neo4j使用说明 - 技术栈

1、简介

neo4j是一种nosql的图数据库，由节点、属性、关系、标签构成，存储图结构。使用Cypher作为查询语言（类似于关系数据库中的sql)。

官方文档：什么是 Neo4j？- 入门 - Neo4j 文档

2、使用

2.1、安装

可参考：Neo4j详细介绍及使用教程-CSDN博客

安装包：【免费】neo4j-desktop-2.1.1-x64资源-CSDN下载

2.2、使用

安装好以后，直接打开neo4j desktop。创建实例，创建数据库。

2.2、代码属性图

使用neo4j，绘制以下代码属性图。

Step1、创建节点

sql 复制代码

// 类节点
CREATE (HashMap:Class {name: 'java.util.HashMap',access:'public'});
CREATE (Object:Class {name: 'java.lang.Object',access:'public'});
CREATE (EnumMap:Class {name: 'java.util.EnumMap',access:'public'}); 
CREATE (URL:Class {name: 'java.net.URL',access:'public'});
CREATE (URLStreamHandler:Class {name: 'java.net.URLStreamHandler',access:'public'});
CREATE (InetAddress:Class {name: 'java.net.InetAddress',access:'public'});

// 接口节点
CREATE (Serializable:Interface {name: 'java.io.Serializable',access:'public'});

// 方法节点
CREATE (readObject:Method {name: 'java.util.HashMap.readObject()',access:'private',returnType:'void'});
CREATE (hash:Method {name: 'java.util.HashMap.hash()',access:'default',returnType:'int',modifier:'static final'});
CREATE (hashCode:Method {name: 'java.util.EnumMap.hashCode()',access:'public',returnType:'int'});
CREATE (entryHashCode:Method {name: 'java.util.EnumMap.entryHashCode()',access:'private',returnType:'int'});
CREATE (hashcode:Method {name: 'java.lang.Object.hashcode()',access:'public',returnType:'int',modifier:'native'});
CREATE (hashcode:Method {name: 'java.net.URL.hashcode()',access:'public',returnType:'int',modifier:'synchronized'});
CREATE (hashcode:Method {name: 'java.net.URLStreamHandler.hashcode()',access:'protected',returnType:'int'});
CREATE (hashcode:Method {name: 'java.net.URLStreamHandler.getHostAddress()',access:'protected',returnType:'java.net.InetAddress'});
CREATE (hashcode:Method {name: 'java.net.InetAddress.getByName()',access:'public',returnType:'java.net.InetAddress',modifier:'static'});

Step2、创建节点之间的关系

sql 复制代码

// 类与方法、类与接口、类与类之间的关系
MATCH (c:Class {name:'java.util.HashMap'}),(m:Method {name:'java.util.HashMap.readObject()'}) CREATE (c)-[:has]->(m);
MATCH (c:Class {name:'java.util.HashMap'}),(m:Method {name:'java.util.HashMap.hash()'}) CREATE (c)-[:has]->(m);
MATCH (c:Class {name:'java.util.EnumMap'}),(m:Method {name:'java.util.EnumMap.hashCode()'}) CREATE (c)-[:has]->(m);
MATCH (c:Class {name:'java.util.EnumMap'}),(m:Method {name:'java.util.EnumMap.entryHashCode()'}) CREATE (c)-[:has]->(m);
MATCH (c1:Class {name:'java.util.EnumMap'}),(c2:Class {name:'java.lang.Object'}) CREATE (c1)-[:extend]->(c2);
MATCH (c:Class {name:'java.lang.Object'}),(m:Method {name:'java.lang.Object.hashcode()'}) CREATE (c)-[:has]->(m);
MATCH (c1:Class {name:'java.net.URL'}),(c2:Class {name:'java.lang.Object'}) CREATE (c1)-[:extend]->(c2);
MATCH (c:Class {name:'java.net.URL'}),(m:Method {name:'java.net.URL.hashcode()'}) CREATE (c)-[:has]->(m);
MATCH (c:Class {name:'java.net.URLStreamHandler'}),(m:Method {name:'java.net.URLStreamHandler.hashcode()'}) CREATE (c)-[:has]->(m);
MATCH (c:Class {name:'java.net.URLStreamHandler'}),(m:Method {name:'java.net.URLStreamHandler.getHostAddress()'}) CREATE (c)-[:has]->(m);
MATCH (c:Class {name:'java.net.InetAddress'}),(i:Interface {name:'java.io.Serializable'}) CREATE (c)-[:interface]->(i);
MATCH (c:Class {name:'java.net.InetAddress'}),(m:Method {name:'java.net.InetAddress.getByName()'}) CREATE (c)-[:has]->(m);

// 类中方法与方法之间的关系
MATCH (m1:Method {name:'java.util.HashMap.readObject()'}),(m2:Method {name:'java.util.HashMap.hash()'}) CREATE (m1)-[:call]->(m2);
MATCH (m1:Method {name:'java.util.HashMap.hash()'}),(m2:Method {name:'java.lang.Object.hashcode()'}) CREATE (m1)-[:call]->(m2);
MATCH (m1:Method {name:'java.util.EnumMap.hashCode()'}),(m2:Method {name:'java.util.EnumMap.entryHashCode()'}) CREATE (m1)-[:call]->(m2);
MATCH (m1:Method {name:'java.net.URL.hashcode()'}),(m2:Method {name:'java.net.URLStreamHandler.hashcode()'}) CREATE (m1)-[:call]->(m2);
MATCH (m1:Method {name:'java.net.URLStreamHandler.hashcode()'}),(m2:Method {name:'java.net.URLStreamHandler.getHostAddress()'}) CREATE (m1)-[:call]->(m2);
MATCH (m1:Method {name:'java.net.URLStreamHandler.getHostAddress()'}),(m2:Method {name:'java.net.InetAddress.getByName()'}) CREATE (m1)-[:call]->(m2);

// 别名（多态）之间的关系
MATCH (m1:Method {name:'java.lang.Object.hashcode()'}),(m2:Method {name:'java.util.EnumMap.hashCode()'}) CREATE (m1)-[:alias]->(m2);
MATCH (m1:Method {name:'java.lang.Object.hashcode()'}),(m2:Method {name:'java.net.URL.hashcode()'}) CREATE (m1)-[:alias]->(m2);

Step3、查看创建好的关系图

sql 复制代码

MATCH (n)-[r]->(m) RETURN n, r, m;

3、总结

在做反序列化漏洞检测研究时，需要查找gadget chain。因为方法调用链，调用关系之间是图结构，所以考虑使用图数据库neo4j存储方法调用链会更方便。

4、参考资料

什么是 Neo4j？- 入门 - Neo4j 文档