feat: Experimental code to start java class reachability. (#1480)

This adds the beginnings of a Java reachability analyser that
recursively parses class constant pools
(https://docs.oracle.com/javase/specs/jvms/se22/html/jvms-4.html#jvms-4.7)
for references to other classes.

The intention is to see if this can be used to exclude transitive
dependencies
from vulnerability scanning completely, if they can be proven to be
unreachable.

There's still a lot of TODOs remaining (recorded in the Go source as
comments). This tool currently expects
all dependency class files to be available (passed via `--classpath`).

experimental/javareach/README.md

@@ -0,0 +1,19 @@
+# Java reachability (WIP)
+
+This is an experimental tool to statically enumerate the reachable classes in a
+Java program.
+
+The intention is to see if this can be used to exclude transitive dependencies
+from vulnerability scanning completely, if they can be proven to be
+unreachable.
+
+## Usage
+
+```
+go run ./cmd/reachable -classpath=<classpath> path/to/root/class
+```
+
+Note that `<classpath>` currently only supports a single directory path
+containing .class files, with a directory structure that mirrors the package
+hierarchy. This is unlike classpaths supported by Java runtimes (which supports
+specifying multiple directories and .jar files)

experimental/javareach/cmd/reachable/main.go

@@ -0,0 +1,144 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/google/osv-scanner/experimental/javareach"
+)
+
+// Usage:
+//
+//	go run ./cmd/reachable -classpath=<classpath> path/to/root/class
+//
+// Note that <classpath> currently only supports a single directory path containing .class files.
+// This is unlike classpaths supported by Java runtimes (which supports
+// specifying multiple directories and .jar files)
+//
+// TODO: Support unpacking .jar files (uber jars that contain all dependencies)
+// TODO: Support non-uber jars by transitively resolving pom.xml files and
+// automatically downloading dependencies if the pom.xml exists in the .jar
+// (e.g. META-INF/maven/pom.xml)
+// TODO: Map classes back to Maven dependencies.
+func main() {
+	classPath := flag.String("classpath", "", "(Required) A single directory containing Java class files with a directory structure that mirrors the package hierarchy.")
+	flag.Usage = func() {
+		fmt.Fprintf(flag.CommandLine.Output(), "Usage: %s <arguments> <root class name> <root class name 2...>\n", os.Args[0])
+		flag.PrintDefaults()
+	}
+	flag.Parse()
+
+	if *classPath == "" {
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	for _, className := range flag.Args() {
+		cf, err := findClass(*classPath, className)
+		if err != nil {
+			slog.Error("Failed to find", "class", className, "error", err)
+			os.Exit(1)
+		}
+
+		err = EnumerateReachability(cf, *classPath)
+		if err != nil {
+			slog.Error("Failed to enumerate reachability", "class", className, "error", err)
+			os.Exit(1)
+		}
+	}
+}
+
+func findClass(classPath string, className string) (*javareach.ClassFile, error) {
+	// TODO: Handle directory traversal.
+	classFilepath := filepath.Join(classPath, className)
+	if !strings.HasSuffix(classFilepath, ".class") {
+		classFilepath += ".class"
+	}
+	classFile, err := os.Open(classFilepath)
+	if err != nil {
+		return nil, err
+	}
+	return javareach.ParseClass(classFile)
+}
+
+// TODO:
+//   - Detect uses of reflection
+//   - See if we should do a finer grained analysis to only consider referenced
+//     classes where a method is called/referenced.
+func EnumerateReachability(cf *javareach.ClassFile, classPath string) error {
+	seen := map[string]struct{}{}
+	if err := enumerateReachability(cf, classPath, seen); err != nil {
+		return err
+	}
+
+	for k, _ := range seen {
+		fmt.Println(k)
+	}
+	return nil
+}
+
+func enumerateReachability(cf *javareach.ClassFile, classPath string, seen map[string]struct{}) error {
+	thisClass, err := cf.ConstantPoolClass(int(cf.ThisClass))
+	if err != nil {
+		return err
+	}
+
+	if _, ok := seen[thisClass]; ok {
+		return nil
+	}
+	slog.Debug("Analyzing", "class", thisClass)
+	seen[thisClass] = struct{}{}
+
+	for i, cp := range cf.ConstantPool {
+		if int(cf.ThisClass) == i {
+			// Don't consider this class itself.
+			continue
+		}
+
+		if cp.Type() == javareach.ConstantKindClass {
+			class, err := cf.ConstantPoolClass(i)
+			if err != nil {
+				return err
+			}
+
+			// Handle arrays.
+			if len(class) > 0 && class[0] == '[' {
+				// "[" can appear multiple times (nested arrays).
+				class = strings.TrimLeft(class, "[")
+
+				// Array of class type. Extract the class name.
+				if len(class) > 0 && class[0] == 'L' {
+					class = strings.TrimSuffix(class[1:], ";")
+				} else if slices.Contains(javareach.BinaryBaseTypes, class) {
+					// Base type (e.g. integer): just ignore this.
+					continue
+				} else {
+					// We don't know what the type is.
+					return fmt.Errorf("unknown class type %s", class)
+				}
+			}
+
+			if javareach.IsStdLib(class) {
+				continue
+			}
+
+			slog.Debug("found", "dependency", class)
+			depcf, err := findClass(classPath, class)
+			if err != nil {
+				// Dependencies can be optional, so this is not a fatal error.
+				slog.Error("failed to find class", "class", class, "from", thisClass, "cp idx", i, "error", err)
+				continue
+			}
+			if err := enumerateReachability(depcf, classPath, seen); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}

experimental/javareach/go.mod

@@ -0,0 +1,3 @@
+module github.com/google/osv-scanner/experimental/javareach
+
+go 1.23