WO2010134123A1 - Test support device and test support method - Google Patents

Abstract

A test support device (100) comprises: an original program acquisition unit (52) for acquiring an original program to be tested; a syntax tree generation unit (54) for generating a syntax tree, based on a program code described in the original program; a syntax tree modification unit (56) for setting, in the syntax tree, to a node of a control command for controlling an execution flow in the original program, a node of a logging command for outputting a message indicating that the execution flow has been controlled by the control command, in correspondence to each other; and a test program output unit (58) for outputting, with reference to the modified syntax tree, a test program in which the logging command is set in correspondence with the control command.

Description

Test support apparatus and test support method

The present invention relates to a data processing technique, and more particularly to a technique for testing a computer program.

A penetration test is known as a test for detecting security vulnerabilities in computer programs. In the penetration test, data indicating a known attack pattern is input to a computer program to be tested, and output data from the computer program is verified.

JP 2005-228177 A

The penetration test is a black box test that focuses on output data from a computer program without considering the internal structure of the computer program. Therefore, although it can be detected that there is a security vulnerability in the computer program to be tested, since the internal structure is a black box, it may take time to solve the problem existing in the computer program.

The present invention has been completed based on the above-mentioned problem recognition of the present inventor, and its main purpose is to provide a technique for supporting a test for a computer program.

In order to solve the above problems, a test support apparatus according to an aspect of the present invention includes a program acquisition unit that acquires a test target program described in a predetermined programming language as an original program, and a grammar rule of the programming language. A syntax tree generation unit that generates a syntax tree having each element of program code described in the original program as a node, and a control instruction node that controls the execution flow of the original program in the syntax tree, the control instruction A syntax tree altering unit that associates and sets a node of a logging instruction that outputs a message indicating that the execution flow is controlled, and execution when predetermined test data is input to the original program with reference to the syntax tree This is a program for checking the flow, and the logging command is set in association with the control command. It includes a program output unit that outputs the test program, the.

Another aspect of the present invention is also a test support apparatus. This device is a program for enabling confirmation of an execution flow when predetermined test data is input to an original program that is a program to be tested, and is associated with a control instruction that controls the execution flow of the original program. A program acquisition unit that acquires a test program in which a logging instruction that outputs a message indicating that the execution flow is controlled by the control instruction is set, and the test data is input to the test program. Refer to the test execution unit that outputs a message with the logging command executed according to the command and the message output from the test program, identify the logging command executed according to the test data, and set it in the test program. Test the ratio of executed logging instructions to the original logging instructions against the original program Includes a coverage situation identifying unit for calculating a coverage percentage, a coverage situation display unit for displaying the calculated coverage ratio, the.

Still another aspect of the present invention is a test support method. This method includes a step of acquiring a test target program described in a predetermined programming language as an original program, and a syntax tree having each element of the program code described in the original program as a node according to a grammatical rule of the programming language. In the syntax tree, in the syntax tree, the node of the control instruction that controls the execution flow of the original program is associated with the node of the logging instruction that outputs a message indicating that the execution flow is controlled by the control instruction. This is a program for checking the execution flow when predetermined test data is input to the original program by referring to the syntax tree and the syntax tree, and the logging instruction is set in association with the control instruction. Outputting a test program to be executed on a computer. That.

It should be noted that any combination of the above-described constituent elements and the expression of the present invention converted between the apparatus, method, system, program, recording medium storing the program, etc. are also effective as an aspect of the present invention.

According to the present invention, a test for a computer program can be supported.

It is a block diagram which shows the function structure of the test assistance apparatus which is embodiment of this invention. It is a figure which shows the structure of the definition information of a control command node. It is a figure which shows the structure of logging command list information. It is a figure which shows the structure of logging command list information. It is a flowchart which shows operation | movement of a test assistance apparatus. It is a figure which shows the example of the program code of an original program. It is a figure which shows the example of the program code of an original program. It is a figure which shows an example of the original syntax tree produced | generated from the original program of Fig.5 (a). It is a figure which shows an example of the original syntax tree produced | generated from the original program of FIG.5 (b). FIG. 7 is a diagram illustrating a modified syntax tree obtained by modifying the original syntax tree of FIG. FIG. 7 is a diagram illustrating a modified syntax tree obtained by modifying the original syntax tree of FIG. It is a figure which shows the example of the program code of the program for a test. It is a figure which shows the example of the program code of the program for a test. It is a flowchart which shows operation | movement of a test assistance apparatus. It is a figure which shows the output data of the program for a test output to the HTML file. It is a figure which shows the output data of the program for a test output to the HTML file. It is a flowchart which shows operation | movement of a test assistance apparatus. It is a figure which shows the display image of the coverage status by a coverage status display part.

This embodiment proposes a test support apparatus that visualizes an execution flow of a program code in a penetration test for an original program (hereinafter also referred to as an “original program” as appropriate) to be a penetration test target. The test support apparatus is configured to output a message for notifying the user of the execution flow in accordance with the execution of the control instruction for controlling the execution flow of the original program among the instructions described in the program code in the original program. Modify the original program. This message is hereinafter referred to as an “execution flow message”.

Specifically, the test support apparatus according to the present embodiment generates an abstract syntax tree having each element of the program code described in the original program as a node. In the abstract syntax tree, for a node indicating a control instruction (hereinafter also referred to as a “control instruction node” as appropriate), a node indicating a logging instruction that outputs an execution flow message that can specify the control instruction (hereinafter referred to as “control instruction node”). (Also referred to as “logging command node” as appropriate). Then, the test support apparatus generates a program in which the original program is modified (hereinafter also referred to as “test program” as appropriate) from the abstract syntax tree to which the logging command node is added. In this test program, a logging command is associated with a control command.

As in the test support apparatus of this embodiment, in order to modify the original program, the program code itself is not analyzed, but the abstract syntax tree corresponding to the original program is analyzed, and the control instructions are associated with each other. This makes it easy to set logging commands. For example, even in the same conditional branch process, there are various description patterns as program codes as in the following three examples.
First description pattern:
If (status) operation;
Second description pattern:
If (status) {
operation;
}
Third description pattern:
If (status)
{
operation;
}

When analyzing the program code itself, an analysis process corresponding to each pattern of the above three examples is required. On the other hand, in the abstract syntax tree, the difference in the format level of the program code is absorbed and becomes the same node configuration, so that the process of adding the logging command node to the control command node can be made common. In other words, it is possible to perform processing with a common logic independent of the program code description pattern. As a result, the program code for realizing the test support apparatus can be reduced in code amount and easy maintenance can be realized.

Furthermore, the test support apparatus according to the present embodiment executes a penetration test on the generated test program. And the execution flow message which can specify the control command which controlled the execution flow is output by the logging command performed in this penetration test. According to the test support apparatus of the present embodiment, the execution flow at the time of execution of the penetration test for the original program is visualized, and it becomes easy to identify a problem location existing in the original program, and can support a quick solution of the problem.

FIG. 1 is a block diagram showing a functional configuration of a test support apparatus 100 according to an embodiment of the present invention. The test support apparatus 100 includes a storage unit 10, a UI unit 30, and a data processing unit 40. The storage unit 10 is a storage area for holding various data. The UI unit 30 is responsible for user interface processing for the user, such as a program developer or a tester. The data processing unit 40 executes various types of data processing based on data held in the storage unit 10 and data acquired by the UI unit 30. The data processing unit 40 also serves as an interface between the storage unit 10 and the UI unit 30.

Each block shown in the block diagram of the present specification can be realized in terms of hardware by an element such as a CPU of a computer or a mechanical device, and in terms of software, it can be realized by a computer program or the like. The functional block realized by those cooperation is drawn. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software. For example, the memory or the auxiliary storage device may execute the processing of the storage unit 10. In addition, the CPU reads a program module in which the processing contents of the UI unit 30 and the data processing unit 40 are mounted into the memory, and executes various processes of the UI unit 30 and the data processing unit 40 according to the respective program modules. Also good.

Storage unit 10:
The storage unit 10 includes an original program holding unit 12, a node definition holding unit 14, a logging command holding unit 16, a test program holding unit 18, an input data holding unit 20, and an output data holding unit 22. The original program holding unit 12 holds the source code of the original program. There is no limitation on the programming language for describing the original program, and for example, PHP / JAVA (registered trademark) may be used.

The node definition holding unit 14 holds the definition information of the control instruction node. Specifically, for abstract structure trees generated from original programs written in different programming languages such as PHP and JAVA, the definition information of control instruction nodes that can exist in each abstract syntax tree is held. . A specific example of this definition information will be described later with reference to FIG.

The logging command holding unit 16 holds attribute information of each logging command as logging command list information for a plurality of logging commands set in association with each of the plurality of control commands in the test program. A specific example of the logging command list information will be described later with reference to FIG. The test program holding unit 18 holds a test program in which the original program is modified.

The input data holding unit 20 holds test data for executing a penetration test on the original program. This test data is typically data in which a known attack pattern for confirming the presence or absence of a program vulnerability is set. For example, it may be test data including a program code written in a script language for verifying the presence or absence of vulnerability to cross-site scripting. Further, it may be test data including a character string for verifying whether or not there is a vulnerability to SQL (Structured Query) Language injection. The output data holding unit 22 holds output data output from the test program in the penetration test.

UI unit 30:
The UI unit 30 includes an instruction receiving unit 32, an execution flow display unit 34, and an coverage status display unit 36. The instruction receiving unit 32 receives various instructions input by the user via various input devices. The execution flow display unit 34 displays output data from the test program in the penetration test on the display.

The coverage status display unit 36 displays the ratio (hereinafter referred to as “coverage rate” as appropriate) of the execution of the program code of the original program in the penetration test in the entire program code of the original program. The coverage status display unit 36 displays a list of logging commands set in the test program. At that time, logging commands that have not been executed in the penetration test are displayed on the display in a manner that is easier for the user to see than the executed logging commands. For example, an unexecuted logging command may be displayed in a character size larger than an executed logging command, a display color that is more easily visible, or the like.

Data processing unit 40:
The data processing unit 40 includes a modification unit 50 that modifies the original program into a test program, and a test unit 60 that performs a penetration test on the test program. The modification unit 50 includes an original program acquisition unit 52, a syntax tree generation unit 54, a syntax tree modification unit 56, and a test program output unit 58. The test unit 60 includes a test program acquisition unit 62, a test execution unit 64, and an coverage status specifying unit 66.

The original program acquisition unit 52 reads the original program data from the original program holding unit 12 into the memory. The syntax tree generation unit 54 performs lexical analysis and syntax analysis on the program code described in the original program by a predetermined method according to the grammar rules of the programming language being used. Then, data of an abstract syntax tree (hereinafter referred to as “original syntax tree” as appropriate) based on the original program is generated in the memory.

The syntax tree generation unit 54 may create an original syntax tree by a known method such as an LR syntax analysis method, or may create an original syntax tree by calling a known parsing function. As an example of the latter, by passing the original program data described in JAVA to the library function of JDT (Java Development Tools) provided by Eclipse (registered trademark), an abstract syntax tree corresponding to the original program is obtained. It may be generated. Similarly, an abstract syntax tree corresponding to the original program described in PHP may be generated by calling a library function of PDT (PHP Development Tools) provided by Eclipse.

The syntax tree modifying unit 56 refers to the control instruction node definition information stored in the node definition holding unit 14, and identifies the control instruction node corresponding to the programming language of the original program among the nodes of the original syntax tree. This control instruction node includes, for example, a node indicating a method declaration, a method call instruction, a conditional branch instruction such as if / else / switch, a repeat instruction such as for / while, and an exception processing instruction such as try / catch.

The syntax tree modifying unit 56 is associated with the control instruction node, and typically sets a logging instruction node as a node immediately below the control instruction node in the original syntax tree, thereby modifying the original syntax tree ( Hereinafter, the data of “modified syntax tree” is set as appropriate. When setting the modified syntax tree, the syntax tree modifying unit 56 associates the identification information of the control instruction node in the original syntax tree with the identification information of the logging instruction node in the modified syntax tree and stores them in the logging instruction holding unit 16. Let

Note that the syntax tree generation unit 54 may generate an object of a DOM (Document Object Model) tree having each node of the original syntax tree as a child node under the root node as data in the original syntax tree. At this time, each child node may have information indicating the type of control instruction as its attribute (for example, class type). The syntax tree modifying unit 56 traverses the DOM tree indicating the original syntax tree to detect a control instruction node, and sets a logging instruction node to be associated with the detected control instruction node as a new child node in the DOM tree. Also good. In this case, the DOM tree to which the logging command node is added becomes the modified syntax tree data.

The test program output unit 58 generates a test program according to the modified syntax tree data and the logging command list information stored in the logging command holding unit 16 and stores it in the test program holding unit 18. This test program may be a source code in which a logging instruction is set in association with each of a plurality of control instructions in the original program, or may be an executable binary code corresponding to the source code.

Here, the test program setting process in the test program output unit 58 will be described in detail. First, the test program output unit 58 determines an execution flow message to be output by the logging command according to the correspondence relationship between the control command node and the logging command node stored as the logging command list information. Specifically, the identification information of the control command corresponding to the logging command, for example, the identification name and position information of the control command in the original program is set as the execution flow message.

Next, the test program output unit 58, by inputting the execution flow message to a predetermined conversion function, differs from the execution flow message, and after-conversion data for uniquely specifying the execution flow message (hereinafter referred to as the execution flow message). As appropriate, also referred to as “message identification data”). For example, an execution flow message may be input to a predetermined hash function, and a hash value uniquely generated from the execution flow message may be acquired as message identification data. The test program output unit 58 further associates the execution flow message with the message identification data corresponding to the execution flow message and causes the logging command holding unit 16 to further store the execution flow message.

Next, the test program output unit 58 determines a logging command corresponding to the programming language of the original program. The logging command may be a command for outputting argument data to a standard output or a predetermined log file, or a command for recording argument data in a predetermined database. For example, when the original program is written in PHP, the “echo” command may be used as the logging command. The test program output unit 58 sets the message identification data as an argument of the logging command so that the message identification data corresponding to the execution flow message is output by the logging command, not the execution code notification message itself.

Finally, the test program output unit 58 refers to the modified syntax tree and generates a test program in which logging instructions are appropriately inserted into the program code of the original program. When generating the source code of the test program, the source code corresponding to the modified syntax tree may be generated by sequentially setting a predetermined program code corresponding to each node of the modified syntax tree. Similarly to the syntax tree generation unit 54, a source code may be generated from data of an abstract syntax tree by calling a known library function. When generating an executable binary code, it is only necessary to sequentially execute semantic analysis, link processing, and the like on the modified syntax tree and output the binary code, as in normal compilation processing.

The test program acquisition unit 62 reads the test program data from the test program storage unit 18 into the memory. The test execution unit 64 executes a penetration test for the test program. Specifically, the test data stored in the input data holding unit 20 is acquired and input to the test program to operate the test program, and the output data from the test program is stored in the output data holding unit 22 Let This output data includes the processing result of the test data by the test program and the message identification data from the logging command set in association with the control command.

The coverage status specifying unit 66 refers to the logging command list information recorded in the logging command holding unit 16 and the message identification data recorded in the output data holding unit 22, and specifies the logging command executed in the penetration test. To do. The coverage status specifying unit 66 calculates the ratio of the number of output message identification data to the total number of logging commands in the logging command list information as the coverage rate of the penetration test for the original program. When calculating the number of output message identification data, the same message identification data is counted as 1 even if it is output a plurality of times.

FIG. 2 shows the structure of the definition information of the control instruction node. In the language column, the type of programming language is recorded. In the control instruction column, identification information of a control instruction node among a plurality of types of nodes that can exist in the abstract syntax tree of each programming language is recorded. That is, the syntax tree modifying unit 56 refers to the control instruction field corresponding to the programming language of the original program, and when the control instruction node recorded in the control instruction field is detected in the original syntax tree, immediately after the control instruction node. Insert a predetermined logging instruction node.

3A and 3B show the structure of the logging command list information. In the logging command ID column, identification information for uniquely specifying the logging command inserted into the test program is recorded. In the logging command node column, identification information of the logging command node in the modified syntax tree is recorded. In the figure, it is recorded in the format of “logging command node identification name: line number in test program”. In the control instruction node column, identification information in the original syntax tree of the control instruction node in which the logging instruction node is set in the modified syntax tree is recorded. In the figure, it is recorded in the format of “control command node identification name: line number in original program”. An execution flow message is recorded in the execution flow message column, and message identification data is recorded in the message identification data column.

The operation of the above configuration will be described below.
FIG. 4 is a flowchart showing the operation of the test support apparatus 100. When the instruction receiving unit 32 receives an instruction to create a test program from the user, the original program acquiring unit 52 acquires the data of the original program from the original program holding unit 12 (S10). FIG. 5A and FIG. 5B show examples of the program code of the original program. FIG. 5A shows an original program written in JAVA, and includes control instructions 102a to 102g. FIG. 5B shows an original program written in PHP and includes control instructions 102h to 102k. Returning to FIG.

The syntax tree generation unit 54 generates data of the original syntax tree corresponding to the original program in the memory (S12). FIG. 6A shows an example of an original syntax tree generated from the original program of FIG. The control instruction nodes 104a to 104g in FIG. 6A correspond to the control instructions 102a to 102g in FIG. In the figure, each control instruction node is shown in the format of “control node identification name: line number in original program”. Each node in the subsequent abstract syntax tree is shown in the same format. FIG. 6B shows an example of an original syntax tree generated from the original program shown in FIG. The control command nodes 104h to 104k in FIG. 6B correspond to the control commands 102h to 102k in FIG. Returning to FIG.

The syntax tree modifying unit 56 sets a modified syntax tree in which the original syntax tree is modified by detecting a control instruction node existing in the original syntax tree and setting a logging instruction node in association with the control instruction node. (S14). Then, the syntax tree modifying unit 56 associates the identification information of the control instruction node in the original syntax tree with the identification information of the logging instruction node set for the control instruction node in the modified syntax tree to the logging instruction holding unit 16. Store (S16). In the present embodiment, a logging command ID field, a logging command node field, and a control command node field in the logging command list information are set.

FIG. 7 (a) shows a modified syntax tree obtained by modifying the original syntax tree of FIG. 6 (a). In the modified syntax tree of FIG. 6, the logging command nodes 106a to 106g are associated with the control command nodes 104a to 104g in FIG. Also, the logging command node column and the control command node column of the logging command ID “001” in FIG. 3A indicate data recorded when setting the logging command node 106a in association with the control command node 104a. Yes. That is, the logging command node column indicates identification information of the logging command node 106a in the modified syntax tree, and the control command node column indicates identification information of the control command node 104a in the original syntax tree. Similarly, the records of the logging command IDs “002” to “007” in FIG. 3A are recorded when the logging command nodes 106b to 106g are set in association with the control command nodes 104b to 104g, respectively. Data is shown.

FIG. 7 (b) shows a modified syntax tree obtained by modifying the original syntax tree of FIG. 6 (b). In the modified syntax tree of FIG. 6, the logging command nodes 106h to 106k are associated with the control command nodes 104h to 104k in FIG. 6B. Further, the logging command node column and the control command node column of the logging command ID “001” in FIG. 3B indicate data recorded when setting the logging command node 106h in association with the control command node 104h. Yes. That is, the logging command node column indicates identification information of the logging command node 106h in the modified syntax tree, and the control command node column indicates identification information of the control command node 104h in the original syntax tree. Similarly, the records of the logging command IDs “002” to “004” in FIG. 3B are recorded when the logging command nodes 106i to 106k are set in association with the control command nodes 104i to 104k, respectively. Data is shown. Returning to FIG.

The test program output unit 58 refers to each record of the logging command list information, determines an execution flow message to be output by the logging command, and determines message identification data corresponding to the execution flow message. Then, the execution flow message and message identification data are added and recorded in each record of the logging command list information (S18). The test program output unit 58 is added with a logging command for outputting message identification data according to the modified syntax tree and the logging command list information, and stores the test program in which the original program is modified in the test program holding unit 18. (S20).

The execution flow message field in FIG. 3 (a) and FIG. 3 (b) is "Test log fixed character string | Logging instruction ID | Original program file name | Control instruction identification name | Control instruction line number in original program" An execution flow message of the form Of these, “Control command identification name | Control program line number in original program” is set to the record data of the control command node column. Also, the message identification data column in FIGS. 3A and 3B shows a hash value obtained by inputting the execution flow message into a predetermined hash function.

FIG. 8 (a) shows an example of a test program corresponding to the original program of FIG. 3 (a). This figure shows the program code generated in accordance with the modified syntax tree of FIG. 7A and the logging instruction list information of FIG. In the figure, logging commands 108a to 108g are set in association with the control commands 102a to 102g described in the original program. FIG. 8B shows an example of a test program corresponding to the original program shown in FIG. This figure shows the program code generated in accordance with the modified syntax tree of FIG. 7B and the logging instruction list information of FIG. 3B. In the figure, logging commands 108h to 108k are set in association with the control commands 102h to 102k described in the original program.

When the logging command node set in the logging command list information is detected by the modified syntax tree, the test program output unit 58 generates a test program by setting the message identification data as an argument of a predetermined logging command. To do. The logging instruction “insert” in FIGS. 8A and 8B is a function defined by the user, and outputs character string data specified by an argument to a predetermined file or database.

The logging command in this embodiment is a command for outputting character string data specified by an argument to the output destination of the processing result in the original program. Thus, message identification data is output in parallel with the processing result output by the program code described at the beginning of the original program, and the correspondence between the processing result and the execution flow is facilitated. Further, the logging command of the present embodiment is a command for outputting the message identification data specified by the argument in such a manner that it is normally hidden in software for browsing the processing result in the original program. For example, when the output destination of the processing result in the original program is a structured document such as an HTML file or an XML file, the character string data specified by the argument is output as a comment sentence in the structured document.

FIG. 9 is a flowchart showing the operation of the test support apparatus 100. The instruction receiving unit 32 receives from the user an instruction to start a penetration test for the test program, and the test program acquiring unit 62 reads the test program data from the test program holding unit 18 (S30). The test execution unit 64 reads the test data stored in the input data holding unit 20, operates the test program by inputting the test data into the test program, and executes the penetration test (S32). When executing the test program, if the test program is a source code, it is appropriately converted into an executable binary code as necessary.

Subsequently, the test execution unit 64 stores the output data from the test program accompanying the operation of the test program in the output data holding unit 22 (S34). This output data includes message identification data output by the logging command. The test execution unit 64 may store the output data from the test program as character data in the structured document file, or may store it as a record of a predetermined table in the database.

The instruction receiving unit 32 receives a display request for output data from the test program from the user (S36). If it is a display request from a user who does not have the authority to refer to the execution flow message (N in S38), the execution flow display unit 34 displays the output data from the test program as it is. FIG. 10 shows the output data of the test program output to the HTML file. This figure shows output data when the “theMethod” method indicated by the control instruction 102h in FIG. 8B is called in the penetration test. In the figure, since the message identification data is displayed as it is, it is difficult to grasp the execution flow of the original program in the penetration test. Returning to FIG.

If it is a display request from a user who has an authority to refer to the execution flow message (Y in S38), the execution flow display unit 34 refers to the logging command list information in the logging command holding unit 16 and outputs from the test program. The message identification data, which is data, is converted into an execution flow message associated with the message identification data and displayed (S40). FIG. 11 shows the output data of the test program output to the HTML file. In the figure, since the message identification data of FIG. 10 is converted into the corresponding execution flow message, the execution flow of the original program in the penetration test can be easily confirmed. Note that whether or not the user has the reference authority may be determined by a known user authentication method, and may be determined by, for example, the ID of the user terminal or user input data at the time of login.

FIG. 12 is a flowchart showing the operation of the test support apparatus 100. S30 to S34 in the figure are the same as S30 to S34 in FIG. The instruction receiving unit 32 receives from the user a request to display the test coverage for the original program. The coverage status specifying unit 66 refers to the message identification data stored in the output data holding unit 22 and specifies a logging command executed by the test (S50). That is, the logging command corresponding to the message identification data stored in the output data holding unit 22 can be specified as the logging command executed by the test. The coverage status specifying unit 66 refers to the logging command list information in the logging command holding unit 16 and calculates the number of executed logging commands in the total number of logging commands as a coverage rate (S52). The coverage status display unit 36 displays the coverage rate calculated by the coverage status specifying unit 66 on the display (S54). Further, when displaying the list of logging commands, the coverage status display unit 36 highlights the logging commands that have not been executed in the test more than the executed logging commands (S56).

FIG. 13 shows a display image of the coverage status by the coverage status display unit 36. Note that the coverage status in FIG. 5 indicates the test coverage status for the original program in FIG. In this example, since the total number of logging instructions is 7 and the number of executed logging instructions is 5, the code coverage is displayed as 71%. In the execution flow message list display, a message output in an unexecuted logging command is highlighted with a bold font and a larger character size than other messages. The user who confirms the result can recognize that the test data or the like should be adjusted so that the condition determination on the 15th line in the original program in FIG. 5A becomes true in order to improve the coverage rate.

According to the test support apparatus 100 of this embodiment, when the penetration test for the original program is to be executed, the penetration test is executed for the test program in which the logging command is set in association with the control command. Thereby, the user can check the execution flow of the original program when the penetration test is executed. When a problem is detected in the penetration test, the problem part can be quickly identified by referring to the corresponding part of the original program execution flow. In the logging instruction, the description position of the control instruction in the original program is output instead of the description position of the control instruction in the test program. Thereby, it becomes easy to identify the problem location which exists in the original program. Since the original program is to be repaired by the user, the repair work by the user can be further supported. Further, not the program code itself described in the original program but the abstract syntax tree corresponding to the original program is modified to generate a test program. As a result, the control command can be detected easily and accurately without depending on the description style of the original program, and the setting of the logging command can be realized easily and accurately.

Further, according to the test support apparatus 100, a control instruction node that matches the definition is detected by referring to a table in which the definition of the control instruction node is recorded for each of a plurality of programming languages. By referring to the definition corresponding to the programming language describing the original program, the control instruction node can be detected by common logic independent of the programming language, and the logging instruction node can be set in association with the control instruction node.

Further, according to the test support apparatus 100, the processing result of the test program in the penetration test is output as structured document data, and the output data by the logging command is output as a comment sentence in the structured document. In other words, in the structured document browsing program, it is output in a mode that is normally hidden. Thereby, it is possible to avoid difficulty in browsing the processing result of the test program due to the output data by the logging command. For example, when the processing result of the test program is output as HTML file data, if the output data by the logging command is displayed as it is, there may be a problem in display on the web browser. However, since it is output as a comment sentence, the processing result of the test program can be displayed without any problem in the web browser. In addition, if the source data of the HTML file is referred to, a message by a logging command can be referred to, and the execution flow can be easily specified.

Furthermore, according to the test support apparatus 100, message identification data is output as output data by the logging command instead of the execution flow message itself. When an authorized user refers to the output data from the logging command, the message identification data is converted into an execution flow message and displayed. As a result, the execution flow message can be concealed from unauthorized users, and information leakage such as the internal structure of the original program can be prevented.

Furthermore, according to the test support apparatus 100, it is possible to provide the user with a coverage rate indicating the execution rate of the program code in the penetration test. In the test support apparatus 100, since a logging instruction is set in association with each of a plurality of control instructions via an abstract syntax tree, high accuracy can be achieved without depending on the size of the original program or the format of the original program. The coverage rate can be calculated easily.

The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

In the above-described embodiment, both the modification unit 50 and the test unit 60 are provided in one test support apparatus 100. In a modification, the modification unit 50 and the test unit 60 may be distributed and provided in a plurality of different devices. In other words, the second device different from the first device reads the test program data generated in the first device, and the second device performs a penetration test, a test result display, and the like. Also good.

In addition, the program module that realizes each functional block of the test support apparatus 100 may be implemented as a plug-in to other software programs such as IDE (Integrated Development Environment). For example, it may be implemented as a plug-in for Eclipse, and the user may add this plug-in to Eclipse to execute a test program generation and a penetration test. As a result, the user can seamlessly execute a penetration test for the program code after coding the program code in Eclipse.

In the above-described embodiment, the example in which the technical idea of the present invention is applied to the penetration test has been shown. However, the technical idea of the present invention can be applied not only to the penetration test but also to the entire computer program test, and even in that case, those skilled in the art will understand that the effects described in the embodiments can be achieved. .

It should be understood by those skilled in the art that the functions to be fulfilled by the constituent elements described in the claims are realized by the individual constituent elements shown in the embodiments and the modifications or by their cooperation.

12 original program holding unit, 14 node definition holding unit, 16 logging instruction holding unit, 18 test program holding unit, 20 input data holding unit, 22 output data holding unit, 32 instruction receiving unit, 34 execution flow display unit, 36 coverage Status display section, 52 original program acquisition section, 54 syntax tree generation section, 56 syntax tree modification section, 58 test program output section, 62 test program acquisition section, 64 test execution section, 66 coverage status identification section, 100 test support apparatus.

The present invention can be applied to an apparatus for supporting a test for a computer program.

Claims (10)

A program acquisition unit for acquiring a test target program described in a predetermined programming language as an original program;
In accordance with the grammatical rules of the programming language, a syntax tree generation unit that generates a syntax tree having each element of the program code described in the original program as a node;
In the syntax tree, a syntax that associates and sets a logging instruction node that outputs a message indicating that the execution flow is controlled by the control instruction to a control instruction node that controls the execution flow of the original program A tree modification section;
A program for checking the execution flow when predetermined test data is input to the original program with reference to the syntax tree, wherein the logging instruction is set in association with the control instruction. A program output unit for outputting a program;
A test support apparatus comprising: The syntax tree modifying unit refers to a table in which a node indicating a control instruction is recorded for each of a plurality of programming languages, and in each of the syntax trees generated from the original program described in each programming language, The test support apparatus according to claim 1, wherein a node indicating a logging command is set in association with a node indicated. The test execution unit according to claim 1, further comprising: a test execution unit that inputs predetermined test data to the test program and outputs the message by a logging command executed according to the test data. Test support device. The original program is described to output a processing result for input as a structured document file with a predetermined tag set,
4. The test support apparatus according to claim 1, wherein the message output by the logging command is a comment sentence in the structured document file. The processing result for the input to the original program is output in a form displayed by an execution device of a predetermined browsing program,
4. The test support apparatus according to claim 1, wherein the message output by the logging command is output in a mode in which the message is not displayed in the browsing program execution apparatus. 5. According to the authority of the user, further comprising an execution flow display unit for limiting the display of the execution flow of the test program,
The logging command is a command to output identification data that is different from the message and can uniquely identify the message, instead of the message,
The execution flow display unit displays a message specified by the identification data when the user confirms the execution flow of the test program and the user has a predetermined authority. Item 6. The test support device according to any one of Items 1 to 5. Referring to a message output from the test program according to the test data, the logging command executed according to the test data is specified, and the executed command occupies the logging command set in the test program A coverage status specifying unit that calculates the ratio of logging commands as the coverage rate of the test for the original program;
A coverage status display section for displaying the calculated coverage rate;
The test support apparatus according to claim 1, further comprising: A program for making it possible to confirm an execution flow when predetermined test data is input to an original program as a test target program, which is associated with a control instruction for controlling the execution flow of the original program. A program acquisition unit for acquiring a test program in which a logging instruction for outputting a message indicating that the execution flow is controlled by the control instruction is set;
A test execution unit for inputting the test data to the test program and outputting a message by a logging command executed according to the test data;
With reference to the message output from the test program, the logging command executed according to the test data is specified, and the ratio of the executed logging command to the logging command set in the test program is determined. , A coverage status specifying unit that calculates the coverage rate of the test for the original program,
A coverage status display section for displaying the calculated coverage rate;
A test support apparatus comprising: Obtaining a test program written in a predetermined programming language as an original program;
Generating a syntax tree having each element of the program code described in the original program as a node according to the grammatical rules of the programming language;
In the syntax tree, a step of associating and setting a logging instruction node that outputs a message indicating that the execution flow is controlled by the control instruction to a control instruction node that controls the execution flow of the original program When,
A program for checking the execution flow when predetermined test data is input to the original program with reference to the syntax tree, wherein the logging instruction is set in association with the control instruction. Outputting a program;
A test support method characterized by causing a computer to execute. A function for acquiring a test program written in a predetermined programming language as an original program;
A function of generating a syntax tree having each element of the program code described in the original program as a node according to the grammatical rules of the programming language;
In the syntax tree, a function that associates and sets a logging instruction node that outputs a message indicating that the execution flow is controlled by the control instruction with respect to a control instruction node that controls the execution flow of the original program When,
A program for checking the execution flow when predetermined test data is input to the original program with reference to the syntax tree, wherein the logging instruction is set in association with the control instruction. A function to output a program;
The computer-readable recording medium which recorded the program for making a computer implement | achieve.

Images