@@ -20,20 +20,20 @@ We cannot just detect whether two types are the same to flag the lint, as this d
20
20
core issue. The core issue is whether two types deserialize the same or not. Thus we should hunt for
21
21
any two types that deserialize the same. However, this is kinda impossible to do, since it is dependent
22
22
on what data format is being used. Two types that deserialize the same in one data format might not
23
- in another.
23
+ in another.
24
24
25
25
So the strategy we've come up with is first gather all the types that are being deserialized in the code.
26
26
Say ` n ` types are collected. Then one of the following constraints must hold:
27
27
28
28
1 . ` n=1 ` , and the type is an enum.
29
29
2 . All types are structs AND
30
- each struct has a field that is the enum type found before AND
31
- the number of variants in the enum must be at least ` n-1 ` .
30
+ each struct has a field that is the enum type found before AND
31
+ the number of variants in the enum must be at least ` n-1 ` .
32
32
33
33
These two constraints encode two scenarios where the code will be safe from the type-cosplay issue:
34
34
35
35
1 . If there is only 1 enum being deserialized, then all types will be unique.
36
- 2 .
36
+ 2 .
37
37
38
38
Two circumstances avoid the type cosplay attack.
39
39
// 1. All structs are variants of a single enum type--an enum effectively has a
@@ -42,12 +42,14 @@ Two circumstances avoid the type cosplay attack.
42
42
// can be distinguished.
43
43
44
44
# Test Cases
45
+
45
46
Whenever we refer to a type, we refer to whether it was deserialized in the program, not
46
47
to the type definition.
48
+
47
49
- single deserialized type; is enum => SECURE
48
50
- single deserialized type; is not enum; has discriminant => SECURE
49
51
- single deserialized type; is not enum; no discriminant => INSECURE (insecure)
50
- NOTE: do we really need to check if one is an enum?
52
+ NOTE: do we really need to check if one is an enum?
51
53
- multiple deserialized types; one is enum; all structs have discriminant => SECURE
52
54
- multiple deserialized types; one is enum; some struct doesn't have discriminant => INSECURE
53
55
- multiple deserialized types; multiple enums => INSECURE (insecure-2)
0 commit comments