rework reflection detection with ssa (#732)
This is significantly more robust, than the ast based detection and can record very complex cases of indirect parameter reflection. Fixes #554pull/735/head
lu4p
2 years ago
committed by
GitHub
parent
b0ff2fb133
commit
1526ce7fd2
@ -0,0 +1,462 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"go/types"
|
||||||
|
"path/filepath"
|
||||||
|
|
||||||
|
"golang.org/x/exp/maps"
|
||||||
|
"golang.org/x/exp/slices"
|
||||||
|
"golang.org/x/tools/go/ssa"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Record all instances of reflection use, and don't obfuscate types which are used in reflection.
|
||||||
|
func (tf *transformer) recordReflection(ssaPkg *ssa.Package) {
|
||||||
|
if reflectSkipPkg[ssaPkg.Pkg.Path()] {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
lenPrevKnownReflectAPIs := len(cachedOutput.KnownReflectAPIs)
|
||||||
|
|
||||||
|
// find all unchecked APIs to add them to checkedAPIs after the pass
|
||||||
|
notCheckedAPIs := make(map[string]bool)
|
||||||
|
for _, knownAPI := range maps.Keys(cachedOutput.KnownReflectAPIs) {
|
||||||
|
if !tf.reflectCheckedAPIs[knownAPI] {
|
||||||
|
notCheckedAPIs[knownAPI] = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
tf.ignoreReflectedTypes(ssaPkg)
|
||||||
|
|
||||||
|
// all previously unchecked APIs have now been checked add them to checkedAPIs,
|
||||||
|
// to avoid checking them twice
|
||||||
|
maps.Copy(tf.reflectCheckedAPIs, notCheckedAPIs)
|
||||||
|
|
||||||
|
// if a new reflectAPI is found we need to Re-evaluate all functions which might be using that API
|
||||||
|
if len(cachedOutput.KnownReflectAPIs) > lenPrevKnownReflectAPIs {
|
||||||
|
tf.recordReflection(ssaPkg)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// find all functions, methods and interface declarations of a package and record their
|
||||||
|
// reflection use
|
||||||
|
func (tf *transformer) ignoreReflectedTypes(ssaPkg *ssa.Package) {
|
||||||
|
for _, memb := range ssaPkg.Members {
|
||||||
|
switch x := memb.(type) {
|
||||||
|
case *ssa.Type:
|
||||||
|
// methods aren't package members only their reciever types are
|
||||||
|
// so some logic is required to find the methods a type has
|
||||||
|
|
||||||
|
method := func(mset *types.MethodSet) {
|
||||||
|
for i, n := 0, mset.Len(); i < n; i++ {
|
||||||
|
at := mset.At(i)
|
||||||
|
|
||||||
|
if m := ssaPkg.Prog.MethodValue(at); m != nil {
|
||||||
|
tf.checkFunction(m)
|
||||||
|
} else {
|
||||||
|
m := at.Obj().(*types.Func)
|
||||||
|
// handle interface declarations
|
||||||
|
tf.checkInterfaceMethod(m)
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// yes, finding all methods really only works with both calls
|
||||||
|
mset := ssaPkg.Prog.MethodSets.MethodSet(x.Type())
|
||||||
|
method(mset)
|
||||||
|
|
||||||
|
mset = ssaPkg.Prog.MethodSets.MethodSet(types.NewPointer(x.Type()))
|
||||||
|
method(mset)
|
||||||
|
|
||||||
|
case *ssa.Function:
|
||||||
|
// these not only include top level functions, but also synthetic
|
||||||
|
// functions like the initialization of global variables
|
||||||
|
|
||||||
|
tf.checkFunction(x)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Exported methods with unnamed structs as paramters may be "used" in interface declarations
|
||||||
|
// elsewhere, these interfaces will break if any method uses reflection on the same parameter.
|
||||||
|
//
|
||||||
|
// Therefore never obfuscate unnamed structs which are used as a method parameter
|
||||||
|
// and treat them like a parameter which is actually used in reflection.
|
||||||
|
//
|
||||||
|
// See "UnnamedStructMethod" in the reflect.txtar test for an example.
|
||||||
|
func (tf *transformer) checkMethodSignature(reflectParams map[int]bool, sig *types.Signature) {
|
||||||
|
if sig.Recv() == nil {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
params := sig.Params()
|
||||||
|
for i := 0; i < params.Len(); i++ {
|
||||||
|
if reflectParams[i] {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
ignore := false
|
||||||
|
param := params.At(i)
|
||||||
|
|
||||||
|
switch x := param.Type().(type) {
|
||||||
|
case *types.Struct:
|
||||||
|
ignore = true
|
||||||
|
case *types.Array:
|
||||||
|
if _, ok := x.Elem().(*types.Struct); ok {
|
||||||
|
ignore = true
|
||||||
|
}
|
||||||
|
case *types.Slice:
|
||||||
|
if _, ok := x.Elem().(*types.Struct); ok {
|
||||||
|
ignore = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ignore {
|
||||||
|
reflectParams[i] = true
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(param.Type())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Checks the signature of an interface method for potential reflection use.
|
||||||
|
func (tf *transformer) checkInterfaceMethod(m *types.Func) {
|
||||||
|
reflectParams := make(map[int]bool)
|
||||||
|
|
||||||
|
maps.Copy(reflectParams, cachedOutput.KnownReflectAPIs[m.FullName()])
|
||||||
|
|
||||||
|
sig := m.Type().(*types.Signature)
|
||||||
|
if m.Exported() {
|
||||||
|
tf.checkMethodSignature(reflectParams, sig)
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(reflectParams) > 0 {
|
||||||
|
cachedOutput.KnownReflectAPIs[m.FullName()] = reflectParams
|
||||||
|
|
||||||
|
/* fmt.Printf("cachedOutput.KnownReflectAPIs: %v\n", cachedOutput.KnownReflectAPIs) */
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Checks all callsites in a function declaration for use of reflection.
|
||||||
|
func (tf *transformer) checkFunction(fun *ssa.Function) {
|
||||||
|
/* if fun != nil && fun.Synthetic != "loaded from gc object file" {
|
||||||
|
// fun.WriteTo crashes otherwise
|
||||||
|
fun.WriteTo(os.Stdout)
|
||||||
|
} */
|
||||||
|
|
||||||
|
f, _ := fun.Object().(*types.Func)
|
||||||
|
|
||||||
|
reflectParams := make(map[int]bool)
|
||||||
|
if f != nil {
|
||||||
|
maps.Copy(reflectParams, cachedOutput.KnownReflectAPIs[f.FullName()])
|
||||||
|
|
||||||
|
if f.Exported() {
|
||||||
|
tf.checkMethodSignature(reflectParams, fun.Signature)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/* fmt.Printf("f: %v\n", f)
|
||||||
|
fmt.Printf("fun: %v\n", fun) */
|
||||||
|
|
||||||
|
for _, block := range fun.Blocks {
|
||||||
|
for _, inst := range block.Instrs {
|
||||||
|
/* fmt.Printf("inst: %v, t: %T\n", inst, inst) */
|
||||||
|
call, ok := inst.(*ssa.Call)
|
||||||
|
if !ok {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
callName := call.Call.Value.String()
|
||||||
|
if m := call.Call.Method; m != nil {
|
||||||
|
callName = call.Call.Method.FullName()
|
||||||
|
}
|
||||||
|
|
||||||
|
if tf.reflectCheckedAPIs[callName] {
|
||||||
|
// only check apis which were not already checked
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
/* fmt.Printf("callName: %v\n", callName) */
|
||||||
|
|
||||||
|
// record each call argument passed to a function parameter which is used in reflection
|
||||||
|
knownParams := cachedOutput.KnownReflectAPIs[callName]
|
||||||
|
for knownParam := range knownParams {
|
||||||
|
if len(call.Call.Args) <= knownParam {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
arg := call.Call.Args[knownParam]
|
||||||
|
|
||||||
|
/* fmt.Printf("flagging arg: %v\n", arg) */
|
||||||
|
|
||||||
|
visited := make(map[ssa.Value]bool)
|
||||||
|
reflectedParam := tf.recordArgReflected(arg, visited)
|
||||||
|
if reflectedParam == nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
pos := slices.Index(fun.Params, reflectedParam)
|
||||||
|
if pos < 0 {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
/* fmt.Printf("recorded param: %v func: %v\n", pos, fun) */
|
||||||
|
|
||||||
|
reflectParams[pos] = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(reflectParams) > 0 {
|
||||||
|
cachedOutput.KnownReflectAPIs[f.FullName()] = reflectParams
|
||||||
|
|
||||||
|
/* fmt.Printf("cachedOutput.KnownReflectAPIs: %v\n", cachedOutput.KnownReflectAPIs) */
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// recordArgReflected finds the type(s) of a function argument, which is being used in reflection
|
||||||
|
// and excludes these types from obfuscation
|
||||||
|
// It also checks if this argument has any relation to a function paramter and returns it if found.
|
||||||
|
func (tf *transformer) recordArgReflected(val ssa.Value, visited map[ssa.Value]bool) *ssa.Parameter {
|
||||||
|
// make sure we visit every val only once, otherwise there will be infinite recursion
|
||||||
|
if visited[val] {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
/* fmt.Printf("val: %v %T %v\n", val, val, val.Type()) */
|
||||||
|
visited[val] = true
|
||||||
|
|
||||||
|
switch val := val.(type) {
|
||||||
|
case *ssa.IndexAddr:
|
||||||
|
for _, ref := range *val.Referrers() {
|
||||||
|
if store, ok := ref.(*ssa.Store); ok {
|
||||||
|
tf.recordArgReflected(store.Val, visited)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return tf.recordArgReflected(val.X, visited)
|
||||||
|
case *ssa.Slice:
|
||||||
|
return tf.recordArgReflected(val.X, visited)
|
||||||
|
case *ssa.MakeInterface:
|
||||||
|
return tf.recordArgReflected(val.X, visited)
|
||||||
|
case *ssa.UnOp:
|
||||||
|
return tf.recordArgReflected(val.X, visited)
|
||||||
|
case *ssa.FieldAddr:
|
||||||
|
return tf.recordArgReflected(val.X, visited)
|
||||||
|
|
||||||
|
case *ssa.Alloc:
|
||||||
|
/* fmt.Printf("recording val %v \n", *val.Referrers()) */
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(val.Type())
|
||||||
|
|
||||||
|
for _, ref := range *val.Referrers() {
|
||||||
|
if idx, ok := ref.(*ssa.IndexAddr); ok {
|
||||||
|
tf.recordArgReflected(idx, visited)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// relatedParam needs to revisit nodes so create an empty map
|
||||||
|
visited := make(map[ssa.Value]bool)
|
||||||
|
|
||||||
|
// check if the found alloc gets tainted by function parameters
|
||||||
|
return relatedParam(val, visited)
|
||||||
|
|
||||||
|
case *ssa.Const:
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(val.Type())
|
||||||
|
case *ssa.Global:
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(val.Type())
|
||||||
|
|
||||||
|
// TODO: this might need similar logic to *ssa.Alloc, however
|
||||||
|
// reassigning a function param to a global variable and then reflecting
|
||||||
|
// it is probably unlikely to occur
|
||||||
|
case *ssa.Parameter:
|
||||||
|
// this only finds the parameters who want to be found,
|
||||||
|
// otherwise relatedParam is used for more in depth analysis
|
||||||
|
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(val.Type())
|
||||||
|
return val
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// relatedParam checks if a route to a function paramter can be constructed
|
||||||
|
// from a ssa.Value, and returns the paramter if it found one.
|
||||||
|
func relatedParam(val ssa.Value, visited map[ssa.Value]bool) *ssa.Parameter {
|
||||||
|
// every val should only be visited once to prevent infinite recursion
|
||||||
|
if visited[val] {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
/* fmt.Printf("related val: %v %T %v\n", val, val, val.Type()) */
|
||||||
|
|
||||||
|
visited[val] = true
|
||||||
|
|
||||||
|
switch x := val.(type) {
|
||||||
|
case *ssa.Parameter:
|
||||||
|
// a paramter has been found
|
||||||
|
return x
|
||||||
|
case *ssa.UnOp:
|
||||||
|
if param := relatedParam(x.X, visited); param != nil {
|
||||||
|
return param
|
||||||
|
}
|
||||||
|
case *ssa.FieldAddr:
|
||||||
|
/* fmt.Printf("addr: %v\n", x)
|
||||||
|
fmt.Printf("addr.X: %v %T\n", x.X, x.X) */
|
||||||
|
|
||||||
|
if param := relatedParam(x.X, visited); param != nil {
|
||||||
|
return param
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
refs := val.Referrers()
|
||||||
|
if refs == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, ref := range *refs {
|
||||||
|
/* fmt.Printf("ref: %v %T\n", ref, ref) */
|
||||||
|
|
||||||
|
var param *ssa.Parameter
|
||||||
|
switch ref := ref.(type) {
|
||||||
|
case *ssa.FieldAddr:
|
||||||
|
param = relatedParam(ref, visited)
|
||||||
|
|
||||||
|
case *ssa.UnOp:
|
||||||
|
param = relatedParam(ref, visited)
|
||||||
|
|
||||||
|
case *ssa.Store:
|
||||||
|
if param := relatedParam(ref.Val, visited); param != nil {
|
||||||
|
return param
|
||||||
|
}
|
||||||
|
|
||||||
|
param = relatedParam(ref.Addr, visited)
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
if param != nil {
|
||||||
|
return param
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// recursivelyRecordAsNotObfuscated calls recordAsNotObfuscated on any named
|
||||||
|
// types and fields under typ.
|
||||||
|
//
|
||||||
|
// Only the names declared in the current package are recorded. This is to ensure
|
||||||
|
// that reflection detection only happens within the package declaring a type.
|
||||||
|
// Detecting it in downstream packages could result in inconsistencies.
|
||||||
|
func (tf *transformer) recursivelyRecordAsNotObfuscated(t types.Type) {
|
||||||
|
switch t := t.(type) {
|
||||||
|
case *types.Named:
|
||||||
|
obj := t.Obj()
|
||||||
|
|
||||||
|
// TODO: the transformer is only needed in this function, there is
|
||||||
|
// probably a way to do this with only the ssa information.
|
||||||
|
if obj.Pkg() == nil || obj.Pkg() != tf.pkg {
|
||||||
|
return // not from the specified package
|
||||||
|
}
|
||||||
|
if recordedAsNotObfuscated(obj) {
|
||||||
|
return // prevent endless recursion
|
||||||
|
}
|
||||||
|
recordAsNotObfuscated(obj)
|
||||||
|
|
||||||
|
// Record the underlying type, too.
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(t.Underlying())
|
||||||
|
|
||||||
|
case *types.Struct:
|
||||||
|
for i := 0; i < t.NumFields(); i++ {
|
||||||
|
field := t.Field(i)
|
||||||
|
|
||||||
|
// This check is similar to the one in *types.Named.
|
||||||
|
// It's necessary for unnamed struct types,
|
||||||
|
// as they aren't named but still have named fields.
|
||||||
|
if field.Pkg() == nil || field.Pkg() != tf.pkg {
|
||||||
|
return // not from the specified package
|
||||||
|
}
|
||||||
|
|
||||||
|
// Record the field itself, too.
|
||||||
|
recordAsNotObfuscated(field)
|
||||||
|
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(field.Type())
|
||||||
|
}
|
||||||
|
|
||||||
|
case interface{ Elem() types.Type }:
|
||||||
|
// Get past pointers, slices, etc.
|
||||||
|
tf.recursivelyRecordAsNotObfuscated(t.Elem())
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// TODO: consider caching recordedObjectString via a map,
|
||||||
|
// if that shows an improvement in our benchmark
|
||||||
|
func recordedObjectString(obj types.Object) objectString {
|
||||||
|
pkg := obj.Pkg()
|
||||||
|
if obj, ok := obj.(*types.Var); ok && obj.IsField() {
|
||||||
|
// For exported fields, "pkgpath.Field" is not unique,
|
||||||
|
// because two exported top-level types could share "Field".
|
||||||
|
//
|
||||||
|
// Moreover, note that not all fields belong to named struct types;
|
||||||
|
// an API could be exposing:
|
||||||
|
//
|
||||||
|
// var usedInReflection = struct{Field string}
|
||||||
|
//
|
||||||
|
// For now, a hack: assume that packages don't declare the same field
|
||||||
|
// more than once in the same line. This works in practice, but one
|
||||||
|
// could craft Go code to break this assumption.
|
||||||
|
// Also note that the compiler's object files include filenames and line
|
||||||
|
// numbers, but not column numbers nor byte offsets.
|
||||||
|
// TODO(mvdan): give this another think, and add tests involving anon types.
|
||||||
|
pos := fset.Position(obj.Pos())
|
||||||
|
return fmt.Sprintf("%s.%s - %s:%d", pkg.Path(), obj.Name(),
|
||||||
|
filepath.Base(pos.Filename), pos.Line)
|
||||||
|
}
|
||||||
|
// Names which are not at the top level cannot be imported,
|
||||||
|
// so we don't need to record them either.
|
||||||
|
// Note that this doesn't apply to fields, which are never top-level.
|
||||||
|
if pkg.Scope() != obj.Parent() {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
// For top-level exported names, "pkgpath.Name" is unique.
|
||||||
|
return pkg.Path() + "." + obj.Name()
|
||||||
|
}
|
||||||
|
|
||||||
|
// recordAsNotObfuscated records all the objects whose names we cannot obfuscate.
|
||||||
|
// An object is any named entity, such as a declared variable or type.
|
||||||
|
//
|
||||||
|
// As of June 2022, this only records types which are used in reflection.
|
||||||
|
// TODO(mvdan): If this is still the case in a year's time,
|
||||||
|
// we should probably rename "not obfuscated" and "cannot obfuscate" to be
|
||||||
|
// directly about reflection, e.g. "used in reflection".
|
||||||
|
func recordAsNotObfuscated(obj types.Object) {
|
||||||
|
if obj.Pkg().Path() != curPkg.ImportPath {
|
||||||
|
panic("called recordedAsNotObfuscated with a foreign object")
|
||||||
|
}
|
||||||
|
if !obj.Exported() {
|
||||||
|
// Unexported names will never be used by other packages,
|
||||||
|
// so we don't need to bother recording them in cachedOutput.
|
||||||
|
knownCannotObfuscateUnexported[obj] = true
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
objStr := recordedObjectString(obj)
|
||||||
|
if objStr == "" {
|
||||||
|
// If the object can't be described via a qualified string,
|
||||||
|
// then other packages can't use it.
|
||||||
|
// TODO: should we still record it in knownCannotObfuscateUnexported?
|
||||||
|
return
|
||||||
|
}
|
||||||
|
cachedOutput.KnownCannotObfuscate[objStr] = struct{}{}
|
||||||
|
}
|
||||||
|
|
||||||
|
func recordedAsNotObfuscated(obj types.Object) bool {
|
||||||
|
if knownCannotObfuscateUnexported[obj] {
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
objStr := recordedObjectString(obj)
|
||||||
|
if objStr == "" {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
_, ok := cachedOutput.KnownCannotObfuscate[objStr]
|
||||||
|
return ok
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue