2022长城杯-b4bycoffee

按照春秋伽玛的文章，安装了插件，也分析了所有jdk依赖 和题目相关依赖的jar包，但是跑不出来文章中的结果。

match (source:Method {NAME:"readObject",CLASSNAME:"java.util.HashMap"})
match (sink:Method {NAME:"toString"})
with source, collect(sink) as sinks
call tabby.algo.findJavaGadget(source, sinks, 12, false) yield path where none(n in nodes(path) where n.CLASSNAME in ["javax.management.BadAttributeValueExpException","com.sun.jmx.snmp.SnmpEngineId","com.sun.xml.internal.ws.api.BindingID","javax.swing.text.html.HTML$UnknownTag"])
return path limit 1

之前的格式match (source:Method {NAME:"readObject"}) // 限定source match (sink:Method {IS_SINK:true, NAME:"invoke"}) // 限定sink with source, collect(sink) as sinks // 聚合sink call tabby.algo.findJavaGadget(source, sinks, 8, false) yield path where none(n in nodes(path) where n.CLASSNAME in ["java.io.ObjectInputStream","org.apache.commons.beanutils.BeanMap","org.apache.commons.collections4.functors.PrototypeFactory$PrototypeCloneFactory"]) return path limit 1 不知道为什么不会返回结果，使用call tabby.help("all")，参数如下： "procedure" | "tabby.algo.allSimplePath" | "tabby.algo.allSimplePath(sink, sources, maxNodes, state, depthFirst) YIELD path, weight - run allSimplePath with maxNodes and state" | "tabby.algo.allSimplePath(sinkNode :: NODE?, sourceNodes :: LIST? OF NODE?, maxNodes :: INTEGER?, state :: STRING?, depthFirst :: BOOLEAN?) :: (path :: PATH?)" | null | null | true 2 | "procedure" | "tabby.algo.allSimplePaths" | "tabby.algo.allSimplePaths(sinks, sources, maxNodes, depthFirst) YIELD path, weight - run allSimplePaths with maxNodes and state" | "tabby.algo.allSimplePaths(sinkNodes :: LIST? OF NODE?, sourceNodes :: LIST? OF NODE?, maxNodes :: INTEGER?, depthFirst :: BOOLEAN?) :: (path :: PATH?)" | null | null | true 3 | "procedure" | "tabby.algo.findAllJavaGadget" | "tabby.algo.findAllJavaGadget(sources, sinks, maxNodes, depthFirst) YIELD path, weight - run findAllJavaGadget with maxNodes from source to sink" | "tabby.algo.findAllJavaGadget(startNodes :: LIST? OF NODE?, endNodes :: LIST? OF NODE?, maxLength :: INTEGER?, depthFirst :: BOOLEAN?) :: (path :: PATH?)" | null | null | true 4 | "procedure" | "tabby.algo.findAllVul" | "tabby.algo.findAllVul(sourceNodes, sinkNodes, maxLength, depthFirst) YIELD path, weight - run findAllVul from source node to sink nodes" | "tabby.algo.findAllVul(startNode :: LIST? OF NODE?, endNodes :: LIST? OF NODE?, maxLength :: INTEGER?, depthFirst :: BOOLEAN?) :: (path :: PATH?)" | null | null | true 好像是只有tabby.algo.findAllJavaGadget参数，但是查询格式好像和原先不太一样，大佬能帮忙解决一下么？