静态分析框架从 01 到 10-数据篇

public abstract class AbstractModel<T> {
    private static final AtomicInteger counter = new AtomicInteger();

    @Getter @Setter private T raw;
    @Getter private long internalId = counter.getAndIncrement();

    public void prepare(Transaction tx) {}
    protected abstract Map<String, Object> getProperties();
    public abstract T doCreate(Transaction tx);
    public abstract T doQuery(Transaction tx);
}

public abstract class AbstractNode extends AbstractModel<Node> {

    protected abstract Set<Label> getLabels();

    @Override
    public Node doQuery(Transaction tx) {...}

    @Override
    public Node doCreate(Transaction tx) {
        if (getRaw() != null) {
            return getRaw();
        }
        Map<String, Object> prop = getProperties();
        Node node = <CREATE NODE AS n RETURN n>
        if (node != null) {
            this.setRaw(node);
        }

        return null;
    }

    @Override
    public String toString() {...}
}

public class JavaTypeDecl extends AbstractNode {

    String name;

    @Override
    protected Set<Label> getLabels() { return Sets.newHashSet(Labels.JavaTypeDecl); }

    @Override
    protected Map<String, Object> getProperties() {
        Map<String, Object> prop = new HashMap<>();
        prop.put("name", this.name);
        return prop;
    }
}

Relationship relationship;
try {
    KernelTransaction ktx = DatabaseService.getKernelTransaction(tx);
    int relationshipTypeId = ktx.tokenWrite().relationshipTypeGetOrCreateForName(getType().name());
    long relationshipId = ktx.dataWrite().relationshipCreate(from.getId(), relationshipTypeId, to.getId());
    relationship = ((InternalTransaction) tx).newRelationshipEntity(relationshipId, from.getId(), relationshipTypeId, to.getId());
} catch (Throwable e) {
    relationship = tx.getNodeById(from.getId()).createRelationshipTo(to, getType());
}

public class CycleUnique implements UniquenessFilter {
    UniquenessFilter parent;
    Map<Long, Set<Long>> pathFieldVisited = new HashMap<>();

    public CycleUnique() { this(RELATIONSHIP_PATH.create(null)); }

    public CycleUnique(UniquenessFilter parent) { this.parent = parent; }

    @Override
    public boolean checkFirst(TraversalBranch branch) { return parent.checkFirst(branch); }

    @Override
    public boolean check(TraversalBranch source) {
        if (!parent.check(source)) return false;
        long idToCompare = source.endNode().getId();
        if (source.endNode().hasLabel(Labels.FieldNode)) {
            Set<Long> visited = pathFieldVisited.computeIfAbsent(source.startNode().getId(), k -> new HashSet<>());
            if (!visited.add(idToCompare)) return false;
        }
        while (source.length() > 0
                && source.lastRelationship().getType().name().equals(RelTypes.DataPointTo.name())
                && source.lastRelationship().getStartNode().hasLabel(Labels.VarNode)) {
            source = source.parent();
            if (source.endNode().getId() == idToCompare) {
                return false;
            }
        }
        return true;
    }
}

@Override
public Evaluation evaluate(Path path, BranchState<LinkedList<Integer>> state) {
    if (maxDepth(path, depth)) return Evaluation.EXCLUDE_AND_PRUNE;

    if (sanitizes != null && sanitizes.contains(path.endNode())) return Evaluation.EXCLUDE_AND_PRUNE;

    if (end != null && end.contains(path.endNode())) return Evaluation.INCLUDE_AND_CONTINUE;

    return end == null ? Evaluation.INCLUDE_AND_PRUNE : Evaluation.EXCLUDE_AND_CONTINUE;
}

@Builder
public PathFinder(int maxDepth, int maxStepExpanding, Direction direction, UniquenessFactory uniqueness, RelationshipType[] flows, PathBooster booster) {
    this.maxDepth = maxDepth;
    this.maxStepExpanding = maxStepExpanding;
    this.direction = direction == null ? Direction.OUTGOING : direction;
    this.uniqueness = uniqueness == null ? CycleUnique.CYCLE_PATH : uniqueness;
    this.flows = flows == null ? DATA_FLOW : flows;
    this.booster = booster;
}

private TraversalDescription traversal(PathEvaluator<LinkedList<Integer>> evaluator) {
    TraversalDescription side = new MonoDirectionalTraversalDescription()
            .breadthFirst()
            .evaluator(evaluator)
            .uniqueness(uniqueness)
            .expand(PathExpander.builder()
                    .flows(flows)
                    .maxStepExpanding(maxStepExpanding)
                    .booster(booster)
                    .build());

    if (isBackward()) {
        side = side.reverse();
    }

    try {
        Field field = MonoDirectionalTraversalDescription.class.getDeclaredField("initialState");
        field.setAccessible(true);
        field.set(side, STACK_EMPTY);
    } catch (NoSuchFieldException | IllegalAccessException e) {
        e.printStackTrace();
    }
    return side;
}

private Iterable<Path> sideCollect(Set<Node> from, TraversalDescription side) {
    HashSet<Path> paths = new HashSet<>();
    for (org.neo4j.graphdb.Path path : side.traverse(from)) {
        path = isBackward() ? reverse(path) : path;
        paths.add(path);
    }
    return paths;
}

public abstract class DataTaintModel extends VulnerableDiscovering {
    public static int DEFAULT_MAX_DEPTH = 0;
    public static int DEFAULT_STEP_EXPANDING = 0;

    private final RuleEngine engine;
    Set<Path> foundPath = new HashSet<>();
    Map<Node, String> nodeQueries = new HashMap<>();

    public DataTaintModel(RuleEngine engine) {this.engine = engine;}

    protected RuleEngine engine() {return engine;}

    protected abstract Set<String> sourceQueries();
    protected abstract Set<String> sinkQueries();

    protected Set<Node> sources() {...}
    protected Set<Node> sinks() {...}

    protected RelationshipType[] flows() {return PathFinder.DATA_FLOW;}

    protected Set<Node> sanitizes() {return null;}

    protected Set<Node> passThrough() {return null;}

    protected int depth() {return DEFAULT_MAX_DEPTH;}

    protected int stepExpanding() {return DEFAULT_STEP_EXPANDING;}

    protected Direction direction() {return Direction.OUTGOING;}

    protected Path verifyPath(Path path) {...}

    protected Vulnerable buildVulnerable(Path path) {...}

    protected int importance(Path path) {return importance();}

    protected Set<String> tags(Path path) {...}

    @Override
    public Set<Vulnerable> discover() {
        Set<Vulnerable> result = new HashSet<>();
        Set<Node> sources = sources();
        Set<Node> sinks = sinks();
        Set<Node> sanitizes = sanitizes();
        if (sources == null || sources.isEmpty() || sinks == null || sinks.isEmpty()) {
            return result;
        }

        PathFinder finder = PathFinder.builder()
                .maxStepExpanding(stepExpanding())
                .maxDepth(depth())
                .flows(flows())
                .direction(direction())
                .booster(engine().getPathBooster())
                .build();

        for (Path path : finder.find(sources, sinks, sanitizes)) {
            path = verifyPath(path);
            if (path == null) continue;
            foundPath.add(path);
            Vulnerable vulnerable = buildVulnerable(path);
            if (vulnerable != null) result.add(vulnerable);
        }

        return result;
    }

    public Set<Path> getFoundPath() {
        return foundPath;
    }
}

public class NestIntentBridge extends DataTaintModel {

    public NestIntentBridge(RuleEngine engine) { super(engine); }

    @Override
    protected Set<String> sourceQueries() { return Sets.newHashSet("SerializationExtraSource"); }

    @Override
    protected Set<String> sinkQueries() { return Sets.newHashSet("StartComponentSink"); }

    @Override
    protected Vulnerability type() { return AndroidVulnerabilities.IntentBridge.vulnerability(); }

    @Override
    protected RelationshipType[] flows() { return PathFinder.POINT_FLOW; }

    @Override
    protected int importance() { return 2; }

    @Override
    protected int importance(Path path) {
        if (!EntryPointFinder.entryPoints(engine(), toMethodNode(path.startNode())).isEmpty()) {
            return super.importance(path) + 5;
        }
        return super.importance(path);
    }

    @Override
    protected Set<String> tags(Path path) {
        Set<String> tags = super.tags(path);
        tags.addAll(EntryPointFinder.entryPoints(engine(), toMethodNode(path.startNode())));
        return tags;
    }
}