From f86a9d8ee22265a1d2fdfe456614e346503d4596 Mon Sep 17 00:00:00 2001 From: ReaJason Date: Thu, 8 Jan 2026 19:33:11 +0800 Subject: [PATCH] test: add classes --- .../java/CommonsBeanutils19PackerTest.java | 21 +++++++++ .../packer/deserialize/java/EvilClass.java | 25 +++++++++++ .../java/jakarta/TestInputStreamServlet.java | 45 +++++++++++++++++++ .../main/java/jakarta/TestReaderServlet.java | 38 ++++++++++++++++ .../src/main/webapp/WEB-INF/web.xml | 18 ++++++++ .../src/main/java/TestInputStreamServlet.java | 41 +++++++++++++++++ .../src/main/java/TestReaderServlet.java | 35 +++++++++++++++ .../src/main/webapp/WEB-INF/web.xml | 23 +++++++--- 8 files changed, 241 insertions(+), 5 deletions(-) create mode 100644 packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/CommonsBeanutils19PackerTest.java create mode 100644 packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/EvilClass.java create mode 100644 vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java create mode 100644 vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java create mode 100644 vul/vul-webapp/src/main/java/TestInputStreamServlet.java create mode 100644 vul/vul-webapp/src/main/java/TestReaderServlet.java diff --git a/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/CommonsBeanutils19PackerTest.java b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/CommonsBeanutils19PackerTest.java new file mode 100644 index 00000000..7e3e6aef --- /dev/null +++ b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/CommonsBeanutils19PackerTest.java @@ -0,0 +1,21 @@ +package com.reajason.javaweb.packer.deserialize.java; + +import com.reajason.javaweb.packer.ClassPackerConfig; +import net.bytebuddy.ByteBuddy; +import org.junit.jupiter.api.Test; + +/** + * @author ReaJason + * @since 2026/1/4 + */ +class CommonsBeanutils19PackerTest { + + @Test + void test(){ + byte[] bytes = new ByteBuddy().redefine(EvilClass.class).name("hello.world").make().getBytes(); + ClassPackerConfig classPackerConfig = new ClassPackerConfig(); + classPackerConfig.setClassBytes(bytes); + System.out.println(new CommonsBeanutils19Packer().pack(classPackerConfig)); + } + +} \ No newline at end of file diff --git a/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/EvilClass.java b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/EvilClass.java new file mode 100644 index 00000000..7d9cd51c --- /dev/null +++ b/packer/src/test/java/com/reajason/javaweb/packer/deserialize/java/EvilClass.java @@ -0,0 +1,25 @@ +package com.reajason.javaweb.packer.deserialize.java; + +/** + * @author ReaJason + * @since 2026/1/4 + */ +public class EvilClass extends Thread implements Runnable { + + static { + new EvilClass().start(); + } + + @Override + public StackTraceElement[] getStackTrace() { + return new StackTraceElement[0]; + } + + @Override + public void run() { + try { + Runtime.getRuntime().exec("touch /tmp/success"); + } catch (Exception ignored) { + } + } +} diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java new file mode 100644 index 00000000..5075ca2a --- /dev/null +++ b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestInputStreamServlet.java @@ -0,0 +1,45 @@ +package jakarta; + +import jakarta.servlet.ServletException; +import jakarta.servlet.http.HttpServlet; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; + +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.nio.charset.StandardCharsets; + +/** + * @author ReaJason + * @since 2025/12/31 + */ +public class TestInputStreamServlet extends HttpServlet { + @Override + protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + String one = req.getParameter("one"); + req.setCharacterEncoding("UTF-8"); + String body = null; + InputStream inputStream = req.getInputStream(); + StringBuilder bodyBuilder = new StringBuilder(); + if (one != null) { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + int b; + while ((b = inputStream.read()) != -1) { + outputStream.write(b); + } + bodyBuilder.append(outputStream.toString(StandardCharsets.UTF_8)); + outputStream.close(); + } else { + byte[] buffer = new byte[1024]; + int bytesRead; + while ((bytesRead = inputStream.read(buffer)) != -1) { + bodyBuilder.append(new String(buffer, 0, bytesRead, StandardCharsets.UTF_8)); + } + } + body = bodyBuilder.toString(); + resp.setContentType("text/html; charset=UTF-8"); + resp.setCharacterEncoding("UTF-8"); + resp.getWriter().println(body); + } +} diff --git a/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java new file mode 100644 index 00000000..e0c5702f --- /dev/null +++ b/vul/vul-webapp-jakarta/src/main/java/jakarta/TestReaderServlet.java @@ -0,0 +1,38 @@ +package jakarta; + +import jakarta.servlet.ServletException; +import jakarta.servlet.http.HttpServlet; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; + +import java.io.BufferedReader; +import java.io.IOException; + +/** + * @author ReaJason + * @since 2025/12/31 + */ +public class TestReaderServlet extends HttpServlet { + @Override + protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + String one = req.getParameter("one"); + String body = null; + BufferedReader reader = req.getReader(); + StringBuilder bodyBuilder = new StringBuilder(); + if (one != null) { + int c; + while ((c = reader.read()) != -1) { + bodyBuilder.append((char) c); + } + } else { + String line; + while ((line = reader.readLine()) != null) { + bodyBuilder.append(line); + } + } + body = bodyBuilder.toString(); + resp.setContentType("text/html; charset=UTF-8"); + resp.setCharacterEncoding("UTF-8"); + resp.getWriter().println(body); + } +} diff --git a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml index 5d275064..88342ccc 100644 --- a/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml +++ b/vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml @@ -63,6 +63,24 @@ /js + + reader + jakarta.TestReaderServlet + + + reader + /reader + + + + inputStream + jakarta.TestInputStreamServlet + + + inputStream + /inputStream + + empty jakarta.EmptyFilter diff --git a/vul/vul-webapp/src/main/java/TestInputStreamServlet.java b/vul/vul-webapp/src/main/java/TestInputStreamServlet.java new file mode 100644 index 00000000..24c91cac --- /dev/null +++ b/vul/vul-webapp/src/main/java/TestInputStreamServlet.java @@ -0,0 +1,41 @@ +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; + +/** + * @author ReaJason + * @since 2025/12/31 + */ +public class TestInputStreamServlet extends HttpServlet { + @Override + protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + String one = req.getParameter("one"); + req.setCharacterEncoding("UTF-8"); + String body = null; + InputStream inputStream = req.getInputStream(); + StringBuilder bodyBuilder = new StringBuilder(); + if (one != null) { + ByteArrayOutputStream outputStream = new ByteArrayOutputStream(); + int b; + while ((b = inputStream.read()) != -1) { + outputStream.write(b); + } + bodyBuilder.append(outputStream.toString("UTF-8")); + outputStream.close(); + } else { + byte[] buffer = new byte[1024]; + int bytesRead; + while ((bytesRead = inputStream.read(buffer)) != -1) { + bodyBuilder.append(new String(buffer, 0, bytesRead, "UTF-8")); + } + } + body = bodyBuilder.toString(); + resp.setContentType("text/html; charset=UTF-8"); + resp.setCharacterEncoding("UTF-8"); + resp.getWriter().println(body); + } +} diff --git a/vul/vul-webapp/src/main/java/TestReaderServlet.java b/vul/vul-webapp/src/main/java/TestReaderServlet.java new file mode 100644 index 00000000..2f02fef8 --- /dev/null +++ b/vul/vul-webapp/src/main/java/TestReaderServlet.java @@ -0,0 +1,35 @@ +import javax.servlet.ServletException; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.BufferedReader; +import java.io.IOException; + +/** + * @author ReaJason + * @since 2025/12/31 + */ +public class TestReaderServlet extends HttpServlet { + @Override + protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + String one = req.getParameter("one"); + String body = null; + BufferedReader reader = req.getReader(); + StringBuilder bodyBuilder = new StringBuilder(); + if (one != null) { + int c; + while ((c = reader.read()) != -1) { + bodyBuilder.append((char) c); + } + } else { + String line; + while ((line = reader.readLine()) != null) { + bodyBuilder.append(line); + } + } + body = bodyBuilder.toString(); + resp.setContentType("text/html; charset=UTF-8"); + resp.setCharacterEncoding("UTF-8"); + resp.getWriter().println(body); + } +} diff --git a/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml b/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml index 5e36e4f8..10cb2981 100644 --- a/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml +++ b/vul/vul-webapp/src/main/webapp/WEB-INF/web.xml @@ -15,7 +15,6 @@ /test - upload UploadServlet @@ -25,7 +24,6 @@ /upload - js ScriptEngineServlet @@ -35,7 +33,6 @@ /js - java-deserialize JavaReadObjServlet @@ -45,7 +42,6 @@ /java_deserialize - b64 Base64ClassLoaderServlet @@ -55,7 +51,6 @@ /b64 - biginteger BigIntegerClassLaoderServlet @@ -65,6 +60,24 @@ /biginteger + + reader + TestReaderServlet + + + reader + /reader + + + + inputStream + TestInputStreamServlet + + + inputStream + /inputStream + + godzilla EmptyFilter