mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-21 20:18:06 +02:00
[pitboss] phase 03: Track J.1 + Track L.1 — DESERIALIZE corpus + Java/Python/PHP/Ruby adapters
This commit is contained in:
parent
01fcaab310
commit
9dc60b51c0
33 changed files with 1625 additions and 53 deletions
|
|
@ -125,6 +125,20 @@ pub enum ProbeKind {
|
|||
/// Signal that interrupted the sink call.
|
||||
signal: Signal,
|
||||
},
|
||||
/// Phase 03 (Track J.1) deserialization-sink observation. Stamped
|
||||
/// by the per-language harness shim when the instrumented
|
||||
/// deserialiser (`ObjectInputStream.resolveClass`,
|
||||
/// `pickle.Unpickler.find_class`, `unserialize` `__wakeup`,
|
||||
/// `Marshal.load` const lookup) is asked to materialise a class
|
||||
/// outside the harness's allowlist. `gadget_chain_invoked` is
|
||||
/// `true` when the disallowed class was actually constructed (i.e.
|
||||
/// the gadget chain ran) and `false` when the shim caught it at
|
||||
/// the resolution boundary before any sink effect.
|
||||
Deserialize {
|
||||
/// `true` iff the disallowed gadget class was instantiated /
|
||||
/// executed before the shim aborted the chain.
|
||||
gadget_chain_invoked: bool,
|
||||
},
|
||||
}
|
||||
|
||||
impl Default for ProbeKind {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue