set B; the inclusion judgment is to determine whether a specified element belongs to a set. Reachability determination is used to determine whether a specified node has been traversed by the code control flow graph and function call graph. The traversal operation of a node is marked as reachable.
8. The code control flow compliance detection method based on graph structure as described in claim 1, characterized in that, In step 4), based on the line number attribute of the code control flow graph node, a precise location mapping relationship between the violation and the source code is established, and a JSON format detection report containing the violation location and the corresponding rule number is output; the optimized code control flow graph is converted into a visual graph, and combined with the JSON format detection report, a Word document is embedded to generate a visual detection report.
9. A code control flow compliance detection device based on a graph structure implemented using the method described in any one of claims 1 to 8, characterized in that, include: Source code control flow graph parsing module; Rules engine building module; Code control flow graph compliance detection module; Test report generation module; including: The source code control flow graph parsing module is used to import source code and generate an initial source code control flow graph and function call graph. It performs node merging optimization on the initial source code control flow graph to obtain an optimized source code control flow graph. The rules engine building module is used to build a control flow compliance rule mapping model, generate compliance detection rule check statements corresponding to defects, and load them into the rules engine; The code control flow graph compliance detection module is used to call the rule engine to perform detection on the optimized code control flow graph on a function-by-function basis, and to identify and output all violations. The test report generation module is used to generate compliance test reports and optimized code control flow diagrams in Word format.