技术领域technical field
本发明涉及计算机技术领域，特别涉及一种快速定位安卓应用代码文件中的指定内容的方法和装置。The invention relates to the field of computer technology, in particular to a method and device for quickly locating specified content in an Android application code file.
背景技术Background technique
开发人员编写的代码文件往往还需要进行检查，经常需要定位到代码中的指定内容处。现有技术中往往通过代码的静态扫描等方式对代码进行遍历，这种方法速度慢，效率低，而且随着代码量的增大，遍历时间往往成指数型增长，非常不利于代码的检查，影响项目进度。Code files written by developers often need to be checked, and often need to be located at specified content in the code. In the prior art, the code is often traversed by means of static scanning of the code, which is slow and inefficient, and as the amount of code increases, the traversal time often increases exponentially, which is very unfavorable for code inspection. affect the progress of the project.
发明内容Contents of the invention
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至少部分地解决上述问题的快速定位安卓应用代码文件中的指定内容的方法和装置。In view of the above problems, the present invention is proposed to provide a method and device for quickly locating specified content in an Android application code file that overcomes the above problems or at least partially solves the above problems.
依据本发明的一个方面，提供了一种快速定位安卓应用代码文件中的指定内容的方法，包括：According to one aspect of the present invention, a method for quickly locating specified content in an Android application code file is provided, including:
获取待处理文件；Get pending files;
调用所述待处理文件的解析器解析文件内容，得到所述文件内容的抽象语法树；Invoking the parser of the file to be processed to parse the file content to obtain the abstract syntax tree of the file content;
对所述抽象语法树中的各节点进行分类，将类型相同的节点保存到对应的同一个节点集合中，得到类型不同的多个节点集合；Classifying each node in the abstract syntax tree, storing nodes of the same type in the corresponding same node set, and obtaining multiple node sets of different types;
确定待定位的指定内容的多个属性，根据该多个属性从所述多个节点集合中查找与所述指定内容对应的节点。Multiple attributes of the specified content to be located are determined, and a node corresponding to the specified content is searched from the multiple node sets according to the multiple attributes.
可选地，所述获取待处理文件包括：Optionally, said obtaining the file to be processed includes:
获取所述待处理文件的路径信息；Obtain the path information of the file to be processed;
根据所述待处理文件的路径信息，以多线程方式读取该路径下的所有文件。According to the path information of the file to be processed, all files under the path are read in a multi-threaded manner.
可选地，所述确定待定位的指定内容的多个属性包括：Optionally, the determining multiple attributes of the specified content to be located includes:
确定所述指定内容的分类属性；determining classification attributes of the specified content;
以及确定所述指定内容的一个或多个其他属性。and determining one or more other attributes of the specified content.
可选地，所述根据该多个属性从所述多个节点集合中查找与所述指定内容对应的节点包括：Optionally, the searching for nodes corresponding to the specified content from the multiple node sets according to the multiple attributes includes:
先根据所述指定内容的分类属性，确定与该分类属性对应的一个节点集合；First, according to the classification attribute of the specified content, determine a node set corresponding to the classification attribute;
从所述其他属性中选择一个属性，从所确定的节点集合中查找出与该属性匹配的节点；Select an attribute from the other attributes, and find a node matching the attribute from the determined node set;
判断所述一个或多个其他属性中是否存在未被选择的属性，如果存在则从查找的节点中进一步选出与该属性匹配的节点，直到所述的其他属性均被选择过一次。It is judged whether there is an unselected attribute in the one or more other attributes, and if there is, a node matching the attribute is further selected from the searched nodes until all the other attributes are selected once.
可选地，所述将类型相同的节点放入对应的同一个节点集合中，得到类型不同的多个节点集合进一步包括：Optionally, the step of putting nodes of the same type into the corresponding same node set to obtain multiple node sets of different types further includes:
将一个节点保存到对应的节点集合时，将该节点在所述抽象语法树中的路径信息一同保存。When saving a node to the corresponding node set, the path information of the node in the abstract syntax tree is saved together.
可选地，每种节点类型是根据JAVACC的一种语法规则确定的。Optionally, each node type is determined according to a syntax rule of JAVACC.
可选地，所述待处理文件为安卓源代码文件；Optionally, the file to be processed is an Android source code file;
所述指定内容为安卓源代码中具有安全漏洞的内容。The specified content is the content with security holes in the Android source code.
可选地，该方法进一步包括：Optionally, the method further includes:
根据预置的安全漏洞检测规则，确定待定位的指定内容和与指定内容对应的安全漏洞类型。According to the preset security vulnerability detection rules, the specified content to be located and the security vulnerability type corresponding to the specified content are determined.
可选地，所述待处理文件还包括：所述安卓源代码文件对应的安卓配置文件；Optionally, the file to be processed further includes: an Android configuration file corresponding to the Android source code file;
所述指定内容还包括：所述安卓配置文件中具有安全漏洞的内容；The specified content also includes: content with security holes in the Android configuration file;
其中，所述安全漏洞为组合型漏洞；Wherein, the security loophole is a combined loophole;
所述安全漏洞检测规则为：当所述安卓源代码中存在具有该安全漏洞的内容，且所述安卓配置文件中也存在具有该安全漏洞的内容时，确定所述安卓源代码和所述安卓配置文件中存在该安全漏洞。The security loophole detection rule is: when there is content with the security loophole in the Android source code, and there is also content with the security loophole in the Android configuration file, determine the source code of the Android source code and the Android security loophole. The security hole exists in the configuration file.
可选地，所述组合型漏洞为拒绝服务漏洞；Optionally, the combined vulnerability is a denial of service vulnerability;
所述安卓源代码中具有安全漏洞的内容为：onCreate函数中的Intent对象调用getXXXExtra()方法后缺少异常捕获方法；The content with security holes in the Android source code is: the Intent object in the onCreate function calls the getXXXExtra () method and lacks an exception capture method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的exported属性为true。The content with security holes in the Android configuration file is: the exported attribute of the activity component is true.
可选地，所述组合型漏洞为越级提权漏洞；Optionally, the combined vulnerability is a privilege escalation vulnerability;
所述安卓源代码中具有安全漏洞的内容为：activity类中的Intent对象调用parseUri()方法后缺少过滤方法；The contents with security holes in the Android source code are: the Intent object in the activity class lacks a filtering method after calling the parseUri () method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的scheme属性存在自定义协议。The content with security holes in the Android configuration file is: there is a custom protocol in the scheme attribute of the activity component.
依据本发明的另一方面，提供了一种快速定位安卓应用代码文件中的指定内容的装置，包括：According to another aspect of the present invention, a device for quickly locating specified content in an Android application code file is provided, including:
获取单元，适于获取待处理文件；an acquisition unit adapted to acquire the file to be processed;
解析单元，适于调用所述待处理文件的解析器解析文件内容，得到所述文件内容的抽象语法树；The parsing unit is adapted to call the parser of the file to be processed to parse the file content, and obtain the abstract syntax tree of the file content;
分类单元，适于对所述抽象语法树中的各节点进行分类，将类型相同的节点保存到对应的同一个节点集合中，得到类型不同的多个节点集合；The classification unit is adapted to classify each node in the abstract syntax tree, and save nodes of the same type in the corresponding same node set to obtain multiple node sets of different types;
定位单元，适于确定待定位的指定内容的多个属性，根据该多个属性从所述多个节点集合中查找与所述指定内容对应的节点。The locating unit is adapted to determine multiple attributes of the specified content to be located, and search for a node corresponding to the specified content from the multiple node sets according to the multiple attributes.
可选地，所述获取单元，适于获取所述待处理文件的路径信息；根据所述待处理文件的路径信息，以多线程方式读取该路径下的所有文件。Optionally, the obtaining unit is adapted to obtain path information of the file to be processed; read all files under the path in a multi-threaded manner according to the path information of the file to be processed.
可选地，所述定位单元，适于确定所述指定内容的分类属性；以及确定所述指定内容的一个或多个其他属性。Optionally, the locating unit is adapted to determine a classification attribute of the specified content; and determine one or more other attributes of the specified content.
可选地，所述定位单元，适于先根据所述指定内容的分类属性，确定与该分类属性对应的一个节点集合；从所述其他属性中选择一个属性，从所确定的节点集合中查找出与该属性匹配的节点；判断所述一个或多个其他属性中是否存在未被选择的属性，如果存在则从查找的节点中进一步选出与该属性匹配的节点，直到所述的其他属性均被选择过一次。Optionally, the locating unit is adapted to first determine a node set corresponding to the classification attribute according to the classification attribute of the specified content; select an attribute from the other attributes, and search for Find the node that matches the attribute; judge whether there is an unselected attribute in the one or more other attributes, and if there is, further select the node that matches the attribute from the searched nodes until the other attributes were selected once.
可选地，所述分类单元，适于将一个节点保存到对应的节点集合时，将该节点在所述抽象语法树中的路径信息一同保存。Optionally, the classifying unit is adapted to store path information of a node in the abstract syntax tree when storing a node in the corresponding node set.
可选地，每种节点类型是根据JAVACC的一种语法规则确定的。Optionally, each node type is determined according to a syntax rule of JAVACC.
可选地，所述待处理文件为安卓源代码文件；Optionally, the file to be processed is an Android source code file;
所述指定内容为安卓源代码中具有安全漏洞的内容。The specified content is the content with security holes in the Android source code.
可选地，所述定位单元，进一步适于根据预置的安全漏洞检测规则，确定待定位的指定内容和与指定内容对应的安全漏洞类型。Optionally, the locating unit is further adapted to determine the specified content to be located and the security hole type corresponding to the specified content according to preset security hole detection rules.
可选地，所述待处理文件还包括：所述安卓源代码文件对应的安卓配置文件；Optionally, the file to be processed further includes: an Android configuration file corresponding to the Android source code file;
所述指定内容还包括：所述安卓配置文件中具有安全漏洞的内容；The specified content also includes: content with security holes in the Android configuration file;
其中，所述安全漏洞为组合型漏洞；Wherein, the security loophole is a combined loophole;
所述安全漏洞检测规则为：当所述安卓源代码中存在具有该安全漏洞的内容，且所述安卓配置文件中也存在具有该安全漏洞的内容时，确定所述安卓源代码和所述安卓配置文件中存在该安全漏洞。The security loophole detection rule is: when there is content with the security loophole in the Android source code, and there is also content with the security loophole in the Android configuration file, determine the source code of the Android source code and the Android security loophole. The security hole exists in the configuration file.
可选地，所述组合型漏洞为拒绝服务漏洞；Optionally, the combined vulnerability is a denial of service vulnerability;
所述安卓源代码中具有安全漏洞的内容为：onCreate函数中的Intent对象调用getXXXExtra()方法后缺少异常捕获方法；The content with security holes in the Android source code is: the Intent object in the onCreate function calls the getXXXExtra () method and lacks an exception capture method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的exported属性为true。The content with security holes in the Android configuration file is: the exported attribute of the activity component is true.
可选地，所述组合型漏洞为越级提权漏洞；Optionally, the combined vulnerability is a privilege escalation vulnerability;
所述安卓源代码中具有安全漏洞的内容为：activity类中的Intent对象调用parseUri()方法后缺少过滤方法；The contents with security holes in the Android source code are: the Intent object in the activity class lacks a filtering method after calling the parseUri () method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的scheme属性存在自定义协议。The content with security holes in the Android configuration file is: there is a custom protocol in the scheme attribute of the activity component.
由上述可知，本发明的技术方案，将代码文件中的内容解析为抽象语法树结构，并根据其结构特性，对各节点进行分类，具体地，将同一类节点放入同一集合中，从而得到了类型不同的多个节点集合，当需要定位指定内容时，根据确定的指定内容的多个不同属性，从集合中查找与指定内容对应的节点。该技术方案通过对节点的分类大大降低了定位指定内容所需的时间，提升了代码检索效率。As can be seen from the above, the technical solution of the present invention parses the content in the code file into an abstract syntax tree structure, and classifies each node according to its structural characteristics, specifically, puts the same type of nodes into the same set, thereby obtaining A plurality of node sets of different types are obtained, and when the specified content needs to be located, according to the determined multiple different attributes of the specified content, the node corresponding to the specified content is searched from the set. The technical solution greatly reduces the time required for locating specified content by classifying nodes, and improves code retrieval efficiency.
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明的上述和其它目的、特征和优点能够更明显易懂，以下特举本发明的具体实施方式。The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.
附图说明Description of drawings
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处对于本领域普通技术人员将变得清楚明了。附图仅用于示出优选实施方式的目的，而并不认为是对本发明的限制。而且在整个附图中，用相同的参考符号表示相同的部件。在附图中：Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:
图1示出了根据本发明一个实施例的一种快速定位安卓应用代码文件中的指定内容的方法的流程图；Fig. 1 shows a flow chart of a method for quickly locating specified content in an Android application code file according to an embodiment of the present invention;
图2示出了根据本发明一个实施例的一种快速定位安卓应用代码文件中的指定内容的装置的结构示意图。Fig. 2 shows a schematic structural diagram of an apparatus for quickly locating specified content in an Android application code file according to an embodiment of the present invention.
具体实施方式Detailed ways
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
图1示出了根据本发明一个实施例的一种快速定位安卓应用代码文件中的指定内容的方法的流程图，如图1所示，该方法包括：Fig. 1 shows a flow chart of a method for quickly locating specified content in an Android application code file according to an embodiment of the present invention. As shown in Fig. 1, the method includes:
步骤S110，获取待处理文件。Step S110, acquiring the file to be processed.
步骤S120，调用待处理文件的解析器解析文件内容，得到文件内容的抽象语法树。Step S120, call the parser of the file to be processed to parse the file content, and obtain the abstract syntax tree of the file content.
其中，抽象语法树(abstract syntax tree，AST)是程序的一种中间表示形式，在程序分析等诸多领域有广泛的应用，例如，一段JAVA代码可以通JJTree(一种JAVA解析器)解析为抽象语法树。Among them, the abstract syntax tree (abstract syntax tree, AST) is an intermediate representation of the program, which is widely used in many fields such as program analysis. For example, a piece of JAVA code can be parsed into an abstract syntax tree.
解析产生的抽象语法树本身包含了多个节点，这些节点可以通过XML路径语言如Xpath进行定位。但是，在大型项目(如安卓系统级项目)中，许多文件级别较大的JAVA类经解析为抽象语法树后，其节点的级别较多，在使用Xpath进行定位时，需要遍历各层级上的节点，这样计算十分缓慢。The abstract syntax tree generated by parsing itself contains multiple nodes, and these nodes can be located by XML path language such as XPath. However, in large-scale projects (such as Android system-level projects), many JAVA classes with large file levels are parsed into abstract syntax trees, and their nodes have many levels. When using Xpath for positioning, it is necessary to traverse all levels. node, this calculation is very slow.
举例而言，在一个15万行的代码中，如果希望定位字符串变量String的初始化值不为Null的代码片段，由于该内容中仅包含了属性信息而不包含对象名称，因此采用Xpath定位的方式如下：For example, in a 150,000-line code, if you want to locate the code fragment whose initialization value of the string variable String is not Null, since the content only contains attribute information but not the object name, use XPath to locate The way is as follows:
遍历该代码文件中的所有节点，对每个节点，判断其是否为String型；若是，判断该String型的初始化值是否为Null；最终记录下满足条件的节点。经测试，以该方式进行内容定位需要60分钟的时间，这是开发人员不希望接受的。Traverse all the nodes in the code file, and for each node, judge whether it is a String type; if so, judge whether the initialization value of the String type is Null; finally record the nodes that meet the conditions. After testing, it takes 60 minutes to locate the content in this way, which is not expected by the developer.
因此在本实施例中，还需采取以下步骤：Therefore in this embodiment, also need to take the following steps:
步骤S130，对抽象语法树中的各节点进行分类，将类型相同的节点保存到对应的同一个节点集合中，得到类型不同的多个节点集合。Step S130, classify each node in the abstract syntax tree, save the nodes of the same type in the corresponding same node set, and obtain multiple node sets of different types.
步骤S140，确定待定位的指定内容的多个属性，根据该多个属性从多个节点集合中查找与指定内容对应的节点。In step S140, multiple attributes of the specified content to be located are determined, and a node corresponding to the specified content is searched from multiple node sets according to the multiple attributes.
可见，图1所示的方法，通过将代码文件中的内容解析为抽象语法树结构，并根据其结构特性，对各节点进行分类，具体地，将同一类节点放入同一集合中，从而得到了类型不同的多个节点集合，当需要定位指定内容时，根据确定的指定内容的多个不同属性，从集合中查找与指定内容对应的节点。该技术方案通过对节点的分类大大降低了定位指定内容所需的时间，提升了代码检索效率。It can be seen that the method shown in Figure 1 parses the content in the code file into an abstract syntax tree structure, and classifies each node according to its structural characteristics, specifically, puts the same type of nodes into the same set, so as to obtain A plurality of node sets of different types are obtained, and when the specified content needs to be located, according to the determined multiple different attributes of the specified content, the node corresponding to the specified content is searched from the set. The technical solution greatly reduces the time required for locating specified content by classifying nodes, and improves code retrieval efficiency.
在本发明的一个实施例中，图1所示的方法中，获取待处理文件包括：获取待处理文件的路径信息；根据待处理文件的路径信息，以多线程方式读取该路径下的所有文件。In one embodiment of the present invention, in the method shown in Fig. 1, obtaining the file to be processed comprises: obtaining the path information of the file to be processed; according to the path information of the file to be processed, read all document.
例如，开发人员将代码存放在代码服务器中，当获取待处理文件时，还可以获取开发人员登录代码服务器的认证信息，再根据输入的路径信息，读取该路径下的所有文件，并进一步将其解析为抽象语法树，放入内存中。For example, the developer stores the code in the code server. When obtaining the file to be processed, the developer can also obtain the authentication information for logging in to the code server, and then read all the files under the path according to the input path information, and further upload the It is parsed into an abstract syntax tree and placed in memory.
在本发明的一个实施例中，图1所示的方法中，确定待定位的指定内容的多个属性包括：确定指定内容的分类属性；以及确定指定内容的一个或多个其他属性。In one embodiment of the present invention, in the method shown in FIG. 1 , determining multiple attributes of the specified content to be located includes: determining a classification attribute of the specified content; and determining one or more other attributes of the specified content.
以前文提及的情景为例，如果希望定位字符串变量String的初始化值不为Null的代码片段，那么根据字符串变量String的属性，可以判断其位于哪个节点集合中。在一实施例中，根据该多个属性从多个节点集合中查找与指定内容对应的节点包括：先根据指定内容的分类属性，确定与该分类属性对应的一个节点集合；从其他属性中选择一个属性，从所确定的节点集合中查找出与该属性匹配的节点；判断一个或多个其他属性中是否存在未被选择的属性，如果存在则从查找的节点中进一步选出与该属性匹配的节点，直到的其他属性均被选择过一次。在本例中，由于确定了字符串变量String为本地变量，又根据节点集合的类型得知，LocalVariableDeclaration集合中存放的都是本地变量，因此确定该集合为目标集合，即根据指定内容中的分类属性确定了与该分类属性对应的集合，在该集合中进行遍历。由于该集合中的节点不仅包含字符串变量，还包含整型变量等，这些属性是由ClassOrInterfaceType的值确定的，因此对该集合中的所有节点，判断其ClassOrInterfaceType是否为String。而目标代码片段是字符串变量String的初始化值不为Null的代码片段，因此在得到的节点中进一步筛选出value为Null的，最终得到了目标节点。Taking the scenario mentioned above as an example, if you want to locate the code fragment whose initial value of the string variable String is not Null, you can determine which node set it is located in according to the properties of the string variable String. In one embodiment, searching for a node corresponding to the specified content from multiple node sets according to the multiple attributes includes: first determining a node set corresponding to the category attribute according to the category attribute of the specified content; selecting from other attributes An attribute, find the node that matches the attribute from the determined node set; judge whether there is an unselected attribute in one or more other attributes, and if it exists, further select the node that matches the attribute from the searched nodes The nodes of , until the other attributes of , have been selected once. In this example, since the string variable String is determined to be a local variable, and according to the type of the node collection, all local variables are stored in the LocalVariableDeclaration collection, so this collection is determined to be the target collection, that is, according to the classification in the specified content The attribute determines the collection corresponding to the classification attribute, and traverses in the collection. Since the nodes in this collection not only contain string variables, but also integer variables, etc., these attributes are determined by the value of ClassOrInterfaceType, so for all the nodes in the collection, judge whether their ClassOrInterfaceType is String. The target code fragment is a code fragment in which the initialization value of the string variable String is not Null, so the obtained nodes are further screened out to have a value of Null, and finally the target node is obtained.
在本发明的一个实施例中，上述方法中，每种节点类型是根据JAVACC的一种语法规则确定的。JAVACC是一种用JAVA开发的受欢迎的语法分析生成器，可以读取上下文无关且有着特殊意义的语法并把它转换成可以识别且匹配该语法的JAVA程序，也可以作为本发明实施例中的待处理文件的解析器进行调用。例如，前文述及的LocalVariableDeclaration集合就是与JAVACC所用的一种语法规则相对应的。In an embodiment of the present invention, in the above method, each node type is determined according to a syntax rule of JAVACC. JAVACC is a popular grammar analysis generator developed by JAVA, which can read context-independent grammar with special meaning and convert it into a JAVA program that can recognize and match the grammar, and can also be used as The parser for the pending file is invoked. For example, the LocalVariableDeclaration collection mentioned above corresponds to a grammatical rule used by JAVACC.
在本发明的一个实施例中，图1所示的方法中，将类型相同的节点放入对应的同一个节点集合中，得到类型不同的多个节点集合进一步包括：将一个节点保存到对应的节点集合时，将该节点在抽象语法树中的路径信息一同保存。In one embodiment of the present invention, in the method shown in FIG. 1, putting nodes of the same type into the corresponding same node set, obtaining multiple node sets of different types further includes: saving a node to the corresponding When a node is assembled, the path information of the node in the abstract syntax tree is saved together.
因此在根据指定内容的多个属性从多个节点集合中查找与指定内容对应的节点后，就可以根据路径信息定位其在代码文件中的位置。Therefore, after finding the node corresponding to the specified content from multiple node sets according to the multiple attributes of the specified content, its position in the code file can be located according to the path information.
在本发明的一个实施例中，上述方法中，待处理文件为安卓源代码文件；指定内容为安卓源代码中具有安全漏洞的内容。In one embodiment of the present invention, in the above method, the file to be processed is an Android source code file; the specified content is the content with security holes in the Android source code.
依然以字符串变量String的初始化值不为Null的代码片段为例，由于在JAVA中，空对象是指定义一个对象s，但是没有给该对象分配空间，即没有实例化该对象，因此，空对象在调用所有对象方法时候都会抛出异常，如s.length(),，s.isEmpty()等方法。可见，该指定内容就是具有安全漏洞的内容，在本实施例中定位指定内容有助于开发人员检测代码文件中的安全漏洞，效率较高。Still take the code fragment whose initialization value of the string variable String is not Null as an example, because in JAVA, an empty object refers to the definition of an object s, but no space is allocated to the object, that is, the object is not instantiated, so the empty The object will throw an exception when calling all object methods, such as s.length(), s.isEmpty() and other methods. It can be seen that the specified content is the content with security loopholes, and locating the specified content in this embodiment helps developers detect security loopholes in code files, and the efficiency is high.
在本发明的一个实施例中，上述方法进一步包括：根据预置的安全漏洞检测规则，确定待定位的指定内容和与指定内容对应的安全漏洞类型。在前述例子中，字符串变量String的初始化值不为Null的指定内容就对应一种安全漏洞类型。In an embodiment of the present invention, the above method further includes: determining the specified content to be located and the security hole type corresponding to the specified content according to the preset security hole detection rules. In the foregoing example, the specified content whose initialization value of the string variable String is not Null corresponds to a type of security vulnerability.
但是在很多情况下，仅凭安卓源代码文件不能确定安全漏洞的存在，在源代码中可能存在的问题由于在安卓配置文件中进行了合理配置而使得问题不复存在。因此在本发明的一个实施例中，待处理文件还包括：安卓源代码文件对应的安卓配置文件；指定内容还包括：安卓配置文件中具有安全漏洞的内容；其中，安全漏洞为组合型漏洞；安全漏洞检测规则为：当安卓源代码中存在具有该安全漏洞的内容，且安卓配置文件中也存在具有该安全漏洞的内容时，确定安卓源代码和安卓配置文件中存在该安全漏洞。However, in many cases, the existence of a security hole cannot be determined only by the Android source code file, and the possible problems in the source code are eliminated due to reasonable configuration in the Android configuration file. Therefore in one embodiment of the present invention, the file to be processed also includes: the Android configuration file corresponding to the Android source code file; the specified content also includes: the content with security holes in the Android configuration file; wherein, the security hole is a combined type hole; The security hole detection rule is: when there is content with the security hole in the Android source code and there is content with the security hole in the Android configuration file, it is determined that the security hole exists in the Android source code and the Android configuration file.
下面给出了三种具体安全漏洞的示例：Examples of three specific security vulnerabilities are given below:
示例一：组合型漏洞为拒绝服务漏洞；安卓源代码中具有安全漏洞的内容为：onCreate函数中的Intent对象调用getXXXExtra()方法后缺少异常捕获方法；安卓配置文件中具有安全漏洞的内容为：activity组件的exported属性为true。Example 1: The combined vulnerability is a denial of service vulnerability; the security vulnerability in the Android source code is: the Intent object in the onCreate function lacks an exception capture method after calling the getXXXExtra() method; the security vulnerability in the Android configuration file is: The exported property of the activity component is true.
AndroidAPP通用型拒绝服务漏洞为：当APP中使用了getXXXExtra的API时，由于应用开发者没有对传入的数据做异常判断，恶意应用可以通过传入畸形数据导致应用本地拒绝服务，但是若存在拒绝服务漏洞，须同时满足上述两个条件。因为即使安卓onCreate函数中的Intent对象在调用getXXXExtra()方法后没有加上try…catch等异常捕获方法，但安卓配置文件AndroidManifest.xml文件将activity组件设置为不可导出的，即exported属性是否为false也可以避免该问题。The AndroidAPP general denial of service vulnerability is: when the APP uses the getXXXExtra API, because the application developer does not make abnormal judgments on the incoming data, a malicious application can cause the local application to deny service by passing in malformed data, but if there is a denial of service Service vulnerabilities must meet the above two conditions at the same time. Because even if the Intent object in the Android onCreate function does not add exception capture methods such as try...catch after calling the getXXXExtra() method, the Android configuration file AndroidManifest.xml sets the activity component as non-exportable, that is, whether the exported attribute is false This problem can also be avoided.
安卓源代码中具有安全漏洞的内容，即安卓onCreate方法代码片段的示例如下：An example of the code fragment of the Android onCreate method that has a security vulnerability in the Android source code is as follows:
Intent i＝getIntent()；Intent i = getIntent();
if(i.getAction().equals("syourdata")){if(i.getAction().equals("syourdata")){
intent.putExtra("data1","yourdata")；//未做异常判断intent.putExtra("data1","yourdata");//No exception judgment
}}
安卓配置文件中具有安全漏洞的内容，即activity组件的exported属性示例如下：An example of the content with security holes in the Android configuration file, that is, the exported attribute of the activity component is as follows:
<activity android:name＝".activity.DemoActivity"<activity android:name=".activity.DemoActivity"
android:theme＝"″android:theme=""
android:exported＝"true">//此处设置为可导出android:exported="true">//Set as exportable here
<intent-filter><intent-filter>
<action android:name＝"com.test.haosou.activity.DemoActivity"/><action android:name="com.test.haosou.activity.DemoActivity"/>
<category android:name＝"android.intent.category.DEFAULT"/><category android:name="android.intent.category.DEFAULT"/>
</intent-filter></intent-filter>
</activity></activity>
其中，安卓配置文件AndroidManifest.xml由于具有节点结构，也可以使用前述实施例中的方法进行节点的查找。Wherein, since the Android configuration file AndroidManifest.xml has a node structure, the method in the foregoing embodiments may also be used to search for nodes.
示例二：组合型漏洞为越级提权漏洞；Example 2: The combined vulnerability is a privilege escalation vulnerability;
安卓源代码中具有安全漏洞的内容为：activity类中的Intent对象调用parseUri()方法后缺少过滤方法；安卓配置文件中具有安全漏洞的内容为：activity组件的scheme属性存在自定义协议。The content with security holes in the Android source code is: the Intent object in the activity class lacks a filtering method after calling the parseUri() method; the content with security holes in the Android configuration file is: there is a custom protocol in the scheme attribute of the activity component.
当同时满足上述条件时，恶意代码可以越级提升权限进行攻击。When the above conditions are met at the same time, malicious code can leapfrog privileges to attack.
安卓源代码中具有安全漏洞的内容，即activity类中的Intent对象调用parseUri()方法后缺少过滤方法的代码片段的示例如下：An example of a code fragment that lacks a filtering method after the Intent object in the activity class calls the parseUri() method is as follows:
Uri uri＝getIntent().getData()；Uri uri = getIntent().getData();
Intent intent＝Intent.parseUri(uri)；//捕获这段代码Intent intent=Intent.parseUri(uri);//capture this code
startActivity(intent)；startActivity(intent);
安卓配置文件中具有安全漏洞的内容，即activity组件的scheme属性存在自定义协议示例如下：The content with security holes in the Android configuration file, that is, the scheme attribute of the activity component has a custom protocol example as follows:
示例三：组合型漏洞为Fragment注入漏洞；Example 3: The combined vulnerability is a Fragment injection vulnerability;
安卓源代码中具有安全漏洞的内容为：activity组件继承PreferenceActivity，且该activity组件中未重写PreferenceActivity.isValidFragment方法；安卓配置文件中具有安全漏洞的内容为：activity组件的exported属性为true。The content with security holes in the Android source code is: the activity component inherits PreferenceActivity, and the PreferenceActivity.isValidFragment method is not rewritten in the activity component; the content with security holes in the Android configuration file is: the exported attribute of the activity component is true.
在本发明的一个实施例中，上述方法中，待处理文件为安卓源代码文件对应的安卓配置文件。下面给出了一种安卓配置文件AndroidManifest.xml中存在安全漏洞的示例，需要对应在安卓配置文件中进行定位。In one embodiment of the present invention, in the above method, the file to be processed is an Android configuration file corresponding to an Android source code file. The following is an example of a security vulnerability in the Android configuration file AndroidManifest.xml, which needs to be located in the Android configuration file.
AndroidManifest.xml中显式设置android:debuggable＝"true"时，应用程序可被调试，方便开发人员进行调试，但在APK正式打包发布时，如果未将设置更改为android:debuggable＝"false"或将android:debuggable＝"true"配置去掉，则其他获取到该APK的人也可以执行调试，因此存在可被Debug漏洞。When android:debuggable="true" is explicitly set in AndroidManifest.xml, the application can be debugged, which is convenient for developers to debug. However, when the APK is officially packaged and released, if the setting is not changed to android:debuggable="false" or If the android:debuggable="true" configuration is removed, other people who have obtained the APK can also perform debugging, so there is a vulnerability that can be debugged.
图2示出了一种快速定位安卓应用代码文件中的指定内容的装置的结构示意图，如图2所示，快速定位安卓应用代码文件中的指定内容的装置200包括：Fig. 2 shows a schematic structural diagram of a device for quickly locating specified content in an Android application code file. As shown in Fig. 2 , the device 200 for quickly locating specified content in an Android application code file includes:
获取单元210，适于获取待处理文件。The obtaining unit 210 is adapted to obtain the file to be processed.
解析单元220，适于调用待处理文件的解析器解析文件内容，得到文件内容的抽象语法树。The parsing unit 220 is adapted to call a parser of the file to be processed to parse the file content to obtain an abstract syntax tree of the file content.
分类单元230，适于对抽象语法树中的各节点进行分类，将类型相同的节点保存到对应的同一个节点集合中，得到类型不同的多个节点集合。The classification unit 230 is adapted to classify each node in the abstract syntax tree, and save nodes of the same type in the corresponding same node set to obtain multiple node sets of different types.
定位单元240，适于确定待定位的指定内容的多个属性，根据该多个属性从多个节点集合中查找与指定内容对应的节点。The positioning unit 240 is adapted to determine multiple attributes of the specified content to be located, and search for a node corresponding to the specified content from multiple node sets according to the multiple attributes.
可见，图2所示的装置，通过各单元的相互配合，将代码文件中的内容解析为抽象语法树结构，并根据其结构特性，对各节点进行分类，具体地，将同一类节点放入同一集合中，从而得到了类型不同的多个节点集合，当需要定位指定内容时，根据确定的指定内容的多个不同属性，从集合中查找与指定内容对应的节点。该技术方案通过对节点的分类大大降低了定位指定内容所需的时间，提升了代码检索效率。It can be seen that the device shown in Figure 2, through the mutual cooperation of each unit, parses the content in the code file into an abstract syntax tree structure, and classifies each node according to its structural characteristics, specifically, puts the same type of nodes into In the same set, multiple node sets of different types are thus obtained. When the specified content needs to be located, the node corresponding to the specified content is searched from the set according to the determined multiple different attributes of the specified content. The technical solution greatly reduces the time required for locating specified content by classifying nodes, and improves code retrieval efficiency.
在本发明的一个实施例中，上述装置中，获取单元210，适于获取待处理文件的路径信息；根据待处理文件的路径信息，以多线程方式读取该路径下的所有文件。In an embodiment of the present invention, in the above device, the obtaining unit 210 is adapted to obtain path information of the file to be processed; read all files under the path in a multi-threaded manner according to the path information of the file to be processed.
在本发明的一个实施例中，上述装置中，定位单元240，适于确定指定内容的分类属性；以及确定指定内容的一个或多个其他属性。In an embodiment of the present invention, in the above device, the locating unit 240 is adapted to determine the classification attribute of the specified content; and determine one or more other attributes of the specified content.
在本发明的一个实施例中，上述装置中，定位单元240，适于先根据指定内容的分类属性，确定与该分类属性对应的一个节点集合；从其他属性中选择一个属性，从所确定的节点集合中查找出与该属性匹配的节点；判断一个或多个其他属性中是否存在未被选择的属性，如果存在则从查找的节点中进一步选出与该属性匹配的节点，直到的其他属性均被选择过一次。In one embodiment of the present invention, in the above device, the positioning unit 240 is adapted to first determine a node set corresponding to the classification attribute according to the classification attribute of the specified content; select an attribute from other attributes, and select an attribute from the determined Find the node that matches the attribute in the node set; judge whether there is an unselected attribute in one or more other attributes, and if it exists, further select the node that matches the attribute from the searched nodes until other attributes were selected once.
在本发明的一个实施例中，上述装置中，分类单元230，适于将一个节点保存到对应的节点集合时，将该节点在抽象语法树中的路径信息一同保存。In an embodiment of the present invention, in the above device, the classification unit 230 is adapted to save the path information of the node in the abstract syntax tree when saving a node in the corresponding node set.
在本发明的一个实施例中，上述装置中，每种节点类型是根据JAVACC的一种语法规则确定的。In an embodiment of the present invention, in the above apparatus, each node type is determined according to a syntax rule of JAVACC.
在本发明的一个实施例中，上述装置中，待处理文件为安卓源代码文件；指定内容为安卓源代码中具有安全漏洞的内容。In an embodiment of the present invention, in the above-mentioned device, the file to be processed is an Android source code file; the specified content is the content with security holes in the Android source code.
在本发明的一个实施例中，上述装置中，定位单元240，进一步适于根据预置的安全漏洞检测规则，确定待定位的指定内容和与指定内容对应的安全漏洞类型。In an embodiment of the present invention, in the above device, the locating unit 240 is further adapted to determine the specified content to be located and the security hole type corresponding to the specified content according to the preset security hole detection rules.
在本发明的一个实施例中，上述装置中，待处理文件还包括：安卓源代码文件对应的安卓配置文件；指定内容还包括：安卓配置文件中具有安全漏洞的内容；其中，安全漏洞为组合型漏洞；安全漏洞检测规则为：当安卓源代码中存在具有该安全漏洞的内容，且安卓配置文件中也存在具有该安全漏洞的内容时，确定安卓源代码和安卓配置文件中存在该安全漏洞。In one embodiment of the present invention, in the above-mentioned device, the file to be processed further includes: an Android configuration file corresponding to the Android source code file; the specified content also includes: content with a security loophole in the Android configuration file; wherein, the security loophole is a combination type vulnerability; the security vulnerability detection rule is: when there is content with the security vulnerability in the Android source code and there is content with the security vulnerability in the Android configuration file, it is determined that the security vulnerability exists in the Android source code and the Android configuration file .
在本发明的一个实施例中，上述装置中，组合型漏洞为拒绝服务漏洞；安卓源代码中具有安全漏洞的内容为：onCreate函数中的Intent对象调用getXXXExtra()方法后缺少异常捕获方法；安卓配置文件中具有安全漏洞的内容为：activity组件的exported属性为true。In one embodiment of the present invention, in the above-mentioned device, the combined vulnerability is a denial of service vulnerability; the content of the security vulnerability in the Android source code is: the Intent object in the onCreate function calls the getXXXExtra () method and lacks an exception capture method; The content with security holes in the configuration file is: the exported attribute of the activity component is true.
在本发明的一个实施例中，上述装置中，组合型漏洞为越级提权漏洞；安卓源代码中具有安全漏洞的内容为：activity类中的Intent对象调用parseUri()方法后缺少过滤方法；安卓配置文件中具有安全漏洞的内容为：activity组件的scheme属性存在自定义协议。In one embodiment of the present invention, in the above-mentioned device, the combination type vulnerability is a leapfrog privilege escalation vulnerability; the content of the security vulnerability in the Android source code is: the Intent object in the activity class lacks a filtering method after calling the parseUri () method; The content with security holes in the configuration file is: there is a custom protocol in the scheme attribute of the activity component.
需要说明是，上述各装置实施例的具体实施方式与前述对应方法实施例的具体实施方式相同，在此不再赘述。It should be noted that the specific implementation manners of the foregoing apparatus embodiments are the same as the specific implementation manners of the foregoing corresponding method embodiments, and will not be repeated here.
综上所述，本发明的技术方案，通过将代码文件中的内容解析为抽象语法树结构，并根据其结构特性，对各节点进行分类，具体地，将同一类节点放入同一集合中，从而得到了类型不同的多个节点集合，当需要定位指定内容时，根据确定的指定内容的多个不同属性，从集合中查找与指定内容对应的节点。该技术方案通过对节点的分类大大降低了定位指定内容所需的时间，提升了代码检索效率。当指定内容为安卓代码漏洞时，可以帮助开发人员快速对代码进行排查，安全漏洞的检测效率得到了极大提升。In summary, the technical solution of the present invention parses the content in the code file into an abstract syntax tree structure, and classifies each node according to its structural characteristics, specifically, puts the same type of nodes into the same set, Thus, a plurality of node sets of different types are obtained, and when the specified content needs to be located, the node corresponding to the specified content is searched from the set according to the determined multiple different attributes of the specified content. The technical solution greatly reduces the time required for locating specified content by classifying nodes, and improves code retrieval efficiency. When the specified content is an Android code vulnerability, it can help developers quickly check the code, and the detection efficiency of security vulnerabilities has been greatly improved.
以上所述仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。凡在本发明的精神和原则之内所作的任何修改、等同替换、改进等，均包含在本发明的保护范围内。The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present invention are included in the protection scope of the present invention.
需要说明的是：It should be noted:
在此提供的算法和显示不与任何特定计算机、虚拟装置或者其它设备固有相关。各种通用装置也可以与基于在此的示教一起使用。根据上面的描述，构造这类装置所要求的结构是显而易见的。此外，本发明也不针对任何特定编程语言。应当明白，可以利用各种编程语言实现在此描述的本发明的内容，并且上面对特定语言所做的描述是为了披露本发明的最佳实施方式。The algorithms and displays presented herein are not inherently related to any particular computer, virtual appliance, or other device. Various general purpose devices can also be used with the teachings based on this. The structure required to construct such an apparatus will be apparent from the foregoing description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的的替代特征来代替。Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的快速定位安卓应用代码文件中的指定内容的装置中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement some or all of the components in the device for quickly locating specified content in an Android application code file according to an embodiment of the present invention some or all of the features. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.
应该注意的是上述实施例对本发明进行说明而不是对本发明进行限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可设计出替换实施例。在权利要求中，不应将位于括号之间的任何参考符号构造成对权利要求的限制。单词“包含”不排除存在未列在权利要求中的元件或步骤。位于元件之前的单词“一”或“一个”不排除存在多个这样的元件。本发明可以借助于包括有若干不同元件的硬件以及借助于适当编程的计算机来实现。在列举了若干装置的单元权利要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。单词第一、第二、以及第三等的使用不表示任何顺序。可将这些单词解释为名称。It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.
本发明的实施例公开了A1、一种快速定位安卓应用代码文件中的指定内容的方法，其中，该方法包括：Embodiments of the present invention disclose A1, a method for quickly locating specified content in an Android application code file, wherein the method includes:
获取待处理文件；Get pending files;
调用所述待处理文件的解析器解析文件内容，得到所述文件内容的抽象语法树；Invoking the parser of the file to be processed to parse the file content to obtain the abstract syntax tree of the file content;
对所述抽象语法树中的各节点进行分类，将类型相同的节点保存到对应的同一个节点集合中，得到类型不同的多个节点集合；Classifying each node in the abstract syntax tree, storing nodes of the same type in the corresponding same node set, and obtaining multiple node sets of different types;
确定待定位的指定内容的多个属性，根据该多个属性从所述多个节点集合中查找与所述指定内容对应的节点。Multiple attributes of the specified content to be located are determined, and a node corresponding to the specified content is searched from the multiple node sets according to the multiple attributes.
A2、如A1所述的方法，其中，所述获取待处理文件包括：A2. The method as described in A1, wherein said obtaining the file to be processed comprises:
获取所述待处理文件的路径信息；Obtain the path information of the file to be processed;
根据所述待处理文件的路径信息，以多线程方式读取该路径下的所有文件。According to the path information of the file to be processed, all files under the path are read in a multi-threaded manner.
A3、如A1所述的方法，其中，所述确定待定位的指定内容的多个属性包括：A3. The method as described in A1, wherein said determining multiple attributes of the specified content to be located includes:
确定所述指定内容的分类属性；determining classification attributes of the specified content;
以及确定所述指定内容的一个或多个其他属性。and determining one or more other attributes of the specified content.
A4、如A3所述的方法，其中，所述根据该多个属性从所述多个节点集合中查找与所述指定内容对应的节点包括：A4. The method as described in A3, wherein the searching for a node corresponding to the specified content from the plurality of node sets according to the plurality of attributes includes:
先根据所述指定内容的分类属性，确定与该分类属性对应的一个节点集合；First, according to the classification attribute of the specified content, determine a node set corresponding to the classification attribute;
从所述其他属性中选择一个属性，从所确定的节点集合中查找出与该属性匹配的节点；Select an attribute from the other attributes, and find a node matching the attribute from the determined node set;
判断所述一个或多个其他属性中是否存在未被选择的属性，如果存在则从查找的节点中进一步选出与该属性匹配的节点，直到所述的其他属性均被选择过一次。It is judged whether there is an unselected attribute in the one or more other attributes, and if there is, a node matching the attribute is further selected from the searched nodes until all the other attributes are selected once.
A5、如A1所述的方法，其中，所述将类型相同的节点放入对应的同一个节点集合中，得到类型不同的多个节点集合进一步包括：A5. The method as described in A1, wherein said putting nodes of the same type into the corresponding same node set to obtain multiple node sets of different types further includes:
将一个节点保存到对应的节点集合时，将该节点在所述抽象语法树中的路径信息一同保存。When saving a node to the corresponding node set, the path information of the node in the abstract syntax tree is saved together.
A6、如A1所述的方法，其中，A6. The method as described in A1, wherein,
每种节点类型是根据JAVACC的一种语法规则确定的。Each node type is determined according to a syntax rule of JAVACC.
A7、如A1-A6中任一项所述的方法，其中，A7. The method of any one of A1-A6, wherein,
所述待处理文件为安卓源代码文件；The file to be processed is an Android source code file;
所述指定内容为安卓源代码中具有安全漏洞的内容。The specified content is the content with security holes in the Android source code.
A8、如A7所述的方法，其中，该方法进一步包括：A8. The method as described in A7, wherein the method further comprises:
根据预置的安全漏洞检测规则，确定待定位的指定内容和与指定内容对应的安全漏洞类型。According to the preset security vulnerability detection rules, the specified content to be located and the security vulnerability type corresponding to the specified content are determined.
A9、如A8所述的方法，其中，A9. The method as described in A8, wherein,
所述待处理文件还包括：所述安卓源代码文件对应的安卓配置文件；The file to be processed also includes: the Android configuration file corresponding to the Android source code file;
所述指定内容还包括：所述安卓配置文件中具有安全漏洞的内容；The specified content also includes: content with security holes in the Android configuration file;
其中，所述安全漏洞为组合型漏洞；Wherein, the security loophole is a combined loophole;
所述安全漏洞检测规则为：当所述安卓源代码中存在具有该安全漏洞的内容，且所述安卓配置文件中也存在具有该安全漏洞的内容时，确定所述安卓源代码和所述安卓配置文件中存在该安全漏洞。The security loophole detection rule is: when there is content with the security loophole in the Android source code, and there is also content with the security loophole in the Android configuration file, determine the source code of the Android source code and the Android security loophole. The security hole exists in the configuration file.
A10、如A9所述的方法，其中，A10, the method as described in A9, wherein,
所述组合型漏洞为拒绝服务漏洞；The combined vulnerability is a denial of service vulnerability;
所述安卓源代码中具有安全漏洞的内容为：onCreate函数中的Intent对象调用getXXXExtra()方法后缺少异常捕获方法；The content with security holes in the Android source code is: the Intent object in the onCreate function calls the getXXXExtra () method and lacks an exception capture method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的exported属性为true。The content with security holes in the Android configuration file is: the exported attribute of the activity component is true.
A11、如A9所述的方法，其中。A11. The method as described in A9, wherein.
所述组合型漏洞为越级提权漏洞；The combined vulnerability is a privilege escalation vulnerability;
所述安卓源代码中具有安全漏洞的内容为：activity类中的Intent对象调用parseUri()方法后缺少过滤方法；The contents with security holes in the Android source code are: the Intent object in the activity class lacks a filtering method after calling the parseUri () method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的scheme属性存在自定义协议。The content with security holes in the Android configuration file is: there is a custom protocol in the scheme attribute of the activity component.
本发明的实施例还公开了B12、一种快速定位安卓应用代码文件中的指定内容的装置，其中，该装置包括：The embodiment of the present invention also discloses B12, a device for quickly locating specified content in an Android application code file, wherein the device includes:
获取单元，适于获取待处理文件；an acquisition unit adapted to acquire the file to be processed;
解析单元，适于调用所述待处理文件的解析器解析文件内容，得到所述文件内容的抽象语法树；The parsing unit is adapted to call the parser of the file to be processed to parse the file content, and obtain the abstract syntax tree of the file content;
分类单元，适于对所述抽象语法树中的各节点进行分类，将类型相同的节点保存到对应的同一个节点集合中，得到类型不同的多个节点集合；The classification unit is adapted to classify each node in the abstract syntax tree, and save nodes of the same type in the corresponding same node set to obtain multiple node sets of different types;
定位单元，适于确定待定位的指定内容的多个属性，根据该多个属性从所述多个节点集合中查找与所述指定内容对应的节点。The locating unit is adapted to determine multiple attributes of the specified content to be located, and search for a node corresponding to the specified content from the multiple node sets according to the multiple attributes.
B13、如B12所述的装置，其中，B13. The device of B12, wherein,
所述获取单元，适于获取所述待处理文件的路径信息；根据所述待处理文件的路径信息，以多线程方式读取该路径下的所有文件。The obtaining unit is adapted to obtain path information of the file to be processed; read all files under the path in a multi-threaded manner according to the path information of the file to be processed.
B14、如B12所述的装置，其中，B14. The device of B12, wherein,
所述定位单元，适于确定所述指定内容的分类属性；以及确定所述指定内容的一个或多个其他属性。The locating unit is adapted to determine a classification attribute of the specified content; and determine one or more other attributes of the specified content.
B15、如B14所述的装置，其中，B15. The device of B14, wherein,
所述定位单元，适于先根据所述指定内容的分类属性，确定与该分类属性对应的一个节点集合；从所述其他属性中选择一个属性，从所确定的节点集合中查找出与该属性匹配的节点；判断所述一个或多个其他属性中是否存在未被选择的属性，如果存在则从查找的节点中进一步选出与该属性匹配的节点，直到所述的其他属性均被选择过一次。The locating unit is adapted to first determine a node set corresponding to the category attribute according to the category attribute of the specified content; select an attribute from the other attributes, and find out the node set corresponding to the attribute from the determined node set Matching node; determine whether there is an unselected attribute in the one or more other attributes, and if there is, further select a node that matches the attribute from the searched nodes until the other attributes are selected once.
B16、如B12所述的装置，其中，B16. The device of B12, wherein,
所述分类单元，适于将一个节点保存到对应的节点集合时，将该节点在所述抽象语法树中的路径信息一同保存。The classification unit is adapted to store path information of a node in the abstract syntax tree when storing a node in the corresponding node set.
B17、如B12所述的装置，其中，B17. The device of B12, wherein,
每种节点类型是根据JAVACC的一种语法规则确定的。Each node type is determined according to a syntax rule of JAVACC.
B18、如B12-B17中任一项所述的装置，其中，B18. The device of any one of B12-B17, wherein,
所述待处理文件为安卓源代码文件；The file to be processed is an Android source code file;
所述指定内容为安卓源代码中具有安全漏洞的内容。The specified content is the content with security holes in the Android source code.
B19、如B18所述的装置，其中，B19. The device of B18, wherein,
所述定位单元，进一步适于根据预置的安全漏洞检测规则，确定待定位的指定内容和与指定内容对应的安全漏洞类型。The locating unit is further adapted to determine the specified content to be located and the type of security hole corresponding to the specified content according to preset security hole detection rules.
B20、如B19所述的装置，其中，B20. The device of B19, wherein,
所述待处理文件还包括：所述安卓源代码文件对应的安卓配置文件；The file to be processed also includes: the Android configuration file corresponding to the Android source code file;
所述指定内容还包括：所述安卓配置文件中具有安全漏洞的内容；The specified content also includes: content with security holes in the Android configuration file;
其中，所述安全漏洞为组合型漏洞；Wherein, the security loophole is a combined loophole;
所述安全漏洞检测规则为：当所述安卓源代码中存在具有该安全漏洞的内容，且所述安卓配置文件中也存在具有该安全漏洞的内容时，确定所述安卓源代码和所述安卓配置文件中存在该安全漏洞。The security loophole detection rule is: when there is content with the security loophole in the Android source code, and there is also content with the security loophole in the Android configuration file, determine the source code of the Android source code and the Android security loophole. The security hole exists in the configuration file.
B21、如B20所述的装置，其中，B21. The device of B20, wherein,
所述组合型漏洞为拒绝服务漏洞；The combined vulnerability is a denial of service vulnerability;
所述安卓源代码中具有安全漏洞的内容为：onCreate函数中的Intent对象调用getXXXExtra()方法后缺少异常捕获方法；The content with security holes in the Android source code is: the Intent object in the onCreate function calls the getXXXExtra () method and lacks an exception capture method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的exported属性为true。The content with security holes in the Android configuration file is: the exported attribute of the activity component is true.
B22、如B20所述的装置，其中。B22, the device as described in B20, wherein.
所述组合型漏洞为越级提权漏洞；The combined vulnerability is a privilege escalation vulnerability;
所述安卓源代码中具有安全漏洞的内容为：activity类中的Intent对象调用parseUri()方法后缺少过滤方法；The contents with security holes in the Android source code are: the Intent object in the activity class lacks a filtering method after calling the parseUri () method;
所述安卓配置文件中具有安全漏洞的内容为：activity组件的scheme属性存在自定义协议。The content with security holes in the Android configuration file is: there is a custom protocol in the scheme attribute of the activity component.
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611110206.5ACN108614695A (en) | 2016-12-06 | 2016-12-06 | The quickly method and apparatus of the specified content in positioning Android application code file |
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201611110206.5ACN108614695A (en) | 2016-12-06 | 2016-12-06 | The quickly method and apparatus of the specified content in positioning Android application code file |
| Publication Number | Publication Date |
|---|---|
| CN108614695Atrue CN108614695A (en) | 2018-10-02 |
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201611110206.5APendingCN108614695A (en) | 2016-12-06 | 2016-12-06 | The quickly method and apparatus of the specified content in positioning Android application code file |
| Country | Link |
|---|---|
| CN (1) | CN108614695A (en) |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101661543A (en)* | 2008-08-28 | 2010-03-03 | 西门子（中国）有限公司 | Method and device for detecting security flaws of software source codes |
| US20100083240A1 (en)* | 2006-10-19 | 2010-04-01 | Checkmarx Ltd | Locating security vulnerabilities in source code |
| CN104298921A (en)* | 2013-07-15 | 2015-01-21 | 深圳市腾讯计算机系统有限公司 | Animation source file security vulnerability checking method and animation source file security vulnerability checking device |
| CN105975392A (en)* | 2016-04-29 | 2016-09-28 | 国家计算机网络与信息安全管理中心 | Duplicated code detection method and device based on abstract syntax tree |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20100083240A1 (en)* | 2006-10-19 | 2010-04-01 | Checkmarx Ltd | Locating security vulnerabilities in source code |
| CN101661543A (en)* | 2008-08-28 | 2010-03-03 | 西门子（中国）有限公司 | Method and device for detecting security flaws of software source codes |
| CN104298921A (en)* | 2013-07-15 | 2015-01-21 | 深圳市腾讯计算机系统有限公司 | Animation source file security vulnerability checking method and animation source file security vulnerability checking device |
| CN105975392A (en)* | 2016-04-29 | 2016-09-28 | 国家计算机网络与信息安全管理中心 | Duplicated code detection method and device based on abstract syntax tree |
| Publication | Publication Date | Title |
|---|---|---|
| US11057424B2 (en) | Database query injection detection and prevention | |
| ES2922303T3 (en) | Automated service-oriented execution management | |
| US8479188B2 (en) | Binary code change vulnerability prioritization | |
| US7849509B2 (en) | Detection of security vulnerabilities in computer programs | |
| US10387627B2 (en) | Systems and methods for analyzing software | |
| Liang et al. | Sound and precise malware analysis for Android via pushdown reachability and entry-point saturation | |
| Dahse et al. | Code reuse attacks in php: Automated pop chain generation | |
| Park et al. | {FUGIO}: Automatic exploit generation for {PHP} object injection vulnerabilities | |
| Aafer et al. | Android {SmartTVs} vulnerability discovery via {log-guided} fuzzing | |
| US9690946B2 (en) | Security analysis using relational abstraction of data structures | |
| US20120174229A1 (en) | Runtime Enforcement Of Security Checks | |
| CN103559447B (en) | A kind of detection method, checkout gear and detection system based on Virus Sample feature | |
| Huang et al. | Detecting sensitive data disclosure via bi-directional text correlation analysis | |
| JP2009129127A (en) | Program invariant extraction processing program, processing device, processing method, and storage medium for storing the program | |
| US10423618B2 (en) | Method and system for enforcing user policy on database records | |
| Ohm et al. | Sok: Practical detection of software supply chain attacks | |
| Di Angelo et al. | Evolution of automated weakness detection in Ethereum bytecode: a comprehensive study | |
| CN108153664A (en) | A kind of static code scan method and device | |
| CN108845941A (en) | A kind of SQL injection test coverage statistical method and system | |
| CN106650439A (en) | Suspicious application program detection method and device | |
| CN103136474B (en) | The method and apparatus for detecting file | |
| Wang et al. | Hang analysis: fighting responsiveness bugs | |
| CN108614695A (en) | The quickly method and apparatus of the specified content in positioning Android application code file | |
| CN104239800B (en) | The detection method and device that leak is threatened are triggered in PDF | |
| US20210294895A1 (en) | Method and system for detecting malware using memory map |
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication | Application publication date:20181002 |