JP6866270B2 - SQL statement extraction device, SQL statement extraction method and program - Google Patents

Description

The present invention relates to a technique for statically analyzing a source code and extracting an SQL statement corresponding to a DAO (Data Access Object) method.

In a Web application with a three-layer architecture, it is difficult to identify the cause of a program malfunction or vulnerability by static analysis. Above all, in a program involving data access, since the SQL statement may be dynamically configured by executing the program, it is difficult to perform static analysis on the SQL statement corresponding to the DAO method.

Patent Document 1 discloses a technique for statically analyzing a source code (AP flow analysis and SQL flow analysis) to generate a set of possible values of variables constituting an SQL statement, and corresponds to the AP flow. A method of listing SQL statements has been proposed.

Japanese Unexamined Patent Publication No. 2011-253363

However, in the method of Patent Document 1, due to the problem of the accuracy of static analysis, the generation omission of a set of values that can be taken by the variables constituting the SQL statement may occur, and by extension, the DAO method as an AP flow. In some cases, the extraction of the SQL statement corresponding to the above was omitted.

Therefore, the present invention has been made in view of the above problems, and an object of the present invention is to extract an SQL statement corresponding to the DAO method even when the analysis accuracy is low.

The present invention is an SQL statement extraction device that has a processor and a memory and statically analyzes the source code, and has an analysis and visualization unit that statically analyzes the source code and extracts the SQL statement corresponding to the DAO method. Then, the analysis and visualization unit acquires the preset SQL map and the contact information for the SQL ID, analyzes the SQL map, generates the SQL ID from the contact information for the SQL ID, and maps the SQL ID and the SQL statement. A search target shaping map generation unit that generates data, a DAO search expression generation unit that analyzes the source code to extract the DAO method definition and generates a DAO search expression from the DAO method definition, and the SQL ID and SQL. It has a SQL statement candidate extraction unit that extracts SQL statement candidates corresponding to the DAO method using the statement map data and the DAO search formula.

According to the present invention, even if the analysis accuracy is low, the SQL statement corresponding to the DAO method can be extracted.

It is a block diagram which shows the Example of this invention and shows an example of the hardware structure of a computer system. It is a block diagram which shows the Example of this invention and shows an example of the function of a computer system. It is a figure which shows the Example of this invention and shows an example of SQL-Map. It is a figure which shows the Example of this invention and shows an example of the DAO method. It is a figure which shows the Example of this invention and shows an example of the map data of the SQL ID and the SQL statement. It is a figure which shows the Example of this invention and shows an example of the correspondence table of DAO method and SOURCE. It is a flowchart which shows an example of the process which shows the Example of this invention, analyzes the source code, extracts the SQL statement corresponding to the DAO method, and visualizes the extracted SQL. It is a flowchart which shows an example of the process which shows the Example of this invention, analyzes the source code, extracts the SQL statement corresponding to the DAO method, and visualizes the extracted SQL. It is a flowchart which shows an example of the process which shows the Example of this invention, visualizes the user selection method of a source code as a sequence diagram, and then displays the selected SQL statement on the sequence diagram. It is a figure which shows the Example of this invention and shows an example of the generated sequence diagram. It is a figure which shows the Example of this invention, and shows the example which the candidate of the SQL sentence is represented on the sequence diagram. It is a figure which shows the Example of this invention and shows the example which the SQL statement selected by the user is overlaid on the sequence diagram. It is a figure which shows the Example of this invention and shows an example of the concatenation table for SQLID. An embodiment of the present invention is shown, and an example of a DAO search type update table is shown.

Hereinafter, an embodiment relating to the SQL statement extraction device, the SQL statement extraction method, and the SQL statement extraction program according to the present invention will be described in detail with reference to the drawings.

In this embodiment, the source code is analyzed, the SQL statement corresponding to the DAO (Data Access Object) method is extracted, and the extracted SQL statement is visualized and displayed on the sequence diagram generated by the same source analysis. Here is an example.

In this embodiment, the Spring framework (registered trademark) is used as the application framework, and myBatis (registered trademark) is used as the O / R mapping (Object-relational mapping) framework. , The present invention is not dependent on any particular framework or language.

Further, in this embodiment, an example of generating a sequence diagram and overlaying an SQL statement on the sequence diagram will be given, but the output diagram is not limited to the sequence diagram, and the sequence diagram, communication diagram, class diagram, etc. Any other UML diagram, other original diagram, etc. may be used.

FIG. 1 is a block diagram showing an example of the hardware configuration of the information processing apparatus 100 according to the embodiment of the present invention. As the hardware of the information processing device 100, a central processing unit 101, an input device 102 such as a keyboard and a mouse, a secondary storage device 103, a main storage device 104, a display device 105 such as a display, and a communication device 107 are used. Have.

Each device is connected by a bus 106, and data can be transmitted and received between the devices. The communication device 107 is connected to the network 120. An information device A110 capable of storing data, such as an information processing device or network storage, is connected to the network 120.

FIG. 2 is a block diagram showing an example of the functions of the information processing device 100 and the information device A110 according to the embodiment of the present invention. In this embodiment, all the functions of the information processing device 100 will be described as software programs and data executed or operated by the central processing unit 101, but some or all of them are realized as hardware. You may.

In addition to these functions, there are an OS (Operating System), a control program, and the like that start and manage each function. In this embodiment, the cooperation processing of these functions will be described as appropriate, and it is obvious that the OS and the control program start and execute the functional blocks required for the cooperation processing described here as appropriate. , The description and description of these OSs and control programs will be omitted.

The information processing apparatus 100 according to the embodiment of the present invention is configured as a functional block as shown in FIG. The analysis and visualization execution unit 200 includes a search target shaping map generation unit 201, a DAO search expression generation unit 202, and a SQL statement candidate extraction unit 203, and includes map data 204 of SQLID and SQL statements, and DAO method and SQLID. Generate or refer to Correspondence Table 205, Concatenation Table 206 for SQL, and DAO Search Expression Update Table 207.

The information device A110 has an XML format SQL-Map230 and a source code (Java (registered trademark)) 231. The SQL-Map 230 and the source code 231 do not necessarily have to be in the above-mentioned device, and may be stored in either the information processing device 100 or the information device A110.

Each functional unit of the analysis and visualization execution unit 200 including the search target shaping map generation unit 201, the DAO search formula generation unit 202, and the SQL statement candidate extraction unit 203 is loaded into the main storage device 104 as a program and is a central processing unit. Performed by 101.

The central processing unit 101 operates as a functional unit that provides a predetermined function by processing according to the program of each functional unit. For example, the central processing unit 101 functions as an analysis and visualization execution unit 200 by processing according to an analysis and visualization program. The same applies to other programs. Further, the central processing unit 101 also operates as a functional unit that provides each function of a plurality of processes executed by each program. A computer and a computer system are devices and systems including these functional parts.

Information such as programs and tables that realize each function of the information processing device 100 can be stored in a secondary storage device 103, a non-volatile semiconductor memory, a hard disk drive, a storage device such as an SSD (Solid State Drive), or an IC card or SD card. , DVD or the like can be stored in a computer-readable non-temporary data storage medium.

By executing the above program, the information processing device 100 can function as an SQL statement extraction device. In addition, the above-mentioned concatenation table 206 and DAO search formula update table 207 for SQL ID, QL-Map 230, and source code 231 are preset information.

FIG. 3 is a diagram showing an example of SQL-Map230. In this embodiment, SQL-Map230 shows an example described in XML. In SQL-Map230, there is a mapper tag element including the namespace attribute "com.hitachi.user", and as a child element thereof, the id attribute "test" including the character string "SELECT id, name FROM user" is included. The select tag element is present.

The information processing apparatus 100 uses the information of SQL-Map 230 to generate map data 204 of SQL ID and SQL statement, and the generation method thereof will be described later.

FIG. 4 is a diagram showing a description example of the DAO of the source code 231. In the source code 231, the "test" method is described as a method of the Dao class. A DAO class method is analyzed to generate a DAO search expression, which is stored in the correspondence table 205 between the DAO method and SOURCE, and the method will be described later.

FIG. 5 is a diagram showing an example of map data 204 of SQLID and SQL statement. In the map data 204 of the SQL and the SQL statement, the SQL ID 2041 and the SQL statement 2042 corresponding to the SQL ID are stored. In this embodiment, the character string "SELECT id, name FROM user" is stored as the SQL statement 2042 corresponding to "com.hitachi.user.test" of SQLID2041. The method of generating the map data 204 of the present SQL and SQL statements will be described later.

FIG. 6 is a diagram showing an example of the correspondence table 205 between the DAO method and the SOURCE. Correspondence table 205 of DAO method and EQUID stores DAO method name 2051, DAO search expression 2052, EQULID 2053, and the number of selections 2054 in one entry.

In this embodiment, "test ()" is stored as the DAO method name 2051, "com \ .hitachi \ ... *. Test" is stored as the DAO search expression 2052, and "com.hitachi.user. "Test" and "com.hitachi.user2.test" are stored, and "com.hitachi.user.test" is stored as 5 and "com.hitachi.user2.test" is stored as 2 as the number of selections 2054. There is. The method of generating the correspondence table 205 between this DAO method and SOURCE will be described later.

FIG. 13 is a diagram showing an example of the connection table 206 for SQLID. The concatenation table 206 for SQL ID sets in advance which elements of SQL-Map230 are concatenated in what order to generate SQLID and which part corresponds to SQL statement when generating map data 204 of SQLID and SQL statement. ing.

The concatenation table 206 for SQL ID includes the number # 2061, the SQL ID 2062 including tags and attributes, and the SQL statement 2063 in one entry. In this embodiment, the value of the attribute "namespace" of the tag "mapper" of # 1 and the value of the attribute "id" of the tag "select" of # 2 or the value of the attribute "id" of the tag "insert" are set. SQLID is generated by concatenating in this order.

The generated SQL statement corresponding to the SQL ID corresponds to the content in which the item of the SQL statement in the connection table 206 for SQL ID is marked with a circle. For example, when the SQLID is generated by connecting with # 1 and # 2a, the content of the select tag becomes the SQL statement, and when the SQLID is generated by connecting with # 1 and # 2b, the content of the insert tag is the SQL statement. It becomes.

FIG. 14 is a diagram showing an example of the DAO search type update table 207. The DAO search formula update table 207 includes an item 2071, a number of times 2072, a threshold value 2073, and an implementation 2074 in one entry.

In the DAO search formula update table 207, what kind of item 2071 is analyzed when updating the DAO search formula, the number of times 2072 that can be analyzed correctly in the item 2071, the threshold value 2073 of the item, and whether or not the update is performed (2074) is stored. Details will be described later, but in this embodiment, it is determined that the DAO search formula is updated when the number of times 2072 that can be correctly analyzed in item 2071 is equal to or greater than the item threshold value 2073.

FIG. 7 is a flowchart showing an example of processing performed by the information processing apparatus 100. The analysis and visualization execution unit 200 of the information processing device 100 analyzes the source code 231, extracts the SQL statement corresponding to the DAO method, generates a sequence diagram, and outputs the sequence diagram to the display device 105. This process is started when a user of the information processing apparatus 100 or the like executes the analysis and visualization execution unit 200.

First, in step 700, the analysis and visualization execution unit 200 starts extracting the SQL statement corresponding to the DAO method, and generates and displays the sequence diagram.

In step 701, the analysis and visualization execution unit 200 acquires the SQL-Map 230 and the source code 231 from the information device A110.

In step 702, the analysis and visualization execution unit 200 determines whether or not the association between the DAO method and the SQL statement is completed. If the determination is true, the process proceeds to step 704. If the determination is false, the process proceeds to step 703.

As the determination method, in this embodiment, determination is made based on whether or not the map data 204 of the SQLID 2041 and the SQL statement shown in FIGS. 5 and 6 and the correspondence table 205 of the DAO method and the SQL statement are generated. It shall be. However, the determination method is not limited to this, and for example, if the source modification occurs after the execution of step 703, it is assumed that the association is not completed.

In step 703, the analysis and visualization execution unit 200 associates the DAO method with the SQL statement. This process will be described in detail later with reference to FIG.

In step 704, the analysis and visualization execution unit 200 receives the input of the method name to be processed from the user. Of course, a method may be used in which a list of method names included in the source code is generated in advance at the time of source code analysis and the user selects from the list.

In step 705, the analysis and visualization execution unit 200 analyzes the call relationship for the method received from the user in step 704, and generates a sequence diagram based on the analysis result. As described above, in this embodiment, the visualization diagram is visualized as a sequence diagram, but the visualization diagram is not limited to the sequence diagram, and the sequence diagram, communication diagram, class diagram, other UML diagram, other original diagram, etc. There may be.

FIG. 10 is a diagram showing an example of visualization by a sequence diagram. FIG. 10 shows an example in which the sequence diagram generated by the analysis and visualization execution unit 200 is output to the display device 105.

In the example of FIG. 10, there are four lifelines in the analysis result of the call relationship: ControllerClass (251), ServiceClass (252), Dao class (253), and DB (254). Then, the methods are called in the order of the "entry ()" method of the Controller class (251), the "serv_a ()" method of the Service class (252), and the "test ()" method of the Dao class (253). Here is an example.

Returning to FIG. 7, in step 706, the analysis and visualization execution unit 200 ends the display after extracting the SQL statement corresponding to the DAO method and generating the sequence diagram.

The order of the above processing may be such that the SQL statement corresponding to the DAO method may be extracted after the sequence diagram is generated, that is, the above steps 704 and 705 may be executed prior to the step 702.

FIG. 8 is a flowchart showing an example of a process in which the information processing apparatus 100 analyzes the source code and extracts the SQL statement corresponding to the DAO method. This flowchart details the process performed in step 703 of FIG.

In step 800, the analysis and visualization execution unit 200 starts extracting the SQL statement corresponding to the DAO method.

In step 801 the search target shaping map generation unit 201 analyzes the SQL-Map 230 acquired in step 701 and generates the map data 204 of the SQL and SQL statements according to the predefined connection table 206 for SQL ID.

In the example of the concatenation table 206 for SQLID shown in FIG. 13, the search target shaping map generation unit 201 concatenates the attribute values of the tags in the order of # 1 and # 2 to generate SQLID 2062. That is, the value of the attribute "namespace" of the tag "mapper" of # 1 and the value of the attribute "id" of the "select" of the tag # 2 or the value of the attribute "id" of the tag "insert" are set in this order. By concatenating, SQLID2062 is generated.

The SQL statement 2042 corresponding to the SQL ID generated by the search target shaping map generation unit 201 corresponds to the content in which the item of the SQL statement 2063 in the connection table 206 for the SQL ID is marked with a circle. For example, when the SQLID is generated by connecting with # 1 and # 2a, the content of the select tag is the SQL statement, and when the SQLID is generated by connecting with the # 1 and # 2b, the content of the insert tag is the SQL statement. It becomes.

In the example of SQL-Map230 of FIG. 3 and the example of the connection table 206 for SQLID of FIG. 13, SQLID2041 is "com.hitachi.user.test" as described in the map data 204 of the SQLID and SQL statement of FIG. The SQL statement 2042 becomes "SELECT id, name FROM user".

In step 802, the DAO search expression generation unit 202 analyzes the source code 231 acquired in step 701 and extracts the method name and definition of the DAO class. Then, the DAO search expression generation unit 202 analyzes the extracted definition part of the DAO method and generates a DAO search expression for searching the EQULID. Further, the DAO search expression generation unit 202 stores the generated DAO search expression together with the DAO method name in the correspondence table 205 of the DAO method and the SOURCE.

The DAO search expression generation method will be described with respect to the example of the DAO method “test ()” shown in FIG. The DAO search expression generation unit 202 can acquire a list of SQLIDs from the SQLID and the map data 204 of the SQL statement generated in step 801. However, a function call is made with an argument that partially matches or entirely matches any of these SQLIDs. The part (function call part) is extracted as the DAO search expression generation part.

That is, the DAO search expression generation unit 202 is a function call unit in the definition of the DAO method, and is an argument of the call function when the argument of the call function partially matches either SQLID or SQLID of the map data of the SQL statement. The part is the target for generating the DAO search expression.

In this embodiment, a function call "getSqlSession (). SelectOne ()" is performed in the DAO method "test ()" shown in FIG. 4, and "com.hitachi." Is used as an argument of the function. ＋ Something. getTableName () + ".test" is given.

Since this argument "com.hitachi." And ".test" partially match the EQULID "com.hitachi.user.test", this is the DAO search expression generation location. The DAO search expression is generated from this argument part. In this embodiment, "com. Hitachi." + Something. GetTableName () + ".test", "com.hitachi." And ".test" are good, but the character string in the part of "entity.getTableName ()" may not be known by static analysis.

Therefore, "entity.getTableName ()" is replaced with the regular expression ". *", And the DAO search expression is "com \ .hitachi \ .. * \. Test". At this time, the character string "." Is escaped.

In step 803, the SQL statement candidate extraction unit 203 uses the DAO search formula stored in the correspondence table 205 between the DAO method and the SQLID for the SQLID stored in the map data 204 of the SQL statement and the SQL statement, and uses the SQL statement. Candidates are extracted. The extracted SQL statement candidates are stored in the correspondence table 205 of the DAO method and SQL ID. At this time, 0 is also stored as the number of selections for the SQL statement candidate.

In step 804, the analysis and visualization execution unit 200 determines whether or not the next DAO method exists. If the determination is true, the process proceeds to step 802. If the determination is false, the process proceeds to step 805. In step 805, the analysis and visualization execution unit 200 finishes the extraction of the SQL statement corresponding to the DAO method.

FIG. 9 is a flowchart showing an example of a process in which the information processing apparatus 100 overlays and displays the designated SQL statement on the sequence diagram. The information processing apparatus 100 visualizes the user selection method of the source code as a sequence diagram, then the user selects the SQL statement of the DAO method used on the sequence diagram, and overlays the SQL statement on the sequence diagram. It is assumed that this flowchart is performed by the user at an arbitrary timing after the generation of the sequence diagram is completed in step 706 of FIG.

In step 900, the analysis and visualization execution unit 200 starts a flowchart for overlaying and displaying the SQL statement corresponding to the DAO method on the sequence diagram. In this embodiment, "when the user mouses over the DAO method" is assumed as the trigger event for starting this flowchart, but the present invention is not limited to this, and the object representing the DAO method is clicked. It may be a predetermined event such as when it is done.

In step 901, the analysis and visualization execution unit 200 accepts an input as to whether or not the user reselects the SQL statement corresponding to the DAO method that the user has moused over in step 900 from the candidates. If the determination is true, the process proceeds to step 903. If the determination is false, the process proceeds to step 902. It should be noted that this process may be executed at an arbitrary timing triggered by a user click or the like.

In step 902, the analysis and visualization execution unit 200 stores the SQL statement corresponding to the DAO method that the user has moused over in step 900 in the correspondence table 205 of the DAO method and the SQL ID, and is a SQL statement candidate for the DAO method. It is determined whether or not the user has already selected the SQL statement from the list. As the determination method, in the present embodiment, whether or not there is a SQLID2053 for the DAO method stored in the correspondence table 205 of the DAO method and the EQUID with a selection count of 2054 of 1 or more, or whether or not there is a SQLID2053 for the DAO method Judge whether the candidate is singular or not.

In the example of FIG. 6, when the user is hovering over the “test ()” of the DAO method name 2051, the number of selections of “com.hitachi.user.test” which is a candidate for the SQLID2053 of the “test ()” Is 5, and the number of times "com.hitachi.user2.test" is selected is 2, so it is determined that the item has already been selected. If the determination is true, the process proceeds to step 904. If the determination is false, the process proceeds to step 903.

In step 903, the analysis and visualization execution unit 200 displays SQL statement candidates corresponding to the DAO method on the sequence diagram, and accepts the user to select one from the displayed SQL statement candidates. When the user selects the SQL statement, the process proceeds to step 908.

In step 908, the analysis and visualization execution unit 200 overlays the selected SQL statement on the DAO method on the sequence diagram. Further, the analysis and visualization execution unit 200 increases the number of selections 2054 of the selected SQL statement in the correspondence table 205 of the DAO method and the SQL ID by 1.

FIG. 11 is a diagram showing an example of displaying SQL sentence candidates on a sequence diagram. Two SQL statement candidates for the DAO method "test ()" are displayed in the pop-up window 255. If the user selects the # 1 candidate and presses the OK button, the # 1 SQL statement is selected. ..

In step 904, the analysis and visualization execution unit 200 overlays the SQL statement selected by the user on the DAO method over which the mouse is over.

FIG. 12 is a diagram showing an example in which the SQL statement selected by the user is overlaid on the sequence diagram. In step 902, FIG. 11 gives an example in which # 1 of the SQL statement candidates is selected by the user, but in FIG. 12, the selected SQL statement 256 is overlaid on the DAO method.

Even when the determination in step 902 in FIG. 9 is true and the process proceeds to step 904, the SQL sentence candidate for the DAO method stored in the correspondence table 205 of the DAO method and the SQL ID has the largest number of selections 2054. It is displayed as an overlay. If there is only one SQL statement candidate, the SQL statement candidate is overlaid.

In step 905, the DAO search expression generation unit 202 determines whether or not to update the correspondence table 205 between the DAO method and the SOURCE. As the determination method, the SQLID of the SQL statement displayed as an overlay is compared with the DAO search formula of the DAO method that is moused over, and when the DAO search formula contains ". *", "*" (Wild card) Replace with the part corresponding to SQLID.

Then, the DAO search expression generation unit 202 checks whether or not the replaced character string (hereinafter referred to as the replacement character string A) can be acquired by static analysis by the item 2071 stored in the DAO search expression update table 207. If it can be obtained, 1 (or a predetermined value) is added to the number of times 2072 in the DAO search expression update table 207, and whether or not the number of times 2072 is set in advance by the system or is equal to or more than the threshold 2073 input by the user. Judge with.

Explaining with reference to FIG. 6, the SQL ID of the SQL statement overlaid on the screen of FIG. 11 is “com.hitachi.user” with respect to the DAO search formula 2052 “com \ .hitachi \ .. * \ .test”. .Test ”. Therefore, the above-mentioned replacement character string A becomes "user".

In step 905, it is determined whether or not this "user" can be acquired by static analysis. Here, the DAO search expression update table 207 is used in determining whether or not the replacement character string A can be acquired by static analysis.

Item 2071 of the DAO search expression update table 207 stores a "constructor" and a "setter method". Therefore, when the DAO method definition part corresponding to the above ". *" Is the getter method for the object given by the argument of the DAO method (in the example of FIG. 4, "entity.getTableName ()"), DAO The search expression generation unit 202 analyzes the object generation unit of the argument, and the replacement character string A is used in the constructor part, or the replacement character string is used by using the object method (setter method, etc.). Check if it is.

The DAO search formula generation unit 202 adds 1 to the number of times 2072 of the corresponding item 2071 in the DAO search formula update table 207 if the above-mentioned "user" is used in either of them. In FIG. 14, it is assumed that the replacement character string “user” is used in the item 2071 = “constructor”, and 1 is added to the number of times 2072 to obtain 3. Further, since the threshold value is 3, it is determined that the update of the DAO search formula is performed, and the process proceeds to step 906.

In step 906, the DAO search expression generation unit 202 analyzes the item 2071 that exceeds the threshold value 2073 in step 905 for all DAO methods including the regular expression ". *", And updates the DAO search expression.

In this embodiment, since the number of items 2071 = “constructor” 2072 exceeds the threshold value 2073 in step 905 as shown in FIG. 14, this analysis is performed for all DAO methods and the DAO search formula is updated.

In other words, the DAO search expression generation unit 202 accepts the user's selection from the SQL statement candidates, and a part or all of the SQLID of the selected SQL statement and the replacement character string A of the DAO search expression is predetermined. When the condition of is satisfied, 1 is added to the number of times 2072 of item 2071 in the DAO search formula update table 207, and when the number of times 2072 of the item 2071 exceeds the preset threshold 2073, the DAO search formula Update. In this embodiment, as a predetermined condition, when the argument of the corresponding DAO method is an object, if the character string that can be obtained by the getter method of the object and the replacement character string match, the object is used. Indicates that the constructor or setter method is parsed and the string is used.

After updating the DAO search formula, for the SQLID 2041 stored in the map data 204 of the SQL and SQL statements, the candidates of the SQL statement are extracted using the DAO search formula 2052 stored in the correspondence table 205 of the DAO method and the SQL ID. To do. The extracted SQL statement candidates are stored in the correspondence table 205 of the DAO method and SQL ID.

In step 907, the analysis and visualization execution unit 200 ends the flowchart for overlaying and displaying the SQL statement corresponding to the DAO method on the sequence diagram.

As described above, according to the present embodiment, due to the problem existing in Patent Document 1 described above, that is, the problem of the accuracy of static analysis, the generation omission of the set of possible values of the variables constituting the SQL statement occurs. As a result, the problem that the extraction of the SQL statement corresponding to the DAO method may be omitted may occur.

In addition, by preferentially using the SQL statement selected by the user from the extracted SQL statement candidates at the time of visualization, it is easy to identify the cause of program malfunction or vulnerability in the Web application of the three-layer architecture. It becomes possible to do it.

The present invention is not limited to the above-described examples, and includes various modifications. For example, the above-described embodiment is described in detail in order to explain the present invention in an easy-to-understand manner, and is not necessarily limited to the one including all the configurations described. Further, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Further, for a part of the configurations of each embodiment, any of addition, deletion, or replacement of other configurations can be applied alone or in combination.

Further, each of the above configurations, functions, processing units, processing means and the like may be realized by hardware by designing a part or all of them by, for example, an integrated circuit. Further, each of the above configurations, functions, and the like may be realized by software by the processor interpreting and executing a program that realizes each function. Information such as programs, tables, and files that realize each function can be stored in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

In addition, the control lines and information lines indicate those that are considered necessary for explanation, and do not necessarily indicate all the control lines and information lines in the product. In practice, it can be considered that almost all configurations are interconnected.

100 Information processing device 101 Central processing device 104 Main storage device 200 Analysis and visualization execution unit 201 Search target shaping map generation unit 202 DAO search formula generation unit 203 SQL statement candidate extraction unit 204 SQL and SQL statement map data 205 DAO method and SQL ID Correspondence table 206 SQL concatenation table 207 DAO search formula update table 230 SQL-Map

Claims (11)

An SQL statement extractor that has a processor and memory to statically analyze source code.
It has an analysis and visualization unit that statically analyzes the source code and extracts the SQL statement corresponding to the DAO method.
The analysis and visualization unit
Search target formatting map generation that acquires preset SQL map and contact information for SQL, analyzes the SQL map, generates SQLID from the contact information for SQL, and generates map data of the SQL and SQL statements. Department and
A DAO search expression generator that analyzes the source code, extracts the definition of the DAO method, and generates a DAO search expression from the definition of the DAO method.
An SQL statement candidate extraction unit that extracts SQL statement candidates corresponding to the DAO method using the SQLID and SQL statement map data and the DAO search expression, and an SQL statement candidate extraction unit.
An SQL statement extraction device characterized by having. The SQL statement extraction device according to claim 1.
The analysis and visualization unit
It also has a visualization diagram generation unit that statically analyzes the source code to generate a visualization diagram.
The visualization diagram generation unit
An SQL statement extraction device characterized by outputting a candidate for the SQL statement triggered by a received trigger event. The SQL statement extraction device according to claim 1.
The DAO search formula generator
In the function call part of the definition of the DAO method, when the argument of the call function partially matches either the SQLID or the SQLID of the map data of the SQL statement, the argument part of the call function is the target for generating the DAO search expression. An SQL sentence extraction device characterized in that. The SQL statement extraction device according to claim 3.
The DAO search formula generator
An SQL statement extraction device characterized in that a DAO search expression is generated from a replacement character string in which a portion other than the character string is replaced with ". *" With respect to the generation target of the DAO search expression. The SQL statement extraction device according to claim 2.
The visualization diagram generation unit
An SQL statement extraction device characterized in that when outputting SQL statement candidates in accordance with the DAO method from the extracted SQL statement candidates, priority is given to the SQL statement that has been selected many times in the past. .. A computer with a processor and memory is an SQL statement extraction method that statically analyzes source code.
The first step in which the computer acquires the SQL map, the contact information for SQL ID, and the source code.
A second step in which the computer analyzes the SQL map, generates SQLID from the contact information for SQLID, and generates map data of the SQLID and SQL statement.
A third step in which the computer analyzes the source code, extracts the definition of the DAO method, and generates a DAO search expression from the definition of the DAO method.
A fourth step in which the computer extracts a candidate for the SQL statement corresponding to the DAO method by using the map data of the SQLID and the SQL statement and the DAO search formula.
A SQL statement extraction method comprising. The SQL statement extraction method according to claim 6.
The computer further includes a fifth step of statically analyzing the source code to generate a visualization diagram.
The fifth step is
A SQL statement extraction method characterized in that a candidate for the SQL statement is output triggered by a received trigger event. The SQL statement extraction method according to claim 6.
The third step is
In the function call part of the definition of the DAO method, when the argument of the call function partially matches either the SQLID or the SQLID of the map data of the SQL statement, the argument part of the call function is the target for generating the DAO search expression. A SQL sentence extraction method characterized in that. The SQL statement extraction method according to claim 8.
The third step is
A SQL statement extraction method characterized in that a DAO search expression is generated from a replacement character string in which a part other than the character string is replaced with ". *" For the generation target of the DAO search expression. The SQL statement extraction method according to claim 7.
The fifth step is
A SQL statement extraction method characterized in that when outputting SQL statement candidates in accordance with the DAO method from the extracted SQL statement candidates, priority is given to the SQL statement that has been selected many times in the past. .. A program that statically analyzes source code on a computer that has a processor and memory.
The first step to obtain the SQL map, contact information and source code for SQL, and
The second step of analyzing the SQL map, generating the SQL ID from the contact information for the SQL ID, and generating the map data of the SQL ID and the SQL statement,
The third step of analyzing the source code, extracting the definition of the DAO method, and generating the DAO search expression from the definition of the DAO method, and
A fourth step of extracting SQL sentence candidates corresponding to the DAO method using the SQLID and SQL statement map data and the DAO search expression, and
A program for causing the computer to execute.

Images