simplifications

src/main/java/ysoserial/Strings.java

@@ -1,7 +1,5 @@
 package ysoserial;
 
-import org.apache.commons.lang.StringUtils;
-
 import java.util.*;
 
 public class Strings {
@@ -46,10 +44,6 @@ public class Strings {
         return lines;
     }
 
-    public static String randUUID() {
-        return UUID.randomUUID().toString().replaceAll("-", "");
-    }
-
     public static class ToStringComparator implements Comparator<Object> {
         public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }
     }

src/main/java/ysoserial/payloads/Myfaces1.java

@@ -56,7 +56,6 @@ public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
                 "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
                 "org.mortbay.jasper:apache-el:8.0.27",
                 "javax.servlet:javax.servlet-api:3.1.0",
-                "com.nqzero:permit-reflect:0.3", // FIXME for custom deserializer
 
                 // deps for mocking the FacesContext
                 "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"
@@ -66,7 +65,6 @@ public class Myfaces1 implements ObjectPayload<Object>, DynamicDependencies {
                 "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
                 "de.odysseus.juel:juel-impl:2.2.7", "de.odysseus.juel:juel-api:2.2.7",
                 "javax.servlet:javax.servlet-api:3.1.0",
-                "com.nqzero:permit-reflect:0.3", // FIXME for custom deserializer
 
                 // deps for mocking the FacesContext
                 "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"

src/test/java/ysoserial/test/payloads/DnsLookupTest.java

@@ -1,22 +1,18 @@
 package ysoserial.test.payloads;
 
 import org.junit.Assert;
-import ysoserial.Strings;
-import ysoserial.payloads.Scala;
 import ysoserial.payloads.URLDNS;
 import ysoserial.secmgr.SecurityManagers;
 import ysoserial.test.CustomTest;
-import ysoserial.test.util.Files;
+import ysoserial.test.util.Randomized;
-import ysoserial.test.util.OS;
 
-import java.io.File;
 import java.security.Permission;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.concurrent.Callable;
 
 public class DnsLookupTest implements CustomTest {
-    private final String testDomain = Strings.randUUID();
+    private final String testDomain = Randomized.randUUID();
 
     @Override
     public void run(Callable<Object> payload) throws Exception {

src/test/java/ysoserial/test/payloads/EmptyFileWriteTest.java

@@ -1,21 +1,18 @@
 package ysoserial.test.payloads;
 
-import org.apache.commons.codec.binary.Base64;
 import org.junit.Assert;
-import ysoserial.Strings;
 import ysoserial.payloads.Scala;
 import ysoserial.test.CustomTest;
 import ysoserial.test.util.Files;
 import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
 
-import java.io.BufferedReader;
 import java.io.File;
-import java.io.FileReader;
 import java.util.concurrent.Callable;
 
 public class EmptyFileWriteTest implements CustomTest {
-    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID());
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
-    private final String testContent = Strings.randUUID();
+    private final String testContent = Randomized.randUUID();
 
     @Override
     public void run(Callable<Object> payload) throws Exception {

src/test/java/ysoserial/test/payloads/JRMPListenerTest.java

@@ -7,6 +7,7 @@ import ysoserial.payloads.JRMPListener;
 import ysoserial.test.CustomTest;
 import ysoserial.test.util.Files;
 import ysoserial.test.util.ObjectInputFilters;
+import ysoserial.test.util.Randomized;
 
 import java.io.File;
 import java.rmi.Remote;
@@ -16,7 +17,7 @@ import java.util.concurrent.Callable;
 public class JRMPListenerTest implements CustomTest, NeedsAddlClasses {
     private final File testFile = Files.getTestFile();
 
-    private final int port = 16000 + new Random().nextInt(16000);
+    private final int port = Randomized.randPort();
 
     @Override
     public void run(Callable<Object> payload) throws Exception {

src/test/java/ysoserial/test/payloads/MyfacesTest.java

@@ -7,7 +7,6 @@ import java.net.URL;
 import java.util.HashMap;
 import java.util.Iterator;
 import java.util.Map;
-import java.util.concurrent.Callable;
 
 import javax.el.BeanELResolver;
 import javax.el.ELContext;
@@ -17,7 +16,6 @@ import javax.faces.context.FacesContext;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletRequest;
 
-import com.nqzero.permit.Permit;
 import org.apache.myfaces.el.CompositeELResolver;
 import org.apache.myfaces.el.unified.FacesELContext;
 import org.mockito.Matchers;
@@ -26,10 +24,8 @@ import org.mockito.invocation.InvocationOnMock;
 import org.mockito.stubbing.Answer;
 
 import ysoserial.payloads.Myfaces2;
-import ysoserial.payloads.util.Reflections;
 import ysoserial.test.CustomDeserializer;
 import ysoserial.Deserializer;
-import ysoserial.test.WrappedTest;
 
 
 /**
@@ -54,7 +50,7 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
     public static final class MyfacesDeserializer extends Deserializer {
         public static Class<?>[] getExtraDependencies () {
             return new Class[] {
-                MockRequestContext.class, MockELResolver.class, Reflections.class, Permit.class
+                MockRequestContext.class, MockELResolver.class, FacesContextSetter.class
             };
         }
 
@@ -63,19 +59,23 @@ public class MyfacesTest extends RemoteClassLoadingTest implements CustomDeseria
         }
 
 
+        public static abstract class FacesContextSetter extends FacesContext {
+            public static void set(FacesContext fc) {
+                FacesContext.setCurrentInstance(fc); // protected
+            }
+        }
+
         @Override
         public Object call () throws Exception {
-            java.lang.reflect.Method setFC = FacesContext.class.getDeclaredMethod("setCurrentInstance", FacesContext.class);
-            Reflections.setAccessible(setFC);
             ClassLoader oldTCCL = Thread.currentThread().getContextClassLoader();
             Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
             FacesContext ctx = createMockFacesContext();
             try {
-                setFC.invoke(null, ctx);
+                FacesContextSetter.set(ctx);
                 return super.call();
             }
             finally {
-                setFC.invoke(null, (FacesContext) null);
+                FacesContextSetter.set(null);
                 Thread.currentThread().setContextClassLoader(oldTCCL);
             }
         }

src/test/java/ysoserial/test/payloads/PythonUploadExecTest.java

@@ -1,18 +1,18 @@
 package ysoserial.test.payloads;
 
 import org.junit.Assert;
-import ysoserial.Strings;
 import ysoserial.test.CustomTest;
 import ysoserial.test.util.Files;
 import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
 
 import java.io.File;
 import java.util.concurrent.Callable;
 
 public class PythonUploadExecTest implements CustomTest {
-    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID());
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
-    private final File srcPyFile = new File(OS.getTmpDir(), "ysoserial-test-src-" + Strings.randUUID() + ".py");
+    private final File srcPyFile = new File(OS.getTmpDir(), "ysoserial-test-src-" + Randomized.randUUID() + ".py");
-    private final File dstPyFile = new File(OS.getTmpDir(), "ysoserial-test-dst-" + Strings.randUUID() + ".py");
+    private final File dstPyFile = new File(OS.getTmpDir(), "ysoserial-test-dst-" + Randomized.randUUID() + ".py");
     private final String testCode = "open('" + testFile + "','w').close()";
 
     {

src/test/java/ysoserial/test/payloads/RemoteClassLoadingTest.java

@@ -4,7 +4,6 @@ package ysoserial.test.payloads;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.Serializable;
-import java.util.Random;
 import java.util.concurrent.Callable;
 
 import fi.iki.elonen.NanoHTTPD;
@@ -15,6 +14,7 @@ import javassist.CtClass;
 import ysoserial.payloads.C3P0;
 import ysoserial.test.CustomTest;
 import ysoserial.test.WrappedTest;
+import ysoserial.test.util.Randomized;
 
 
 /**
@@ -23,7 +23,8 @@ import ysoserial.test.WrappedTest;
  */
 public class RemoteClassLoadingTest extends CommandExecTest implements WrappedTest, CustomTest {
 
-    private int port = new Random().nextInt(65535-1024)+1024;
+    private int port = Randomized.randPort();
+
     private String className = "Exploit-" + System.currentTimeMillis();
 
 

src/test/java/ysoserial/test/payloads/SimpleFileWriteTest.java

@@ -2,10 +2,10 @@ package ysoserial.test.payloads;
 
 import org.apache.commons.codec.binary.Base64;
 import org.junit.Assert;
-import ysoserial.Strings;
 import ysoserial.test.CustomTest;
 import ysoserial.test.util.Files;
 import ysoserial.test.util.OS;
+import ysoserial.test.util.Randomized;
 
 import java.io.BufferedReader;
 import java.io.File;
@@ -13,8 +13,8 @@ import java.io.FileReader;
 import java.util.concurrent.Callable;
 
 public class SimpleFileWriteTest implements CustomTest {
-    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID());
+    private final File testFile = new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
-    private final String testContent = Strings.randUUID();
+    private final String testContent = Randomized.randUUID();
 
     @Override
     public void run(Callable<Object> payload) throws Exception {

src/test/java/ysoserial/test/payloads/SsrfTest.java

@@ -4,9 +4,9 @@ import com.sun.net.httpserver.HttpExchange;
 import com.sun.net.httpserver.HttpHandler;
 import com.sun.net.httpserver.HttpServer;
 import org.junit.Assert;
-import ysoserial.Strings;
 import ysoserial.payloads.Scala;
 import ysoserial.test.CustomTest;
+import ysoserial.test.util.Randomized;
 
 import java.io.IOException;
 import java.net.InetSocketAddress;
@@ -16,9 +16,9 @@ import java.util.Random;
 import java.util.concurrent.Callable;
 
 public class SsrfTest implements CustomTest {
-    int port = 16000 + new Random().nextInt(16000);
+    int port = Randomized.randPort();
     String authority = "http://localhost:" + port;
-    String uri = "/?" + Strings.randUUID();
+    String uri = "/?" + Randomized.randUUID();
 
     @Override
     public String getPayloadArgs() {

src/test/java/ysoserial/test/payloads/Struts2JasperReportsTest.java

@@ -9,6 +9,7 @@ import com.opensymphony.xwork2.config.providers.XWorkConfigurationProvider;
 import com.opensymphony.xwork2.inject.Container;
 
 import ysoserial.Deserializer;
+import ysoserial.payloads.Struts2JasperReports;
 import ysoserial.test.CustomDeserializer;
 
 public class Struts2JasperReportsTest extends CommandExecTest implements CustomDeserializer {
@@ -17,7 +18,7 @@ public class Struts2JasperReportsTest extends CommandExecTest implements CustomD
 	public Class<?> getCustomDeserializer() {
 		return StrutsJasperReportsDeserializer.class;
 	}
-	
+
     /**
      * need to use a custom deserializer so that the action context gets set in the isolated class
      *
@@ -25,18 +26,18 @@ public class Struts2JasperReportsTest extends CommandExecTest implements CustomD
      *
      */
     public static final class StrutsJasperReportsDeserializer extends Deserializer {
-        
+
 		public StrutsJasperReportsDeserializer(byte[] bytes) {
 			super(bytes);
 		}
-    	
+
         @Override
         public Object call () throws Exception {
             ConfigurationManager configurationManager = new ConfigurationManager(Container.DEFAULT_NAME);
             configurationManager.addContainerProvider(new XWorkConfigurationProvider());
             Configuration config = configurationManager.getConfiguration();
             Container container = config.getContainer();
-            
+
         	HashMap<String, Object> context = new HashMap<String, Object>();
         	context.put(ActionContext.CONTAINER, container);
         	ActionContext.setContext(new ActionContext(context));
@@ -44,4 +45,8 @@ public class Struts2JasperReportsTest extends CommandExecTest implements CustomD
         }
     }
 
+    public static void main(String[] args) throws Exception {
+        PayloadsTest.testPayload(Struts2JasperReports.class);
+    }
+
 }

src/test/java/ysoserial/test/util/Files.java

@@ -1,7 +1,5 @@
 package ysoserial.test.util;
 
-import ysoserial.Strings;
-
 import java.io.File;
 import java.io.PrintWriter;
 
@@ -24,6 +22,6 @@ public class Files {
     }
 
     public static File getTestFile() {
-        return new File(OS.getTmpDir(), "ysoserial-test-" + Strings.randUUID());
+        return new File(OS.getTmpDir(), "ysoserial-test-" + Randomized.randUUID());
     }
 }

src/test/java/ysoserial/test/util/Randomized.java

@@ -0,0 +1,24 @@
+package ysoserial.test.util;
+
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.util.Random;
+import java.util.UUID;
+
+public class Randomized {
+    public static int randPort() {
+        while (true) {
+            int port = new Random().nextInt(65535 - 16384) + 16384;
+            try {
+                ServerSocket s = new ServerSocket(port);
+                s.setReuseAddress(true);
+                s.close();
+                return port;
+            } catch (IOException e) {}
+        }
+    }
+
+    public static String randUUID() {
+        return UUID.randomUUID().toString().replaceAll("-", "");
+    }
+}