Method test

src/main/java/Preprocess/TEST.java:38–446

()

    private static List<HashMap> resultList = new LinkedList<>();

    public static void test() {

        int i = 1;
        Driver driver = GraphDatabase.driver("bolt://localhost:7687", AuthTokens.basic("neo4j", "password"));
        Session session = driver.session();

        String jsonPath = "./src/main/resources";

        try {


            //Map<Long, Node> nodesMap = new HashMap<>();
            //Map<Long, Node> nodesMap = new LinkedHashMap<>(); //HashMap存入数据与取出数据顺序不一致


            String cmdSql1 = "match (source:Method {SIGNATURE:'<java.util.PriorityQueue: void readObject(java.io.ObjectInputStream)>'})\n" +
                    "match (sink:Method {SIGNATURE:'<java.lang.reflect.Method: java.lang.Object invoke(java.lang.Object,java.lang.Object[])>'})\n" +
                    "call apoc.algo.allSimplePaths(sink, source, '<CALL|ALIAS', 10) yield path \n" +
                    "return path limit 50";

            //CC:4.0    CC2,4,8
            //CC:3.1    CC5,6,7,9
            //CC:3.2.1  CC10

            String cmdSqlcc2 = "//cc2\n" +
                    "match path = (m1:Method {SIGNATURE:'<java.util.PriorityQueue: void readObject(java.io.ObjectInputStream)>'})-[:CALL ]->(m2:Method {NAME:'heapify'})-[:CALL ]->(m3)-[:CALL]->(m4:Method {NAME:'siftDownUsingComparator'})-[:CALL]->(m5)-[:ALIAS*]-(m6 )-[:CALL]->(m7)-[:ALIAS*]-(m8:Method)-[:CALL]->(m9:Method {IS_SINK:true}) return path";

            String cmdSqlcc5  = "// cc5\n" +
                    "match path=(m1:Method {SIGNATURE:'<javax.management.BadAttributeValueExpException: void readObject(java.io.ObjectInputStream)>'})-[:CALL]->(m2:Method {NAME:'toString'})-[:ALIAS*]-(m3:Method {SIGNATURE:'<org.apache.commons.collections.keyvalue.TiedMapEntry: java.lang.String toString()>'})-[:CALL]->(m4:Method {NAME:'getValue'})-[:CALL]->(m5:Method {NAME:'get'})-[:ALIAS*1..2]-(m6:Method {NAME:'get'})-[:CALL]->(m7:Method {NAME:'transform'})-[:ALIAS*]-(m8:Method)-[:CALL]->(m9:Method {IS_SINK:true}) return path";

            String cmdSqlcc6 = "//cc6cc10\n" +
                    "match (source:Method {SIGNATURE:'<java.util.HashSet: void readObject(java.io.ObjectInputStream)>'})-[:CALL]->(m2:Method) where (m2.NAME in ['defaultReadObject','readFloat','readObject'])=false\n" +
                    "match (sink:Method {IS_SINK:true,NAME:'invoke'})<-[:CALL]-(m1:Method {NAME:'transform'})\n" +
                    "call apoc.algo.allSimplePaths(sink, source, '<CALL|ALIAS', 10) yield path\n" +
                    "return *";

            String cmdSqlcc7 ="//cc7\n" +
                    "match path=(m1:Method {SIGNATURE:'<java.util.Hashtable: void readObject(java.io.ObjectInputStream)>'})-[:CALL ]->(m2:Method {NAME:'reconstitutionPut'})-[:CALL ]->(m3:Method {NAME:'equals'})-[:ALIAS*..2]-(m4:Method)-[:CALL ]->(m5:Method {NAME:'get'})-[:ALIAS*1..2]-(m6:Method {NAME:'get'})-[:CALL]->(m7:Method {NAME:'transform'})-[:ALIAS*]-(m8:Method)-[:CALL]->(m9:Method {IS_SINK:true})  return path";

            String cmdSqlcc8 = "//cc8\n" +
                    "match path=(m1:Method {SIGNATURE:'<org.apache.commons.collections4.bag.TreeBag: void readObject(java.io.ObjectInputStream)>'})-[:CALL ]->(m2:Method {NAME:'doReadObject'})-[:CALL ]->(m3:Method {NAME:'put'})-[:ALIAS*1..4]-(m4:Method)-[:CALL ]->(m5:Method {NAME:'compare'})-[:CALL ]->(m6:Method)-[:ALIAS*]-(m7:Method {SIGNATURE:'<org.apache.commons.collections4.comparators.TransformingComparator: int compare(java.lang.Object,java.lang.Object)>'})-[:CALL ]->(m8)-[:ALIAS*]-(m9:Method)-[:CALL*..5 ]->(m10:Method {IS_SINK:true}) return path";

            String cmdSqlcc9="//cc9\n" +
                    "match path=(m1:Method {SIGNATURE:'<java.util.Hashtable: void readObject(java.io.ObjectInputStream)>'})-[:CALL]->(m2:Method {NAME:'reconstitutionPut'})-[:CALL]->(m3:Method {NAME:'hashCode'})-[:ALIAS*]-(m4:Method {SIGNATURE:'<org.apache.commons.collections.keyvalue.TiedMapEntry: int hashCode()>'})-[:CALL]->(m5:Method {NAME:'getValue'})-[:CALL]->(m6:Method {NAME:'get'})-[:ALIAS*1..2]-(m7:Method {NAME:'get'})-[:CALL]->(m8:Method {NAME:'transform'})-[:ALIAS*]-(m9:Method)-[:CALL]->(m10:Method {IS_SINK:true}) return path";
            String cmdSql =
                    "match (source:Method {NAME:'readObject'})\n" +
                            "match (sink:Method {SIGNATURE:'<java.lang.reflect.Method: java.lang.Object invoke(java.lang.Object,java.lang.Object[])>'})\n" +
                            "call apoc.algo.allSimplePaths(sink, source, '<CALL|ALIAS', 10) yield path \n" +
                            "return path limit 2";

            // XStream

            //CVE-2021-21346
            String xstream ="//xstream 2021-1\n" +
                    "match p1 = (m3:Method {CLASSNAME:'com.sun.org.apache.xpath.internal.objects.XString'})-[:ALIAS*..3]-(m2:Method {NAME:'equals'})<-[:CALL]-(source:Method {NAME:'compareTo',CLASSNAME:'javax.naming.ldap.Rdn$RdnEntry'})\n" +
                    "match p2 = (sink:Method {IS_SINK:true,NAME:'invoke'})<-[:CALL]-(m1:Method {CLASSNAME:'sun.swing.SwingLazyValue',NAME:'createValue'}) \n" +
                    "call apoc.algo.allSimplePaths(m1, m3, '<CALL|ALIAS', 12) yield path\n" +
                    "return apoc.path.combine(apoc.path.combine(p2,path),p1) limit 20";