Code analysis

Abstract

The embodiments of the present description provide a code analysis method and apparatus. The code analysis method comprises: in the process of performing code analysis on a program code, firstly acquiring an analysis task of performing code analysis on the program code; then, on the basis of a code structure type corresponding to the analysis task, determining from a relational database a data table storing code structure data of the program code under the code structure type; next, performing code structure data reading and data structure relationship reading in the data table, so as to obtain the code structure data and a data structure relationship; and finally, analyzing and processing the code structure data and the data structure relationship according to a code analysis mode of the analysis task, so as to obtain a code analysis result.

Description

Code Analysis Technical Field

[0001] This document relates to the field of data processing technology, and in particular to code analysis. Background Art

[0002] With the development of the Internet, in the process of Internet development, different Internet services will be coded according to appropriate programming languages ​​to implement services. In order to ensure the accuracy and effective operation of the written program code, the program code is analyzed to detect whether there are any problems in the program code. Different analysis tasks require different analysis algorithms for code analysis. How to perform code analysis on program codes efficiently and conveniently has become a focus of increasing attention for code providers and code analysts.

[0003] Summary of the Invention

[0004] One or more embodiments of this specification provide a code analysis method. The code analysis method includes: obtaining an analysis task for performing code analysis on program code. Based on the code structure type corresponding to the analysis task, determining a data table in a relational database that stores code structure data of the program code under the code structure type. Reading the code structure data and data structure relationship from the data table to obtain the code structure data and data structure relationship. Analyzing and processing the code structure data and data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result.

[0005] One or more embodiments of the present specification provide a code analysis device, comprising: an analysis task acquisition module, configured to acquire an analysis task for performing code analysis on a program code. A data table determination module, configured to determine, in a relational database, a data table storing code structure data of the program code under the code structure type corresponding to the analysis task. A code structure data reading module, configured to read code structure data and data structure relationships from the data table to obtain the code structure data and data structure relationships. An analysis and processing module, configured to analyze and process the code structure data and the data structure relationships according to the code analysis method of the analysis task to obtain a code analysis result.

[0006] One or more embodiments of this specification provide a code analysis device, comprising: a processor; and a memory configured to store computer-executable instructions, wherein the computer-executable instructions, when executed, cause the processor to: obtain an analysis task for performing code analysis on a program code. According to the code structure type corresponding to the analysis task, a data table storing the code structure data of the program code under the code structure type is determined in a relational database. The code structure data and the data structure relationship are read from the data table to obtain the code structure data and the data structure relationship. The code structure data and the data structure relationship are analyzed and processed according to the code analysis method of the analysis task to obtain a code analysis result.

[0007] One or more embodiments of this specification provide a storage medium for storing computer-executable instructions, which implement the following process when executed by a processor: obtain an analysis task for performing code analysis on a program code. According to the code structure type corresponding to the analysis task, determine a data table in a relational database that stores the code structure data of the program code under the code structure type. Read the code structure data and the data structure relationship in the data table to obtain the code structure data and the data structure relationship. Analyze and process the code structure data and the data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in one or more embodiments of this specification or related technologies, the following briefly introduces the drawings required for use in the description of the embodiments or related technologies. Obviously, the drawings described below are only some embodiments described in this specification. Those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0009] FIG1 is a schematic diagram of an implementation environment of a code analysis method provided by one or more embodiments of this specification;

[0010] FIG2 is a flowchart of a code analysis method provided by one or more embodiments of this specification;

[0011] FIG3 is a schematic diagram of the architecture of a code analysis method provided by one or more embodiments of this specification;

[0012] FIG4 is a flowchart of a code analysis method for a call analysis scenario provided by one or more embodiments of this specification;

[0013] FIG5 is a flowchart of a code analysis method for applying to an exception analysis scenario provided by one or more embodiments of this specification;

[0014] FIG6 is a schematic diagram of an embodiment of a code analysis device provided by one or more embodiments of this specification;

[0015] FIG7 is a schematic diagram of the structure of a code analysis device provided by one or more embodiments of this specification. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below in conjunction with the drawings in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this document.

[0017] The code analysis method provided in one or more embodiments of this specification may be applicable to an implementation environment of code analysis. As shown in FIG1 , the implementation environment includes at least a server 101 and a relational database 102 .

[0018] The server 101 may be one or more servers, a server cluster consisting of several servers, or a cloud server of a cloud computing platform. The server 101 is used to perform code analysis on the program code based on a data table storing code structure data of the program code under a code structure type stored in the relational database 102;

[0019] The relational database 102 stores a data table storing code structure data of program codes under the code structure type;

[0020] In addition, the implementation environment may also include a user terminal 103, which may be a smartphone, tablet computer, e-book reader, wearable device, device for information interaction based on AR (Augmented Reality) / VR (Virtual Reality), etc., and may also be installed with an application or browser, through which the user submits analysis instructions and receives and displays code analysis results;

[0021] In this implementation environment, the user submits an analysis instruction for performing code analysis on the program code to the server 101 through the user terminal 103. The server 101 first obtains the analysis task for performing code analysis on the program code, and then determines the data table storing the code structure data of the program code under the code structure type in the relational database 102 according to the code structure type corresponding to the analysis task, and then reads the code structure data and the data structure relationship in the data table to obtain the code structure data and the data structure relationship. Finally, the code structure data and the data structure relationship are analyzed and processed according to the code analysis method of the analysis task to obtain the code analysis result.

[0022] One or more embodiments of a code analysis method provided in this specification are as follows.

[0023] A code analysis method provided in this embodiment determines, in the process of code analysis, a data table storing code structure data of the program code under the code structure type in a relational database according to the code structure type corresponding to the analysis task of performing code analysis on the program code, and then reads the code structure data and the data structure relationship in the data table to obtain the code structure data and the data structure relationship, performs analysis and processing based on the code structure data and the data structure relationship, and obtains the code analysis result. In this way, by converting the program code into standard relational data and storing it in the data table, code analysis is performed based on the relational data, thereby improving the analysis efficiency of code analysis. Compared with the program code, the data itself has a high degree of certainty, and the code analysis task of the program code is converted into a data analysis task, thereby improving the accuracy of the code analysis.

[0024] 2 , the code analysis method provided in this embodiment specifically includes steps S202 to S208 .

[0025] Step S202: obtaining an analysis task for performing code analysis on the program code.

[0026] In actual applications, the analysis requirements of code analysis are different in different analysis scenarios. For example, in the code security analysis scenario, it is necessary to analyze whether the program code has vulnerabilities; in the code instruction analysis scenario, it is necessary to analyze the accuracy of the program code; in the code call analysis scenario, it is necessary to analyze whether the called function is called normally.

[0027] In response to the above different analysis requirements, during the code analysis process, different analysis tasks are submitted to achieve code analysis with different analysis requirements, such as vulnerability analysis tasks, call analysis tasks, and quality analysis tasks.

[0028] During specific implementation, the user submits an analysis instruction for performing code analysis on the program code. The analysis instruction carries an analysis task, and the program code is analyzed according to the analysis task.

[0029] In order to improve the convenience of users submitting analysis instructions, users can write analysis instructions in a high-level language. After obtaining the analysis instructions written in a high-level language, since the server cannot directly determine the data table and perform code analysis in the relational database based on the analysis instructions in the form of a high-level language, the analysis instructions written in the high-level language are converted into assembly language, and data table reading and code analysis are performed using analysis instructions in the form of a low-level language.

[0030] In an optional implementation provided by this embodiment, an analysis instruction that can be recognized by the server is obtained in the following manner: obtaining an instruction code corresponding to an interface call instruction for performing code analysis on the program code; optionally, the instruction code is written based on a first language; performing code conversion on the instruction code to obtain an analysis instruction code carrying the analysis task; optionally, the analysis instruction code is in a second language form; and determining the analysis task based on the analysis instruction code.

[0031] Optionally, the first language includes a language that provides instructions or statements close to the user language required for writing program codes; for example Language. Second language includes languages ​​that provide the ability to operate the underlying hardware of the computer system; for example, Datalog (data query language). The language may be a high-level language corresponding to Datalog.

[0032] Specifically, according to different analysis requirements, different interfaces are called to implement code analysis of the program code; therefore, the first thing obtained is the instruction code corresponding to the interface call instruction for calling the target interface written in a high-level language; then the instruction code is converted to obtain the analysis instruction code in the form of a low-level language carrying the analysis task corresponding to the target interface, and finally the analysis task carried in the analysis instruction code is read.

[0033] For example, users based on An instruction code for calling and analyzing the program code was written to perform code analysis on the program code by calling the analysis interface. After obtaining the instruction code, the instruction code was converted to obtain the analysis instruction code in the form of Datalog, and the analysis task of calling and analyzing the program code was read from the analysis instruction code.

[0034] The above-mentioned instruction code corresponding to the interface call instruction for performing code analysis on the program code can also be replaced by obtaining the instruction code corresponding to the user analysis instruction for performing code analysis on the program code, and forming a new implementation method with other steps.

[0035] Step S204 : determining, in a relational database, a data table storing code structure data of the program code under the code structure type according to the code structure type corresponding to the analysis task.

[0036] After the analysis task of performing code analysis on the program code is obtained as described above, the code analysis task is converted into a data analysis task, and code analysis is implemented through analysis and processing of the data to obtain the code analysis result; therefore, in this step, according to the code structure type corresponding to the analysis task, a data table storing the code structure data of the program code under the said code structure type is determined in the relational database.

[0037] In this embodiment, the structural relationships of code are abstracted from at least one dimension. An abstract dimension can be a code structure type. For example, abstracting structural relationships from the grammatical dimension is an abstract grammatical type; abstracting structural relationships from the semantic dimension is an abstract semantic type; and abstracting structural relationships from the function call dimension is a function call type. Furthermore, this may include control flow types, program dependency types, class inheritance types, and documentation / comment information types.

[0038] In specific implementations, after abstracting the structural relationships of the code from at least one dimension, the structural relationships of each code structure type are characterized using a benchmark data table for each code structure type. In this embodiment, in order to perform code analysis according to the analysis task of performing code analysis on program code, a corresponding code structure type is configured for the analysis task, so that code analysis is performed based on the code structure data of the program code under the corresponding code structure type.

[0039] In this embodiment, a data table of the program code under each code structure type can be generated in advance when the program code is obtained. That is, a data table storing the code structure data of the program code under each code structure type can be generated in advance for each code structure type. In the process of performing code analysis on the program code, the data table for performing the code analysis is determined based on the code structure type corresponding to the analysis task of the code analysis. It is also possible to generate a data table storing the code data structure of the program code under the code structure type corresponding to the analysis task after obtaining the analysis task of performing code analysis on the program code.

[0040] The following specifically describes the generation of a data table storing code structure data of a program code under a code structure type.

[0041] In an optional implementation provided by this embodiment, before determining in a relational database a data table storing code structure data of a program code under a code structure type, a data table may be generated in the following manner: reading a pre-created benchmark data table under each code structure type; based on the data category of the benchmark data table, reading the code structure data in the program code and writing it into the corresponding benchmark data table to obtain the data table under each code structure type; and storing the data table under each code structure type in the relational database.

[0042] Specifically, after obtaining the program code, the pre-created reference data table under each code structure type is read, and then the program code is written into the reference data table to obtain the data table under each code structure type, and finally the data table under each code structure type is stored in the relational database.

[0043] For example, a benchmark data table for the abstract syntax tree, a benchmark data table for the abstract semantic graph, and a benchmark data table for the function call graph are created in advance. After obtaining the program code, the benchmark data table for the abstract syntax tree, the benchmark data table for the abstract semantic graph, and the benchmark data table for the function call graph are read. According to the node category of each node in the benchmark data table of the abstract syntax tree, the code structure data is read in the program code and written into the benchmark data table to obtain a data table storing the code structure data of the program code under the abstract syntax type. Similarly, a data table storing the code structure data of the program code under the abstract semantic type and a data table storing the code structure data of the program code under the function call type are obtained. Then, the above three data tables are stored in a relational database, so that after obtaining the analysis task of performing code analysis on the program code, the data table storing the code structure data of the program code under the code structure type corresponding to the analysis task is determined in the relational database.

[0044] In another optional implementation provided by this embodiment, after obtaining an analysis task for performing code analysis on a program code, a data table may be generated in the following manner: obtaining an analysis instruction for performing code analysis on the program code; reading the analysis task carried in the analysis instruction and determining the code structure type corresponding to the analysis task; writing data to a plurality of benchmark data tables under the code structure type according to the program code, obtaining a data table under the code structure type and storing the data table in the relational database.

[0045] Specifically, according to the analysis task carried in the analysis instruction for performing code analysis on the program code, the corresponding code structure type is read, and then the program code is written into a benchmark data table of the code structure type to obtain a data table storing the code structure data of the program code under the code structure type. Since the data table is stored in the corresponding relational database after generation, the data table storing the code structure data of the program code under the code structure type is obtained to determine the data table storing the code structure data of the program code under the code structure type in the relational database.

[0046] For example, the analysis task for performing code analysis on the program code is obtained as a call analysis task, and the code structure type corresponding to the call analysis task is read as a function call type. Then, the benchmark data table of the function call type is read, and according to the node category of each node in the benchmark data table, the program structure data is read in the program code and written into the benchmark data table to obtain a data table storing the code structure data of the program code under the function call type.

[0047] Optionally, step S204 can also be replaced by generating a data table storing the code structure data of the program code under the code structure type based on a benchmark data table of the code structure type corresponding to the program code and the analysis task, and forming a new implementation method together with other processing steps provided in this embodiment.

[0048] In a specific implementation, a data table can be configured for each code structure type to store the code structure data for each node type. In this embodiment, multiple reference data tables can be configured for each code structure type. Optionally, multiple node categories exist under the code structure type, and each node category corresponds to a reference data table. If multiple reference data tables exist under a code structure category, the number of data tables can be multiple.

[0049] In the case where there are multiple data tables, in an optional implementation provided by this embodiment, the code structure data in the data table is written in the following manner: multiple benchmark data tables under the code structure type are read; and according to the data category of each benchmark data table in the multiple benchmark data tables, the code structure data is read in the program code and written into each benchmark data table.

[0050] Specifically, the data table storing the code structure data of the program code under the code structure type is composed of multiple data tables. In the process of writing the code structure data in the multiple data tables, the code structure data is read in the program code and written into each benchmark data table according to the data category of each benchmark data table under the code structure type, thereby obtaining multiple data tables under the code structure type.

[0051] It should be noted that the code structure data can be written using the above method for multiple benchmark data tables under each code structure type. It should also be noted that the code structure data for the program code under a code structure type is determined based on the code structure type. For example, if the code structure type is an abstract syntax type, the code structure data for the program code under the abstract syntax type is determined based on the node categories under the abstract syntax type.

[0052] Optionally, the field relationship among each of the multiple data tables is determined according to the field structure configuration of the code structure type; and the table relationship among the multiple data tables is determined according to the code structure configuration of the code structure type.

[0053] During implementation, a data table may contain multiple code categories, or in other words, multiple fields. The relationships between multiple fields stored in the same data table are determined by the field structure configuration, or grammatical structure. Multiple data tables within the same code structure category represent the code structure through table relationships. These relationships are determined by the fragment structure relationships of each code snippet within the key program code selected for that code structure type. Specifically, the field structure configuration includes the grammatical structure, and the code structure configuration includes the fragment structure relationships of the code snippets.

[0054] The following describes how to create multiple benchmark data tables under the code structure type.

[0055] In an optional implementation manner provided by this embodiment, multiple benchmark data tables of code structure type are created in the following manner: code extraction is performed in the source program code according to the code structure type to obtain key program code; code categories of each code fragment in the key program code are extracted, and the multiple benchmark data tables are created based on the code categories; and table relationships of the multiple benchmark data tables are constructed based on the fragment structure relationships of the each code fragment in the source program code.

[0056] Optionally, in the process of extracting the code categories of each code fragment in the key program code and creating the multiple benchmark data tables based on the code categories, the code categories are first deduplicated to obtain key code categories; then the key code categories are merged according to the grammatical structure to obtain at least one data category, and a benchmark data table for each data category in the at least one data category is created.

[0057] Specifically, in the process of configuring the benchmark data table of the code structure type, code extraction is first performed in the source program code to obtain the key program code, and then the code category of each code fragment in the key program code is extracted, the code category is deduplicated and merged to obtain at least one data category, and then a benchmark data table corresponding to each data category is created; on the basis of obtaining the benchmark data table corresponding to each data category, the table relationship of multiple benchmark data tables is constructed according to the fragment structure relationship of the data category of the benchmark data table in the source program code. At this point, the creation of the benchmark data table of the code structure type is completed.

[0058] For example, in the process of configuring a benchmark data table of an abstract syntax type, the key program code includes if statements and for statements, the if statement contains then statements and else statements, and the for statement also contains a loop statement. The code category is extracted for each line of code to obtain five code categories, namely if, then, else, for and loop. However, configuring benchmark data tables for these five code categories separately will result in too many benchmark data tables. Therefore, the code categories are merged according to the syntax structure to obtain two data categories, if and for; a benchmark data table for the if data category and a benchmark data table for the for data category are created; in the key program code, the code corresponding to the if statement is executed before the code corresponding to the for statement, the benchmark data table for the if data category is determined as the parent data table of the benchmark data table for the for data category, and correspondingly, the benchmark data table for the for data category is the child data table of the benchmark data table for the if data category. It should also be noted that the benchmark data table of the if data category includes an if field, a then field, and an else field, and the field relationship among the if field, the then field, and the else field can be generated according to the grammatical structure of the if statement.

[0059] The above process of creating the benchmark data table under the abstract syntax type is merely illustrative. In the actual process of creating the benchmark data table of the code structure category, it can be created according to actual needs and service configuration, and this embodiment does not limit this.

[0060] In this embodiment, taking the Java Abstract Syntax Tree (AST) as an example, the abstract syntax tree contains 162 different types of nodes, and thus contains 162 reference data tables. Through the above method, unstructured data can be sorted into structured relational data.

[0061] It should be noted that, during the process of extracting code from the source code, the code extraction may be performed according to a pre-configured extraction strategy, or the code extraction may be performed by the user, which is not limited in this embodiment.

[0062] The architecture diagram shown in Figure 3 includes a tool layer, a data layer, a description layer, a platform layer, and a product layer. The tool layer includes extractors for code extraction from different coding languages, such as coref-java extractor, coref-js extractor, and coref-txt extractor; it is used to extract code from original program codes in different coding languages; the data layer includes coref models and relational databases for generating benchmark data tables of different code structure types. In addition, it can also store dynamic data, other data, model data, and analysis knowledge; the description layer includes analysis tools and supporting languages ​​for analyzing and processing data tables of corresponding code structure types for different analysis tasks, such as codelnsight language in the description layer, including godel-datalog, semgrep (lightweight static analysis tool), graph language, and SQL (Structured Query Language, database language); correspondingly, it also includes datalog execution engine, sem engine, graph engine, and database engine; the platform layer includes open API (Application Programming Interface (application programming interface) and sparrow (code data platform) services; the product layer includes playground, large-scale analysis engine, query management center and others; the architecture can also correspond to system detection, deployment system and logging system.

[0063] Step S206 , reading the code structure data and the data structure relationship in the data table to obtain the code structure data and the data structure relationship.

[0064] In the above steps, a data table storing code structure data of program code under the code structure type is determined in the relational database. In this step, the code structure data and data structure relationship are read from the data table to obtain the code structure data and data structure relationship.

[0065] During specific implementation, the code structure data and the data structure relationship can be read from the data table according to the analysis task to obtain the code structure data and the data structure relationship.

[0066] During the specific execution process, the code structure data and data structure relationship can be read from the data table according to the analysis task to obtain global code structure data and data structure relationship. The code structure data and data structure relationship can also be read from the data table according to the local data identifier carried in the analysis task to obtain local code structure data and data structure relationship. Specifically, due to different analysis tasks, the analysis objects are also different. For example, when analyzing and processing a calling function, only the calling data and called data of the calling function need to be analyzed; however, when analyzing code exceptions, all code structure data needs to be analyzed.

[0067] Therefore, according to the analysis object of the analysis task, the code data and the data structure relationship are read in the data table to obtain the code structure data and the data structure relationship. Optionally, different analysis tasks have different analysis objects. If the analysis task is a call analysis task, the analysis object is a local analysis object. In an optional implementation provided by this embodiment, if the analysis task is a call analysis task, the code structure data and the data structure relationship are read in the data table to obtain the code structure data and the data structure relationship. The following operations are performed: according to the calling function identifier carried by the call analysis task, the calling data and the called data are read in the function call data table under the function call type of the program code; according to the calling relationship between the calling data and the called data in the function call data table, a data calling relationship between the calling data and the called data is constructed.

[0068] Specifically, if the analysis task is a call analysis task of any calling function, the calling data and the called data are read in the function call data table under the function call type in the program code according to the calling function identifier carried in the calling analysis task, and the data call relationship between the calling data and the called data is constructed according to the table relationship between the data table storing the calling data and the data table storing the called data in the function call data table.

[0069] If the analysis task is an exception analysis task, in an optional implementation manner provided by this embodiment, in the process of reading the code structure data and the data structure relationship in the data table to obtain the code structure data and the data structure relationship, the following operations are performed: reading the abstract syntax data in the abstract syntax data table under the abstract syntax type of the program code; and constructing the data structure relationship of the abstract syntax data according to the table relationship of the data table to which the abstract syntax data belongs.

[0070] The above takes the call analysis task and the exception analysis task as an example to specifically illustrate the process of reading code structure data and data structure relationship in the data table to obtain code structure data and data structure relationship. For other analysis tasks, the process of reading code structure data and data structure relationship in the data table to obtain code structure data and data structure relationship is similar to the above method, and this embodiment will not be repeated here.

[0071] In addition, step S206 can also be replaced by reading the code structure data and the data structure relationship in the data table to obtain the code structure data with the data structure relationship, and forming a new implementation method together with other processing steps provided in this embodiment.

[0072] Step S208 : analyzing and processing the code structure data and the data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result.

[0073] In this embodiment, code analysis is converted into data analysis, and code analysis results are generated based on the data analysis results, thereby improving the accuracy of code analysis.

[0074] In specific implementation, after obtaining the code structure data and the data structure relationship, the code structure data and the data structure relationship are analyzed and processed according to the code analysis method corresponding to the analysis task to obtain the code analysis result.

[0075] During the execution process, code structure data and data structure relationships can be analyzed and processed using both static code analysis and dynamic code analysis. Whether to use static code analysis or dynamic code analysis depends on the analysis task.

[0076] In an optional implementation manner provided by this embodiment, if the code analysis method corresponding to the analysis task is a static analysis method, then in the process of analyzing and processing the code structure data and the data structure relationship to obtain the code analysis result, the following operations are performed: read the code analysis strategy corresponding to the analysis task; based on the code analysis strategy, perform static code analysis on the code structure data and the data structure relationship to obtain a static code analysis result; and generate a code analysis result for the program code based on the static code analysis result.

[0077] Specifically, during the static code analysis process, it is necessary to configure a code analysis strategy, determine the static analysis results by comparing the code structure data and data structure relationships with the benchmark analysis conditions in the code analysis strategy, and generate code analysis results for the program code based on the static analysis results.

[0078] For example, the analysis task is a quality analysis task, and the code structure data and data structure relationship are read from a data table storing the code structure data of the program code under the document / annotation information type in a relational database, and the line number and comment of each code line in the program code are obtained. The correlation between the comment of each code line and the corresponding comment in the benchmark comment library is calculated. If the correlation does not meet the preset conditions, the corresponding line number and comment are used as the static analysis result, and the static analysis result is used as the code analysis result.

[0079] In an optional implementation provided by this embodiment, if the code analysis method corresponding to the analysis task is a dynamic analysis method, then in the process of analyzing and processing the code structure data and the data structure relationship to obtain the code analysis results, the following operations are performed: code simulation operation is performed based on the code structure data and the data structure relationship; and according to the running results of the code simulation operation, the code analysis results of the program code are generated.

[0080] Specifically, code simulation is performed based on the code structure data and data structure relationships, and code analysis results are generated according to the running results.

[0081] For example, the analysis task is a call analysis task, and the code structure data and data structure relationship are read from a data table storing the code structure data of the program code under the function call type in a relational database to obtain the calling data and called data of the calling function with the calling relationship, simulate the call based on the calling data and called data, and generate the code analysis results based on the simulated call results.

[0082] It should be noted that the above description of analysis and processing based on static code analysis and dynamic code analysis is merely exemplary, and other code analysis methods may also be used to analyze and process code structure data and data structure relationships, which is not limited in this embodiment.

[0083] In addition, step S208 can also be replaced by performing code analysis processing of the analysis task on the code structure data and the data structure relationship to obtain a code analysis result, and forming a new implementation method with other processing steps provided in this embodiment.

[0084] In summary, the one or more code analysis methods provided in this embodiment first configure a benchmark data table for each code structure type based on the source program code; specifically, extract key program code of each code structure type from the source program code, extract the code category of each code fragment in the key program code for each code structure type, use the code category as the data category, create a benchmark data table for each data category, and then construct a table relationship of the benchmark data table based on the fragment structure relationship, which can be a fragment sequence relationship, of each code fragment in the key program code. In this way, a benchmark data table consisting of multiple benchmark data tables and table relationships is obtained for each code structure type;

[0085] Then, after obtaining the program code, the code structure data of the program code is extracted according to the data categories of multiple benchmark data tables under each code structure type, and the code structure data is written into the benchmark data table of the corresponding data category, thereby obtaining a data table storing the code program data of the program code under each code structure type and storing the data table in a relational database; by storing the code program data of the program code in the form of a data table of the code structure type, the program code is standardized and digitized, and the program code is converted into standard relational data and stored in a relational database, so that users can perform code analysis based on database operations, thereby improving the convenience of code analysis; compared with graph structures, relational data is more suitable for high-performance computing, and the data tables stored in relational databases can be graph structures or non-graph data. Compared with program code, the data has higher certainty, and relational data can comprehensively and accurately store relevant information of the program code;

[0086] After obtaining an analysis task for performing code analysis on program code, a data table storing the code structure data of the program code under the code structure type is determined in a relational database according to the code structure type corresponding to the analysis task, and the code structure data and data structure relationship are read in the data table to obtain the code structure data and data structure relationship. The code structure data and data structure relationship are analyzed and processed to obtain code analysis results, thereby converting code analysis into data analysis and improving the accuracy and effectiveness of code analysis.

[0087] In addition, one or more code analysis methods provided in this embodiment can also perform code analysis through interface calls. Specifically, an analysis task for performing code analysis on program code is obtained, and according to the code structure type corresponding to the analysis task, a data table storing the code structure data of the program code under the code structure type is determined in a relational database, and the code structure data and data structure relationship are read in the data table to obtain the code structure data and data structure relationship. The analysis processing structure corresponding to the analysis task is called and the code structure data and data structure relationship are passed in to analyze and process the code structure data and the data structure relationship to obtain a code analysis result.

[0088] The following further illustrates the code analysis method provided by this embodiment by taking the application of a code analysis method provided by this embodiment in a call analysis scenario as an example. Referring to FIG4 , the code analysis method applied to the call analysis scenario specifically includes the following steps.

[0089] Step S402: When the program code is acquired, a reference data table of each code structure type is read.

[0090] Step S404 , based on the data category of the benchmark data table of each code structure type, read the code structure data in the program code and write it into the corresponding benchmark data table to obtain the data table of the program code under each code structure type.

[0091] Optionally, the data table of the program code under each code structure type stores the code structure data of the program code under the corresponding code structure type.

[0092] Step S406: store the data table in a relational database.

[0093] Step S408: obtaining a user analysis instruction written by the user in a high-level language for performing code analysis on the program code.

[0094] Optionally, the high-level language can be a data processing language developed language.

[0095] Step S410: Convert the instruction code of the user analysis instruction to obtain an analysis instruction in a low-level language.

[0096] Alternatively, the low-level language may be Datalog language.

[0097] Step S412: determining that the analysis task is a call analysis task based on the analysis instruction, and determining a data table storing code structure data of the program code under the function call type in the relational database.

[0098] Step S414 , according to the calling function identifier carried in the analysis instruction, code structure data and data structure relationship are read from the data table to obtain calling data and called data with a calling relationship.

[0099] Step S416: simulate calling based on the calling data and the called data, and generate code analysis results according to the simulated calling results.

[0100] In addition, step S416 may also be replaced by inputting the calling data and the called data into the analysis interface corresponding to the calling analysis task to analyze and process the calling data and the called data to obtain the code analysis result.

[0101] Optionally, steps S412 to S416 can also be replaced by determining the analysis task based on the analysis instruction, and determining the data table of the program code under the code structure type in the relational database according to the code structure type corresponding to the analysis task; reading the code structure data and the data structure relationship in the data table to obtain code structure data with data structure relationship, performing code simulation operation based on the code structure data, and obtaining simulation operation results.

[0102] The following further illustrates the code analysis method provided by this embodiment by taking the application of a code analysis method provided by this embodiment in an exception analysis scenario as an example. Referring to FIG5 , the code analysis method applied to the exception analysis scenario specifically includes the following steps.

[0103] Step S502: obtaining a user analysis instruction written by the user in a high-level language for performing code analysis on the program code.

[0104] Optionally, the high-level language can be a data processing language developed language.

[0105] Step S504: convert the instruction code of the user analysis instruction to obtain an analysis instruction in a low-level language form.

[0106] Alternatively, the low-level language may be Datalog language.

[0107] Step S506 : determining that the analysis task is an exception analysis task based on the analysis instruction, and reading the code structure type corresponding to the exception analysis task as an abstract syntax type.

[0108] Step S508 , based on the data category of the benchmark data table of the abstract syntax type, read the code structure data in the program code and write it into the benchmark data table, obtain a data table storing the code structure data of the program code under the abstract syntax type and store it in a relational database.

[0109] Step S510 , reading the code structure data and the data structure relationship of the data table in the relational database to obtain code structure data with data structure relationship.

[0110] Step S512: Perform static code analysis on the code structure data according to the code analysis strategy corresponding to the exception analysis task to obtain a static code analysis result.

[0111] In addition, step S512 may also be replaced by transferring the obtained code structure data having the data structure relationship to the analysis interface corresponding to the abnormality analysis task, so as to analyze and process the code structure data to obtain a code analysis result.

[0112] Optionally, steps S506 to S512 can also be replaced by determining the analysis task based on the analysis instruction, and reading the code structure type corresponding to the analysis task; based on the data category of the benchmark data table of the code structure type, reading the code structure data in the program code and writing it into the benchmark data table, obtaining a data table storing the code structure data of the program code under the code structure type and storing it in a relational database; reading the code structure data and the data structure relationship from the data table in the relational database to obtain code structure data with data structure relationships; performing static code analysis on the code structure data according to the code analysis strategy corresponding to the analysis task to obtain static code analysis results.

[0113] One or more embodiments of a code analysis device provided in this specification are as follows: In the above embodiments, a code analysis method is provided, and correspondingly, a code analysis device is also provided, which is described below in conjunction with the accompanying drawings.

[0114] 6 , which shows a schematic diagram of an embodiment of a code analysis device provided by this embodiment.

[0115] Since the device embodiment corresponds to the method embodiment, the description is relatively simple. For the relevant parts, please refer to the corresponding description of the method embodiment provided above. The device embodiment described below is only illustrative.

[0116] This embodiment provides a code analysis device, including the following modules.

[0117] An analysis task acquisition module 602 is configured to acquire an analysis task for performing code analysis on program code;

[0118] A data table determination module 604 is configured to determine, in a relational database, a data table storing code structure data of the program code under the code structure type according to the code structure type corresponding to the analysis task;

[0119] A code structure data reading module 606 is configured to read the code structure data and the data structure relationship in the data table to obtain the code structure data and the data structure relationship;

[0120] The analysis and processing module 608 is configured to analyze and process the code structure data and the data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result.

[0121] One or more embodiments of a code analysis device provided in this specification are as follows: Corresponding to a code analysis method described above, based on the same technical concept, one or more embodiments of this specification also provide a code analysis device, which is used to execute the code analysis method provided above. Figure 7 is a structural schematic diagram of a code analysis device provided in one or more embodiments of this specification.

[0122] The present embodiment provides a code analysis device, including: As shown in FIG7 , the code analysis device may have relatively large differences due to different configurations or performances, and may include one or more processors 701 and memory 702, and the memory 702 may store one or more storage applications or data. Among them, the memory 702 may be a temporary storage or a persistent storage. The application stored in the memory 702 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the code analysis device. Furthermore, the processor 701 may be configured to communicate with the memory 702 and execute a series of computer executable instructions in the memory 702 on the code analysis device. The code analysis device may also include one or more power supplies 703, one or more wired or wireless network interfaces 704, one or more input / output interfaces 705, one or more keyboards 706, etc.

[0123] In a specific embodiment, a code analysis device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer-executable instructions in the code analysis device, and the one or more programs are configured to be executed by one or more processors to include the following computer-executable instructions.

[0124] An analysis task for performing code analysis on a program code is obtained; based on a code structure type corresponding to the analysis task, a data table storing code structure data of the program code under the code structure type is determined in a relational database; code structure data and data structure relationships are read from the data table to obtain the code structure data and data structure relationships; the code structure data and the data structure relationships are analyzed and processed according to a code analysis method of the analysis task to obtain a code analysis result.

[0125] One or more embodiments of a storage medium provided in this specification are as follows.

[0126] Corresponding to the code analysis method described above, based on the same technical concept, one or more embodiments of this specification also provide a storage medium.

[0127] The storage medium provided in this embodiment is used to store computer-executable instructions, which implement the following process when executed by a processor: obtaining an analysis task for performing code analysis on a program code; determining, in a relational database, based on the code structure type corresponding to the analysis task, a data table storing code structure data of the program code under the code structure type; reading the code structure data and the data structure relationship from the data table to obtain the code structure data and the data structure relationship; analyzing and processing the code structure data and the data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result.

[0128] It should be noted that the embodiment of the storage medium in this specification and the embodiment of a code analysis method in this specification are based on the same inventive concept. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned corresponding method, and the repeated parts will not be repeated.

[0129] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. For example, the device embodiment, equipment embodiment and storage medium embodiment are similar to the method embodiment, so the description is relatively simple. To read the relevant content in the device embodiment, equipment embodiment and storage medium embodiment, please refer to the partial description of the method embodiment.

[0130] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0131] In the 1930s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0132] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the means for implementing various functions included therein can also be considered as structures within the hardware component. Or even, the means for implementing various functions can be considered as both a software module implementing the method and a structure within the hardware component.

[0133] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0134] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing the embodiments of this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0135] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as a method, system, or computer program product. Thus, one or more embodiments of this specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0137] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0138] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0139] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0140] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0141] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0142] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0143] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0144] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0145] The foregoing description is merely an example of the present invention and is not intended to limit the present invention. Persons skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be included within the scope of the claims herein.

Claims

1. A code analysis method, comprising: Obtaining an analysis task for code analysis of program code; Determining, in a relational database, a data table for storing code structure data of the program code under the code structure type corresponding to the analysis task; Reading code structure data and data structure relationships in the data table to obtain the code structure data and data structure relationships; Analyzing and processing the code structure data and the data structure relationships according to the code analysis method of the analysis task to obtain a code analysis result.

2. The code analysis method according to claim 1, wherein the number of the data tables is multiple; the field relationships in each of the multiple data tables are determined according to the field structure configuration of the code structure type; The table relationships of the multiple data tables are determined according to the code structure configuration of the code structure type.

3. The code analysis method according to claim 1, wherein the code structure data in the data table is written in the following manner: Reading multiple reference data tables under the code structure type; Reading code structure data in the program code and writing it into each of the reference data tables according to the data categories of the multiple reference data tables.

4. The code analysis method according to claim 3, wherein the multiple reference data tables are created in the following manner: Performing code extraction in the source program code according to the code structure type to obtain key program code; Extracting the code categories of each code segment in the key program code and creating the multiple reference data tables based on the code categories; Constructing the table relationships of the multiple reference data tables based on the segment structure relationships of the code segments in the source program code.

5. The code analysis method according to claim 4, wherein creating the multiple reference data tables based on the code categories includes: Performing duplicate removal processing on the code categories to obtain key code categories; Performing merging processing on the key code categories according to the syntax structure to obtain at least one data category, and creating reference data tables for each data category in the at least one data category.

6. The code analysis method according to claim 1, before the step of determining, in a relational database, a data table for storing code structure data of the program code under the code structure type corresponding to the analysis task, further comprising: Reading the reference data tables under each pre-created code structure type; Reading code structure data in the program code and writing it into the corresponding reference data tables based on the data categories of the reference data tables to obtain the data tables under each code structure type; Storing the data tables under each code structure type into the relational database.

7. The code analysis method according to claim 1, before the step of obtaining an analysis task for code analysis of program code, further comprising: Obtaining an analysis instruction for code analysis of the program code; Reading the analysis task carried in the analysis instruction and determining the code structure type corresponding to the analysis task; Write data to multiple benchmark data tables under the code structure type according to the program code, obtain the data table under the code structure type, and store the data table in the relational database.

8. The code analysis method according to claim 1, wherein the obtaining an analysis task for code analysis of a program code comprises: Obtaining instruction codes corresponding to interface call instructions for code analysis of the program code; The instruction codes are written in a first language; Performing code conversion on the instruction codes to obtain analysis instruction codes carrying the analysis task; The analysis instruction codes are in the form of a second language; Determining the analysis task based on the analysis instruction codes.

9. The code analysis method according to claim 1, if the code analysis method is a static analysis method, the analyzing and processing the code structure data and the data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result comprises: Reading a code analysis strategy corresponding to the analysis task; Based on the code analysis strategy, performing static code analysis on the code structure data and the data structure relationship to obtain a static code analysis result; Generating a code analysis result of the program code according to the static code analysis result.

10. The code analysis method according to claim 1, if the code analysis method is a dynamic analysis method, the analyzing and processing the code structure data and the data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result comprises: Performing code simulation operation based on the code structure data and the data structure relationship; Generating a code analysis result of the program code according to the operation result of the code simulation operation.

11. The code analysis method according to claim 1, if the analysis task is a call analysis task, the reading code structure data and data structure relationship in the data table to obtain the code structure data and the data structure relationship comprises: According to the call function identifier carried by the call analysis task, reading call data and called data in the function call data table of the program code under the function call type; Constructing a data call relationship between the call data and the called data according to the call relationship between the call data and the called data in the function call data table.

12. A code analysis device, comprising: An analysis task obtaining module, configured to obtain an analysis task for code analysis of a program code; A data table determining module, configured to determine, according to the code structure type corresponding to the analysis task, a data table storing code structure data of the program code under the code structure type in a relational database; A code structure data reading module, configured to read code structure data and data structure relationship in the data table to obtain the code structure data and the data structure relationship; An analysis processing module, configured to analyze and process the code structure data and the data structure relationship according to the code analysis method of the analysis task to obtain a code analysis result.

13. A code analysis device, comprising: a processor; and a memory configured to store computer-executable instructions, which when executed cause the processor to: obtain an analysis task for code analysis of program code; determine, in a relational database, a data table storing code structure data of the program code under the code structure type corresponding to the analysis task; read code structure data and data structure relationships in the data table to obtain the code structure data and the data structure relationships; perform analysis and processing on the code structure data and the data structure relationships according to the code analysis method of the analysis task to obtain a code analysis result.

14. A storage medium for storing computer-executable instructions, which when executed by a processor implement the following process: obtain an analysis task for code analysis of program code; determine, in a relational database, a data table storing code structure data of the program code under the code structure type corresponding to the analysis task; read code structure data and data structure relationships in the data table to obtain the code structure data and the data structure relationships; perform analysis and processing on the code structure data and the data structure relationships according to the code analysis method of the analysis task to obtain a code analysis result.

Images