feat: support servletNameFilter
Dev Deploy / Build Jar (ubuntu-latest) (push) Has been cancelled
Dev Deploy / Build Jar (windows-latest) (push) Has been cancelled
Dev Deploy / Docker Push (push) Has been cancelled
Dev Deploy / Deploy to Maven Central (push) Has been cancelled
Dev Deploy / Deploy to Northflank (push) Has been cancelled
Probe IntegrationTest / springwebmvc (push) Has been cancelled
Probe IntegrationTest / struct2 (push) Has been cancelled
Probe IntegrationTest / tomcat (push) Has been cancelled
Probe IntegrationTest / glassfish (push) Has been cancelled
Probe IntegrationTest / jbosseap (push) Has been cancelled
Probe IntegrationTest / jetty (push) Has been cancelled
Probe IntegrationTest / payara (push) Has been cancelled
Probe IntegrationTest / wildfly (push) Has been cancelled
Probe IntegrationTest / jbossas (push) Has been cancelled
Probe IntegrationTest / resin (push) Has been cancelled
Probe IntegrationTest / weblogic (push) Has been cancelled
Probe IntegrationTest / websphere7 (push) Has been cancelled
Probe IntegrationTest / websphere (push) Has been cancelled
Unit-Test / UniteTest (push) Has been cancelled

This commit is contained in:
ReaJason
2026-01-11 12:14:45 +08:00
parent a1bab098e3
commit 3dfeb324f2
16 changed files with 287 additions and 277 deletions
@@ -45,6 +45,8 @@ public class FilterProbeFactory {
return WebLogicFilterProbe.class; return WebLogicFilterProbe.class;
case Server.Undertow: case Server.Undertow:
return UndertowFilterProbe.class; return UndertowFilterProbe.class;
case Server.Resin:
return ResinFilterProbe.class;
default: default:
throw new GenerationException("filterProbe not supported for server: " + server); throw new GenerationException("filterProbe not supported for server: " + server);
} }
@@ -13,73 +13,58 @@ public class ApusicFilterProbe {
@Override @Override
public String toString() { public String toString() {
String msg = ""; StringBuilder msg = new StringBuilder();
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>(); Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
Set<Object> contexts = null; Set<Object> contexts = null;
try { try {
contexts = getContext(); contexts = getContext();
} catch (Throwable throwable) { } catch (Throwable throwable) {
msg += "context error: " + getErrorMessage(throwable); msg.append("context error: ").append(getErrorMessage(throwable));
} }
if (contexts == null || contexts.isEmpty()) { if (contexts == null || contexts.isEmpty()) {
msg += "context not found\n"; msg.append("context not found\n");
} else { } else {
for (Object context : contexts) { for (Object context : contexts) {
String contextRoot = getContextRoot(context); String contextRoot = getContextRoot(context);
List<Map<String, String>> filters = collectFiltersData(context); try {
allFiltersData.put(contextRoot, filters); List<Map<String, String>> filters = collectFiltersData(context);
allFiltersData.put(contextRoot, filters);
} catch (Throwable e) {
msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n");
}
} }
msg += formatFiltersData(allFiltersData); msg.append(formatFiltersData(allFiltersData));
} }
return msg; return msg.toString();
} }
@SuppressWarnings("all") @SuppressWarnings("all")
private List<Map<String, String>> collectFiltersData(Object context) { private List<Map<String, String>> collectFiltersData(Object context) throws Exception {
Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>(); Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
Object webModule = getFieldValue(context, "webapp");
Object[] filterMappings = (Object[]) invokeMethod(webModule, "getAllFilterMappings");
Map<String, String> filterClassMap = new HashMap<>();
try { for (Object fm : filterMappings) {
Object webModule = getFieldValue(context, "webapp"); String name = (String) invokeMethod(fm, "getFilterName");
if (webModule == null) { if (!aggregatedData.containsKey(name)) {
return Collections.emptyList(); Map<String, Object> info = new HashMap<>();
Object filterModel = invokeMethod(webModule, "getFilter", new Class[]{String.class}, new Object[]{name});
info.put("filterName", name);
info.put("filterClass", invokeMethod(filterModel, "getFilterClass"));
info.put("urlPatterns", new LinkedHashSet<String>());
info.put("servletNames", new LinkedHashSet<String>());
aggregatedData.put(name, info);
} }
Map<String, Object> info = aggregatedData.get(name);
Object[] filterMappings = (Object[]) invokeMethod(webModule, "getAllFilterMappings"); String urlPattern = (String) invokeMethod(fm, "getUrlPattern");
if (filterMappings == null || filterMappings.length == 0) { if (urlPattern != null) {
return Collections.emptyList(); ((Set<String>) info.get("urlPatterns")).add(urlPattern);
} }
String servletName = (String) invokeMethod(fm, "getServletName");
Object[] filters = (Object[]) invokeMethod(webModule, "getFilterList"); if (servletName != null) {
Map<String, String> filterClassMap = new HashMap<>(); ((Set<String>) info.get("servletNames")).add(servletName);
if (filters != null) {
for (Object filter : filters) {
String name = (String) invokeMethod(filter, "getName");
String className = (String) invokeMethod(filter, "getFilterClass");
if (name != null && className != null) {
filterClassMap.put(name, className);
}
}
} }
for (Object fm : filterMappings) {
String name = (String) invokeMethod(fm, "getFilterName");
if (name == null) {
continue;
}
if (!aggregatedData.containsKey(name)) {
Map<String, Object> info = new HashMap<>();
info.put("filterName", name);
info.put("filterClass", filterClassMap.getOrDefault(name, "N/A"));
info.put("urlPatterns", new LinkedHashSet<String>());
aggregatedData.put(name, info);
}
Map<String, Object> info = aggregatedData.get(name);
String urlPattern = (String) invokeMethod(fm, "getUrlPattern");
if (urlPattern != null) {
((Set<String>) info.get("urlPatterns")).add(urlPattern);
}
}
} catch (Exception ignored) {
} }
List<Map<String, String>> result = new ArrayList<>(); List<Map<String, String>> result = new ArrayList<>();
@@ -89,6 +74,8 @@ public class ApusicFilterProbe {
finalInfo.put("filterClass", (String) entry.get("filterClass")); finalInfo.put("filterClass", (String) entry.get("filterClass"));
Set<?> urls = (Set<?>) entry.get("urlPatterns"); Set<?> urls = (Set<?>) entry.get("urlPatterns");
finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString()); finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
Set<?> servletNames = (Set<?>) entry.get("servletNames");
finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString());
result.add(finalInfo); result.add(finalInfo);
} }
return result; return result;
@@ -108,6 +95,7 @@ public class ApusicFilterProbe {
appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, "", info.get("filterName"), "");
appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), "");
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
appendIfPresent(output, " -> Servlet:", info.get("servletNames"), "");
output.append("\n"); output.append("\n");
} }
} }
@@ -176,27 +164,30 @@ public class ApusicFilterProbe {
throw new NoSuchFieldException(fieldName + " for " + obj.getClass().getName()); throw new NoSuchFieldException(fieldName + " for " + obj.getClass().getName());
} }
@SuppressWarnings("all") public static Object invokeMethod(Object obj, String methodName) throws Exception {
public static Object invokeMethod(Object obj, String methodName) { return invokeMethod(obj, methodName, null, null);
try { }
Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
Method method = null;
while (clazz != null && method == null) {
try {
method = clazz.getDeclaredMethod(methodName);
} catch (NoSuchMethodException e) {
clazz = clazz.getSuperclass();
}
}
if (method == null) {
throw new NoSuchMethodException("Method not found: " + methodName);
}
method.setAccessible(true); @SuppressWarnings("all")
return method.invoke(obj instanceof Class ? null : obj); public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) throws Exception {
} catch (Exception e) { Class<?> clazz = (obj instanceof Class) ? (Class<?>) obj : obj.getClass();
throw new RuntimeException("Error invoking method: " + methodName, e); Method method = null;
while (clazz != null && method == null) {
try {
if (paramClazz == null) {
method = clazz.getDeclaredMethod(methodName);
} else {
method = clazz.getDeclaredMethod(methodName, paramClazz);
}
} catch (NoSuchMethodException e) {
clazz = clazz.getSuperclass();
}
} }
if (method == null) {
throw new NoSuchMethodException("Method not found: " + methodName);
}
method.setAccessible(true);
return method.invoke(obj instanceof Class ? null : obj, param);
} }
@SuppressWarnings("all") @SuppressWarnings("all")
@@ -13,73 +13,93 @@ public class ResinFilterProbe {
@Override @Override
public String toString() { public String toString() {
String msg = ""; StringBuilder msg = new StringBuilder();
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>(); Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
Set<Object> contexts = null; Set<Object> contexts = null;
try { try {
contexts = getContext(); contexts = getContext();
} catch (Throwable throwable) { } catch (Throwable throwable) {
msg += "context error: " + getErrorMessage(throwable); msg.append("context error: ").append(getErrorMessage(throwable));
} }
if (contexts == null || contexts.isEmpty()) { if (contexts == null || contexts.isEmpty()) {
msg += "context not found\n"; msg.append("context not found\n");
} else { } else {
for (Object context : contexts) { for (Object context : contexts) {
String contextRoot = getContextRoot(context); String contextRoot = getContextRoot(context);
List<Map<String, String>> filters = collectFiltersData(context); try {
allFiltersData.put(contextRoot, filters); List<Map<String, String>> filters = collectFiltersData(context);
allFiltersData.put(contextRoot, filters);
} catch (Throwable e) {
msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n");
}
} }
msg += formatFiltersData(allFiltersData); msg.append(formatFiltersData(allFiltersData));
} }
return msg; return msg.toString();
} }
private List<Map<String, String>> collectFiltersData(Object context) { @SuppressWarnings("unchecked")
List<Map<String, String>> result = new ArrayList<>(); private List<Map<String, String>> collectFiltersData(Object context) throws Exception {
try { Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
Object filterMapper = getFieldValue(context, "_filterMapper"); Object filterMapper = getFieldValue(context, "_filterMapper");
Object filterManager = getFieldValue(context, "_filterManager"); Object filterManager = getFieldValue(context, "_filterManager");
if (filterMapper == null) return Collections.emptyList(); if (filterMapper == null) return Collections.emptyList();
ArrayList<Object> filterMappings = (ArrayList<Object>) getFieldValue(filterMapper, "_filterMap"); ArrayList<Object> filterMappings = (ArrayList<Object>) getFieldValue(filterMapper, "_filterMap");
for (Object filterMapping : filterMappings) { for (Object filterMapping : filterMappings) {
Map<String, String> info = new HashMap<>(); String filterName = (String) invokeMethod(filterMapping, "getFilterName", null, null);
String filterName = (String) invokeMethod(filterMapping, "getFilterName", null, null); if (aggregatedData.get(filterName) == null) {
Map<String, Object> info = new HashMap<>();
info.put("filterName", filterName); info.put("filterName", filterName);
String filterClassName = (String) invokeMethod(filterMapping, "getFilterClassName", null, null); String filterClassName = (String) invokeMethod(filterMapping, "getFilterClassName", null, null);
try { if (filterClassName == null) {
if (filterClassName == null) { Class<?> filterClass = (Class<?>) invokeMethod(filterMapping, "getFilterClass", null, null);
Class<?> filterClass = (Class<?>) invokeMethod(filterMapping, "getFilterClass", null, null); if (filterClass != null) {
if (filterClass != null) { filterClassName = filterClass.getName();
filterClassName = filterClass.getName(); } else {
} else { Object filter = ((Map<String, Object>) getFieldValue(filterManager, "_instances")).get(filterName);
Object filter = ((Map<String, Object>) getFieldValue(filterManager, "_instances")).get(filterName); if (filter != null) {
if (filter != null) { filterClassName = filter.getClass().getName();
filterClassName = filter.getClass().getName();
}
} }
} }
} catch (Exception ignored) {
} }
info.put("filterClass", filterClassName != null ? filterClassName : "N/A"); info.put("filterClass", filterClassName != null ? filterClassName : "N/A");
info.put("urlPatterns", new LinkedHashSet<String>());
List<String> urlPatterns = new ArrayList<>(); info.put("servletNames", new LinkedHashSet<String>());
String urlPattern = invokeMethod(filterMapping, "getURLPattern", null, null).toString(); aggregatedData.put(filterName, info);
if (urlPattern == null || urlPattern.isEmpty()) { }
List<Object> matchList = (List<Object>) getFieldValue(filterMapping, "_matchList"); Map<String, Object> info = aggregatedData.get(filterName);
if (matchList != null && !matchList.isEmpty()) { List<String> urlPatterns = new ArrayList<>();
for (Object match : matchList) { String urlPattern = (String) invokeMethod(filterMapping, "getURLPattern", null, null);
if (((Integer) getFieldValue(match, "_value")) == 1) { if (urlPattern == null || urlPattern.isEmpty()) {
urlPatterns.add(getFieldValue(match, "_regex").toString()); List<Object> matchList = (List<Object>) getFieldValue(filterMapping, "_matchList");
} if (matchList != null && !matchList.isEmpty()) {
for (Object match : matchList) {
if (((Integer) getFieldValue(match, "_value")) == 1) {
urlPatterns.add(getFieldValue(match, "_regex").toString());
} }
} }
} else {
urlPatterns.add(urlPattern);
} }
info.put("urlPatterns", Arrays.toString(urlPatterns.toArray())); } else {
result.add(info); urlPatterns.add(urlPattern);
} }
} catch (Exception ignored) { if (!urlPatterns.isEmpty()) {
((Set) info.get("urlPatterns")).addAll(urlPatterns);
}
List<String> servletNames = (List<String>) getFieldValue(filterMapping, "_servletNames");
if (servletNames != null && !servletNames.isEmpty()) {
((Set) info.get("servletNames")).addAll(servletNames);
}
}
List<Map<String, String>> result = new ArrayList<>();
for (Map<String, Object> entry : aggregatedData.values()) {
Map<String, String> finalInfo = new HashMap<>();
finalInfo.put("filterName", (String) entry.get("filterName"));
finalInfo.put("filterClass", (String) entry.get("filterClass"));
Set<?> urls = (Set<?>) entry.get("urlPatterns");
finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
Set<?> servletNames = (Set<?>) entry.get("servletNames");
finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString());
result.add(finalInfo);
} }
return result; return result;
} }
@@ -100,6 +120,7 @@ public class ResinFilterProbe {
appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, "", info.get("filterName"), "");
appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), "");
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
appendIfPresent(output, " -> Servlet:", info.get("servletNames"), "");
output.append("\n"); output.append("\n");
} }
} }
@@ -13,89 +13,114 @@ public class WebSphereFilterProbe {
@Override @Override
public String toString() { public String toString() {
String msg = ""; StringBuilder msg = new StringBuilder();
Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>(); Map<String, List<Map<String, String>>> allFiltersData = new LinkedHashMap<String, List<Map<String, String>>>();
Set<Object> contexts = null; Set<Object> contexts = null;
try { try {
contexts = getContext(); contexts = getContext();
} catch (Throwable throwable) { } catch (Throwable throwable) {
msg += "context error: " + getErrorMessage(throwable); msg.append("context error: ").append(getErrorMessage(throwable));
} }
if (contexts == null || contexts.isEmpty()) { if (contexts == null || contexts.isEmpty()) {
msg += "context not found\n"; msg.append("context not found\n");
} else { } else {
for (Object context : contexts) { for (Object context : contexts) {
String contextRoot = getContextRoot(context); String contextRoot = getContextRoot(context);
List<Map<String, String>> filters = collectFiltersData(context); try {
allFiltersData.put(contextRoot, filters); List<Map<String, String>> filters = collectFiltersData(context);
allFiltersData.put(contextRoot, filters);
} catch (Throwable e) {
msg.append(contextRoot).append(" failed ").append(getErrorMessage(e)).append("\n");
}
} }
msg += formatFiltersData(allFiltersData); msg.append(formatFiltersData(allFiltersData));
} }
return msg; return msg.toString();
} }
private List<Map<String, String>> collectFiltersData(Object context) { private List<Map<String, String>> collectFiltersData(Object context) throws Exception {
Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>(); Map<String, Map<String, Object>> aggregatedData = new LinkedHashMap<>();
try { try {
Object filterManager = getFieldValue(context, "filterManager"); Object filterManager = getFieldValue(context, "filterManager");
Object webAppConfig = getFieldValue(context, "config"); Object webAppConfig = getFieldValue(context, "config");
try { try {
List uriFilterMappingInfos = (List) getFieldValue(webAppConfig, "uriFilterMappingInfos"); List uriFilterMappingInfos = (List) getFieldValue(webAppConfig, "uriFilterMappingInfos");
if (uriFilterMappingInfos == null || uriFilterMappingInfos.isEmpty()) {
return Collections.emptyList();
}
for (Object uriFilterMappingInfo : uriFilterMappingInfos) { for (Object uriFilterMappingInfo : uriFilterMappingInfos) {
Object filterConfig = getFieldValue(uriFilterMappingInfo, "filterConfig"); Object filterConfig = getFieldValue(uriFilterMappingInfo, "filterConfig");
String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null); String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null);
Collection urlPatternMappings = (Collection) invokeMethod(filterConfig, "getUrlPatternMappings", null, null);
String urlPattern = (String) invokeMethod(uriFilterMappingInfo, "getUrlPattern", null, null);
if (!aggregatedData.containsKey(filterName)) { if (!aggregatedData.containsKey(filterName)) {
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null); String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
Map<String, Object> info = new HashMap<>(); Map<String, Object> info = new HashMap<>();
info.put("filterName", filterName); info.put("filterName", filterName);
info.put("filterClass", filterClassName); info.put("filterClass", filterClassName);
LinkedHashSet<String> urlPatterns = new LinkedHashSet<>(); info.put("urlPatterns", new LinkedHashSet<>());
if (urlPattern != null && !urlPattern.isEmpty()) { info.put("servletNames", new LinkedHashSet<>());
urlPatterns.add(urlPattern);
}
if (urlPatternMappings != null) {
urlPatterns.addAll(urlPatternMappings);
}
info.put("urlPatterns", urlPatterns);
aggregatedData.put(filterName, info); aggregatedData.put(filterName, info);
} else { }
Set urlPatterns = (Set) aggregatedData.get(filterName).get("urlPatterns"); Map<String, Object> info = aggregatedData.get(filterName);
if (urlPattern != null && !urlPattern.isEmpty()) { String urlPattern = (String) invokeMethod(uriFilterMappingInfo, "getUrlPattern", null, null);
urlPatterns.add(urlPattern); if (urlPattern != null && !urlPattern.isEmpty()) {
} ((Set) info.get("urlPatterns")).add(urlPattern);
if (urlPatternMappings != null) { }
urlPatterns.addAll(urlPatternMappings); }
}
List servletFilterMappingInfos = (List) getFieldValue(webAppConfig, "servletFilterMappingInfos");
for (Object servletFilterMappingInfo : servletFilterMappingInfos) {
Object filterConfig = getFieldValue(servletFilterMappingInfo, "filterConfig");
String filterName = (String) invokeMethod(filterConfig, "getFilterName", null, null);
if (!aggregatedData.containsKey(filterName)) {
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
Map<String, Object> info = new HashMap<>();
info.put("filterName", filterName);
info.put("filterClass", filterClassName);
info.put("urlPatterns", new LinkedHashSet<>());
info.put("servletNames", new LinkedHashSet<>());
aggregatedData.put(filterName, info);
}
Map<String, Object> info = aggregatedData.get(filterName);
String servletName = (String) invokeMethod(invokeMethod(servletFilterMappingInfo, "getServletConfig"), "getServletName");
if (servletName != null && !servletName.isEmpty()) {
((Set) info.get("servletNames")).add(servletName);
} }
} }
} catch (Throwable throwable) { } catch (Throwable throwable) {
throwable.printStackTrace();
// WebLogic 10.3.6 // WebLogic 10.3.6
List uriFilterMappings = (List) getFieldValue(filterManager, "_uriFilterMappings"); List uriFilterMappings = (List) getFieldValue(filterManager, "_uriFilterMappings");
for (Object uriFilterMapping : uriFilterMappings) { for (Object uriFilterMapping : uriFilterMappings) {
String filterName = (String) getFieldValue(uriFilterMapping, "_filterName"); String filterName = (String) getFieldValue(uriFilterMapping, "_filterName");
String urlPattern = (String) getFieldValue(uriFilterMapping, "_filterURI");
if (!aggregatedData.containsKey(filterName)) { if (!aggregatedData.containsKey(filterName)) {
Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName}); Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName});
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null); String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
Map<String, Object> info = new HashMap<>(); Map<String, Object> info = new HashMap<>();
info.put("filterName", filterName); info.put("filterName", filterName);
info.put("filterClass", filterClassName); info.put("filterClass", filterClassName);
LinkedHashSet<String> urlPatterns = new LinkedHashSet<>(); info.put("urlPatterns", new LinkedHashSet<>());
if (urlPattern != null && !urlPattern.isEmpty()) { info.put("servletNames", new LinkedHashSet<>());
urlPatterns.add(urlPattern);
}
info.put("urlPatterns", urlPatterns);
aggregatedData.put(filterName, info); aggregatedData.put(filterName, info);
} else { }
if (urlPattern != null && !urlPattern.isEmpty()) { Map<String, Object> info = aggregatedData.get(filterName);
((Set) aggregatedData.get(filterName).get("urlPatterns")).add(urlPattern); String urlPattern = (String) getFieldValue(uriFilterMapping, "_filterURI");
} if (urlPattern != null && !urlPattern.isEmpty()) {
((Set) info.get("urlPatterns")).add(urlPattern);
}
}
List servletFilterMappings = (List) getFieldValue(filterManager, "_servletFilterMappings");
for (Object servletFilterMapping : servletFilterMappings) {
String filterName = (String) getFieldValue(servletFilterMapping, "_filterName");
if (!aggregatedData.containsKey(filterName)) {
Object filterConfig = invokeMethod(webAppConfig, "getFilterInfo", new Class[]{String.class}, new Object[]{filterName});
String filterClassName = (String) invokeMethod(filterConfig, "getFilterClassName", null, null);
Map<String, Object> info = new HashMap<>();
info.put("filterName", filterName);
info.put("filterClass", filterClassName);
info.put("urlPatterns", new LinkedHashSet<>());
info.put("servletNames", new LinkedHashSet<>());
aggregatedData.put(filterName, info);
}
Map<String, Object> info = aggregatedData.get(filterName);
String servletName = (String) getFieldValue(servletFilterMapping, "_filterServlet");
if (servletName != null && !servletName.isEmpty()) {
((Set) info.get("servletNames")).add(servletName);
} }
} }
} }
@@ -108,7 +133,9 @@ public class WebSphereFilterProbe {
finalInfo.put("filterName", (String) entry.get("filterName")); finalInfo.put("filterName", (String) entry.get("filterName"));
finalInfo.put("filterClass", (String) entry.get("filterClass")); finalInfo.put("filterClass", (String) entry.get("filterClass"));
Set<?> urls = (Set<?>) entry.get("urlPatterns"); Set<?> urls = (Set<?>) entry.get("urlPatterns");
finalInfo.put("urlPatterns", urls.isEmpty() ? "[/*]" : Arrays.toString(urls.toArray())); finalInfo.put("urlPatterns", urls.isEmpty() ? "" : urls.toString());
Set<?> servletNames = (Set<?>) entry.get("servletNames");
finalInfo.put("servletNames", servletNames.isEmpty() ? "" : servletNames.toString());
result.add(finalInfo); result.add(finalInfo);
} }
return result; return result;
@@ -130,6 +157,7 @@ public class WebSphereFilterProbe {
appendIfPresent(output, "", info.get("filterName"), ""); appendIfPresent(output, "", info.get("filterName"), "");
appendIfPresent(output, " -> ", info.get("filterClass"), ""); appendIfPresent(output, " -> ", info.get("filterClass"), "");
appendIfPresent(output, " -> URL:", info.get("urlPatterns"), ""); appendIfPresent(output, " -> URL:", info.get("urlPatterns"), "");
appendIfPresent(output, " -> Servlet:", info.get("servletNames"), "");
output.append("\n"); output.append("\n");
} }
} }
@@ -208,6 +236,10 @@ public class WebSphereFilterProbe {
return contexts; return contexts;
} }
public static Object invokeMethod(Object obj, String methodName) {
return invokeMethod(obj, methodName, null, null);
}
@SuppressWarnings("all") @SuppressWarnings("all")
public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) { public static Object invokeMethod(Object obj, String methodName, Class<?>[] paramClazz, Object[] param) {
try { try {
@@ -34,24 +34,4 @@ public class DetectionTool {
public static String getServerDetection() { public static String getServerDetection() {
return getBase64Class(ServerProbe.class); return getBase64Class(ServerProbe.class);
} }
public static String getResinFilterProbe() {
return getBase64Class(ResinFilterProbe.class);
}
public static String getUndertowFilterProbe() {
return getBase64Class(UndertowFilterProbe.class);
}
public static String getApusicFilterProbe() {
return getBase64Class(ApusicFilterProbe.class);
}
public static String getWebLogicFilterProbe() {
return getBase64Class(WebLogicFilterProbe.class);
}
public static String getWebSphereFilterProbe() {
return getBase64Class(WebSphereFilterProbe.class);
}
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes; import net.bytebuddy.jar.asm.Opcodes;
@@ -81,20 +84,17 @@ public class Resin3116ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes; import net.bytebuddy.jar.asm.Opcodes;
@@ -86,20 +89,17 @@ public class Resin318ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes; import net.bytebuddy.jar.asm.Opcodes;
@@ -80,20 +83,17 @@ public class Resin4058ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.resin;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes; import net.bytebuddy.jar.asm.Opcodes;
@@ -80,20 +83,17 @@ public class Resin4067ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrl(container); String url = getUrl(container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrl(container); String url = getUrl(container);
shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.Resin, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getResinFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.Resin));
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith("com.caucho.server.dispatch.handlers"))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.utils.CommonUtil; import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes; import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.testcontainers.containers.BindMode;
import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container; import org.testcontainers.junit.jupiter.Container;
@@ -27,8 +28,6 @@ import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.CoreMatchers.*;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
/** /**
@@ -91,21 +90,17 @@ public class OpenLiberty18ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.utils.CommonUtil; import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes; import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.testcontainers.containers.BindMode;
import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container; import org.testcontainers.junit.jupiter.Container;
@@ -27,8 +28,6 @@ import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.CoreMatchers.*;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
/** /**
@@ -91,21 +90,18 @@ public class OpenLiberty20ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data); log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,18 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.utils.CommonUtil; import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import net.bytebuddy.jar.asm.Opcodes; import net.bytebuddy.jar.asm.Opcodes;
import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.testcontainers.containers.BindMode;
import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.containers.wait.strategy.Wait;
import org.testcontainers.junit.jupiter.Container; import org.testcontainers.junit.jupiter.Container;
@@ -27,8 +28,6 @@ import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.CoreMatchers.*;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
/** /**
@@ -91,21 +90,17 @@ public class OpenLiberty22ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil; import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
@@ -91,21 +94,17 @@ public class OpenLiberty25ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil; import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
@@ -26,7 +29,8 @@ import java.util.List;
import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS; import static com.reajason.javaweb.integration.ContainerTool.getUrlFromWAS;
import static com.reajason.javaweb.integration.ContainerTool.warFile; import static com.reajason.javaweb.integration.ContainerTool.warFile;
import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk; import static com.reajason.javaweb.integration.ShellAssertion.shellInjectIsOk;
import static org.hamcrest.CoreMatchers.*; import static org.hamcrest.CoreMatchers.anyOf;
import static org.hamcrest.CoreMatchers.startsWith;
import static org.hamcrest.MatcherAssert.assertThat; import static org.hamcrest.MatcherAssert.assertThat;
import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -89,21 +93,17 @@ public class WebSphere855ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,11 +2,14 @@ package com.reajason.javaweb.integration.probe.websphere;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil; import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
@@ -85,21 +88,17 @@ public class WebSphere905ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }
@@ -2,15 +2,19 @@ package com.reajason.javaweb.integration.probe.websphere7;
import com.reajason.javaweb.Server; import com.reajason.javaweb.Server;
import com.reajason.javaweb.integration.ProbeAssertion; import com.reajason.javaweb.integration.ProbeAssertion;
import com.reajason.javaweb.integration.ShellAssertion;
import com.reajason.javaweb.integration.VulTool; import com.reajason.javaweb.integration.VulTool;
import com.reajason.javaweb.integration.probe.DetectionTool; import com.reajason.javaweb.integration.probe.DetectionTool;
import com.reajason.javaweb.memshell.MemShellResult;
import com.reajason.javaweb.memshell.ShellTool; import com.reajason.javaweb.memshell.ShellTool;
import com.reajason.javaweb.memshell.ShellType; import com.reajason.javaweb.memshell.ShellType;
import com.reajason.javaweb.packer.Packers; import com.reajason.javaweb.packer.Packers;
import com.reajason.javaweb.probe.payload.FilterProbeFactory;
import com.reajason.javaweb.utils.CommonUtil; import com.reajason.javaweb.utils.CommonUtil;
import lombok.SneakyThrows; import lombok.SneakyThrows;
import lombok.extern.slf4j.Slf4j; import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.objectweb.asm.Opcodes;
import org.testcontainers.containers.BindMode; import org.testcontainers.containers.BindMode;
import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.GenericContainer;
import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.containers.wait.strategy.Wait;
@@ -70,21 +74,17 @@ public class WebSphere700ContainerTest {
@Test @Test
void testFilterProbe() { void testFilterProbe() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
System.out.println(data); ShellAssertion.assertFilterProbeIsRight(data);
assertThat(data, anyOf(
containsString("Context: ")
));
} }
@Test @Test
void testFilterFirstInject() { void testFilterFirstInject() {
String url = getUrlFromWAS(container); String url = getUrlFromWAS(container);
shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, org.objectweb.asm.Opcodes.V1_6, Packers.BigInteger, container); MemShellResult memShellResult = shellInjectIsOk(url, Server.WebSphere, ShellType.FILTER, ShellTool.Command, Opcodes.V1_6, Packers.BigInteger, container);
String data = VulTool.post(url + "/b64", DetectionTool.getWebSphereFilterProbe()); String data = VulTool.post(url + "/b64", FilterProbeFactory.getBase64ByServer(Server.WebSphere));
log.info(data);
List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app"); List<String> filter = ProbeAssertion.getFiltersForContext(data, "/app");
String filterName = ProbeAssertion.extractFilterName(filter.get(0)); String filterName = ProbeAssertion.extractFilterName(filter.get(0));
assertThat(filterName, anyOf(startsWith(CommonUtil.getWebPackageNameForServer(Server.WebSphere)))); assertEquals(filterName, memShellResult.getShellClassName());
} }
} }