Riba:
- Ikon yin amfani da hankali na wucin gadi azaman ido na biyu da tuta OWASP raunin aji (allura, sirrin sirri, ikon samun dama) a cikin lambar ta hanyar ba da mahallin
- Ikon kawar da abubuwan da ba daidai ba da aka samar ta hanyar hankali na wucin gadi tare da mahallin da kuma hana ɗaukar kowane bincike a matsayin rashin ƙarfi na gaske ba tare da tabbatar da shi ba.
- Ƙarfin gane cewa gyara da aka ba da shawarar ta hanyar basirar wucin gadi na iya gabatar da sababbin lahani / kwari da wuce kowane faci ta hanyar bita da ƙofar gwaji.
Rashin lahani a cikin software na daga cikin mafi tsadar rashin lahani saboda an saka su a cikin samfurin tun daga farko kuma ana rarraba su ga miliyoyin masu amfani. Amintaccen bita na lambar shine aiwatar da karanta layin lambar tushe ta layi da kama lahani - allurar SQL, rashin lafiyar tantancewa, kalmar sirri mai ƙarfi, ba da izini ba daidai ba - kafin su shiga samarwa. Lokacin da aka yi da hannu, yana jinkiri da gajiya; Yana da sauƙi a rasa lahani a cikin babban tushe na lamba.
AI yana da ƙarfi a sake duba lambar don dalilai guda biyu: lambar kuma harshe ne, kuma AI yana da kyau a ƙirar ƙira. AI na iya nuna alamu masu haɗari da sauri a cikin wani yanki na lamba (saka shigar da mai amfani kai tsaye cikin tambayar, ajiyar bayanan da ba a ɓoye, bacewar ingantaccen shigarwar), bayyana dalilin da yasa kowannensu ke da haɗari, kuma ya ba da shawarar gyara. Amma AI ba ta ganin duk mahallin aiki na lambar (ana iya share shigarwar a wani Layer), yana iya ƙirƙira raunin da ba ya wanzu (tabbatacciyar ƙarya) ko rasa ainihin rauni (ƙarya mara kyau), kuma mafi mahimmanci, "gyara" da yake ba da shawara na iya gabatar da sabon rauni ko kwaro. AI shine ido na biyu da mai nuni a cikin sake duba lambar; Mai haɓakawa da ƙwararrun tsaro sun yanke shawara ko binciken shine ainihin rauni kuma ko gyara daidai ne kuma mai lafiya.
Matakan sake duba lambar
- Ba da iyaka da mahallin. Wane harshe, wane tsari, a ina wannan lambar ke ɗaukar shigarwa, a ina yake ba da fitarwa, a wane Layer yake aiki? Bita na lamba ba tare da mahallin yana haifar da tabbataccen ƙarya ba.
- Duba ga alamu masu haɗari. Bincika sanannun azuzuwan raunin AI (kamar OWASP Top 10): allura, tantancewa, bayyana bayanan sirri, ikon samun dama.
- Ka sa kowane binciken ya barata. Ga kowane tuta: wane layi, wane nau'in raunin rauni, ta yaya za a iya amfani da shi, menene shaida. Ba a ɗaukar binciken da bai dace ba da muhimmanci.
- Kawar da tabbataccen ƙarya. Shin da gaske ana share shigarwar, shin wannan hanyar tana da sauƙin shiga - duba tare da mahallin.
- Tabbatar da gyara. Tabbatar da cewa facin da AI ya ba da shawarar a zahiri yana rufe raunin, baya gabatar da sabbin lahani/kwaro, kuma ya wuce gwaji.
- Yardar dan Adam. Mai haɓakawa + ƙwararrun tsaro na duba binciken da gyara; Haka yake shigar da ma'ajiyar lambar.
Sharuɗɗa: SAST (Gwajin Tsaro na Aikace-aikacen A tsaye - Gwajin tsaro na tsaye wanda ke nazarin lambar tushe ba tare da gudanar da shi ba). DAST (Dynamic - gwaji mai ƙarfi wanda ke gwada aikace-aikacen da ke gudana a waje). OWASP Top 10 shine madaidaicin lissafin mafi yawan lahani na aikace-aikacen yanar gizo. Allura wani rauni ne da ke haifarwa ta hanyar fassara shigarwar mai amfani azaman umarni/tambaya (misali allurar SQL). Tambayar da aka daidaita ita ce hanyar da ta dace wacce ke hana allura ta hanyar raba abin shigar da lambar.
Tebur na gama-gari na rashin ƙarfi
Ajin rauni
Alamar (a cikin lambar)
daidai bayani
AI tarkon
allurar SQL
Shiga shigarwa cikin tambaya
Tambayar da aka daidaita
Zai iya yin watsi da tsafta
sirrin sirri
Kalmar sirri/maɓalli a lambar
Amintaccen sirri (vault), env
Ƙarya tabbatacce (samfurin/gwaji)
Tabbacin raunin rauni
Rashin kulawa/ba daidai ba
Ƙarfi, sarrafawa mai ƙarfi
rasa mahallin
Kuskuren sarrafa damar shiga
Babu rajistan izini
Izinin gefen uwar garke
Bai fahimci hadaddun kwarara ba
Bayyana bayanai masu ma'ana
Ajiye/shiga mara kalmar sirri
Encryption, masking
Ba za a iya sanin mahimmanci ba
Serialization mara tsaro
Rusa bayanan da ba a dogara ba
Amintaccen tantancewa
Rashin ƙarancin tsari
uku mini lokuta
Case 1 - Kama ainihin allurar. Mai haɓakawa yana da AI don bincika aikin samun damar bayanai. AI tana yin alamar layin inda ƙimar mai amfani daga mai amfani ke tattare kai tsaye zuwa cikin rubutun SQL kuma ya ce "wannan allurar SQL ce ta al'ada, juya ta zuwa tambaya mai ma'ana"; Yana ba da gyaran samfurin. Mai haɓakawa ya tabbatar da cewa ba a tsabtace shigarwar a wani wuri ba, yana tabbatar da cewa lahani ne na gaske, yana aiwatar da tambayar da aka ba da shawarar, kuma ya rubuta gwaji. AI ya nuna rashin lafiya; tabbatarwa da gwajin gyara sun fito daga mai haɓakawa.
Case 2 - Qarya tabbatacce tabbataccen sirri. AI yana ganin kalmar sirri = layin "test1234" a cikin fayil kuma ya ce "mafi mahimmanci: kalmar sirri". Mai haɓakawa yana bincika mahallin: wannan fayil ɗin gwaji ne na raka'a, bayanan gwaji mara nauyi, ba a fitar da shi zuwa samarwa ba kuma ba a tura shi zuwa wani tsari na gaske ba. Sakamakon binciken karya ne tabbatacce. Mai haɓakawa ya rubuta wannan amma bai ɗauki mataki ba saboda ba sirri bane na gaske. Darasi: Alamar "sirri mai wuya" ta AI dole ne a kawar da ita ta mahallin; Ba kowane zaren sirri bane.
Case 3 - Sabon gyara rashin lahani. AI yana ba da shawarar gyara don rashin lafiyar XSS (rubutun giciye); amma lambar da ya ba da shawarar tana share shigarwa a wurin da bai dace ba kuma ta tsallake shigar da kayan aiki a wani yanki; Sakamakon haka, gibin baya rufe gaba daya. Masanin tsaro yana duba gyara, ya lura da bacewar coding, kuma ya gyara shi a daidai Layer. Darasi: Facin da AI ke ba da shawarar ba shi da tsaro ta atomatik; Kowane gyara ana dubawa kuma an gwada shi.
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rawanin faɗakarwa:
Shin akwai madauki a cikin wannan lambar, gyara shi: [code]
This prompt gives no context (language, framework, input source), does not ask for justification, does not question the false positive, and is open to blindly accepting the correction produced by the AI. AI gauraye alamun duka rauni na gaske da kuma wanda babu shi.
Ƙarfi mai ƙarfi:
Matsayinku: mataimaki wanda shine IDO NA BIYU ga mai haɓakawa a cikin amintaccen bitar lambar. Yin yanke shawara; la'akari da gyaran kai tsaye da aka yi amfani da shi. Lamba: [ƙayyade harshe/tsari].Tsarin: wannan aikin [tushen shigarwa: misali. yana karɓar [buƙatun HTTP na waje], ya rubuta zuwa [makomar fitarwa]. Ayyukanku: (1) tuta yiwuwar raunin da ya shafi aji na OWASP, ba da lambar layi + dalilin da yasa mai haɗari + yadda ake amfani da + shaida ga kowane, (2) rubuta aƙalla yanayin tabbataccen ƙarya 1 don kowane binciken (misali idan an tsabtace shigarwar a cikin wani Layer), (3) ba da shawarar gyara amma tare da alamar "[bita + rubuta gwajin]"; Hakanan kimanta ko gyara ya gabatar da sabbin lahani/kwarori. Ƙara rashin lahani na karya.[code]
Ƙarfi mai ƙarfi yana ba da mahallin, yana neman ajin OWASP da shaida, tambayoyi masu inganci na ƙarya da haɗarin gyarawa, tilasta bitar ɗan adam.
Samfuran gaggawar da za a iya kwafi
KYAUTA SCAN TEMPLATE Jarrabawar lambar [harshe/tsari] don OWASP Top 10. Ga kowane mai yiwuwa ganowa: lambar layi, aji mai rauni, dalilin da yasa yake da haɗari, amfani da samfur, ƙarfin shaida (tabbas / yuwuwar/rauni). Ma'anar: shigarwa [source], fitarwa [manufa]. Ƙara abubuwan da aka ƙirƙira; Idan ba ku da tabbas, rubuta "[dole ne a tabbatar]". Code: [Paste]
KASHIN KAWAR KARYA Don gano lambar mai zuwa, jera yanayin yanayin da BABU wani lahani na gaske a cikinsu: shin za a iya share shigarwar a wani Layer, shin wannan hanyar tana iya samun dama, shin wannan ƙimar gwaji/samfuri, tsarin tsarin yana kiyaye shi ta atomatik. Rubuta yadda ake tabbatar da kowane ɗayan. Nemo: [manna]
GYARA TEMPLATTER yana ba da shawarar gyara don rashin lahani mai zuwa; sannan ku soki gyaran ku: (1) yana rufe raunin da gaske, (2) yana gabatar da sabon rauni / bug, (3) wanne gwajin zan rubuta (mai kyau da mara kyau), (4) tasirin aiki / aiki. Zan sake dubawa kuma in gwada gyara. Rashin lahani + lambar: [manna]
TSARO TEMPLATE KOYARWA don aji mai rauni [misali. alluran SQL] kwatankwacin nuna amintaccen tsarin buga rubutu da tsarin kuskure gama gari a cikin wannan harshe/tsarin. Gabaɗaya doka + ba da misali na lamba; amma ina so ka tambayi mahallin kafin aiwatar da shi a cikin code na. Harshe / tsarin aiki: [rubuta]
Kuskuren gama gari
- Bita ba tare da mahallin ba. Ba tare da harshe, tsari, da shigarwar / fitarwa mahallin ba, AI yana rikitar da abubuwan da aka gano na gaske da na zato; Tabbatar bayar da mahallin.
- Kuskure kowane alamar don ainihin rauni. AI yana samar da bayanan karya (bayanan gwaji, an tsabtace shigarwar a wani Layer); Cire kowane bincike tare da mahallin mahallin.
- A makance amfani da gyaran AI. Faci da aka ba da shawarar na iya gabatar da sabbin lahani/ kwari; bita da rubuta gwaje-gwaje.
- Amincewa da mummunan mummunan. Ko da AI ta ce "babu lahani", bincika mahimman hanyoyi da kanku; Binciken a tsaye baya gano kowane lahani.
- Ba da lambar/asirin zuwa kayan aiki na waje. Lambar sirri da ainihin sirri (maɓalli, kalmar sirri) mallakin hankali ne da rauni; saka sunan ko amfani da kamfani, keɓaɓɓen kayan aikin.
Tukwici: Lokacin samun lambar sake dubawa na AI, mafi kyawun tacewa shine a nemi "ƙarfin shaida" (tabbas / mai yiwuwa / rauni) ga kowane bincike. Yawancin binciken da aka yiwa alama "rauni" tabbataccen ƙarya ne; ka ware makamashinka ga "tabbatacce".
Tsanaki: Tsarin tsaro na AI bai kamata ya shiga cikin sito ba tare da an gwada shi ba. "gyara" da ba daidai ba na iya barin ɓarna a buɗe kuma ya haifar da kuskuren aiki a samarwa; Kowane faci yana wucewa ta ƙofar bita da gwaji.
a takaice
Amintaccen lambar sake dubawa ita ce hanya mafi arha don kama raunin kafin su shiga samarwa, kuma tun da lambar harshe ce, AI ta zama ido na biyu mai ƙarfi a nan: tutocin alamu masu haɗari, ya bayyana haɗari, yana ba da shawarar gyarawa. Amma AI ba ya ganin duk mahallin aiki, yana haifar da halayen ƙarya da rashin ƙarfi na ƙarya, kuma facin da ya ba da shawarar na iya gabatar da sabbin lahani. Don haka bita yana da matakai guda shida (yanayin, nunawa, gaskatawa, kawar da tabbataccen ƙarya, tabbatarwa da tabbatarwa, amincewar ɗan adam) kuma shawarar ta ta'allaka ne ga mai haɓakawa da masanin tsaro. Ka'idoji guda uku: babu wani bincike da aka fassara ba tare da mahallin ba, kowace alamar an kawar da ita tare da mahallin, babu gyara da ke shiga cikin ajiya ba tare da gwadawa ba. Kuma ba a taɓa ba lambar/asirin ga kayan aiki na waje ba tare da ɓoye suna ba.
Aikin aikace-aikace
Ɗauki snippet lambar samfurin (ko dai cire sassa masu mahimmanci daga lambar ku ko lambar samfurin tare da lahani). Shin AI ta gwada shi tare da samfurin "Scanning Rauni"; Aiwatar da samfurin "Ƙarya Mai Kyau" don kowane gano kuma kawar da ainihin. Ɗauki gyara mafi mahimmancin binciken tare da samfurin "Remediation Evaluation", sake duba shi da kanku kuma rubuta tabbataccen shari'ar gwaji guda ɗaya + mara kyau. Yi la'akari da yawan binciken da aka samu na karya.
jerin abubuwan dubawa
- [ ] Na ba da harshe, tsari da shigarwa/fitarwa mahallin kafin in sake nazarin lambar.
- [ ] Na nemi lambar layi, aji mai rauni, amfani da hanya da shaida ga kowane bincike.
- [ ] Na bincika kowane bincike don ingantaccen ingancin ƙarya tare da mahallin.
- [ ] Ban yi makauniyar amfani da gyaran AI ba; Na bita kuma na rubuta gwaji.
- [ ] Duk da fitowar "Babu lahani", na bincika hanyoyi masu mahimmanci da kaina.
- [ ] Na ɓoye sunan lambar/asirin ko amfani da keɓantaccen kayan aikin kamfani.
- [ ] Na wuce binciken kuma na gyara ta hanyar mai haɓakawa + amincewar tsaro.