CN108459954B - Application program vulnerability detection method and device - Google Patents
Application program vulnerability detection method and device Download PDFInfo
- Publication number
- CN108459954B CN108459954B CN201710097344.2A CN201710097344A CN108459954B CN 108459954 B CN108459954 B CN 108459954B CN 201710097344 A CN201710097344 A CN 201710097344A CN 108459954 B CN108459954 B CN 108459954B
- Authority
- CN
- China
- Prior art keywords
- detected
- code
- detection
- variable
- detection function
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/362—Software debugging
- G06F11/3644—Software debugging by instrumenting at runtime
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
- G06F21/563—Static detection by source code analysis
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- Virology (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Quality & Reliability (AREA)
- Debugging And Monitoring (AREA)
Abstract
The invention relates to an application program bug detection method, which comprises the following steps: acquiring a detection range of the configured code to be detected; reading vulnerability detection logic corresponding to the codes to be detected in a preset rule base; inserting a detection function into the code to be detected, executing the code to be detected with the detection function inserted, detecting whether a bug exists in the code to be detected according to the bug detection logic in the code execution process, and if yes, outputting a detection result. By adopting the method, the false alarm rate of the vulnerability detection of the application program can be reduced. In addition, an application program vulnerability detection device is further provided.
Description
Technical Field
The invention relates to the technical field of computers, in particular to a method and a device for detecting application program bugs.
Background
An application program refers to a computer program that is developed to run on top of an operating system in order to accomplish a certain task or tasks. PHP (Hypertext markup language) applications are one of many applications. With more and more websites developing PHP, it becomes an essential link to test the security performance of the PHP developed websites. In the traditional technology, PHP white-box auditing technology is mainly used for PHP application programs to detect security vulnerabilities. The PHP white-box audit is also called PHP code audit and is an important component of security test, and testers can analyze and read codes through manual identification or automation tools and find out hidden security holes from the codes. However, the existing automatic PHP white-box audit technology mainly focuses on static scanning, and only through regular matching in the analysis process, source codes cannot be executed, and there is no correlation of context execution environments, and the logics of interfaces such as entry filtering and database interaction cannot be excluded generally, so that false alarm is caused, and some bugs requiring complex logic cannot be detected effectively, so that the false alarm rate is high.
Disclosure of Invention
In view of the foregoing, it is desirable to provide a method and an apparatus for detecting vulnerability of an application program, which can reduce the false alarm rate.
An application program vulnerability detection method comprises the following steps:
acquiring a detection range of the configured code to be detected;
reading vulnerability detection logic corresponding to the codes to be detected in a preset rule base;
inserting a detection function into the code to be detected, executing the code to be detected with the detection function inserted, detecting whether a bug exists in the code to be detected according to the bug detection logic in the code execution process, and if yes, outputting a detection result.
An application vulnerability detection apparatus, comprising:
the acquisition module is used for acquiring the detection range of the configured code to be detected;
the reading module is used for reading vulnerability detection logic corresponding to the codes to be detected in the preset rule base;
and the vulnerability detection module is used for inserting a detection function into the code to be detected, executing the code to be detected into which the detection function is inserted, detecting whether a vulnerability exists in the code to be detected according to vulnerability detection logic in the code execution process, and outputting a detection result if the vulnerability exists in the code to be detected.
According to the application program bug detection method and device, the detection range of the configured to-be-detected code is obtained, the corresponding bug detection logic is obtained according to the bug type to be detected, and the detection function is inserted into the to-be-detected code to simulate and execute the code in the target range, so that the code bug is detected. The detection function is inserted to obtain the codes and the codes are detected in the simulation execution process according to the vulnerability detection logic, so that the dynamic vulnerability detection method is provided, vulnerabilities with complex logic can be detected and analyzed, and the vulnerability false alarm rate is effectively reduced.
Drawings
FIG. 1 is an internal block diagram of a server in one embodiment;
FIG. 2 is a flow diagram of a method for application vulnerability detection in an embodiment;
FIG. 3 is a flowchart of a method for application vulnerability detection in another embodiment;
FIG. 4 is a flow diagram of a method for application variable coverage vulnerability detection in one embodiment;
FIG. 5 is a diagram illustrating an embodiment of a detection mechanism for vulnerability detection of an application;
FIG. 6 is a block diagram of an application vulnerability detection apparatus in one embodiment;
FIG. 7 is a block diagram of a vulnerability detection module in one embodiment;
FIG. 8 is a block diagram of a vulnerability detection module in one embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
Fig. 1 is a schematic diagram of an internal structure of a server in one embodiment. As shown in fig. 1, the server includes a processor, a non-volatile storage medium, an internal memory, and a network interface connected through a system bus. The nonvolatile storage medium of the server stores an operating system, a database and an application program vulnerability detection device, the database stores relevant data of the operation of a scanning tool and relevant vulnerability detection rules, and the application program vulnerability detection device is used for realizing an application program vulnerability detection method applicable to the server. The processor of the server is used for providing calculation and control capacity and supporting the operation of the whole server. The internal memory of the server provides an environment for the operation of the application bug detection device in the non-volatile storage medium, and the internal memory can store computer readable instructions, and when the computer readable instructions are executed by the processor, the processor can be caused to execute an application bug detection method. The network interface of the server is used for communicating with an external terminal through network connection, receiving a request for scanning the application program bugs sent by the terminal and returning the detected application program bugs to the terminal. The server may be implemented as a stand-alone server or as a server cluster comprised of multiple servers. Those skilled in the art will appreciate that the architecture shown in fig. 2 is a block diagram of only a portion of the architecture associated with the subject application, and does not constitute a limitation on the servers to which the subject application applies, as a particular server may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
As shown in fig. 2, in an embodiment, an application vulnerability detection method is provided, which can be applied to the server shown in fig. 1, and includes the following steps:
and step 210, acquiring a detection range of the configured code to be detected.
In this embodiment, the detection range of the code to be detected refers to a code that needs to be subjected to vulnerability detection. The method comprises the steps that a source code of an application program runs in a server, when vulnerability detection is needed to be carried out on the application program, relevant parameters are configured in the server to obtain a code to be detected, needing vulnerability detection, in the source code of the application program, and the vulnerability detection is carried out, namely the detection range of the code to be detected is determined.
In this embodiment, the vulnerability detection logic refers to a logic rule that is formulated according to the cause of the vulnerability of the application program and is capable of detecting whether there is a factor that generates the vulnerability, for example, if there is a variable coverage vulnerability, it is first necessary for a variable to be referred to, and therefore when detecting the variable coverage vulnerability, the corresponding logic rule is formulated to detect whether there is a referred variable, thereby further detecting whether there is a variable coverage vulnerability. The preset rule base refers to a rule base which stores different vulnerability detection logics in advance and is stored in a database. When whether a certain bug exists in the code to be detected in the server needs to be detected, reading the bug detection logic corresponding to the code to be detected in the preset rule base to detect the code to be detected.
And step 230, inserting a detection function into the code to be detected, executing the code to be detected with the detection function inserted, detecting whether a bug exists in the code to be detected according to the bug detection logic in the code execution process, and if yes, outputting a detection result.
In this embodiment, the detection function refers to a function stored in the server for scanning and detecting a code. When the application program needs to be subjected to vulnerability detection, the detection function is inserted into the code to be detected obtained from the server, and the specific content of the code to be detected into which the detection function is inserted is obtained through scanning and is subjected to simulation execution. And in the process of simulation execution, judging whether the factors which can cause the vulnerability exist in the to-be-detected code inserted with the detection function according to the vulnerability detection logic read from the preset rule base. When detecting that a factor which can cause a bug exists in a to-be-detected code inserted with a detection function in the simulation execution process, acquiring a relevant content definition corresponding to the factor which can cause the bug in the to-be-detected code through the detection function so as to judge whether the bug exists in the code which is being simulated and executed. And outputting a detection result when detecting that the code to be detected inserted into the detection function has a bug.
In this embodiment, a configured detection range of the code to be detected is obtained, a corresponding vulnerability detection logic is obtained according to a code vulnerability to be detected, a detection function is inserted into the code to be detected to simulate execution of the code to be detected, and whether a vulnerability exists in the code to be detected is judged according to the obtained vulnerability detection logic. The detection function is inserted to simulate and execute the code to be detected, so that the vulnerability in the code to be detected can be dynamically detected, and the false alarm rate of the vulnerability is effectively reduced.
In one embodiment, inserting a detection function into the code to be detected, executing the code to be detected into which the detection function is inserted, detecting whether a bug exists in the code to be detected according to a bug detection logic in a code execution process, and if yes, outputting a detection result, including:
inserting a detection function in the code to be detected line by line; for each line of codes to be detected, executing the line of codes to be detected after the detection function is inserted; when detecting that the line of codes to be detected has a bug, outputting a detection result, deleting a detection function inserted by the line of codes to be detected, and continuously inserting the detection function into the next line of codes to be detected and executing the detection function until the codes to be detected are completely executed; and when detecting that the line of codes to be detected has no loopholes, deleting the detection function inserted by the line of codes to be detected, and continuing to insert the detection function into the next line of codes and executing the detection function until the execution of the codes to be detected is finished.
In this embodiment, a scanning tool is installed in a server, the scanning tool includes a simulation execution engine and a deletion and insertion detection function engine, when vulnerability detection needs to be performed on an application program, the detection function engine in the scanning tool inserts a detection function before one line of codes in the codes to be detected, so as to scan the codes in which the detection function is inserted to obtain specific contents of the codes to be detected, the simulation execution engine performs simulation execution on the codes to be detected in which the detection function is inserted, and whether vulnerabilities exist in the codes in which the detection function is inserted is judged according to vulnerability detection logic read from a preset rule base.
In this embodiment, when detecting that a bug exists in a line code being executed in a simulated manner, a corresponding log is generated for a detection result and stored in a database, and meanwhile, a detection function engine is deleted to delete a detection function before the currently detected line code and is inserted into the detection function engine to insert the detection function before a next line code of the currently detected line code for bug detection, that is, a scanning tool inserts the detection function into a code to be detected line by line to perform simulated execution for bug detection, and after detecting one line code, deletes the detection function before the current line code and inserts the detection function into the next line code of the current line code until the last line code in the code to be detected is executed in a simulated manner.
In this embodiment, when it is detected that there is no bug in the line code being executed in a simulated manner, the deletion detection function engine deletes the detection function before the currently detected line code and inserts the detection function before the next line code of the currently detected line code to perform bug detection, that is, the scanning tool inserts the detection function into the code to be detected line by line to perform simulated execution for performing bug detection, and after detecting one line code, deletes the detection function before the currently detected line code and inserts the detection function into the next line code of the currently detected line code until the last line code in the code to be detected is executed in a simulated manner.
In one embodiment, acquiring the configured detection range of the code to be detected includes: and acquiring a code directory, a directory depth and a file extension of the configured code to be detected.
In this embodiment, the source code of the application program is stored in the server, and a scanning tool is installed in the server to perform vulnerability detection on the source code of the application program. The code to be detected required to be detected by the scanning tool is formulated by configuring the related parameters, and the source code of the application program comprises different code directories and code files formed by different writing languages, so that the code to be detected can be obtained by configuring the code directory, the directory depth and the file extension of the source code of the application program.
In one embodiment, detecting whether a bug exists in a code to be detected according to a bug detection logic in a code execution process, and if so, outputting a detection result, including: detecting whether variables in the to-be-detected code inserted with the detection function are quoted or not according to the vulnerability detection logic in the code execution process; if the variable is detected to be quoted, calling an inserted detection function to detect whether the variable is defined before being quoted; and if the referenced variable is not defined, the variable coverage loophole exists, and the detection result is output.
In this embodiment, the vulnerability of the variable coverage type refers to a vulnerability caused by that a variable in the code to be detected can be artificially controlled or replaced by another variable, that is, when a variable is referenced, if the referenced variable is not predefined in the code logic, the referenced variable value is replaced by an artificial change or another value, so that the code logic is wrong, that is, the variable coverage vulnerability exists. Therefore, when detecting whether a variable coverage hole exists in a code, it is first required to determine whether a variable is referred to, and when detecting that a variable is referred to, it is detected whether the referred variable is predefined, and if not, a variable coverage hole exists.
In this embodiment, a scanning tool is installed in a server storing an application source code, and variable coverage vulnerability detection is performed on a code to be detected by using the scanning tool. Specifically, after the scanning tool obtains a code to be detected in the source code according to the configuration parameters and reads the corresponding variable coverage vulnerability detection logic from the preset rule base, the scanning tool inserts a detection function into the code to be detected, wherein the detection function comprises a scanning function and a variable definition function. The scanning tool utilizes the scanning function in the detection function to acquire the specific content of the code to be detected inserted with the detection function, and performs simulation execution on the acquired specific content, detecting whether a quoted variable exists in the code to be detected currently being executed in a simulation mode according to the read variable coverage loophole detection logic in the simulation execution process, if detecting that the quoted variable exists in the code to be detected in the simulation execution mode, calling the variable definition function inserted in the function detects whether the referenced variable has been defined in the code to be detected before being referenced, namely, whether the currently detected referenced variable exists in the variable definition list in the code to be detected is obtained, if the currently detected referenced variable does not exist, the variable can be covered, therefore, the code to be detected, which is currently inserted into the detection function for simulation execution, has a variable coverage hole, and the referenced variable in the code, into which the detection function is currently inserted, is output and stored in the database.
In this embodiment, whether a quoted variable exists in the to-be-detected code into which the detection function is inserted is judged through the variable coverage vulnerability detection logic, and when the quoted variable is detected to exist, the variable definition list in the to-be-detected code is obtained according to the variable definition function in the to-be-detected code, so that whether the quoted variable in the to-be-detected code into which the detection function is inserted is defined is judged, and whether a variable coverage vulnerability exists in the to-be-detected code into which the detection function is inserted is judged. By combining the detection function with the variable coverage loophole detection logic, the variable coverage loophole is detected according to the execution logic of the code to be detected, and the false alarm rate of the loophole is reduced.
In one embodiment, detecting whether a variable in a to-be-detected code, into which a detection function is inserted, is referenced according to a vulnerability detection logic during code execution includes: detecting whether a variable identifier in a code to be detected, into which a detection function is inserted, appears behind an assigned identifier in the code to be detected in the code execution process; and if so, the variable corresponding to the variable identification in the code to be detected is quoted.
In this embodiment, a variable in a to-be-detected code of an application program is provided with a variable identifier, when a scanning tool installed in a server performs variable coverage vulnerability detection on the to-be-detected code, the scanning tool inserts a detection function into the to-be-detected code to obtain corresponding to-be-detected code content and performs simulation execution on the obtained to-be-detected code content, in the process of simulation execution, a variable coverage vulnerability detection logic read from a preset rule base is combined to obtain the variable identifier and an assignment identifier, whether a quoted variable exists in the to-be-detected code subjected to simulation execution is judged according to positions where the variable identifier and the assignment identifier appear, and when it is detected that whether the variable identifier in the to-be-detected code appears behind the assignment identifier in the to-be-detected code, it is indicated that the quoted variable exists in the currently-to-be-executed code.
Specifically, for example, in the case of an application program written in the PHP language, an equal sign is used as an assignment identifier, a variable on the left side of the equal sign is assigned, and a variable on the right side of the equal sign is referred to in advance according to the basic specification of the programming language. That is, a variable is used only if it does not appear to the left of the equal sign. For the PHP programming language, a variable mark $iscarried in front of a variable, and a variable coverage vulnerability detection logic is defined and stored in a preset rule base according to the characteristic that the variable is quoted. The scanning tool obtains a variable coverage vulnerability detection logic for detecting variable coverage vulnerabilities in codes written by a PHP programming language corresponding to a preset rule base, a detection function is inserted into the codes to be detected to obtain corresponding code contents and simulation execution is carried out, in the process of simulation execution, according to the obtained variable coverage vulnerability detection logic, the positions where variable identifications $ and assignment identifications are appeared in the codes to be detected in the simulation execution are searched, when the positions where the variable identifications $ appear are detected to be later than the positions where the assignment identifications are appeared, the corresponding variables are shown on the right side of the assignment identifications equal numbers after the variable identifications are described, and then the variables behind the variable identifications are quoted.
In one embodiment, detecting whether a variable in a to-be-detected code, into which a detection function is inserted, is referenced according to a vulnerability detection logic during code execution includes: in the code execution process, when detecting that the variable identification exists in the code to be detected inserted with the detection function but the assignment identification does not exist, the variable corresponding to the variable identification in the code to be detected is quoted.
In this embodiment, a scanning tool installed in a server is used to perform variable coverage vulnerability detection on an application program stored in the server, and taking the PHP language as an example, when a row of codes in the application program written by using the PHP language has a variable identifier but no assignment identifier, it is considered that a variable corresponding to the variable identifier in the row of codes is directly referred to. Therefore, after the scanning tool acquires the detection logic of the corresponding variable coverage loophole in the preset rule base, the scanning tool acquires the specific content of the code to be detected by using the detection function and performs simulation execution, and if the fact that the variable identification $ but the assignment identification equal sign does not exist in the code to be detected which is being simulated and executed in the process of simulation execution of the code to be detected with the detection function inserted is detected, the variable behind the variable identification $ in the code to be detected which is being simulated and executed is considered to be quoted.
As shown in fig. 3, in an embodiment, an application vulnerability detection method is provided, which is exemplified by being applied to the server shown in fig. 1, and includes the following steps:
and 310, acquiring a configured code directory, directory depth and file extension of the code to be detected.
In this embodiment, the source code of the application program is stored in the server, and a scanning tool is installed in the server to perform vulnerability detection on the source code of the application program. The code to be detected required to be detected by the scanning tool is formulated by configuring the related parameters, and the source code of the application program comprises different code directories and code files formed by different writing languages, so that the code to be detected can be obtained by configuring the code directory, the directory depth and the file extension of the source code of the application program. For example, a code directory may be configured by defining path ═ var/www, a directory depth of scanning may be configured by configuring depth ═ 3, and an extension of a scan type may be defined by configuring PHP, so that a code written in the PHP language corresponding to the directory of/var/www is determined to be a code to be detected.
And step 320, reading vulnerability detection logic corresponding to the codes to be detected in the preset rule base.
In this embodiment, vulnerability detection logics corresponding to different variable vulnerability types are stored in a database in advance to form a preset rule base, and when vulnerability detection needs to be performed on codes in an application program, a scanning tool installed in a server acquires the vulnerability detection logics corresponding to the vulnerability detection logics from the preset rule base in the database according to the acquired vulnerability types to be detected of the codes to be detected.
In step 330, a detection function is inserted into one row of the code to be detected.
In this embodiment, when the vulnerability of the code to be detected needs to be detected, the code to be detected is detected line by line through the scanning tool. The method includes the steps that before a code to be detected is detected, specific content of the code to be detected needs to be acquired, therefore, a scanning tool is used for scanning any line of codes in the code to be detected, specifically, the scanning tool comprises a simulation execution engine and a deletion and insertion detection function engine, when the scanning tool acquires one line of codes of the code to be detected, the insertion detection function engine inserts a detection function into the line of codes, the detection function comprises a scanning function, and the scanning tool scans the line of codes with the detection function inserted by the scanning function.
And step 340, executing the line code with the detection function inserted in the code to be detected.
In this embodiment, when the scanning tool scans the line code inserted with the detection function by using the scanning function to obtain the specific content corresponding to the line code, the simulation execution engine in the scanning tool simulates and executes the type of the obtained line code. The simulation execution means that the scanning tool provides a simulation running environment to run the line code inserted with the detection function so as to detect whether a bug exists in the line code inserted with the detection function in the dynamic execution process.
In this embodiment, the scanning tool obtains the specific content of the line code inserted with the detection function through the scanning function in the detection function, and when the scanning tool is executed in the simulation execution engine in a simulation manner, according to the vulnerability detection logic corresponding to the code to be detected obtained from the preset rule base, whether a factor causing a vulnerability in the corresponding vulnerability detection logic exists in the line code executed in the simulation manner is judged, so as to judge whether the line code currently inserted with the detection function has a vulnerability, if yes, step 360 is executed, and if not, step 370 is executed.
And step 360, outputting a detection result.
In this embodiment, when the scanning tool detects that a bug exists in a line code currently inserted with a detection function through simulation execution and by combining with the acquired bug detection logic corresponding to the code to be detected, a scanning log of a bug detection result is generated and sent to the database for storage.
In this embodiment, after the scanning tool completes the detection of the line code currently inserted with the detection function, that is, after the scanning tool performs the simulation on the line code currently inserted with the detection function and determines whether the current line code has a bug by combining with the corresponding bug detection logic, it is further determined whether the line code currently inserted with the detection function is the last line code in the to-be-detected codes acquired by the scanning tool, if so, step 390 is performed, and if not, step 380 is performed.
In this embodiment, after the scanning tool completes the detection of the line code currently inserted with the detection function, the detection function engine is used to delete the detection function inserted before the current line code. When detecting that the current code is not the last line of the obtained code to be detected, that is, when the detection of the code to be detected is not completed, the scanning tool inserts the detection function before the next line of the code of the current line of the code to be detected by using the insertion detection function engine, and returns to execute step 340.
And 390, deleting the detection function inserted in the line code currently inserted with the detection function, and stopping detecting the code to be detected.
In this embodiment, when the scanning tool completes detection of the line code currently inserted with the detection function and detects that the current line code is the last line of the to-be-detected code acquired by the scanning tool from the server, that is, the scanning tool completes detection of the to-be-detected code, the scanning tool deletes the detection function inserted before the current line code by using the deletion detection function engine, and stops detection of the to-be-detected code.
In this embodiment, by obtaining a configured detection range of the to-be-detected code and a vulnerability detection logic corresponding to the to-be-detected code, inserting a detection function into the to-be-detected code line by using a scanning tool, performing simulation execution on the to-be-detected code line by line, judging whether each line of code in the to-be-detected code has a vulnerability according to the obtained corresponding vulnerability detection logic in the simulation execution process, and generating a corresponding log of a result and storing the corresponding log in a database. The detection function is inserted to simulate and execute the code to be detected, so that the loophole in the code to be detected is detected, and the false alarm rate of the loophole is effectively reduced.
As shown in fig. 4, in an embodiment, a method for detecting an application variable coverage vulnerability is provided, which includes the following steps:
and step 410, acquiring a configured code directory, directory depth and file extension of the code to be detected.
In this embodiment, as shown in fig. 5, a website source code is stored in the website server 510, and when vulnerability detection needs to be performed on a website, a scanning tool 520 is installed in the website server 510, where the scanning tool 520 includes a simulation execution engine 521 and an insertion/deletion detection function engine 522, and the scanning software 520 is used to perform vulnerability detection on the source code in the website server 510. Because a large amount of codes are needed when the website source codes realize various functions, in order to detect the source codes in a targeted manner, parameters are required to be configured to determine the vulnerability detection range of the scanning tool, and the configuration parameters include a code directory, a directory depth and a file extension of the codes to be detected. For example, taking a system written in PHP language as an example, when detecting a variable coverage vulnerability of one section of code in the system, a code directory such as path ═ var/www/zhidao, a directory depth configured as depth ═ 3, and an extension of a scan file configured as scan type ═ PHP are first configured according to the location of the code to be detected. The code to be detected in the system is obtained from the server 510 by configuring the three parameters, and the obtained code to be detected is as follows:
In this embodiment, the variable coverage type bug refers to a bug that is caused by that variables in the code to be detected can be manually controlled or replaced by other variables. For example, when the variable coverage hole detection is performed on a system written in the PHP language, $ is used as a variable identifier and $ is used as an assignment identifier according to the programming rule of the PHP language. When the variable identification $ is located on the left side of the assignment identification, the variable corresponding to the variable identification $ is assigned, and when the variable identification $ is located on the right side of the assignment identification, the variable corresponding to the variable identification $ is referenced. Defining the detection logic of the variable coverage holes, find ($ str) > find (', str), where str is used to obtain an entire line of code currently inserted into the detection function, and the find function is used to find the position where the character appears, and storing the defined detection logic of the variable coverage holes in the rule base 531 in the database 530.
In this embodiment, when the scanning tool 520 needs to detect a variable coverage hole in a code to be detected, the scanning tool 520 reads a corresponding bug detection logic of the variable coverage hole from the rule base 531.
And step 430, inserting a detection function into one line of codes to be detected.
In this embodiment, the detection function includes a scan function, which is used to obtain the code to be detected inserted with the detection function for simulation execution; and the variable definition function get _ defined _ vars is used for acquiring the defined variable in the detection range of the configuration.
In this embodiment, after the scanning tool 520 obtains the corresponding variable coverage vulnerability detection logic, the insertion and deletion detection function engine 522 is used to insert a detection function into one row of the to-be-detected codes, and the simulation execution engine 521 is used to perform simulation execution on the to-be-detected codes into which the detection function is inserted. For example, if the variable coverage hole detection is performed on the code in the system written in the PHP language, which is obtained as described above, a detection function is first inserted into the first line of code.
In this embodiment, when the scanning tool 520 inserts a detection function in front of one line of the obtained code to be detected, the scanning function scan function in the detection function is used to scan and obtain the specific content of the line of code, and the variable identifier $ and the assignment identifier $ in the line of code in which the detection function is inserted are detected according to the read find function in the detection logic of the variable coverage vulnerability, when it is detected that the variable identifier and the assignment identifier exist in the line of code in which the detection function is inserted, step 450 is executed, when it is detected that only the variable identifier exists in the line of code in which the detection function is inserted, it is considered that the variable is directly referenced, and step 460 is executed.
For example, taking the obtained system code written in the PHP language as an example, if a detection function is inserted in front of a first row of codes in the obtained code to be detected, obtaining specific content of the first row of codes, $ sort _ where ═ where ' qa _ quality ' >0 according to a scan function, then detecting by using variable coverage vulnerability detection logic find ($ ', str) > find (' ═ str '), and detecting that a variable identifier and an assignment identifier exist in the row, but no variable identifier exists on the right side of the assignment identifier, so that no variable coverage vulnerability exists. After the first row of codes is detected, deleting the detection function inserted before the first row of codes and inserting the detection function before the second row of codes for detection, and so on, when the detection function is inserted in the fifth row of the obtained codes to be detected, obtaining that the corresponding code is if (count ($ sort _ where _ a) >0), at this time, returning the find function to-1, and the variable coverage detection logic is still true, so at this time, the variable sort _ where _ a is referred to, and executing step 460.
In this embodiment, when detecting that the variable identifier $ and the assignment identifier ═ exist in the line code into which the detection function is inserted according to the variable coverage vulnerability detection logic, it is described that an assigned or referenced variable exists in the line code into which the detection function is inserted at this time. At this time, the position relationship between the variable identifier $ and the assignment identifier equal number is judged through the find function, if the position where the variable identifier $ appears is detected to be later than the position where the assignment identifier equal number appears, if so, it is indicated that the referenced variable exists in the line code currently inserted into the detection function, and step 460 is executed. If it is detected that the variable identifier $ and the assignment identifier $ exist in the line code into which the detection function is inserted, but the variable identifier $ appears before the assignment identifier ═ is present, it indicates that the variable in the line code into which the detection function is currently inserted is assigned but not referenced, and there is no variable coverage hole, and step 480 is executed.
In this embodiment, when detecting that there is $ variable identifier in the line code into which the detection function is inserted but there is no equal sign of the assigned identifier according to the find function, the value of find (' $ ', str) returns to-1, and find (' $ ', str) > find (', str) is still true, and at this time, the variable is directly referenced, and there may be a variable coverage hole. Or when detecting that the variable identification and the assignment identification exist in the code inserted into the detection function at present, but the position of the variable identification $ appears is later than the position of the assignment identification equal sign, the variable corresponding to the variable identification $ is shown to be on the right side of the assignment identification equal sign, and at this time, the variable is quoted, and a variable coverage hole may exist.
In this embodiment, when the referenced variable cannot correctly assign values to other variables, a variable coverage hole is generated. Therefore, when it is detected that a referenced variable exists in the line code into which the detection function is inserted, in order to detect whether the line code has a variable coverage hole, it is further required to detect whether the variable is defined in the code to be detected, and when the detected referenced variable is defined, it is stated that the referenced variable conforms to a certain logic or is a specific value. Specifically, a defined variable list in the code to be detected is obtained through a variable definition function get _ defined _ vars in the inserted detection function, so as to judge whether a variable referenced in the line code in which the detection function is currently inserted is defined. If yes, go to step 480, otherwise go to step 470.
Specifically, for example, for a system written in the PHP language, when it is detected that a variable sort _ where _ a in the code in the 5 th line is referred to, a defined variable list in the code to be detected is obtained according to a variable definition function get _ defined _ vars function, it is determined whether the defined variable list includes the variable sort _ where _ a, if so, it is determined that the variable is defined and no variable coverage hole exists, step 480 is performed, when it is detected that the variable is not defined, it is determined that a variable coverage hole exists in the code in the line currently inserted into the detection function, and step 470 is performed.
In this embodiment, when the variable list defined in the code to be detected, which is obtained according to the variable definition function get _ defined _ vars, does not include the referenced variable in the line code of the currently inserted detection function, it is indicated that the line code of the currently inserted detection function has a variable coverage hole, and a system log 540 is generated and stored in the database 530 according to the result of the variable coverage hole.
Specifically, in the obtained code to be detected of the system written in the PHP language, the referenced variable sort _ where _ a exists in the source code in line 5, and when the variable sort _ where _ a does not exist in the defined variable list in the obtained code to be detected, the output variable sort _ where _ a is stored in the database 530.
Further, other vulnerabilities related to the variable coverage vulnerability in the code to be detected can be analyzed according to the variable coverage vulnerability generated by the detected quoted variable, such as SQL injection vulnerability, arbitrary file reading vulnerability and unauthorized vulnerability.
In this embodiment, when the variable defined in the to-be-detected code acquired by the scanning tool 520 according to the variable definition function get _ defined _ vars function includes a variable that is referred to in the line code of the current inserted detection function, it indicates that there is no variable coverage hole in the line code of the current inserted detection function, or after detecting that there is a variable coverage hole in the line code of the current inserted detection function and outputting a detection result, the detection function corresponding to the current line code is deleted, and it is determined whether the code of the current inserted detection function is the last line code in the to-be-detected code, if so, the detection of the to-be-detected code is stopped, and if not, the step 490 is executed.
In this embodiment, if the currently detected code is not the last line of the code to be detected, that is, the detection of the code to be detected is not completed, the scanning tool deletes the insertion function before the code of the current line and inserts the detection function into the code of the next line of the code of the current line, and then step 440 is executed to detect the code of the line to be detected, into which the detection function is currently inserted, until the code to be detected reaches the last line. For example, a detection function is inserted into a first line of codes in the system written in the PHP language, when it is detected that no variable coverage holes exist in the first line of codes, the scanning tool deletes the insertion function before the first line of codes, inserts the detection function before a second line of codes, and executes step 440 to detect the second line of codes until a last line of codes to be detected is detected.
In this embodiment, a detection function is inserted to obtain content in a code to be detected and execute simulation execution, a variable in the code to be detected is detected in combination with read variable coverage vulnerability detection logic in the simulation execution process, and whether a vulnerability covered by the variable exists in the code to be detected is determined by determining whether the variable is defined when the variable is quoted. The execution condition of the code to be detected is simulated and executed, the code to be detected is detected line by line, and the false alarm rate of vulnerability detection is reduced.
As shown in fig. 6, in one embodiment, an application bug detection apparatus is provided, including:
the obtaining module 610 is configured to obtain a detection range of the configured code to be detected.
The reading module 620 is configured to read a vulnerability detection logic corresponding to the code to be detected in the preset rule base.
The vulnerability detection module 630 is configured to insert a detection function into the code to be detected, execute the code to be detected into which the detection function is inserted, detect whether a vulnerability exists in the code to be detected according to vulnerability detection logic in the code execution process, and output a detection result if the vulnerability exists in the code to be detected.
In this embodiment, a configured detection range of the to-be-detected code is obtained, a corresponding vulnerability detection logic is obtained according to a code vulnerability to be detected, a detection function is inserted into the to-be-detected code to simulate execution of the to-be-detected code, and whether a vulnerability exists in the to-be-detected code is judged according to the obtained vulnerability detection logic. The detection function is inserted to simulate and execute the code to be detected, so that the loophole in the code to be detected is detected, and the false alarm rate of the loophole is effectively reduced.
In one embodiment, as shown in fig. 7, the vulnerability detection module 630 includes:
the detecting unit 631 is configured to insert a detecting function into the to-be-detected code line by line, and for each line of to-be-detected code, execute the line of to-be-detected code into which the detecting function is inserted after the detecting function is inserted.
The execution unit 632 is configured to, when detecting that the line of codes to be detected has a bug, output a detection result, delete the detection function inserted into the line of codes to be detected, and continue to insert the detection function into the next line of codes to be detected and execute the detection function until the execution of the codes to be detected is completed; and when detecting that the line of codes to be detected does not have the loopholes, deleting the detection function inserted by the line of codes to be detected, and continuously inserting the detection function into the next line of codes and executing the next line of codes until the codes to be detected are executed completely.
In one embodiment, the obtaining module 610 is further configured to obtain the configured code directory to be detected, the directory depth, and the file extension.
As shown in fig. 8, in an embodiment, the vulnerability detection module 630 includes:
and the variable detection module 810 is configured to detect whether a variable in the to-be-detected code, into which the detection function is inserted, is referred according to the vulnerability detection logic in the code execution process.
And a function call module 820, configured to, if it is detected that the variable is referenced, call an inserted detection function to detect whether the variable has been defined before being referenced.
And the output module 830 is configured to, if it is detected that the referenced variable is not defined, have a variable coverage hole, and output a detection result.
In one embodiment, the variable detecting module 810 is further configured to detect, during execution of the code, whether a variable identifier in the code to be detected into which the detecting function is inserted appears after an assigned identifier in the code to be detected; if yes, the variable corresponding to the variable identification in the code to be detected is quoted; or in the code execution process, when detecting that the variable identification exists in the code to be detected inserted with the detection function but the assignment identification does not exist, the variable corresponding to the variable identification in the code to be detected is quoted.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by a computer program, which can be stored in a computer-readable storage medium, and can include the processes of the embodiments of the methods described above when the computer program is executed. The storage medium may be a non-volatile storage medium such as a magnetic disk, an optical disk, a Read-Only Memory (ROM), or a Random Access Memory (RAM).
The technical features of the embodiments described above may be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the embodiments described above are not described, but should be considered as being within the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present invention, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that various changes and modifications can be made by those skilled in the art without departing from the spirit of the invention, and these changes and modifications are all within the scope of the invention. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. An application vulnerability detection method, the method comprising:
acquiring a detection range of the configured code to be detected;
reading vulnerability detection logic corresponding to the codes to be detected in a preset rule base;
inserting a detection function into the code to be detected, executing the code to be detected with the insertion of the detection function, obtaining a variable identifier and an assignment identifier according to the vulnerability detection logic in the code execution process, detecting whether a variable corresponding to the variable identifier is quoted according to the positions of the variable identifier and the assignment identifier, if so, determining whether the code to be detected has a vulnerability based on whether the variable is defined before being quoted, and if so, outputting a detection result.
2. The method according to claim 1, wherein inserting a detection function into the code to be detected, executing the code to be detected into which the detection function is inserted, detecting whether a bug exists in the code to be detected according to the bug detection logic during code execution, and if yes, outputting a detection result, including:
inserting a detection function in the code to be detected line by line;
for each line of codes to be detected, executing the line of codes to be detected after the detection function is inserted;
when detecting that the line of codes to be detected has a bug, outputting a detection result, deleting a detection function inserted by the line of codes to be detected, and continuing to insert the detection function into the next line of codes to be detected and executing the detection function until the codes to be detected are completely executed;
and when detecting that the line of codes to be detected does not have the loopholes, deleting the detection function inserted by the line of codes to be detected, and continuously inserting the detection function into the next line of codes and executing the next line of codes until the codes to be detected are executed completely.
3. The method according to claim 1, wherein the obtaining of the detection range of the configured to-be-detected code comprises:
and acquiring a code directory, a directory depth and a file extension of the configured code to be detected.
4. The method according to claim 1, wherein the detecting whether the code to be detected has a bug according to the bug detection logic during the execution of the code, and if yes, outputting a detection result, including:
detecting whether variables in the to-be-detected code inserted with a detection function are quoted or not according to the vulnerability detection logic in the code execution process;
if the variable is detected to be quoted, calling the inserted detection function to detect whether the variable is defined before being quoted;
and if the referenced variable is not defined, the variable coverage loophole exists, and the detection result is output.
5. The method according to claim 4, wherein the detecting whether the variable in the code to be detected, into which the detection function is inserted, is referenced according to the vulnerability detection logic during the execution of the code comprises:
detecting whether a variable identifier in the code to be detected, into which the detection function is inserted, appears behind an assigned identifier in the code to be detected in a code execution process;
if yes, the variable corresponding to the variable identification in the code to be detected is quoted; or
In the code execution process, when detecting that the variable identification exists in the code to be detected inserted with the detection function but the assignment identification does not exist, the variable corresponding to the variable identification in the code to be detected is quoted.
6. An apparatus for application vulnerability detection, the apparatus comprising:
the acquisition module is used for acquiring the detection range of the configured code to be detected;
the reading module is used for reading the vulnerability detection logic corresponding to the code to be detected in a preset rule base;
the vulnerability detection module is used for inserting a detection function into the code to be detected, executing the code to be detected with the detection function inserted, acquiring a variable identifier and an assignment identifier according to the vulnerability detection logic in the code execution process, detecting whether a variable corresponding to the variable identifier is quoted according to the positions of the variable identifier and the assignment identifier, if the variable is quoted, determining whether a vulnerability exists in the code to be detected based on whether the variable is defined before being quoted, and if the vulnerability exists, outputting a detection result.
7. The apparatus of claim 6, wherein the vulnerability detection module comprises:
the detection unit is used for inserting detection functions into the codes to be detected line by line, and for each line of codes to be detected, the line of codes to be detected into which the detection functions are inserted is executed after the detection functions are inserted;
the execution unit is used for outputting a detection result when detecting that the line of codes to be detected has a bug, deleting the detection function inserted by the line of codes to be detected, and continuously inserting the detection function into the next line of codes to be detected and executing the detection function until the execution of the codes to be detected is finished; and when detecting that the line of codes to be detected has no loopholes, deleting the detection function inserted by the line of codes to be detected, and continuing to insert the detection function into the next line of codes and executing the detection function until the execution of the codes to be detected is finished.
8. The apparatus of claim 6, wherein the obtaining module is further configured to obtain a code directory, a directory depth, and a file extension of the configured code to be detected.
9. The apparatus of claim 6, wherein the vulnerability detection module comprises:
the variable detection module is used for detecting whether the variable in the code to be detected, inserted with the detection function, is quoted or not according to the vulnerability detection logic in the code execution process;
the function calling module is used for calling the inserted detection function to detect whether the variable is defined before being referred if the variable is referred;
and the output module is used for outputting the detection result if the referenced variable is not defined.
10. The apparatus according to claim 9, wherein the variable detection module is further configured to detect whether a variable identifier in the code to be detected into which the detection function is inserted appears after an assigned identifier in the code to be detected during execution of the code; if yes, the variable corresponding to the variable identification in the code to be detected is quoted; or in the code execution process, when detecting that the variable identification exists in the code to be detected inserted with the detection function but the assignment identification does not exist, the variable corresponding to the variable identification in the code to be detected is quoted.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710097344.2A CN108459954B (en) | 2017-02-22 | 2017-02-22 | Application program vulnerability detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710097344.2A CN108459954B (en) | 2017-02-22 | 2017-02-22 | Application program vulnerability detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108459954A CN108459954A (en) | 2018-08-28 |
| CN108459954B true CN108459954B (en) | 2022-08-26 |
Family
ID=63220700
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710097344.2A Active CN108459954B (en) | 2017-02-22 | 2017-02-22 | Application program vulnerability detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108459954B (en) |
Families Citing this family (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109460663A (en) * | 2018-11-12 | 2019-03-12 | 北京知道创宇信息技术有限公司 | A kind of intelligence contract auditing method, device and its storage medium |
| CN109857669A (en) * | 2019-02-13 | 2019-06-07 | 杭州孝道科技有限公司 | A kind of JavaWEB vulnerability of application program detection method based on JavaAgent |
| CN110110523A (en) * | 2019-05-10 | 2019-08-09 | 极智(上海)企业管理咨询有限公司 | A method of it promoting rule code and scans accuracy rate |
| CN111783096B (en) * | 2019-08-28 | 2024-02-02 | 北京京东尚科信息技术有限公司 | Method and device for detecting security hole |
| CN110929264B (en) * | 2019-11-21 | 2022-08-30 | 中国工商银行股份有限公司 | Vulnerability detection method and device, electronic equipment and readable storage medium |
| CN113139190A (en) * | 2020-01-17 | 2021-07-20 | Oppo广东移动通信有限公司 | Program file detection method and device, electronic equipment and storage medium |
| CN113010899B (en) * | 2021-04-16 | 2022-06-07 | 上海交通大学 | PHP deserialization vulnerability exploitation chain detection method |
| CN113485923B (en) * | 2021-06-30 | 2022-12-27 | 展讯通信（上海）有限公司 | Project code detection method and device and electronic equipment |
| CN114048488B (en) * | 2022-01-13 | 2022-04-22 | 杭州默安科技有限公司 | Vulnerability detection method and system |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101017458A (en) * | 2007-03-02 | 2007-08-15 | 北京邮电大学 | Software safety code analyzer based on static analysis of source code and testing method therefor |
| CN102955914A (en) * | 2011-08-19 | 2013-03-06 | 百度在线网络技术（北京）有限公司 | Method and device for detecting security flaws of source files |
| CN102999420A (en) * | 2011-09-13 | 2013-03-27 | 阿里巴巴集团控股有限公司 | XSS (Cross Site Scripting) testing method and XSS testing system based on DOM (Document Object Model) |
| CN104933368A (en) * | 2014-03-21 | 2015-09-23 | 腾讯科技（深圳）有限公司 | Network security vulnerability detection method and apparatus |
| CN104951700A (en) * | 2014-10-11 | 2015-09-30 | 腾讯科技（深圳）有限公司 | Webpage loophole detecting method and device |
| CN105320591A (en) * | 2014-07-25 | 2016-02-10 | 腾讯科技（深圳）有限公司 | Code detection method and device |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101937388B (en) * | 2009-12-17 | 2013-03-13 | 张 | High-extensibility and high-maintainability source code defect detection method and device |
| CN103761471A (en) * | 2014-02-21 | 2014-04-30 | 北京奇虎科技有限公司 | Application program installation method and device based on intelligent terminal |
| CN104298594B (en) * | 2014-09-25 | 2018-03-02 | 南京航空航天大学 | A kind of automatic detection and localization method of source code median calculation mistake |
-
2017
- 2017-02-22 CN CN201710097344.2A patent/CN108459954B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101017458A (en) * | 2007-03-02 | 2007-08-15 | 北京邮电大学 | Software safety code analyzer based on static analysis of source code and testing method therefor |
| CN102955914A (en) * | 2011-08-19 | 2013-03-06 | 百度在线网络技术（北京）有限公司 | Method and device for detecting security flaws of source files |
| CN102999420A (en) * | 2011-09-13 | 2013-03-27 | 阿里巴巴集团控股有限公司 | XSS (Cross Site Scripting) testing method and XSS testing system based on DOM (Document Object Model) |
| CN104933368A (en) * | 2014-03-21 | 2015-09-23 | 腾讯科技（深圳）有限公司 | Network security vulnerability detection method and apparatus |
| CN105320591A (en) * | 2014-07-25 | 2016-02-10 | 腾讯科技（深圳）有限公司 | Code detection method and device |
| CN104951700A (en) * | 2014-10-11 | 2015-09-30 | 腾讯科技（深圳）有限公司 | Webpage loophole detecting method and device |
Non-Patent Citations (1)
| Title |
|---|
| 源代码安全漏洞检测方法探讨;马虹哲;《网络空间安全》;20161210;第57-60页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108459954A (en) | 2018-08-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108459954B (en) | Application program vulnerability detection method and device | |
| CN108614707B (en) | Static code checking method, device, storage medium and computer equipment | |
| CN110730107B (en) | Test data generation method and device, computer equipment and storage medium | |
| US11888885B1 (en) | Automated security analysis of software libraries | |
| CN111367595B (en) | Data processing method, program running method, device and processing equipment | |
| CN113158197B (en) | SQL injection vulnerability detection method and system based on active IAST | |
| CN104462985A (en) | Detecting method and device of bat loopholes | |
| CN108399125B (en) | Automatic testing method and device, computer equipment and storage medium | |
| CN111859380A (en) | Zero false alarm detection method for Android App vulnerability | |
| KR101696694B1 (en) | Method And Apparatus For Analysing Source Code Vulnerability By Using TraceBack | |
| US11868465B2 (en) | Binary image stack cookie protection | |
| CN112419057A (en) | Method, device, equipment and storage medium for generating and storing logs of intelligent contracts | |
| CN116383833A (en) | Method and device for testing software program code, electronic equipment and storage medium | |
| CN111913878A (en) | Program analysis result-based bytecode instrumentation method, device and storage medium | |
| CN114969762A (en) | Vulnerability information processing method, service device and vulnerability detection module | |
| CN111221721A (en) | Automatic recording and executing method and device for unit test cases | |
| US11695793B2 (en) | Vulnerability scanning of attack surfaces | |
| CN117493188A (en) | Interface testing method and device, electronic equipment and storage medium | |
| KR102117905B1 (en) | Credibility test result management data auto generation method and credibility test result management data auto generation apparatus | |
| CN115391230A (en) | Test script generation method, test script penetration method, test script generation device, test penetration device, test equipment and test medium | |
| US9824175B1 (en) | Method and system of evaluation of validity of a refinement rule for a hardware emulation | |
| CN114691197A (en) | Code analysis method and device, electronic equipment and storage medium | |
| CN116775040B (en) | Pile inserting method for realizing code vaccine and application testing method based on code vaccine | |
| CN115658551B (en) | Code testing method, storage medium, electronic device and apparatus | |
| CN116244195B (en) | PHP ras module hook stability test method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |