Inspection device, inspection method, and inspection program

Abstract

To provide an inspection device, an inspection method, and an inspection program in which an automatically generated input value of a program is automatically inspected in executing the program.SOLUTION: An inspection device 1 includes: an extraction part 11 for extracting a definition character string from a program to be executed; a type discrimination part 12 for discriminating a type on the basis of a value of the definition character string; an input part 13 for providing a user interface for receiving an input value rewriting the definition character string; an inspection part 14 for applying prescribed inspection according to a type to an input value; a dictionary generation part 15 for generating a dictionary file in which a definition character string is associated with an input value having passed the inspection; and an execution part 16 for rewriting and executing a program based on the dictionary file.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technique for inspecting software. [Background technology]

[0002] In recent years, a technology called generative AI has been put to use, which automatically generates various contents such as text, images, audio, and videos based on learned data (see, for example, Non-Patent Document 1). In software development, programs are sometimes automatically generated by taking advantage of AI's characteristic of being able to develop and use a large amount of software in a short time. Furthermore, there are also methods for automating software testing (see, for example, Non-Patent Document 2). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] ChatGPT, Internet,<https: / / openai.com / > [Non-Patent Document 2] AI Exploratory Test Automation Tools, Internet,<https: / / adoc-teslab.com / > Summary of the Invention [Problem to be solved by the invention]

[0004] However, when developing a program using AI, it is necessary to use natural language to inquire of the AI ​​and have it generate the program. In this case, it is difficult to explain security requirements in natural language, and as a result, there are cases where a vulnerable program is generated.

[0005] An object of the present invention is to provide an inspection device, an inspection method, and an inspection program that can automatically inspect input values ​​of an automatically generated program while executing the program. [Means for solving the problem]

[0006] The inspection device of the present invention comprises an extraction unit that extracts a definition string from a program to be executed, a type discrimination unit that discriminates a type based on the value of the definition string, an input unit that provides a user interface for accepting an input value that rewrites the definition string, an inspection unit that performs a predetermined inspection on the input value according to the type, a dictionary generation unit that generates a dictionary file that corresponds to the definition string and the input value that passes the inspection, and an execution unit that rewrites and executes the program based on the dictionary file.

[0007] The extraction unit may extract the defined character string using i18n software, and the dictionary generation unit may generate a dictionary file referenced by the i18n software.

[0008] The program may be a program automatically generated by an AI in response to an input question.

[0009] The input unit may receive the input value through the user interface of a type corresponding to the type.

[0010] The dictionary generation unit may associate a combination of the input value for each of the defined character strings extracted by the extraction unit with an identifier and register the combination in the dictionary file.

[0011] The execution unit may, upon receiving an instruction to select any one of the identifiers registered in the dictionary file, execute the program using a combination of the input values ​​associated with the selected identifier.

[0012] The inspection method of the present invention is performed by a computer, and includes an extraction step of extracting a definition string from a program to be executed, a type determination step of determining a type based on the value of the definition string, an input step of providing a user interface for accepting an input value that rewrites the definition string, an inspection step of performing a predetermined inspection on the input value according to the type, a dictionary generation step of generating a dictionary file that corresponds to the definition string and the input value that passes the inspection, and an execution step of rewriting and executing the program based on the dictionary file.

[0013] The inspection program according to the present invention causes a computer to function as the inspection device. Effect of the Invention

[0014] According to the present invention, it is possible to execute an automatically generated program while automatically checking input values ​​of the program. [Brief description of the drawings]

[0015] [Figure 1] 1 is a block diagram showing a functional configuration of an inspection device according to an embodiment; [Diagram 2] 4 is a flowchart showing a procedure of an inspection method according to an embodiment. [Diagram 3] FIG. 4 is a diagram illustrating an example of an automatically generated program in the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] An example of an embodiment of the present invention will now be described. The inspection device of this embodiment automatically inserts a program that inspects input values ​​into a program that is automatically generated from natural language using learning techniques such as AI, prevents unauthorized input, and safely executes the automatically generated program.

[0017] FIG. 1 is a block diagram showing the functional configuration of an inspection device 1 according to this embodiment. The inspection device 1 is an information processing device including a control unit 10, a storage unit 20, and various input / output interfaces. The control unit 10 is a part that controls the entire inspection device 1, and realizes each function in this embodiment by appropriately reading and executing various programs stored in the storage unit 20. The control unit 10 may be a CPU.

[0018] The storage unit 20 is a storage area for various programs for causing the hardware group to function as the inspection device 1, various data, and the like, and may be a ROM, a RAM, a flash memory, a hard disk drive (HDD), or the like.

[0019] Specifically, the control unit 10 functions as an extraction unit 11, a type discrimination unit 12, an input unit 13, an inspection unit 14, a dictionary generation unit 15, and an execution unit 16 by executing software (inspection program) stored in the memory unit 20.

[0020] The extraction unit 11 accepts a question input by a user and automatically generates a program using a predetermined generation AI, or when a separately automatically generated program is input, it extracts a definition string from the program using i18n (internationalization) software. A defined string is a string (such as a temporary file name) that is temporarily placed by the AI ​​and must be replaced with an input value when the program is executed.

[0021] Here, the i18n software is, for example, "Python Standard Library > Internationalization > gettext - Internationalization services related to multilingual support, Internet<https: / / docs.python.org / ja / 3 / library / gettext.html> " is provided as a library for replacing multiple languages ​​with each other using dictionary files. The extraction unit 11 is not limited to software for i18n, and may be configured by software having a similar function.

[0022] The type determination unit 12 determines the type of the file, character string, numerical value, URL, etc., based on the value of the definition character string extracted by the extraction unit 11. For example, if the character string includes "file" and has an extension, such as "file1.txt", the type determination unit 12 identifies the file format from the extension and determines that the file path is in that file format. Also, if the character string is in URL format, such as "http: / / example.com / ", the type determination unit 12 determines that the character string is a URL.

[0023] The input unit 13 provides a user interface (such as a file selection dialog, a list of character encoding candidates, etc.) according to the type for receiving an input value for rewriting a defined character string included in a program.

[0024] The inspection unit 14 performs a predetermined inspection on the input value received by the input unit 13 according to the type determined by the type determination unit 12 . The contents of the checks on the input values ​​may be similar to those normally performed in existing software, as shown in the following example.

[0025] [For files] Is the file path in the correct format? -Does the file path contain the path traversal ".."? -Does the file path include an executable file? -Is the length of the file path normal (for example, less than 1kbyte)? Does the file exist in the specified path? -Is the file format (image, CSV, text, etc.) indicated by the file name correct?

[0026] [For character strings] -Does the string contain special characters such as escape characters? -Is the string length normal (for example, less than 1TB)?

[0027] [For numbers] -Is the value a valid number (e.g. does it not contain any characters other than 0-9)?

[0028] [For URLs] - Is the URL in the correct format? -Does the URL contain special characters such as escape characters? - Check whether the URL points to a dangerous site such as a phishing site.

[0029] The dictionary generating unit 15 generates a dictionary file for i18n software in which defined character strings are associated with input values ​​that have passed the inspection.

[0030] The execution unit 16 rewrites and executes the program based on the dictionary file generated by the dictionary generation unit 15.

[0031] FIG. 2 is a flowchart showing the flow of the inspection method in this embodiment. It is assumed that a natural language input character string (question sentence) A is received from a user via a predetermined interface, and a program B is generated in advance from this natural language input character string using AI.

[0032] In step S1, the extraction unit 11 extracts a definition character string C from a program B using i18n software. In step S2, the type determination unit 12 determines the type based on the value of the definition character string C.

[0033] In step S3, the input unit 13 displays a user interface (UI) of a type corresponding to the type for allowing the user to input a value to replace the defined string C, and sequentially accepts input values ​​for each of all the defined strings. In step S4, the inspection unit 14 checks whether each input value received in step S3 matches the type determined in step S2. For example, if the input value is a file path for an image file, the input value must be a normal file path character string (not including path traversal, not including special characters, not including program execution commands, etc.).

[0034] In step S5, the dictionary generation unit 15 generates a dictionary file D, which is referenced by the i18n software and corresponds the input value to the defined character string, that is, a dictionary file for replacing the defined character string in the program with a character string in another language. The language indicated by the dictionary file D may be any language E.

[0035] In step S6, the execution unit 16 executes the program B after converting the defined character string into an input value by specifying the language E, using the dictionary file D generated in step S5. In addition, multiple combinations of input values ​​may be registered in the dictionary file D, each associated with a multiple language (identifier). In this case, the execution unit 16 accepts an instruction to select one of the multiple registered identifiers, converts the defined string into the corresponding combination, and executes the program B.

[0036] FIG. 3 is a diagram illustrating an example of a program automatically generated by the AI ​​in this embodiment. Here, values ​​such as ['file1.zip', 'file2.zip', 'file3.zip'], whose input method is not indicated in the query statement (input string A), are written directly into the automatically generated program.

[0037] The definition strings extracted from this program are: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} .TXT utf-8 {ip}: {count} file1.zip file2.zip file3.zip These types are respectively: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} → String .txt → string utf-8 → character encoding {ip}: {count} → string file1.zip → file file2.zip → file file3.zip → file The input value is checked based on the above.

[0038] This avoids inconveniences such as processing unintended files by giving a string like ". / .. / .. / path / traversal" to the file name, or outputting the entire file by setting the string to an empty string.

[0039] According to this embodiment, the inspection device 1 uses the feature of a program automatically generated by AI to write external input values ​​as defined strings in the program, and uses i18n software to translate strings that are originally written in the program for screen display into other languages ​​as an input means for external input values. That is, the inspection device 1 determines the type of the input value based on the value of the defined string in the program, inspects the input value according to the type, and then executes the program by replacing the defined string with the input value using a dictionary file that associates the defined string with the input value. This allows the inspection device 1 to automatically inspect input values ​​of an automatically generated program while executing the program without modifying it.

[0040] Therefore, users of the inspection device 1 can use the program generated by AI without making any changes, and can automatically add inspections of input values ​​that are unlikely to be added as requirements when generating a program. Unlike traditional program development sites, sites where programs using AI are developed may not have sufficient basic knowledge of program development. In such cases, basic security may not be taken into consideration, which may result in a high risk of using programs developed using AI. On the other hand, if such programs are subjected to the same inspection methods as traditional software code reviews, the characteristic of being able to develop a large amount of software in a short period of time will not be fully utilized. According to this embodiment, a certain level of security can be automatically imparted to programs generated using AI, making it possible to reduce security and other test items and quickly put the programs into operation, thereby enabling efficient program implementation. Furthermore, by using a dictionary file as input values, external input values ​​can be saved in a versatile format, making them reusable.

[0041] This will make it possible to efficiently and safely introduce AI-based automatic generation programs, for example, which will contribute to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0042] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Furthermore, the effects described in the above-described embodiments are merely a list of the most preferable effects resulting from the present invention, and the effects of the present invention are not limited to those described in the embodiments.

[0043] The inspection method by the inspection device 1 is realized by software. When realized by software, a program constituting this software is installed in an information processing device (computer). These programs may be recorded on a removable medium such as a CD-ROM and distributed to users, or may be distributed by being downloaded to the user's computer via a network. Furthermore, these programs may be provided to the user's computer as a Web service via a network without being downloaded. [Explanation of symbols]

[0044] 1. Inspection equipment 10 Control section 11 Extraction part 12 Type discrimination section 13 Input section 14 Inspection Department 15 Dictionary Generation Unit 16 Executive Department 20 Memory section

Claims

1. an extracting unit that extracts a definition character string from a program to be executed; a type determination unit that determines a type based on a value of the definition character string; an input unit that provides a user interface for receiving an input value for rewriting the definition character string; A test unit that performs a predetermined test on the input value according to the type of the input value; a dictionary generating unit that generates a dictionary file in which the defined character strings are associated with the input values ​​that have passed the inspection; and an execution unit that rewrites and executes the program based on the dictionary file.

2. The extraction unit extracts the definition character string using i18n software, The inspection device according to claim 1 , wherein the dictionary generation unit generates a dictionary file to which the i18n software refers.

3. 3. The inspection device according to claim 1, wherein the program is a program automatically generated by AI in response to an input question.

4. The inspection device according to claim 1 , wherein the input unit receives the input value through the user interface of a type corresponding to the model.

5. 3 . The inspection device according to claim 1 , wherein the dictionary generation unit associates the combinations of the input values ​​for all the defined character strings extracted by the extraction unit with identifiers and registers them in the dictionary file.

6. 3. The inspection device according to claim 1, wherein when the execution unit receives an instruction to select one of the identifiers registered in the dictionary file, the execution unit executes the program using a combination of the input values ​​associated with the selected identifier.

7. An extraction step of extracting a definition character string from a program to be executed; a type determination step of determining a type based on a value of the definition string; an input step of providing a user interface for receiving an input value for rewriting the definition character string; a check step of performing a predetermined check on the input value according to the type; a dictionary generating step of generating a dictionary file in which the defined character strings are associated with the input values ​​that have passed the check; an execution step of rewriting and executing the program based on the dictionary file, the execution step being performed by a computer.

8. 3. An inspection program for causing a computer to function as the inspection device according to claim 1.

Images