Cybersecurity-Projects/PROJECTS/beginner/deserialization-gadget-lab/test/control_check.rb

155 lines
6.4 KiB
Ruby

# ©AngelaMos | 2026
# control_check.rb
# frozen_string_literal: true
$LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
require "marshalsea"
Pair = Struct.new(:x, :y)
failures = []
def check(label, passed, detail)
puts format(" %-6s %-46s %s", passed ? "PASS" : "FAIL", label, detail)
passed
end
puts "=== 1 oracle liveness ==="
fired = false
tracer = TracePoint.new(:call, :c_call) do |tp|
fired = true if tp.method_id == :load && tp.self.equal?(Marshal)
end
tracer.enable { Marshal.load(Marshal.dump([1, 2])) }
failures << "oracle" unless check("TracePoint observes a real Marshal.load", fired, fired ? "fired" : "silent")
puts
puts "=== 2 object link indexing ==="
cyclic = []
cyclic << cyclic
blob = Marshal.dump(cyclic)
link = Marshalsea::Marshal::Parser.new(blob).parse.root.children.first
bytes = blob.bytes.map { |b| format("%02x", b) }.join(" ")
failures << "link index" unless check("self-referential array links to index 0", link.value.zero?, bytes)
puts
puts "=== 3 corpus round-trip ==="
shared = "shared"
aliased = [shared, shared]
cyclic_hash = {}
cyclic_hash[:self] = cyclic_hash
deep = [1]
20.times { deep = [deep] }
corpus = [
nil, true, false,
0, 1, -1, 122, 123, -123, -124, 255, -256, 65_536, -65_536,
1_073_741_823, -1_073_741_824, 2**70, -(2**70), 2**200,
0.0, -0.0, 3.14, Float::INFINITY, -Float::INFINITY,
"", "str", "\x00\xff binary".b, "unicode é中",
:sym, :"with spaces", :marshal_load,
[], {}, [1, [2, [3, [4]]]], { a: { b: { c: 1 } } },
(1..5).to_a, Pair.new(1, 2), Pair.new(nil, [1, 2]),
Object.new, Time.now, /regex/i, //mx, String, Comparable, Marshalsea,
aliased, cyclic_hash, deep,
{ "mixed" => [1, :two, 3.0, nil, true] },
Hash.new(0).tap { |h| h[:k] = 1 },
Gem::Requirement.new(">= 0"), Gem::Version.new("1.2.3")
]
parsed = corpus.count do |item|
Marshalsea::Marshal::Parser.new(Marshal.dump(item)).parse.root
true
rescue StandardError => e
puts " #{item.class}: #{e.class}: #{e.message}"
false
end
failures << "corpus" unless check("every corpus entry parsed", parsed == corpus.length, "#{parsed}/#{corpus.length}")
puts
puts "=== 4 stream rejection ==="
rejected = begin
Marshalsea::Marshal::Parser.new("\x04\x08[\x06@\x63").parse
false
rescue Marshalsea::Marshal::InvalidLinkError
true
end
failures << "bounds" unless check("out-of-range object link rejected", rejected, "InvalidLinkError")
puts
puts "=== 5 payload inspection ==="
result = Marshalsea::Marshal::Parser.new(Marshal.dump(Gem::Requirement.new(">= 0"))).parse
from_stream = result.gated_sinks.map { |s| "#{s.class_name}##{s.sink_method}" }.uniq.sort
failures << "class names" unless check("classes extracted", !result.class_names.empty?,
result.class_names.join(", "))
failures << "gated sinks" unless check("gated sinks flagged", !from_stream.empty?,
from_stream.join(", "))
puts
puts "=== 6 parser and scanner agreement ==="
scanned = Marshalsea::Scanner.new(namespace: "Gem").scan.gated.map(&:to_s).sort
missing = from_stream - scanned
located = !from_stream.empty? && missing.empty?
agreement_detail = if from_stream.empty?
"vacuous, section 5 produced no sinks to locate"
elsif missing.empty?
"#{from_stream.length}/#{from_stream.length}"
else
"missing #{missing.join(', ')}"
end
failures << "agreement" unless check("parser sinks located by reflection", located, agreement_detail)
puts
puts "=== 7 scanner precision ==="
full = Marshalsea::Scanner.new.scan
ungated = full.ungated.length
reachable = full.reachable.count { |c| !c.gated? }
kept = ungated.zero? ? 0 : (100.0 * reachable / ungated).round(1)
prism_detail = full.prism_available? ? "Prism.parse_file in use" : "ABSENT, every state verdict is a guess"
failures << "prism" unless check("prism backend live, so reachability is real",
full.prism_available?, prism_detail)
failures << "precision" unless check("reachability filter discriminates",
reachable.positive? && reachable < ungated,
"#{ungated} ungated -> #{reachable} reachable, #{kept}% kept")
failures << "gated located" unless check("gated sinks located", !full.gated.empty?,
full.gated.join(", "))
lossy = full.candidates_lost? ? full.suppressions.join(", ") : "0 lossy suppressions"
failures << "candidates lost" unless check("no candidate was silently dropped",
!full.candidates_lost?, lossy)
unreadable = full.candidates.select(&:unreadable_source?)
fails_open = !unreadable.empty? &&
unreadable.all? { |c| c.gated? || !c.entry_point? || !c.accepts_dispatch? || c.reachable? }
failures << "unreadable fails open" unless check("an unreadable source fails open, never to inert",
fails_open,
"#{unreadable.length} candidates whose source could not be parsed")
unanalysable = full.unanalysable
owned = !unanalysable.empty? && unanalysable.none?(&:state_known?) && !full.fully_analysed?
failures << "unanalysable owned" unless check("C-defined methods are named unanalysable, not inert",
owned,
"#{unanalysable.length} of #{full.candidates.length} have no Ruby source")
flooded = unanalysable.reject(&:gated?).select(&:reachable?)
flood_detail = flooded.empty? ? "0 of #{unanalysable.length} promoted" : "#{flooded.length} promoted with no evidence"
failures << "unanalysable flood" unless check("unanalysable never buys its way into reachable",
!unanalysable.empty? && flooded.empty?, flood_detail)
coverage = "#{full.candidates.count(&:state_known?)} analysed, " \
"#{unanalysable.length} unanalysable, #{unreadable.length} unreadable"
suppressed = full.complete? ? "none" : full.suppressions_by_site.map { |site, n| "#{site}=#{n}" }.join(" ")
puts format(" %-6s %-46s %s", "INFO", "ObjectSpace coverage is load-bounded",
"#{full.scanned_modules} modules loaded")
puts format(" %-6s %-46s %s", "INFO", "state analysis coverage", coverage)
puts format(" %-6s %-46s %s", "INFO", "suppressed errors this scan", suppressed)
puts
if failures.empty?
puts "ALL CONTROLS PASSED"
exit 0
end
puts "FAILED: #{failures.join(', ')}"
exit 1