feat(security): 仅加载显式授权的外部 DLL

Runtime/Loading/ShrinkModLoader.cs

@@ -18,6 +18,7 @@ namespace ShrinkModFramework
         private static readonly Dictionary<string, ShrinkModHandle> LoadedMods = new(StringComparer.Ordinal);
         private static readonly List<ShrinkModHandle> LoadSequence = new();
         private static readonly ShrinkModRegistryManager RegistryManager = new();
+        private static string[] _authorizedDllPaths = Array.Empty<string>();
 
         public static bool IsLoaded { get; private set; }
         public static IReadOnlyDictionary<string, ShrinkModHandle> Mods =>
@@ -27,8 +28,35 @@ namespace ShrinkModFramework
         public static event Action<IReadOnlyDictionary<string, ShrinkModHandle>> OnAllModsReady;
 
         public static IReadOnlyDictionary<string, ShrinkModHandle> LoadAll(ShrinkModFrameworkSettings settings = null)
+            => LoadInternal(settings, Array.Empty<string>());
+
+        /// <summary>
+        /// 加载工程内模组，并且只加载调用方显式授权的外部 DLL 路径。
+        /// 路径集合是完整白名单，不会递归扫描模组目录；后续 revision 刷新也只复用该白名单。
+        /// </summary>
+        public static IReadOnlyDictionary<string, ShrinkModHandle> LoadAuthorized(
+            ShrinkModFrameworkSettings settings,
+            IEnumerable<string> authorizedDllPaths)
+        {
+            if (authorizedDllPaths == null)
+                throw new ArgumentNullException(nameof(authorizedDllPaths));
+
+            return LoadInternal(settings, authorizedDllPaths);
+        }
+
+        private static IReadOnlyDictionary<string, ShrinkModHandle> LoadInternal(
+            ShrinkModFrameworkSettings settings,
+            IEnumerable<string> authorizedDllPaths)
         {
             settings ??= ShrinkModFrameworkSettings.Instance;
+            _authorizedDllPaths = authorizedDllPaths
+                .Where(path => !string.IsNullOrWhiteSpace(path))
+                .Select(path => path.Trim())
+                .Distinct(StringComparer.OrdinalIgnoreCase)
+                .ToArray();
+
+            if (settings == null || settings.useContextHost)
+                return ApplyContextComposition(settings, _authorizedDllPaths);
 
             if (IsLoaded)
             {
@@ -36,15 +64,13 @@ namespace ShrinkModFramework
                 return Mods;
             }
 
-            if (settings == null || settings.useContextHost)
-                return ApplyContextComposition(settings);
-
             var verboseLogging = settings == null || settings.verboseLogging;
 
             try
             {
                 ShrinkModNetworkManager.Configure(settings == null || settings.enableNetworkSync, verboseLogging);
-                ShrinkExternalModAssemblyLoader.LoadExternalAssemblies(settings, verboseLogging);
+                ShrinkExternalModAssemblyLoader.LoadExternalAssemblies(
+                    settings, verboseLogging, _authorizedDllPaths);
 
                 var discovered = DiscoverMods(settings);
                 var ordered = ResolveLoadOrder(discovered, allowExistingLoadedDependencies: true);
@@ -73,12 +99,13 @@ namespace ShrinkModFramework
         {
             settings ??= ShrinkModFrameworkSettings.Instance;
             if (settings == null || settings.useContextHost)
-                return ApplyContextComposition(settings);
+                return ApplyContextComposition(settings, _authorizedDllPaths);
             if (!IsLoaded)
-                return LoadAll(settings);
+                return LoadInternal(settings, _authorizedDllPaths);
 
             var verboseLogging = settings == null || settings.verboseLogging;
-            ShrinkExternalModAssemblyLoader.LoadExternalAssemblies(settings, verboseLogging);
+            ShrinkExternalModAssemblyLoader.LoadExternalAssemblies(
+                settings, verboseLogging, _authorizedDllPaths);
 
             var discovered = DiscoverMods(settings)
                 .Where(mod => !LoadedMods.ContainsKey(mod.Info.ModId))
@@ -145,6 +172,7 @@ namespace ShrinkModFramework
             ShrinkModNetworkManager.ResetForDomainReload();
             ShrinkExternalModAssemblyLoader.ResetForTesting();
             ShrinkHarmonyPatchService.ResetForTesting();
+            _authorizedDllPaths = Array.Empty<string>();
         }
 
         internal static void ResetForDomainReload()
@@ -160,17 +188,22 @@ namespace ShrinkModFramework
             ShrinkModNetworkManager.ResetForDomainReload();
             ShrinkExternalModAssemblyLoader.ResetForDomainReload();
             ShrinkHarmonyPatchService.ResetForTesting();
+            _authorizedDllPaths = Array.Empty<string>();
         }
 
         private static IReadOnlyDictionary<string, ShrinkModHandle> ApplyContextComposition(
-            ShrinkModFrameworkSettings settings)
+            ShrinkModFrameworkSettings settings,
+            IEnumerable<string> authorizedDllPaths)
         {
             var previousGenerations = Mods.ToDictionary(
                 pair => pair.Key,
                 pair => pair.Value.Generation,
                 StringComparer.Ordinal);
 
-            var result = ShrinkModCordisRuntime.ApplyDiscoveredAsync(settings).GetAwaiter().GetResult();
+            var result = ShrinkModCordisRuntime
+                .ApplyDiscoveredAsync(settings, authorizedDllPaths)
+                .GetAwaiter()
+                .GetResult();
             IsLoaded = true;
             foreach (var pair in result.OrderBy(pair => pair.Key, StringComparer.Ordinal))
             {
@@ -206,6 +239,11 @@ namespace ShrinkModFramework
 
             foreach (var assembly in AppDomain.CurrentDomain.GetAssemblies())
             {
+                if (ShrinkExternalModAssemblyLoader.IsExternalAssembly(assembly) &&
+                    !ShrinkExternalModAssemblyLoader.TryGetCurrentRevision(assembly, out _))
+                {
+                    continue;
+                }
                 if (!ShouldScanAssembly(assembly, prefixes))
                     continue;