Some basic cleanups (warnings, imports)

Add controlled instantiation constructor utility.

src/main/java/ysoserial/GeneratePayload.java

@@ -30,6 +30,7 @@ public class GeneratePayload {
 			System.err.println("Invalid payload type '" + payloadType + "'");
 			printUsage();
 			System.exit(USAGE_CODE);
+			return; // make null analysis happy
 		}
 
 		try {

src/main/java/ysoserial/exploit/RMIRegistryExploit.java

@@ -3,7 +3,6 @@ package ysoserial.exploit;
 import java.rmi.Remote;
 import java.rmi.registry.LocateRegistry;
 import java.rmi.registry.Registry;
-import java.util.Arrays;
 import java.util.concurrent.Callable;
 
 import ysoserial.payloads.CommonsCollections1;
@@ -18,6 +17,7 @@ import ysoserial.secmgr.ExecCheckingSecurityManager;
  * TODO: automatic exploitation of endpoints, potentially with automated download and use of jars containing remote
  * interfaces. See http://www.findmaven.net/api/find/class/org.springframework.remoting.rmi.RmiInvocationHandler .
  */
+@SuppressWarnings({"rawtypes", "unchecked"})
 public class RMIRegistryExploit {
 	public static void main(final String[] args) throws Exception {
 		final String host = args[0];

src/main/java/ysoserial/payloads/BeanShell1.java

@@ -3,8 +3,6 @@ package ysoserial.payloads;
 import bsh.Interpreter;
 import bsh.XThis;
 
-import java.io.*;
-import java.lang.reflect.Field;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Comparator;
@@ -17,7 +15,7 @@ import ysoserial.payloads.util.PayloadRunner;
  * Credits: Alvaro Munoz (@pwntester) and Christian Schneider (@cschneider4711)
  */
 
-@SuppressWarnings({ "rawtypes", "unchecked", "restriction" })
+@SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({ "org.beanshell:bsh:2.0b5" })
 public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
  

src/main/java/ysoserial/payloads/ObjectPayload.java

@@ -6,6 +6,7 @@ import org.reflections.Reflections;
 
 import ysoserial.GeneratePayload;
 
+@SuppressWarnings("rawtypes")
 public interface ObjectPayload<T> {
 	/*
 	 * return armed payload object to be serialized that will execute specified

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -14,7 +14,6 @@ import java.util.Map;
 import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
-import ysoserial.payloads.util.Gadgets.StubTransletPayload;
 
 import com.sun.org.apache.xalan.internal.xsltc.DOM;
 import com.sun.org.apache.xalan.internal.xsltc.TransletException;
@@ -113,7 +112,7 @@ public class Gadgets {
 
 		// required to make TemplatesImpl happy
 		Reflections.setFieldValue(templates, "_name", "Pwnr");
-		Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl());
+		Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
 		return templates;
 	}
 	

src/main/java/ysoserial/payloads/util/Reflections.java

@@ -2,7 +2,11 @@ package ysoserial.payloads.util;
 
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
 
+import sun.reflect.ReflectionFactory;
+
+@SuppressWarnings ( "restriction" )
 public class Reflections {
 
 	public static Field getField(final Class<?> clazz, final String fieldName) throws Exception {
@@ -29,5 +33,21 @@ public class Reflections {
 	    ctor.setAccessible(true);
 	    return ctor;
 	}
+	
+
+    public static <T> T createWithoutConstructor ( Class<T> classToInstantiate )
+            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
+        return createWithConstructor(classToInstantiate, Object.class, new Class[0], new Object[0]);
+    }
+    
+    @SuppressWarnings ( {"unchecked"} )
+    public static <T> T createWithConstructor ( Class<T> classToInstantiate, Class<? super T> constructorClass, Class<?>[] consArgTypes, Object[] consArgs )
+            throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException {
+        Constructor<? super T> objCons = constructorClass.getDeclaredConstructor(consArgTypes);
+        objCons.setAccessible(true);
+        Constructor<?> sc = ReflectionFactory.getReflectionFactory().newConstructorForSerialization(classToInstantiate, objCons);
+        sc.setAccessible(true);
+        return (T)sc.newInstance(consArgs);
+    }
 
 }