Program processing method, system, device, storage medium and program product

Abstract

Embodiments of the present application provide a program processing method, system, device, storage medium and program product. In the present application, when performing statement analysis on a source program, if it is determined that a statement in the source program contains a composite data structure variable, and the statement involves a target function associated with the composite data structure variable, a specified function is determined according to the target function involved in the statement, and the variable state information in the statement is established by calling the specified function, and then the variable state information is stored. In the above, the internal information of the target function involved in the corresponding statement can be obtained through the specified function, and based on the internal information, the accuracy of the taint propagation analysis can be ensured when establishing the variable state information in the statement, and then the accuracy of the determination of the taint state of the variable can be improved. As can be seen from the above, the present application can also support accurate taint analysis when processing the composite data structure variable in the source program.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a program processing method, system, device, storage medium, and program product. Background Technology

[0002] Most source code contains potential security vulnerabilities and code defects. Various analytical methods exist for detecting and analyzing these issues, one of which is taint analysis. For example, static analysis tools can be used to perform taint analysis on source code, which involves representing the source code using intermediate representations (IRs). Currently, existing IRs are basic IRs, which can meet the needs of representing basic variable types such as integers (int) in the source code. However, complex data structure variables such as lists and mappings cannot be directly represented using basic IRs. This can easily lead to inaccurate reflection of the impact of tainted data in taint analysis applications, resulting in false negatives and false negatives in security detection. Summary of the Invention

[0003] Several embodiments of this application provide a program processing method, system, device, storage medium, and program product, which can achieve more accurate support for taint analysis by introducing a custom high-level IR to accurately represent complex data structure variables such as lists and maps in the source program.

[0004] In a first embodiment, this application provides a program processing method. The method includes:

[0005] The specified function is determined based on the target function involved in the statements in the source program;

[0006] Call the specified function to obtain the internal information of the target function;

[0007] Based on the internal information, establish the variable state information in the statement;

[0008] Store the variable state information;

[0009] The objective function is associated with the composite data structure variable in the statement. The internal information includes the parameter information within the objective function, and the variable state information includes the value and taint status of the composite data structure variable determined based on the parameter information.

[0010] In a second embodiment, this application provides a program processing method. The method includes:

[0011] Obtain the source code;

[0012] Determine the variable state information within each statement in the source program;

[0013] Based on the variable state information, intermediate representation code is generated.

[0014] Wherein, if the target function involved in a statement in the source program is related to the composite data structure variable, then a specified function is determined according to the target function, and the internal information of the target function is obtained through the specified function. The variable state information in the statement is established according to the internal information. The internal information includes the parameter information in the target function, and the variable state information includes the value and taint status of the composite structure variable determined according to the parameter information. In addition, the intermediate representation code is an abstract form of code located between programming speech and machine language.

[0015] In a third embodiment, this application also provides a program processing system, the system comprising:

[0016] The client is used to respond to input operations on the client interface, obtain the input source program, and send the source program to the server.

[0017] The server is used to implement the steps in the various method embodiments provided in this application.

[0018] Fourth embodiment: This application provides an electronic device, including: a memory and a processor; wherein,

[0019] The memory is used to store programs;

[0020] The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps in the various method embodiments provided in this application.

[0021] In a fifth embodiment, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a computer, can implement the steps in the various method embodiments provided in this application described above.

[0022] In a sixth embodiment, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the various method embodiments provided in this application described above.

[0023] The technical solutions provided in the embodiments of this application, when determining that a statement in the source program contains a composite data structure variable and that the statement involves an objective function related to the composite data structure variable, execute a specified function determined based on the objective function involved in the statement, and call this specified function to obtain the internal information of the objective function. Based on this internal information, when determining the variable state information in the statement, the accuracy of taint propagation analysis can be ensured, thereby improving the accuracy of determining the taint state of variables. The aforementioned internal information includes parameter information within the objective function, and the established variable state information includes the value and taint state of the composite structure variable determined based on this parameter information. In summary, this solution can also support accurate taint analysis when processing composite data structure variables in the source program. Furthermore, based on the stored variable state information of each variable in the source program, intermediate expression code of the source program can be generated. This code can also be used for subsequent program analysis of the source program to analyze program characteristics, such as data flow analysis (how variables propagate), security vulnerability detection, and memory leak checking. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0025] Figure 1 This application provides a schematic diagram illustrating the analysis process of source code in a static analysis tool, as an exemplary embodiment of the present application.

[0026] Figure 2 A flowchart illustrating a program processing method provided for an exemplary embodiment of this application. A schematic diagram illustrating several process parameters collected by sensors on an internal mixer;

[0027] Figure 3a A schematic diagram illustrating the acquisition of source code as provided in an exemplary embodiment of this application;

[0028] Figure 3b A schematic diagram illustrating source code analysis based on intermediate representation (IR) provided for an exemplary embodiment of this application;

[0029] Figure 3c A schematic diagram of taint propagation provided for an exemplary embodiment of this application;

[0030] Figure 4 A schematic diagram of the structure of an electronic device provided for an exemplary embodiment of this application. Detailed Implementation

[0031] Source code, written by developers using a high-level programming language, inevitably contains potential security vulnerabilities and code defects. Currently, methods for analyzing these issues include taint analysis. For example, taint analysis can be performed using appropriate static analysis tools (Static Application Security Testing, SAST). The analysis process in static analysis tools generally follows... Figure 1 As shown: First, the source program is converted into an Abstract Syntax Tree (AST). An AST is a tree-like structure used to represent the syntactic structure of the source code. Each node in the tree represents a syntactic structure in the source code, such as an expression, statement, or declaration. Then, the AST is further converted into a custom Intermediate Representation (IR) (i.e., generating intermediate representation code corresponding to the source program). Finally, program analysis is performed based on the intermediate representation code. In the process between converting the AST to the custom IR, taint analysis is performed by representing the source program using the IR. During this process, variable state information (such as variable type, scope, value, taint state, etc.) for each variable in the source program is established and stored based on the IR for use in the subsequent custom IR stage. Therefore, taint analysis involves representing the source program using the IR. Currently, source code representation is based on traditional Information Representation (IR), which includes basic types such as Integer types, Floating Point types, Pointer types, Array types, Struct types, and String types. These basic types constitute low-order IR (also known as basic IR). However, programming languages ​​often contain complex variable types that cannot be directly represented by low-order IR. Complex variable types are usually composed of combinations of multiple basic variable types. Therefore, this application refers to complex variable types as composite data structure variable types. Composite data structure variable types include, but are not limited to, Lists, Sets, Maps, Stacks, Graphs, and Linked Lists. These composite data structure variable types are difficult to represent directly in traditional IR. Therefore, when performing taint analysis on source code in SAST, while the propagation analysis of taints is relatively clear and accurate for basic variables in the source code, the propagation of taints may not be accurately reflected for composite data structure variables.

[0032] For example, suppose b = a; c = b. Here, the integer variable a is a tainted variable. The value of a is written to the integer variable b, and then the value of the integer variable b is written to the integer c. In this case, we can consider a to affect c because a is passed to c through b. Therefore, since a is marked as a tainted variable, based on data dependencies, b is also a tainted variable, and thus c is also a tainted variable.

[0033] The above provides an example of taint propagation when dealing with basic variable types. However, taint propagation becomes more complex when dealing with advanced, complex data structure variable types. Taking the Map type as an example, the Map type code in the source code (as a Java code example) is shown in Example 1 below:

[0034] int a = 5; / / This line of code defines an integer variable a and assigns it the value 5;

[0035] Map<String,Integer> b = new HashMap<>(); / / This line of code defines a variable b of type HashMap, where the keys are strings and the values ​​are integers; this variable b is a complex variable type.

[0036] b.put("key",a); / / This line of code uses the put function (insertion function) associated with the map type to insert the key-value pair with key=5 into the variable b;

[0037] int c = b.get("key"); / / This line of code uses the get function (retrieval function) associated with the map type to read the value of key "key" from variable b. The result is 5 and is assigned to the integer variable c.

[0038] Following the traditional IR conversion, the Map type code in Example 1 above will be converted into the following IR code:

[0039] a:int = 5; / / a is an integer, initialized to 5

[0040] b:point = new(); / / b is a pointer type, and an initial value is assigned.

[0041] Map<String,Integer> ::put(b."key",a); / / Call the put function and pass b into it.

[0042] c:int = Map<String,Integer> ::get(b."key"); / / Call the get function and pass the return value to c.

[0043] In traditional IR (Intrusion Detection) frameworks, taint analysis for composite data structures such as Maps typically employs the following two methods:

[0044] The first method: coarse-grained analysis

[0045] In coarse-grained analysis, the composite data structure variable is abstracted into a single variable, and then the read and write operations of that variable are abstracted. The taint is passed to this composite data structure variable, and the entire composite data structure variable is tainted. Subsequent readings of this composite data structure variable simply pass the taint mark of the composite data structure variable out.

[0046] Using this coarse-grained analysis approach, in the Map type code example given above, we can assume that 'a' affects 'b', 'b' affects 'c', and therefore 'a' also affects 'c'. The advantage of this coarse-grained analysis is its speed and ease of understanding. However, if we change the key names used to different values, as in Example 2 below:

[0047] int a = 5;

[0048] Map<String,Integer> b = new HashMap<>();

[0049] b.put("key1",a);

[0050] int c = b.get("key2"); / / b does not contain a key-value pair associated with key2, so c = empty.

[0051] In Example 2 above, although 'a' affects 'b', and 'b' affects 'c', 'a' does not actually directly affect 'c'. This is because 'c' is retrieved using a map-related 'get' function to read the value with key 'key2' from variable 'b'. However, variable 'b' does not store a value associated with key 'key2', so the read result is null and assigned to 'c', i.e., 'c = null'. Therefore, 'a' does not actually affect 'c', and if 'a' is a tainted variable, the taint will not propagate to 'c'. However, if taint analysis is performed based on traditional IR, only coarse-grained analysis can be performed on Example 2 above, leading to unreasonable inferences. For example, if the dependent variable b is a composite data structure variable of type Map, when performing taint analysis on variable b based on traditional IR, it can only achieve coarse-grained analysis down to the put and get functions. It cannot deeply analyze and obtain the specific data (such as key1, key2) inside the put and get functions related to the Map type. Therefore, if a is a tainted variable, when marking variable b as a tainted variable through coarse-grained analysis, variable b as a tainted variable will also be marked as a tainted variable. The taint marking range is too large, which will lead to c being mistakenly marked as a tainted variable, resulting in a taint propagation error.

[0052] The second approach: In-depth function analysis

[0053] This analytical approach will delve deeper into the Map within the aforementioned IR, based on the example content provided.<String,Integer> ::put and =Map<String,Integer> While ::get is implemented, in real-world scenarios, map implementations can vary widely, with different programming languages ​​having different internal implementations. Moreover, such implementations are often quite complex and prone to the "path explosion" problem, making accurate analysis difficult.

[0054] During the analysis process, due to the complexity of the code paths of composite data structure variables and the diversity of branches (such as containing a large number of conditional branches, loops, etc.), a large number of execution paths may be generated. This will lead to a sharp increase in the number of paths that need to be analyzed. As the number of these paths increases, the cost of analyzing each path will also increase significantly, resulting in a "path explosion".

[0055] In summary, for composite data structure variables, if taint analysis is performed directly on the native functions such as get / put (or insert) under the composite data structure variables based on traditional IR, it is impossible to analyze the internal data of these native functions. The implementation of the internal data of these native functions is very complex, which will likely lead to path explosion and incomplete analysis, resulting in taint propagation errors and inaccurate taint analysis.

[0056] In addition, although there is a graph-based taint analysis scheme that represents data flow through a graph structure, this approach is usually suitable for certain specific scenarios and is difficult to adapt to the representation of all complex data types.

[0057] To address the issue that traditional IRs cannot accurately represent complex data structure variables, this application provides a solution. The basic idea is to define custom IRs that support complex data structure variable types, referred to as advanced IRs. These advanced IRs include read functions (reader(key)) and write functions (writer(key)); the parameters in the read and write functions are the keys. Furthermore, advanced IRs may include other functions, such as a clear function (clear()), which does not accept parameters. A pre-established mapping relationship is created between these custom advanced IR functions and related functions for the complex data structure variable type. During taint analysis, this pre-established mapping relationship can be used to map related functions for the complex data structure variable type to the associated advanced IR functions. By calling the associated advanced IR functions, the internal data of the related functions for the complex variable type can be obtained, thereby analyzing taint propagation and improving the accuracy of taint analysis.

[0058] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0059] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for user input, data analyzed, data stored, data displayed, etc.) involved in the embodiments of this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse. In addition, the various models involved in this application (including but not limited to language models or large models) comply with relevant laws and standards.

[0060] The embodiments provided in this application will be described in detail below with reference to the accompanying drawings.

[0061] First, the terminology used in the embodiments of this application will be explained. It should be understood that this explanation is for the purpose of making the embodiments of this application clearer and does not necessarily constitute a limitation on the embodiments of this application.

[0062] Source code: refers to the original code file written by developers using a high-level programming language. It consists of a series of instructions written according to the syntax rules of a specific programming language, which define the steps for the computer to perform a specific task or solve a specific problem. Source code is in human-readable text form and usually needs to be converted into machine code or intermediate representation (IR) by a compiler so that the computer can understand and execute it.

[0063] Programming languages, also known as high-level programming languages, generally refer to those that are closer to human natural language and thought processes, such as C, C++, Python, and Java. Programming languages ​​often feature many complex data structure types (also known as collection type variables), such as lists, sets, maps, and stacks.

[0064] Intermediate Representation (IR): An abstract syntactic structure used in compilers to represent source code. Specifically, it is an abstract representation between high-level programming languages ​​and low-level machine language (machine code). In other words, IR provides a representation that is lower-level than source code and higher-level than machine code, facilitating debugging and performance analysis for developers.

[0065] Low-level IR (also known as basic IR): It is a relatively simple intermediate representation, usually a low-level abstraction generated after the initial parsing of the source code, and can only support a small number of variable types in the programming language.

[0066] Advanced IR: This is an IR that is added by the user in this application to support complex data structure variable types, such as custom read functions and write functions added under the IR.

[0067] Static Abstraction Tree (SAST) is a white-box testing technique primarily used to identify security vulnerabilities and defects in source code during the early stages of software development. SAST tools work by parsing the source code, constructing an Abstract Syntax Tree (AST), and then applying a predefined set of security rules to search for security vulnerabilities based on known patterns.

[0068] Taint analysis is an important static analysis technique (belonging to the data flow analysis method) in the SAST tool. It identifies potential security risks by marking and tracking "tainted" data in the program.

[0069] The various method embodiments provided in this application can be implemented using a corresponding compiler. The compiler allows third-party tools (including the SAST tool) to be inserted into different stages of the compilation process. In specific implementations, the various method embodiments are mainly implemented using the SAST tool. The compiler can be deployed on a client or a server. The server can be a physical server (such as a single server or a server cluster consisting of one or more servers), a virtual server, or the cloud. If the server is in the cloud, the compiler exists in the cloud as a service. The client can be a smartphone, personal computer, smart wearable device, etc. Personal computers include laptops, all-in-one computers (which have computing units, storage devices, and other hardware directly installed behind or at the bottom of the display), and discrete desktop computers.

[0070] Figure 2 A flowchart illustrating a process processing method provided in this application is shown. Figure 2 As shown, the processing method of this program includes the following steps:

[0071] 101. Determine the specified function based on the target function involved in the statements in the source program;

[0072] 102. Call the specified function to obtain the internal information of the target function;

[0073] 103. Based on the internal information, establish the variable state information in the statement.

[0074] The objective function is related to the composite data structure variables in the statement. "Related" here means, for example, that the operations of the objective function affect the state (e.g., value) of the corresponding composite data structure variables in the statement. The internal information of the objective function, including its parameters, can be obtained through the specified function. The variable state information includes the values ​​and taint states of the composite data structure variables determined based on the parameter information, used for taint analysis of the source program. A more detailed description of the aforementioned internal information and variable state information is provided in other sections below.

[0075] In the above 101, the source program can be input by the user or obtained from the corresponding code library. This embodiment does not limit the method of obtaining the source program.

[0076] For example, see Figure 3a As shown, a compiler is deployed on the server, and the client has a user interface P for interacting with the compiler. The user can input the source program to be analyzed through this user interface P, and after clicking the "OK" control, the server can be triggered to call its compiler to execute the program processing flow provided in this embodiment on the input source program.

[0077] During the processing of the source program, statements are read sequentially and analyzed. The analysis first requires identifying potential taint sources in the source program. After identifying the taint sources, they are marked and their flow throughout the program is tracked. In this application, potential taint sources can be determined based on preset taint source rules. That is, the method provided in this embodiment may further include the following steps:

[0078] 100a. Based on the preset taint source rules, determine that the first statement in the source program contains a taint source;

[0079] 100b. When storing the variable status information of the first statement, mark the variable that receives the taint source in the first statement as a taint.

[0080] In specific implementation, a taint source refers to untrusted external input in the program. Therefore, in this application, the taint source rule includes external input data as a taint source, which includes, but is not limited to: user input (such as input provided through forms, command-line arguments, environment variables, etc.), network requests, file reads (data read from the file system), database query results, third-party API responses, etc. Furthermore, the taint source rule may also include unverified data sources or potentially insecure input data as taint sources (in which case, the taint source may carry malicious content), etc. This embodiment does not specifically limit the taint source rule.

[0081] Based on this taint source rule, see [link to relevant documentation] Figure 3a The example source code shown below can identify the "5" in the statement "int a = 5" as a taint source. Furthermore, for this statement "int a = 5", based on IR, a regular integer variable 'a' will be constructed in the variable record area, and this integer variable 'a' will be marked as tainted. Therefore, the variable state information stored for 'a' in the variable record area is: a(int): 5 (tainted).

[0082] It should be noted here that the variable record area mentioned above is also called the variable symbol record area, which refers to the area inside the compiler used to record information about all variables in the program. In practice, the variable record area can be in the form of a table (in this case, it can be called a symbol table). The variable state information of each variable recorded in the variable record area includes: the variable's metadata (describing the variable's own attributes, such as name, type, scope, etc.), the variable's value, and the variable's taint status, etc.

[0083] After identifying the source of the taint, the source can be traced and potential taint propagation identified during statement analysis of other statements in the source program. In this application, the source program contains composite data structure variables, such as lists, sets, maps, and stacks. Statements containing composite data structure variables may involve functions associated with these variables. In this application, these associated functions are mapped to designated functions to extract internal information about the functions within the statements, thereby determining whether potential taint propagation exists.

[0084] Based on the above, the aforementioned 101 "determine the specified function based on the target function involved in the statements in the source program" can specifically include:

[0085] 1011. Determine the variable type of the variables in the statement;

[0086] 1012. If the variable type contains a composite data structure variable, execute the specified function determined based on the objective function associated with the composite data structure variable involved in the statement.

[0087] The target functions involved in the statements can be divided into explicit functions and implicit functions. The difference between the two lies in whether they are directly visible in the statements and whether they are automatically triggered by the editor / runtime. Specifically:

[0088] An explicit function is defined as a function that is explicitly called directly within a statement. It typically appears in the form of a function name (parameters), meaning the explicit function is directly visible within the statement. For example, see [link to example]. Figure 3a The source code shown contains a statement "b.put("key",a)", where the put function is the display function.

[0089] Implicit functions are defined as function calls that are not directly written in a statement but are automatically inserted by the compiler / runtime. In other words, implicit functions are not visible in a statement but are called when the statement is executed. For example, if a source program contains the statement "b[1] = a;", and the variable b in this statement is a composite data structure variable (such as an array variable), then the function involved in this statement is an implicit function.

[0090] Furthermore, in addition to the first statement containing the taint source, the aforementioned source program may also include at least one second statement and other statements, where the objective function involved in the second statement is related to the composite data structure variable. Therefore, the "determining the specified function based on the objective function involved in the statement" mentioned in section 101 above specifically refers to the following steps:

[0091] S1. Determine the specified function based on the target function involved in the second statement.

[0092] Furthermore, the aforementioned 103 "determine the variable state information in the statement based on the internal information" specifically refers to the following step: determining the variable state information in the second statement based on the internal information.

[0093] In a specific implementable solution, the above step S1, "determine the specified function based on the target function involved in the second statement," may include:

[0094] S11. Determine the specified function that is associated with the objective function.

[0095] In the above example, the target function involved in the second statement could be a get function or an insert function. The expressions for get functions and insert functions may differ in different programming languages. For example, in Java, `get()` represents a get function and `put()` represents an insert function.

[0096] Furthermore, the specified function mentioned above is a function under the IR layer. In this application, a pre-defined association relationship between functions in different programming languages ​​and functions in the IR layer is established, and step S12 above can be implemented based on this association relationship. Therefore, a specific implementation of step S12 above may include the following steps:

[0097] S121. Obtain the correspondence between functions in the preset programming language and functions in the intermediate representation (IR);

[0098] S122. Query the functions in the intermediate representations that are associated with the target function from the association correspondence relationship;

[0099] S123. The function in the intermediate representation obtained from the query is determined as the specified function.

[0100] In practice, the aforementioned pre-defined association relationships can contain multiple association groups. Each association group contains associations between different functions that have the same or similar data operation functions. Based on this, the target association group can be determined from the multiple association groups contained in the association relationships according to the function type of the target function. Then, functions in the intermediate representations that are associated with the target function are queried from the target association group, and the functions in the queried intermediate representations are then identified as the specified functions. This query method helps improve query speed.

[0101] The function type of the target function reflects its data manipulation capabilities. Data manipulation capabilities refer to a function's ability to perform various processing, transformations, or management of data within a program, specifically including reading / getting data, writing / inserting data, etc. For example, the `get` function's data manipulation capability is data retrieval, and the `read` function's data manipulation capability is data reading. Both functions are essentially methods for retrieving data from a certain storage location (such as memory, database, file system, etc.), so the `get` function and the `read` function are two different functions with the same or similar data manipulation capabilities.

[0102] This application focuses on custom-designed read and write functions for composite data structure variables provided in programming languages, aiming to enhance the flexibility and accuracy of taint analysis. Specifically, the retrieval functions in different programming languages ​​can be associated with the read functions, and the insertion functions can be associated with the write functions.

[0103] Therefore, in the above-mentioned correspondence, the get functions in different programming languages ​​are associated with the read functions in IR, and the insert functions in different programming languages ​​are associated with the write functions in IR.

[0104] For example, in Java, the `get` function (retrieval function) related to `Map` will be associated with the read function of the high-level IR, while the `put` function (insertion function) will be associated with the write function of the high-level IR.

[0105] Furthermore, after the specified function is determined, step 102 above will be executed to obtain the internal information of the target function through the specified function. This internal information includes not only parameter information within the target function but also other information, such as, but not limited to, control flow statements within the target function (e.g., conditional branches, recursion, and nesting). Subsequently, based on this internal information, the variable state information of the composite data structure variables in the second statement can be determined, such as the value and taint status of the composite data structure variables. That is, in a specific implementable scheme, the step 103 above, "determining the variable state information in the second statement based on the internal information," may include:

[0106] 1031. Determine the value of the composite data structure variable in the second statement based on the internal information; specifically, determine the value of the composite data structure variable in the second statement based on the parameter information contained in the internal information.

[0107] 1032. If the value of the composite data structure variable is associated with the taint source, then the composite data structure variable is marked as a taint variable.

[0108] For illustrative purposes, see [link to example]. Figure 3aTaking the second statement "b.put("key1",a)" as an example, b is a map type variable (a composite data structure variable), and the put function related to b will be mapped to the write function under the IR layer. Therefore, for this second statement, the write function under the IR corresponding to b will be called to obtain the internal information of the put function (including key1 and a), and key1 and a will be associated to form a key-value pair. Thus, the value of key1 in b is determined to be the value of variable a (i.e., 5). As can be seen from the examples given in steps 100a and 100b, a is a variable that receives the taint source and is marked with a taint. Therefore, based on the above analysis in this second statement, the value of b is related to a (i.e., related to the taint source), so the taint is passed to b, and b will be marked as a tainted variable. The variable state information of b obtained above will be stored in the variable record, such as Figure 3b The example shows "b(map):key1=5(tainted)". Further, when analyzing the second statement `int c=b.get("key2")`, the `get` function related to `b` is mapped to the read function under the IR layer. Therefore, for this second statement, the read function under the IR layer corresponding to `b` is called to obtain the internal information state of the `get` function, i.e., the "key2" state. Since `b` does not store the "key2" key-value pair, `b[key2]` is null. The value of the integer variable `c` is equal to `b[key2]`, so the value of the integer variable `c` is not associated with the taint source, taint propagation fails, and the taint state of the integer variable `c` is marked as untainted. The variable state information of the integer variable `c` obtained above will be stored in the variable record, such as... Figure 3b The example shown is "c link(int): null(no taint mark)".

[0109] Figure 3c China targets Figure 3a The provided source code example illustrates the taint propagation process identified during statement analysis.

[0110] In addition, combined Figures 3a to 3cAs the examples provided demonstrate, in the actual taint analysis of the source program based on IR, this application establishes internal states for high-level variables (i.e., composite data structure variables) in the source program using custom read / write functions defined under the IR layer. Specifically, this involves MUXting the associated record of a variable, recording various information about the variable, such as type, value, and taint status. The propagation status of taints is then comprehensively determined based on the corresponding read / write conditions (including the order and parameters of read / write). These custom read / write functions defined under the IR layer constitute high-level IR. Through this high-level IR, this application ensures better adaptation to composite data structure variables in high-level programming languages, thereby enabling more accurate taint analysis. Furthermore, different composite data variable types have different variable setting methods; for example, the setting methods for Map and List may differ. By abstracting the read / write functions under the IR corresponding to composite data structure variables, this application effectively accommodates the differences in variable setting under different composite data variable types, thus having a wide range of applications.

[0111] Furthermore, as can be seen from the above, during the statement analysis of the source program, this application stores the variable state information of each variable in the source program obtained based on IR in a variable record area. This variable record area is essentially a variable storage area. Based on this, the method provided in this embodiment may further include the following steps:

[0112] 104. Establish a variable storage area for the source program;

[0113] 105. The variable state information is stored in the variable storage area.

[0114] For a detailed description of the variable storage area, please refer to the descriptions of the variable record area in other embodiments; they will not be repeated here. Furthermore, the variable state information of each variable stored in the variable storage area includes, but is not limited to, the variable's attributes (such as name, type, scope, etc.), the variable's value, and the variable's taint status. For a detailed description of the variable state information, please refer to the relevant content in other embodiments.

[0115] In summary, the technical solution provided in this embodiment, when analyzing source code statements, determines that a statement in the source code contains a composite data structure variable and involves an objective function related to the composite data structure variable. It then maps the objective function involved in this statement to a specified function and calls this specified function to establish the variable state information in the statement, thereby storing the variable state information. As described above, the specified function can obtain the internal information of the objective function involved in the corresponding statement. Based on this internal information, the accuracy of taint propagation analysis can be ensured when establishing the variable state information in the statement, thus improving the accuracy of determining the taint state of variables. Therefore, this solution can also support accurate taint analysis when processing composite data structure variables in source code.

[0116] The content described in steps 101 to 105 above typically occurs in... Figure 1 The stages between the AST tree and the self-built IR shown in the figure, as well as the variable state information of each variable in the source program stored in the variable record area, can be used by the subsequent self-built IR stage, that is, for the subsequent generation of the intermediate representation code corresponding to the source program.

[0117] Based on this, another embodiment of this application also provides a program processing method. The method includes the following steps:

[0118] 201. Obtain the source code;

[0119] 202. Determine the variable state information within each statement in the source program;

[0120] 203. Based on the variable state information, generate intermediate representation code.

[0121] Specifically, if a function within a statement in the source program is related to a composite data structure variable, a specified function is determined based on the target function, and the internal information of the target function is obtained by calling the specified function. This internal information is then used to establish the variable state information within the statement. The internal information includes parameter information within the target function, and the variable state information includes the value and taint status of the composite structure variable determined based on the parameter information. Furthermore, the intermediate representation code is an abstract form of code situated between programming language and machine language.

[0122] For specific implementations of steps 201 to 202 above, please refer to the relevant content described in other embodiments, such as the content related to steps 101 to 103 described in the aforementioned other embodiments.

[0123] Furthermore, the variable state information within each statement in the source program determined through steps 201 to 202 above will be stored in the variable record area (i.e., variable storage area) established for the source program, for use in subsequent steps 203 when generating intermediate representation code.

[0124] For step 203, several examples are given below for illustration.

[0125] Example 1: Source code related to the Map type

[0126] by Figure 3a The source code shown is an example. Figure 3b In the source program, the variable record area (i.e., the variable storage area) records the variable state information within each statement. Based on the information recorded in the variable record area, the generated intermediate representation code (IR code) can be as follows:

[0127] a: int = 5; / / a is an integer, initialized to 5

[0128] b: map<string,number> =None; / / b is a map type variable, and its internal state is initialized.

[0129] b["key1"] = a; / / Set the value of key1 in b to a.

[0130] tmp: int = b["key2"]; / / Retrieve the value of key2 from b and assign it to the integer variable tmp (a temporary intermediate variable)

[0131] c: int = tmp; / / Assign the value of tmp to the integer variable c.

[0132] As can be seen from this example, compared with the intermediate representation code generated by traditional IR conversion given in the other embodiments above, this application has abstracted the composite data structure variable b to a certain extent. Specifically, the composite data structure variable is abstracted into an ordinary variable.

[0133] Example 2: Source code related to array variables, as shown in the example below:

[0134] int a = 5;

[0135] int[]b = {10, 20, 30, 40, 50};

[0136] b[1] = a;

[0137] int c = b[2];

[0138] After analyzing the statements in the above source code, the following variable status information can be stored in the corresponding variable record area:

[0139] a: int = 5 (marked with taint) / / Based on IR, a normal integer variable a is constructed in the variable record area. The initial value of a is 5, and a is marked as tainted.

[0140] b: array <int>={10,20,30,40,50}; / / Construct a high-level array type variable b in the variable record area based on IR, and initialize the internal state of b;

[0141] b[1] = a; (with taint mark) / / Call the IR associated write function (array write function) of b, associate the value of b[1] with the value of a (which is 5), that is, set the value of b[1] to the value of a, at this time the taint mark of a is passed to b[1].

[0142] tmp: int = b[2] (no taint mark) / / Call the IR associated read function (array read function) of b to get the state of b[2] (i.e. the value of b[2]). In the variable record area, record that b[2] has no taint mark. The taint propagation is not valid.

[0143] c: int = tmp(untainted) / / Assigning the value of tmp to c, c has no taint, a does not affect c.

[0144] And accordingly, the generated intermediate representation code is as follows:

[0145] a: int = 5;

[0146] b: array <int>={10,20,30,40,50};

[0147] b[1] = a;

[0148] tmp: int = b[2];

[0149] c: int = tmp.

[0150] Furthermore, after the generated intermediate representation code, the subsequent process will enter the program analysis stage (such as...). Figure 1 As shown, this allows for the analysis of program characteristics, such as data flow analysis (how variables propagate), security vulnerability detection, and memory leak checks. During the program analysis phase, the variable state information stored in the variable record area can be directly used for analysis.

[0151] The detailed implementation methods and beneficial effects of each step in this embodiment have been described in detail in the foregoing embodiments, and will not be elaborated here.

[0152] It should be noted that some processes described in the above embodiments and accompanying drawings include multiple operations appearing in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear in this document, or they may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should also be noted that the terms "first," "second," etc., used in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0153] This application also provides apparatus embodiments corresponding to each method embodiment. Specifically, they are as follows:

[0154] One embodiment of this application provides a program processing apparatus, which includes a determining module, a calling module, and a storing module. The determining module is used to determine a specified function based on a target function involved in a statement in the source program. The calling module is used to call the specified function and obtain the internal information of the target function. Furthermore, the determining module is also used to determine variable state information in the statement based on the internal information. The target function is associated with a composite data structure variable in the statement, the internal information includes parameter information within the target function, and the variable state information includes the value and taint status of the composite data structure variable determined based on the parameter information.

[0155] Furthermore, when the aforementioned determining module is used to determine the specified function based on the target function involved in the statement, it is specifically used to: determine the specified function that has an association with the target function.

[0156] Furthermore, the aforementioned determining module, when determining the specified function that is associated with the target function, is specifically used for: obtaining the association correspondence between functions in a preset programming language and functions in an intermediate representation; querying functions in the intermediate representation that are associated with the target function from the association correspondence; and determining the queried functions in the intermediate representation as the specified function; wherein, in the association correspondence, the get function in the programming language is associated with the read function in the intermediate representation, and the insert function in the programming language is associated with the write function in the intermediate representation.

[0157] Furthermore, the variable state information includes the variable's attributes, values, and taint status. The device also includes a determination module and a marking module. The determination module is used to determine that the first statement in the source program contains a taint source according to a preset taint source rule. The taint source rule includes external input data as a taint source. The marking module is used to mark variables receiving taint sources in the first statement as tainted when storing the variable state information of the first statement.

[0158] Furthermore, the source program also contains at least one second statement, in which the objective function is associated with the composite data structure variable. And, the aforementioned determining module, when determining the variable state information in the second statement based on the obtained internal information of the objective function involved in the second statement, specifically performs the following: determining the value of the composite data structure variable in the second statement based on the internal information; if the value of the composite data structure variable is associated with the taint source, then marking the composite data structure variable as a taint.

[0159] Furthermore, the device also includes a storage module. The storage module is used to store the variable state information, specifically for storing the variable state information in a variable storage area established for the source program.

[0160] Furthermore, the aforementioned determining module, when used to determine a specified function based on the target function involved in the statement in the source program, is specifically used to: determine the variable type in the statement; if the variable type includes a composite data structure variable type, trigger the determination of the specified function based on the target function involved in the statement that is associated with the composite data structure variable.

[0161] A schematic diagram of a program processing apparatus is provided in another exemplary embodiment of this application. The apparatus includes: an acquisition module, a determination module, and a generation module. The acquisition module is used to acquire a source program. The determination module is used to determine variable state information within each statement in the source program. The generation module is used to generate intermediate representation code based on the variable state information. Wherein, if a target function involved in a statement in the source program is related to a composite data structure variable, a specified function is determined based on the target function, and the internal information of the target function is obtained by calling the specified function. Variable state information in the statement is then established based on the internal information; the internal information includes parameter information within the target function, and the variable state information includes the value and taint status of the composite structure variable determined based on the parameter information; and the intermediate representation code is an abstract form of code between programming language and machine language.

[0162] It should be noted that the above-mentioned devices can implement the technical solutions described in the corresponding method embodiments. The specific implementation principles of each module or unit can be found in the relevant content of the corresponding method embodiments, and will not be elaborated here.

[0163] This application also provides a program processing system, comprising: a client and a server. The client is used to respond to input operations on a client interface, obtain the input source program, and send the source program to the server. The server is used to implement the various method embodiments provided in this application described above.

[0164] Of course, if the client has logical processing capabilities (such as an all-in-one computer), the methods provided in this application can also be executed on the client side.

[0165] For a detailed description of the client and server, please refer to the relevant content in other embodiments, which will not be described in detail here.

[0166] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, in practice, this electronic device includes a memory 41 and a processor 42.

[0167] Memory 41 is used to store computer programs and can be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device, data structures, contact data, phone book data, messages, pictures, videos, etc.

[0168] The processor 42, coupled to the memory 41, is used to execute the computer program in the memory 42 to implement the steps in the various method embodiments provided in this application.

[0169] Furthermore, such as Figure 4 As shown, the electronic device also includes other components such as a communication component 43, a display 44, a power supply component 45, and an audio component 46. Figure 4 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 4 The components shown. Additionally... Figure 4 The components within the dashed box are optional, not mandatory, and their specific requirements depend on the product form of the electronic device. The electronic device in this embodiment can be a client device (such as a desktop computer, laptop, smartphone, or IoT device) or a server device (such as a conventional server, cloud server, or server array). If the electronic device in this embodiment is implemented as a client device, it may include... Figure 4 The components within the dashed box; if the electronic device in this embodiment is implemented as a server device, it may not include... Figure 4 The component within the dashed box.

[0170] The aforementioned memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random-Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0171] The aforementioned communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel.

[0172] The aforementioned display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen can be implemented as a touchscreen to receive input signals from the user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0173] The aforementioned power supply components provide power to various components within the device in which they reside. These power supply components may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device in which they reside.

[0174] The aforementioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0175] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in the above-described method embodiments. The computer-readable storage medium includes volatile or non-volatile components, or a combination thereof, and can be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, CD-ROM, Digital Video Disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium.

[0176] Accordingly, this application also provides a computer program product, which includes a computer program or instructions that, when executed by a processor, cause the processor to implement the steps in the above method embodiments. It should be understood that each step or combination of steps in the above method flow can be implemented by the computer program or instructions. Furthermore, these computer programs or instructions can be applied to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device, enabling the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to function as an apparatus for implementing the corresponding functions in the above method embodiments.

[0177] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0178] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.< / int> < / int>

Claims

1. A program processing method, characterized in that, include: The specified function is determined based on the target function involved in the statements in the source program; Call the specified function to obtain the internal information of the target function; Based on the internal information, determine the variable state information in the statement; The objective function is related to the composite data structure variable in the statement; the internal information includes the parameter information within the objective function, and the variable state information includes the value and taint status of the composite data structure variable determined based on the parameter information.

2. The method according to claim 1, characterized in that, Based on the target function involved in the statement, determine the specified function, including: Identify the specified function that is associated with the objective function.

3. The method according to claim 2, characterized in that, Determining the specified function that is associated with the objective function includes: Obtain the correspondence between functions in the preset programming language and functions in the intermediate representation; Query the intermediate representations that are associated with the target function from the association correspondence; The function in the intermediate representation retrieved is identified as the specified function; In the aforementioned association relationship, the get function in the programming language is associated with the read function in the intermediate representation, and the insert function in the programming language is associated with the write function in the intermediate representation.

4. The method according to any one of claims 1 to 3, characterized in that, Also includes: According to preset taint source rules, the first statement in the source program is determined to contain a taint source; wherein, the taint source rules include external input data as taint sources; When storing the variable state information of the first statement, variables whose values ​​in the first statement contain taint sources are marked as taints.

5. The method according to claim 4, characterized in that, The source program also contains at least one second statement, in which the objective function involved in the second statement is related to the composite data structure variable; Furthermore, based on the obtained internal information of the objective function involved in the second statement, the variable state information in the second statement is determined, including: Based on the internal information, determine the value of the composite data structure variable in the second statement; If the value of the composite data structure variable is associated with the taint source, then the composite data structure variable is marked as a taint.

6. The method according to any one of claims 1 to 3, characterized in that, Also includes: Establish a variable storage area for the source program; The variable state information is stored in the variable storage area.

7. The method according to any one of claims 1 to 3, characterized in that, Based on the target function involved in the statements in the source program, determine the specified function, including: Determine the variable type of the variables in the statement; If the variable type includes a composite data structure variable type, the specified function is determined based on the target function associated with the composite data structure variable in the statement.

8. A program processing method, characterized in that, include: Obtain the source code; Determine the variable state information within each statement in the source program; Based on the variable state information, intermediate representation code is generated; Wherein, if the target function involved in a statement in the source program is related to the composite data structure variable, then a specified function is determined according to the target function, and the internal information of the target function is obtained through the specified function. The variable state information in the statement is established according to the internal information. The internal information includes the parameter information in the target function, and the variable state information includes the value and taint status of the composite structure variable determined according to the parameter information. In addition, the intermediate representation code is an abstract form of code between programming language and machine language.

9. A program processing system, characterized in that, include: The client is used to respond to input operations on the client interface, obtain the input source code, and send the source code to the server. A server-side component for implementing the method described in any one of claims 1 to 8.

10. An electronic device, characterized in that, include: Memory and processor, among which, The memory is used to store programs; The processor, coupled to the memory, is configured to execute the program stored in the memory to implement the method of any one of claims 1 to 8.

11. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a computer, it can implement the method of any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 8.

Images