论文标题
发现隐藏的危险：在野外找到不安全的GO代码
Uncovering the Hidden Dangers: Finding Unsafe Go Code in the Wild
论文作者
论文摘要
GO编程语言旨在通过诸如垃圾收集和严格类型系统的自动内存管理等措施来提供内存和线程安全。但是，它还提供了一种通过使用不安全包装来规避此安全网的方法。虽然有不安全的合法用例，但开发人员必须谨慎行事，以免引入诸如缓冲区溢出或内存腐败之类的漏洞。我们使用Go-Geiger进行了一项研究，研究了在Github上最受欢迎的500个最受欢迎的开源GO项目中使用不安全的研究，其中包括对1,400个代码示例的手动分析，涉及如何使用不安全。从使用GO的模块系统的项目中，有38％的人至少包含一种不安全的使用情况，而91％的使用中至少包含项目本身或其及其及其依赖性的一种不安全使用情况。根据发现的使用模式，我们在不同情况下提出了可能的利用向量。最后，我们提出了Go-Safer，这是一种新型的静态分析工具，可识别以前未被现有工具发现的危险和常见使用模式。
The Go programming language aims to provide memory and thread safety through measures such as automated memory management with garbage collection and a strict type system. However, it also offers a way of circumventing this safety net through the use of the unsafe package. While there are legitimate use cases for unsafe, developers must exercise caution to avoid introducing vulnerabilities like buffer overflows or memory corruption in general. Using go-geiger, we conducted a study on the usage of unsafe in the top 500 most popular open-source Go projects on GitHub, including a manual analysis of 1,400 code samples on how unsafe is used. From the projects using Go's module system, 38% directly contain at least one unsafe usage, and 91% contain at least one unsafe usage in the project itself or one of its transitive dependencies. Based on the usage patterns found, we present possible exploit vectors in different scenarios. Finally, we present go-safer, a novel static analysis tool to identify dangerous and common usage patterns that were previously undetected with existing tools.
