GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — 更新 Java OWASP 代码 · Drun1baby/JavaSecurityLearning@6b325bb

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • JavaSecurity
    • CodeReview/JavaSec-Code
      • SSTI
        • pom.xml
        • src
          • main
            • java/com/drunkbaby/ssti
              • SstiApplication.java
              • config
                • Temp.java
              • controller
                • FreeMarkerSSTI.java
                • FreeMarkerSSTI_Safe.java
                • ThymeleafController.java
            • resources
              • application.properties
              • static
                • css
                  • main.css
                • js
                  • main.js
              • templates
                • hello.ftl
                • index.ftl
                • user/en
                  • welcome.html
                • welcome.html
          • test/java/com/drunkbaby/ssti
            • SstiApplicationTests.java
      • pom.xml
    • SpringMVC/BasicSpringMVC
      • springmvc-01-BackServlet
        • springmvc-01-BackServlet.iml
      • springmvc-02-HelloMVC
        • springmvc-02-HelloMVC.iml
    • Struts2
      • S2-001
        • src/main/java/com/drunkbaby/action
          • LoginAction.java
        • target
          • S2-001-1.0-SNAPSHOT
            • META-INF
              • MANIFEST.MF
            • WEB-INF/classes/com/drunkbaby/action
              • LoginAction.class
          • classes/com/drunkbaby/action
            • LoginAction.class
      • Struts2AndOGNL
        • src/main/java/com/drunkbaby/OGNLGrammar
          • CreateClass.java
          • EvilCalc.java
        • target/classes/com/drunkbaby/OGNLGrammar
          • EvilCalc.class
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/pom.xml‎

Copy file name to clipboard
+70Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>org.springframework.boot</groupId>
7+
<artifactId>spring-boot-starter-parent</artifactId>
8+
<version>2.2.0.RELEASE</version>
9+
</parent>
10+
<groupId>com.drunkbaby</groupId>
11+
<artifactId>SSTI</artifactId>
12+
<version>0.0.1-SNAPSHOT</version>
13+
<name>SSTI</name>
14+
<description>SSTI</description>
15+
<properties>
16+
<java.version>1.8</java.version>
17+
</properties>
18+
<dependencies>
19+
<dependency>
20+
<groupId>org.springframework.boot</groupId>
21+
<artifactId>spring-boot-starter-web</artifactId>
22+
</dependency>
23+
24+
<dependency>
25+
<groupId>org.springframework.boot</groupId>
26+
<artifactId>spring-boot-starter-test</artifactId>
27+
<scope>test</scope>
28+
</dependency>
29+
30+
<dependency>
31+
<groupId>org.springframework.boot</groupId>
32+
<artifactId>spring-boot-configuration-processor</artifactId>
33+
<version>2.6.7</version>
34+
</dependency>
35+
36+
<dependency>
37+
<groupId>org.springframework.boot</groupId>
38+
<artifactId>spring-boot-starter-thymeleaf</artifactId>
39+
</dependency>
40+
41+
<dependency>
42+
<groupId>org.springframework.boot</groupId>
43+
<artifactId>spring-boot-starter-freemarker</artifactId>
44+
<version>2.6.4</version>
45+
</dependency>
46+
47+
<!-- https://mvnrepository.com/artifact/org.apache.velocity/velocity-engine-core -->
48+
<dependency>
49+
<groupId>org.apache.velocity</groupId>
50+
<artifactId>velocity-engine-core</artifactId>
51+
<version>2.3</version>
52+
</dependency>
53+
<!-- https://mvnrepository.com/artifact/org.apache.velocity.tools/velocity-tools-generic -->
54+
<dependency>
55+
<groupId>org.apache.velocity.tools</groupId>
56+
<artifactId>velocity-tools-generic</artifactId>
57+
<version>3.0</version>
58+
</dependency>
59+
</dependencies>
60+
61+
<build>
62+
<plugins>
63+
<plugin>
64+
<groupId>org.springframework.boot</groupId>
65+
<artifactId>spring-boot-maven-plugin</artifactId>
66+
</plugin>
67+
</plugins>
68+
</build>
69+
70+
</project>
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/java/com/drunkbaby/ssti/SstiApplication.java‎

Copy file name to clipboard
+13Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package com.drunkbaby.ssti;
2+
3+
import org.springframework.boot.SpringApplication;
4+
import org.springframework.boot.autoconfigure.SpringBootApplication;
5+
6+
@SpringBootApplication
7+
public class SstiApplication {
8+
9+
public static void main(String[] args) {
10+
SpringApplication.run(SstiApplication.class, args);
11+
}
12+
13+
}
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/java/com/drunkbaby/ssti/config/Temp.java‎

Copy file name to clipboard
+13Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
package com.drunkbaby.ssti.config;
2+
3+
import freemarker.cache.StringTemplateLoader;
4+
import freemarker.template.Configuration;
5+
import freemarker.template.utility.Execute;
6+
import org.springframework.web.servlet.DispatcherServlet;
7+
import org.springframework.web.servlet.view.UrlBasedViewResolver;
8+
import org.springframework.web.servlet.view.freemarker.FreeMarkerView;
9+
10+
public class Temp {
11+
public static void main(String[] args) {
12+
}
13+
}
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/java/com/drunkbaby/ssti/controller/FreeMarkerSSTI.java‎

Copy file name to clipboard
+23Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package com.drunkbaby.ssti.controller;
2+
3+
import freemarker.core.TemplateClassResolver;
4+
import freemarker.template.Configuration;
5+
import org.springframework.stereotype.Controller;
6+
import org.springframework.ui.Model;
7+
import org.springframework.web.bind.annotation.GetMapping;
8+
import org.springframework.web.bind.annotation.RequestParam;
9+
10+
@Controller
11+
public class FreeMarkerSSTI {
12+
13+
@GetMapping("/freeMarker")
14+
public String index() {
15+
return "index";
16+
}
17+
18+
@GetMapping("/hello")
19+
public String hello(Model model, @RequestParam(value="name", required=false, defaultValue="Drunkbaby") String name) {
20+
model.addAttribute("name", name);
21+
return "hello";
22+
}
23+
}
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/java/com/drunkbaby/ssti/controller/FreeMarkerSSTI_Safe.java‎

Copy file name to clipboard
+35Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
package com.drunkbaby.ssti.controller;
2+
3+
import freemarker.cache.StringTemplateLoader;
4+
import freemarker.core.TemplateClassResolver;
5+
import freemarker.template.Configuration;
6+
import freemarker.template.Template;
7+
8+
import java.io.IOException;
9+
import java.io.OutputStreamWriter;
10+
import java.io.StringWriter;
11+
import java.util.HashMap;
12+
13+
public class FreeMarkerSSTI_Safe {
14+
public static void main(String[] args) throws Exception {
15+
16+
//设置模板
17+
HashMap<String, String> map = new HashMap<String, String>();
18+
// String poc ="<#assign aaa=\"freemarker.template.utility.Execute\"?new()> ${ aaa(\"Calc\") }";
19+
String poc ="";
20+
System.out.println(poc);
21+
StringTemplateLoader stringLoader = new StringTemplateLoader();
22+
Configuration cfg = new Configuration();
23+
stringLoader.putTemplate("name",poc);
24+
cfg.setTemplateLoader(stringLoader);
25+
// cfg.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
26+
//处理解析模板
27+
Template Template_name = cfg.getTemplate("name");
28+
StringWriter stringWriter = new StringWriter();
29+
30+
Template_name.process(Template_name,stringWriter);
31+
32+
33+
}
34+
}
35+
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/java/com/drunkbaby/ssti/controller/ThymeleafController.java‎

Copy file name to clipboard
+57Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package com.drunkbaby.ssti.controller;
2+
3+
import org.slf4j.Logger;
4+
import org.slf4j.LoggerFactory;
5+
import org.springframework.stereotype.Controller;
6+
import org.springframework.ui.Model;
7+
import org.springframework.web.bind.annotation.*;
8+
9+
import javax.servlet.http.HttpServletResponse;
10+
11+
@Controller
12+
public class ThymeleafController {
13+
14+
Logger log = LoggerFactory.getLogger(ThymeleafController.class);
15+
16+
@GetMapping("/")
17+
public String index(Model model) {
18+
model.addAttribute("message", "happy birthday");
19+
return "welcome";
20+
}
21+
22+
//GET /path?lang=en HTTP/1.1
23+
//GET /path?lang=__$%7bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22id%22).getInputStream()).next()%7d__::.x
24+
@GetMapping("/path")
25+
public String path(@RequestParam String lang) {
26+
return "user/" + lang + "/welcome"; //template path is tainted
27+
}
28+
29+
//GET /fragment?section=main
30+
//GET /fragment?section=__$%7bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22touch%20executed%22).getInputStream()).next()%7d__::.x
31+
@GetMapping("/fragment")
32+
public String fragment(@RequestParam String section) {
33+
return "welcome :: " + section; //fragment is tainted
34+
}
35+
36+
@GetMapping("/doc/{document}")
37+
public void getDocument(@PathVariable String document) {
38+
log.info("Retrieving " + document);
39+
//returns void, so view name is taken from URI
40+
}
41+
42+
@GetMapping("/safe/fragment")
43+
@ResponseBody
44+
public String safeFragment(@RequestParam String section) {
45+
return "welcome :: " + section; //FP, as @ResponseBody annotation tells Spring to process the return values as body, instead of view name
46+
}
47+
48+
@GetMapping("/safe/redirect")
49+
public String redirect(@RequestParam String url) {
50+
return "redirect:" + url; //FP as redirects are not resolved as expressions
51+
}
52+
53+
@GetMapping("/safe/doc/{document}")
54+
public void getDocument(@PathVariable String document, HttpServletResponse response) {
55+
log.info("Retrieving " + document); //FP
56+
}
57+
}
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/resources/application.properties‎

Copy file name to clipboard
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
server.port=8081
2+
spring.freemarker.template-loader-path: classpath:/templates
3+
spring.freemarker.suffix: .ftl
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/resources/static/css/main.css‎

Copy file name to clipboard
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.hello-title{
2+
color: darkgreen;
3+
}
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/resources/static/js/main.js‎

Copy file name to clipboard
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
(function(){
2+
console.log("Hello World!");
3+
})();
Collapse file

‎JavaSecurity/CodeReview/JavaSec-Code/SSTI/src/main/resources/templates/hello.ftl‎

Copy file name to clipboard
+13Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<meta charset="UTF-8">
5+
<title>Hello ${name}!</title>
6+
<link href="/css/main.css" rel="stylesheet">
7+
</head>
8+
<body>
9+
<h2 class="hello-title">Hello ${name}!</h2>
10+
<h3><#assign value="freemarker.template.utility.Execute"?new()>${value("Calc")}</h3>
11+
<script src="/js/main.js"></script>
12+
</body>
13+
</html>

0 commit comments

Comments
0 (0)
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.