A hybrid flow graph generation method that supports serialization or deserialization features

Abstract

The application discloses a hybrid flow graph generation method supporting serialization or deserialization features, specifies an entry function for a java source program, adopts a context-sensitive pointer analysis method to construct an initial call graph, improves the efficiency and accuracy of pointer analysis, and combines the rules of information flow propagation to adapt to the deserialization blacklist and whitelist rules existing in the actual program, so that the constructed call relationship is more accurate, and the combination of information flow propagation and the call graph jointly constructs a hybrid flow graph, realizes accurate analysis of serialization or deserialization call relationship, and helps developers to find possible vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of software security, and in particular to a hybrid flow graph generation method that supports serialization or deserialization features. Background Technology

[0002] In 2015, Lawrence and Frohoff reported a Java deserialization vulnerability. Subsequently, Breenmachine successfully exploited this vulnerability to attack Java applications such as WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS, achieving remote code execution. Third-party deserialization libraries like Fastjson, Jackson, Hessian, and XStream have also been found to contain deserialization vulnerabilities. When deserializing data controlled by an attacker, malicious code crafted by the attacker may be executed. Finding the deserialization exploit chain is crucial for the exploitation of this type of vulnerability. Therefore, performing a complete inter-process analysis of Java programs is essential, including vulnerability detection, information flow optimization, and analysis. Due to the large code space of Java applications and their dependent libraries, and the inherent polymorphism in Java, serialization primarily relies on reflection to complete method calls. This makes it difficult to perform a complete analysis of the deserialization process. "Salsa: Static Analysis of Serialization Features" uses pointer analysis and iteration to construct the calls during (de)serialization. "Serialization-Aware CallGraph Construction" further expands the callback methods during Salsa's deserialization, but it still only considers serializable classes that inherit from Serializable. It doesn't support the relevant callbacks `void readExternal(OIS)` and `void writeExternal(OIS)` for serializable classes that inherit from Externalizable, nor does it consider the potential blacklist / whitelist issues in real-world environments. Summary of the Invention

[0003] Purpose of the invention: The purpose of this invention is to provide a hybrid flow graph generation method that supports serialization or deserialization features, clearly defining the actual call relationships that exist during serialization or deserialization and the information propagation relationship from the serialization point of the deserialized object downwards, thus solving the current problem of not being able to accurately generate function calls during serialization or deserialization.

[0004] Technical solution: This invention provides a hybrid flow graph generation method that supports serialization or deserialization features, comprising the following steps:

[0005] 1) Take the Java source code, a CSV file containing the program's entry function, and related configuration files as input;

[0006] 2) Based on the CSV file containing the entry function input by the tool, extract the entry function and its corresponding context to the work list. Work list<m,c> It exists in the form ∈W, where c represents the context corresponding to the entry function;

[0007] 3) Based on the existing work list Using object-sensitive pointer analysis from the entry function, an initial call graph is constructed. If the call process includes serialization and deserialization point calls, the serialization and deserialization point calls and the context c are stored in the synthesistic method function. The initial call graph is generated based on pointer analysis. The initial call graph and the synthesistic methods function are passed together to step 4). The serialization point refers to the deserialization point ObjectInputStream.readObject() and the serialization point ObjectOutputStream.writeObject(Object).

[0008] 4) Iteratively optimize the initial call graph and synthetic methods functions, and use filters to match the blacklist and whitelist rules in the program during the process to generate a complete call graph with serialization or deserialization.

[0009] 5) During the generation of the call graph in deserialization, pointer analysis and information propagation rules in the deserialization process are processed together. The specific implementation of the serialization point or deserialization point of the deserialization function is used as the starting point for analysis to propagate the information flow downwards. Finally, it is combined with the complete call graph with serialization or deserialization to form a hybrid flow graph.

[0010] Furthermore, in step 2), the CSV file contains entry functions, where each entry function is named...<m,c> Extract to worklist in the form of Right now Each entry function is assigned a global context Globe c, where c is an abstract representation of the program state.

[0011] Furthermore, in step 2),<m,c> All functions m in ∈W are converted into intermediate representations of a single static assignment (SSA). Initial processing is performed using context-sensitive pointer analysis. When processing function calls in the entry function, the call target g of the pointer analysis calculation method is determined by the following formula:

[0012] Targets = dispatch(pt(<o,c> ),g)

[0013] When the pointer set pt(<o,c> If the object class pointed to by ) has an implementation of g, then the above formula is called;

[0014] When there is an ObjectInputStream or ObjectOutputStream stream and its subclasses, and readObject() and writeObject() functions are generated for reading objects, a synthetic method function is created for each of them to record serialization and the calls made during serialization, as input for the next stage.

[0015] Furthermore, in step 3), callback functions are provided during the serialization and deserialization processes. These functions inherit from both the callbacks generated by the Serializable class and the Externalizable class during serialization and deserialization. The callback functions during the serialization process include void writeObject(ObjectOutputStream), void writeExternal(ObjectOutputStream), and ObjectwriteReplace(). The callback functions during the deserialization process include void readObjectNoData(), void readObject(ObjectInputStream), ObjectreadResolve(), void readExternal(ObjectInputStream), and void validateObject().

[0016] Furthermore, in step 4), the initial call graph is iteratively optimized, and the synthetic methods are placed into the corresponding processing model. The processing model includes a serialization model and a deserialization model. At the same time, the deserialization model includes two call graph generation modes: a downsampling-based deserialization call graph generation mode and a full-program call graph generation mode. The downsampling-based deserialization call graph generation mode determines the called classes based on the def-use of IR and performs improved CHA analysis, while the full-program call graph generation mode processes the classes in the program that can be deserialized.

[0017] Furthermore, in step 4), the processing model includes a serialization model and a deserialization model, wherein the serialization model includes the following steps:

[0018] 4.1.1) The serialization point in the synthetic method function of serialization, ObjectOutputStream.writeObject(Object o), is traversed, where the pointer set pt(o) of parameter o is...<o,c> The object o1 is pointed to by ), and t is the serializable object type that the o1 object points to;

[0019] 4.1.2) Iterate through all t. If the corresponding object type contains a callback function during the serialization process, add the callback function as an execution parameter and record the object type corresponding to the callback function in m. s In the middle, m s Given a set of program behaviors, iterate through the object types corresponding to all attributes in t. If the pointer set of a certain attribute f in t is traversed, then fieldType∈pt(<o.f,c> In the last part, fieldType is the object type corresponding to f. If the object type is a callback function during the serialization process, then the object type is added to m. s In the meantime, the callback function is recorded as executed.

[0020] 4.1.3) m s Re-add to step 2) The call analysis is performed again to finally generate a complete serialized call graph.

[0021] Furthermore, in step 4), the processing model includes a serialization model and a deserialization model. The deserialization model employs a downsampling-based deserialization call graph generation mode, which includes the following steps:

[0022] 4.2.1) Iterate through the serialization points ObjectInputStream.readObject() in the synthetic method function of serialization;

[0023] 4.2.2) Use the caller's IR def-use chain to locate the deserialized object:

[0024] o ret =in.readObject();

[0025] x=(T)o ret

[0026] 4.2.3) Iterate through the collection of serialized subclasses t of T. If t implements the relevant callback, determine the corresponding object type and add the object type and callback function to m. sThen iterate through the attribute fields of t. If the object type corresponding to the attribute field of t and its subclasses satisfy deserialization and contain callback functions during the deserialization process, then add the object type corresponding to that attribute field to m. s And add the callback function to m s After all iterations are complete, m will be... s Join again The call analysis is performed, and a complete deserialized call graph is generated.

[0027] Furthermore, in step 5), through underlying pointer analysis and information propagation rules, each instruction in the access function IR is determined according to the rules, using all serialized or deserialized classes G. c As the starting point of information propagation, attributes that satisfy the serialization or deserialization column are marked as the starting point of information propagation. T(x) indicates whether signal x will be propagated. Under the dual analysis of pointer analysis and information flow propagation analysis, a hybrid flow graph with callback functions in the process of complete serialization or deserialization is generated, in which call relationship edges and information propagation relationship edges coexist.

[0028] Beneficial effects: Compared with the prior art, the significant feature of this invention is that it provides comprehensive support for callback function calls during the serialization or deserialization process of classes inheriting from Serializable and Externalizable. At the same time, it uses context-sensitive pointer analysis to improve the efficiency and accuracy of pointer analysis. By combining the rules of information flow propagation with pointer analysis, it adapts the deserialization blacklist and whitelist rules existing in actual programs to make the constructed call relationship more accurate. Furthermore, it enables the call graph to be combined with the information flow to construct a hybrid flow graph, helping developers to find potential deserialization vulnerabilities. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating the present invention;

[0030] Figure 2 This is the code for an example of information flow propagation in this invention;

[0031] Figure 3 This is a schematic diagram of the information flow propagation process in this invention. Detailed Implementation

[0032] The present invention will now be described in further detail with reference to the accompanying drawings.

[0033] This invention provides a hybrid flow graph generation method that supports serialization or deserialization features. Please refer to [link to relevant documentation]. Figure 1 As shown, it includes the following steps:

[0034] 1) Take the Java source code, a CSV file containing the program entry function, and related configuration files as input.

[0035] Java source code is an application that may generate complex callbacks during serialization or deserialization. The entry point function CSV file contains the methods that start program execution, i.e., functions. Using the main() method as the entry point ensures that requests from many entry point methods can be handled. The client can also provide a CSV file with the signatures of the entry point methods, and the configuration file contains the specific pointer analysis strategy of the tool.

[0036] 2) Based on the CSV file containing the entry function input by the tool, extract the entry function and its corresponding context to the work list. Work list<m,c> It exists in the form ∈W, where c represents the context corresponding to the entry function.

[0037] Work list For the generation of the initialization call graph and information flow graph in the next stage, each entry function is assigned a global context Globe c, where c is an abstract representation of the program state.

[0038] All functions m in the code are converted into an intermediate representation (SSA) using a single static assignment (SSA). Initial processing is performed using context-sensitive pointer analysis. When processing function calls within the entry function m, such as x = og(a1, a2, a3, ..., an), the call target g calculated by the pointer analysis method is determined using the following formula:

[0039] Targets = dispatch(pt(<o,c> ),g)

[0040] At this point, the set of pointers to object o in context c is considered, when the pointer set pt(<o,c> If the object class being pointed to has an implementation of g, then the above formula is used for calculation. When there is an ObjectInputStream or ObjectOutputStream and its subclasses that read object stream (readObject()) and write object stream (writeObject()), a synthetic method function is created for each of them to record the calls during serialization and deserialization, as input for the next stage.

[0041] 3) Based on the existing work list Using object-sensitive pointer analysis from the entry function, an initial call graph is constructed. If the call process includes serialization and deserialization point calls, the serialization and deserialization point calls and the context c are stored in the synthesistic method function. The initial call graph is generated based on pointer analysis. The initial call graph and the synthesistic methods function are passed together to step 4), where the deserialization point is ObjectInputStream.readObject() and the serialization point is ObjectOutputStream.writeObject(Object).

[0042] In existing technologies, callback generation tools for serialization or deserialization only consider callbacks that may be generated during the serialization or deserialization process of inheriting the Serializable class, and do not consider callbacks that may be generated during the serialization or deserialization process of the Externalizable class. The CVE-2016-0638 vulnerability that actually exists in the WebLogic server proves that inheriting the Externalizable class can bypass the original deserialization blacklist during the deserialization process, thereby creating vulnerabilities for remote control and code execution.

[0043] Therefore, this invention provides callback functions during serialization and deserialization, which inherit callbacks generated by the Serializable class during serialization or deserialization, and also inherit callbacks generated by the Externalizable class during serialization or deserialization. The callback functions during serialization include void writeObject(ObjectOutputStream), void writeExternal(ObjectOutputStream), and ObjectwriteReplace(); the callback functions during deserialization include void readObjectNoData(), void readObject(ObjectInputStream), ObjectreadResolve(), void readExternal(ObjectInputStream), and void validateObject().

[0044] 4) Iteratively optimize the initial call graph and synthetic methods functions, and use filters to match the blacklist and whitelist rules in the program during the process to generate a complete call graph with serialization or deserialization.

[0045] The initial call graph is iteratively optimized, and synthetic methods are placed into the corresponding processing models. The processing models include serialization and deserialization models. At the same time, due to the uncertainty of objects during Java deserialization, two call graph generation modes are provided. The deserialization model contains two call graph generation modes: a downsampling-based deserialization call graph generation mode and a full-program call graph generation mode. The downsampling-based deserialization call graph generation mode determines the called classes based on the def-use of IR and performs improved CHA analysis, while the full-program call graph generation mode processes the classes in the program that can be deserialized.

[0046] The serialization model includes the following steps:

[0047] 4.1.1) The serialization point in the synthetic method function of serialization, ObjectOutputStream.writeObject(Object o), is traversed, where the pointer set pt(o) of parameter o is...<o,c> The object o1 is pointed to by ), and t is the serializable object type that the o1 object points to;

[0048] 4.1.2) Iterate through all t. If the corresponding object type contains a callback function during the serialization process, add the callback function as an execution parameter and record the object type corresponding to the callback function in m. s In the middle, m s Given a set of program behaviors, iterate through the object types corresponding to all attributes in t. If the pointer set of a certain attribute f in t is traversed, then fieldType∈pt(<o.f,c> In the last part, fieldType is the object type corresponding to f. If the object type is a callback function during the serialization process, then the object type is added to m. s In the meantime, the callback function is recorded as executed.

[0049] 4.1.3) m s Re-add to step 2) The call analysis is performed again to finally generate a complete serialized call graph.

[0050] The deserialization model employs a downsampling-based deserialization call graph generation pattern, which includes the following steps:

[0051] 4.2.1) Iterate through the serialization points ObjectInputStream.readObject() in the synthetic method function of serialization;

[0052] 4.2.2) Use the caller's IR def-use chain to locate the deserialized object:

[0053] o ret =in.readObject();

[0054] x=(T)o ret

[0055] 4.2.3) Iterate through the collection of serialized subclasses t of T. If t implements the relevant callback, determine the corresponding object type and add the object type and callback function to m. s Then iterate through the attribute fields of t. If the object type corresponding to the attribute field of t and its subclasses satisfy deserialization and contain callback functions during the deserialization process, then add the object type corresponding to that attribute field to m. s And add the callback function to m s After all iterations are complete, m will be... s Join again The call analysis is performed, and a complete deserialized call graph is generated.

[0056] The deserialization model also includes a full-program call graph generation mode. Since the object to be deserialized is unknown, for the unknown object input stream, the call graph is generated when deserializing classes that meet the deserialization requirements in the program using the deserialization iterative algorithm based on the results of the filter analysis. All relevant callbacks of all classes that meet the deserialization requirements in the program are executed once, and finally, call analysis is generated.

[0057] 5) During the generation of the call graph in deserialization, pointer analysis and information propagation rules in the deserialization process are processed together. The specific implementation of the serialization point or deserialization point of the deserialization function is used as the starting point for analysis to propagate the information flow downwards. Finally, it is combined with the complete call graph with serialization or deserialization to form a hybrid flow graph.

[0058] Please see Figure 2 and Figure 3 As shown, through underlying pointer analysis and information propagation rules, each instruction in the function IR is accessed according to the rules, using all serialized or deserialized classes G. c As the starting point of information propagation, attributes that satisfy the serialization or deserialization column are marked as the starting point of information propagation. T(x) indicates whether signal x will be propagated. Under the dual analysis of pointer analysis and information flow propagation analysis, a hybrid flow graph with callback functions in the process of complete serialization or deserialization is generated, in which call relationship edges and information propagation relationship edges coexist. Information propagation is carried out according to the information propagation rules in Table 1 below.

[0059] Table 1 Information Dissemination Rules

[0060]

[0061] The final generated information flow call diagram is as follows: Figure 3 As shown, solid lines represent call relationships, and dashed lines represent information flow transmission relationships.

Claims

1. A hybrid flow graph generation method supporting serialization or deserialization features, characterized by, Comprising the following steps: 1) inputting java source program, and the program entry function CSV file, and the related configuration file; 2) According to the entry function CSV file input by the tool, the entry function and the context corresponding to the entry function are extracted to the work list , the work list exists in the form of , where represents the context corresponding to the entry function, is the function; 3) According to the existing work list From the entry function, use object-sensitive pointer analysis method to construct the initial call graph, if the call process contains serialization point and deserialization point call, the serialization point and deserialization point call and context Store in Function, The function is used to record the serialization and the call at the time of serialization. According to the pointer analysis, the initial call graph is generated, and the initial call graph and The function is used to record the serialization and the call at the time of serialization. According to the pointer analysis, the initial call graph is generated, and the initial call graph and The function is used to record the serialization and the call at the time of serialization. According to the pointer analysis, the initial call graph is generated, and the initial call graph and ; Callback functions are provided during serialization and deserialization, both inheriting the callback produced by the class during serialization or deserialization, while inheriting the callback produced by the class during serialization or deserialization, the callback function during serialization contains , , ; The callback function during the deserialization process includes , , , , ; 4) the initial call graph and The iterative optimization of the call graph is performed by the function, which utilizes the filter to match the black and white list rules present in the program during this process, to generate a complete call graph with serialization or deserialization. 5) in the process of generating the deserialization call graph, the pointer analysis and the information propagation rule in the deserialization process are jointly processed, taking the serialization point or the specific implementation of the deserialization point of the deserialization function as the analysis starting point, the downward propagation of the information flow is carried out, and finally the mixed flow graph is synthesized with the complete call graph with serialization or deserialization.

2. The method for generating a hybrid flow graph supporting serialization or deserialization features according to claim 1, wherein, the function in step 2), the function in step 2), the function in step 2), the function in step 2), the function in step 2), is determined by the following equation: ； When the set of pointers The object class pointed to has The above formula is invoked. When there are streams or streams and subclasses thereof occur, read object streams and write object streams are created for them, respectively functions that record the calls for serialization and serialization, as input for the next stage.

3. The method for generating a hybrid flow graph supporting serialization or deserialization features according to claim 2, wherein, In step 4), the initial call graph is iteratively optimized, and the functions are put into the corresponding processing model, which includes a serialization model and a deserialization model, and the deserialization model includes two usage generation modes, namely a deserialization call graph generation mode based on downsampling and a full-program call graph generation mode, wherein the deserialization call graph generation mode based on downsampling determines the class of the call according to the caller chain and makes improved analysis, and the full-program call graph generation mode processes the classes that can be deserialized in the program.

4. The method for generating a hybrid flow graph supporting serialization or deserialization features according to claim 3, wherein, In step 4), the processing model comprises a serialization model and a deserialization model, wherein the serialization model comprises the following steps: 4.1.1) Traversing the serialization points in the serialized function where the parameter set of pointers to objects pointed to by the parameter , is of the type of the serializable object pointed to by the object; 4.1.2) for all , if the corresponding object type contains a callback function during the serialization process, the callback function is added as an execution and the object type corresponding to the callback function is recorded in , for the set of program behaviors, and then for all object types corresponding to the attributes in , if some attribute of the pointer set is traversed, then in is the object type corresponding to the attribute, if the object type is a callback function during the serialization process, the object type is added to , and the callback function is recorded as an execution; 4.1.3) to rejoin the call in step 2) The call analysis is performed again and the complete serialized call graph is finally generated.

5. The method for generating a hybrid stream graph supporting serialization or deserialization features according to claim 4, wherein, In step 4), the processing model comprises a serialization model and a deserialization model, wherein in the deserialization model, a deserialization call graph generation mode based on downsampling is adopted, comprising the following steps: 4.2.1) Traversing the serialized Serialization points in functions traversal; 4.2.2) With the caller of the chain, find the deserialized object: 3) the serialization of T's subclasses is traversed, and if the associated callback is implemented, the corresponding object type is determined, and the object type and the callback function are added to , and the property fields of are traversed, and if the object type and its subclasses corresponding to the property field satisfy deserialization and contain the callback function during the deserialization process, the object type corresponding to the property field is added to , and the callback function is added to , and when all traversals are completed, is added to again to call the analysis, and finally a complete deserialization call graph is generated.

6. The method for generating a hybrid flow graph supporting serialization or deserialization features according to claim 5, wherein, In step 5), by the pointer analysis and information propagation rules of the bottom layer, each instruction in the function IR is accessed according to the rules, and all the serialized or deserialized class G c is the starting point of information propagation, and the attributes that meet the serialization or deserialization column are marked as the starting point of information propagation, indicates a signal whether it will be propagated, and under the dual analysis of pointer analysis and information flow propagation analysis, a mixed flow graph with call relationship edges and information propagation relationship edges coexisting in the serialization or deserialization process of the callback function is generated.

7. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the steps of the method in any one of claims 1 to 6.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 6.

Images