合约安全检测服务对外提供检测接口。
此接口接收一个合约文件的zip压缩包Base64编码，然后内部解压分析后，返回给检测端一个检测结果。
调用此接口进行合约安全检测。
输入：合约文件zip压缩包Base64编码（合约文件放在contracts文件夹下，每个合约的文件名要和合约名要一致，合约引用需使用“./xxx.sol”，将文件夹打包成zip文件，以业务编号appid命名，然后将zip文件转成Base64编码）。文件夹格式如下：
|- contracts
| |- Evidence.sol
| |- EvidenceFactory.sol
|- docs
| |- deploy.md
输出：合约安全检测信息（JSON格式)。
http://localhost:5007/WeBASE-Solidity-Security/scan
HTTP POST
1）入参表
| 序号 | 输入参数 | 类型 | 可为空 | 备注 |
|---|---|---|---|---|
| 1 | appid | String | 否 | 业务编号，用来区分合约 |
| 2 | contractSource | String | 否 | 合约文件zip压缩包Base64编码 |
2）数据格式
{
"appid": "appid001",
"contractSource": "UEsDBBQAAAAAACizbFAAAAAAAAAAAAAAAAAKAAAAY29udHJhY3RzL1BLAwQUAAAACAAIiGVQuSZqBJ0AAABvAQAAGAAAAGNvbnRyYWN0cy9IZWxsb1dvcmxkLnNvbIWOMQvCMBCF90L/w43tUiS4FXcnFwc3IbRnCCQXSa6CSP+7sakYpNo33r33vXf1UlkJwRnda77DedNsG9GWReeIvewY9miMOzlv+kdZQFRgr0kBSYttuuANieGIfIi3KvvXSwax5LgM1LF2BAq5qmN5YBkjHnnwFOZE/VqQNH/yFeMXKUTSuylPotWfsTQNSJpgO/qNE6s88R84PgFQSwMEFAAAAAAAE7NsUAAAAAAAAAAAAAAAAAUAAABkb2NzL1BLAwQKAAAAAADjgGxQ1Qj/mQkAAAAJAAAADgAAAGRvY3MvZGVwbG95Lm1kIyBEZXBsb3kKUEsBAj8AFAAAAAAAKLNsUAAAAAAAAAAAAAAAAAoAJAAAAAAAAAAQAAAAAAAAAGNvbnRyYWN0cy8KACAAAAAAAAEAGACqQxwMevjVAapDHAx6+NUBEu2Y9Xn41QFQSwECPwAUAAAACAAIiGVQuSZqBJ0AAABvAQAAGAAkAAAAAAAAACAAAAAoAAAAY29udHJhY3RzL0hlbGxvV29ybGQuc29sCgAgAAAAAAABABgAselMfMzy1QF9ieU0evjVAapDHAx6+NUBUEsBAj8AFAAAAAAAE7NsUAAAAAAAAAAAAAAAAAUAJAAAAAAAAAAQAAAA+wAAAGRvY3MvCgAgAAAAAAABABgAa0Sa9Xn41QFrRJr1efjVARPSmfV5+NUBUEsBAj8ACgAAAAAA44BsUNUI/5kJAAAACQAAAA4AJAAAAAAAAAAgAAAAHgEAAGRvY3MvZGVwbG95Lm1kCgAgAAAAAAABABgAIBTBN0X41QFrRJr1efjVAWtEmvV5+NUBUEsFBgAAAAAEAAQAfQEAAFMBAAAAAA=="
}
1）出参表
| 序号 | 输出参数 | 类型 | 可为空 | 备注 |
|---|---|---|---|---|
| 1 | code | Int | 否 | 返回码，0：正常 其它：异常 |
| 2 | message | String | 是 | 错误信息 |
| 3 | data | Json | 是 | 检测结果 |
2）数据格式
a.检测正常返回结果示例
{
"code": 0,
"message": null,
"data": {
"detectors": [
{
"elements": [
{
"source_mapping": {
"starting_column": 1,
"ending_column": 24,
"filename_used": "/WeBASE-Solidity-Security/dist/contracts/appid001/contracts/HelloWorld.sol",
"filename_relative": "contracts/HelloWorld.sol",
"start": 0,
"length": 23,
"filename_short": "contracts/HelloWorld.sol",
"is_dependency": false,
"lines": [
1
],
"filename_absolute": "/WeBASE-Solidity-Security/dist/contracts/appid001/contracts/HelloWorld.sol"
},
"name": "^0.4.2",
"type": "pragma",
"type_specific_fields": {
"directive": [
"solidity",
"^",
"0.4",
".2"
]
}
}
],
"impact": "Informational",
"confidence": "High",
"markdown": "Pragma version[^0.4.2](contracts/HelloWorld.sol#L1) allows old versions\n",
"description": "Pragma version^0.4.2 (contracts/HelloWorld.sol#1) allows old versions\n",
"id": "b93b7ce0902076867f801a1b62ad7557d0305767e196372ed38c0d7076440c1e",
"check": "solc-version"
}
]
}
}
b.检测异常返回结果示例
{
"code": 203003,
"message": "Traceback (most recent call last):\n File \"/usr/local/lib/python3.6/dist-packages/crytic_compile/platform/solc.py\", line 309, in _run_solc\n ret = json.loads(stdout)\n File \"/usr/lib/python3.6/json/__init__.py\", line 354, in loads\n return _default_decoder.decode(s)\n File \"/usr/lib/python3.6/json/decoder.py\", line 339, in decode\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n File \"/usr/lib/python3.6/json/decoder.py\", line 357, in raw_decode\n raise JSONDecodeError(\"Expecting value\", s, err.value) from None\njson.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/local/lib/python3.6/dist-packages/slither/__main__.py\", line 578, in main_impl\n (slither_instances, results_detectors, results_printers, number_contracts) = process_all(filename, args, detector_classes, printer_classes)\n File \"/usr/local/lib/python3.6/dist-packages/slither/__main__.py\", line 60, in process_all\n compilations = compile_all(target, **vars(args))\n File \"/usr/local/lib/python3.6/dist-packages/crytic_compile/crytic_compile.py\", line 1023, in compile_all\n compilations.append(CryticCompile(filename, **kwargs))\n File \"/usr/local/lib/python3.6/dist-packages/crytic_compile/crytic_compile.py\", line 142, in __init__\n self._compile(target, **kwargs)\n File \"/usr/local/lib/python3.6/dist-packages/crytic_compile/crytic_compile.py\", line 915, in _compile\n self._platform.compile(self, target, **kwargs)\n File \"/usr/local/lib/python3.6/dist-packages/crytic_compile/platform/solc.py\", line 90, in compile\n working_dir=solc_working_dir,\n File \"/usr/local/lib/python3.6/dist-packages/crytic_compile/platform/solc.py\", line 312, in _run_solc\n raise InvalidCompilation(f\"Invalid solc compilation {stderr}\")\ncrytic_compile.platform.exceptions.InvalidCompilation: Invalid solc compilation /WeBASE-Solidity-Security/dist/contracts/appid003/contracts/HelloWorld.sol:6:16: Error: Expected ';' but got '('\n functio get()constant returns(string){\r\n ^\ncontracts/HelloWorld.sol:6:16: Error: Expected ';' but got '('\n functio get()constant returns(string){\r\n ^\n\n",
"data": null
}
3）返回码信息
| Codze | message | 描述 |
|---|---|---|
| 0 | success | 正常 |
| 103001 | system error | 系统异常 |
| 103002 | param valid fail | 参数错误 |
| 203001 | There is no sol files under contracts folder | contracts文件夹下不存在合约 |
| 203002 | shell execute error | shell执行错误 |
| 203003 | contracts abnormal | 合约检测异常 |
| 软件名称 | 版本 |
|---|---|
| Java | JDK8或以上版本 |
| Python | 3.6+ |
| solc | 0.4.25 |
| slither |
从pip安装slither
pip install slither-analyzer根据需要检测的不同的合约版本，部署合约编译器 solc。此处以0.4.25合约为例，下载后放入PATH目录中。
curl -LO https://github.com/FISCO-BCOS/solidity/releases/download/v0.4.25/solc-linux.tar.gz解压后，将可执行文件copy到/bin目录 安装成功可用命令检查
slither --version
执行命令：
git clone https://github.com/WeBankFinTech/WeBASE-Solidity-Security.git
进入目录：
cd WeBASE-Solidity-Security
使用以下方式编译构建：
方式一：如果服务器已安装Gradle，且版本为Gradle-4.10或以上
gradle build -x test方式二：如果服务器未安装Gradle，或者版本不是Gradle-4.10或以上，使用gradlew编译
chmod +x ./gradlew && ./gradlew build -x test构建完成后，会在根目录WeBASE-Solidity-Security下生成已编译的代码目录dist。
返回到dist目录执行：
启动: bash start.sh
停止: bash stop.sh
检查: bash status.sh备注：服务进程起来后，需通过日志确认是否正常启动，出现以下内容表示正常；如果服务出现异常，确认修改配置后，重启提示服务进程在运行，则先执行stop.sh，再执行start.sh。
...
Application() - main run success...
在dist目录查看：
服务日志：tail -f log/WeBASE-Solidity-Security.log