The invention discloses a
Rust ecological CVE influence tracking method and
system based on reverse dependency propagation and function
call graph analysis. The method comprises the following steps: connecting a
crate.io structured
database by taking affected crates and version constraints as starting points, selecting a boundary version meeting a semantic version condition as an analysis source, downloading according to levels by adopting a breadth-first reverse dependency traversal strategy, and unpacking a dependency version in an isolated working area, a parent dependency is automatically injected in a local copy form, and an accurate version is locked through a dependency coverage mechanism of a configuration file, so that reproducibility and offline
robust analysis of a revoked version are ensured. The method also supports independent operation of CSV batch task
processing and statistics, and has automatic log separation and process-level result
traceability. According to the method, the supply chain
vulnerability propagation analysis complexity is reduced, and the reproducibility,
observability and performance of analysis are improved.