add fastjson

Author: JoyChou93

README.md

@@ -20,6 +20,8 @@
 - [SQL注入](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)
 - [URL白名单Bypass](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/URLWhiteList.java)
 - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java)
+- [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Fastjson.java)
+
 
 ## 漏洞说明
 

java-sec-code.iml

@@ -59,11 +59,9 @@
     <orderEntry type="library" name="Maven: org.codehaus.groovy:groovy:2.4.7" level="project" />
     <orderEntry type="library" name="Maven: mysql:mysql-connector-java:8.0.12" level="project" />
     <orderEntry type="library" name="Maven: com.google.protobuf:protobuf-java:2.6.0" level="project" />
-    <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.49" level="project" />
+    <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.24" level="project" />
     <orderEntry type="library" name="Maven: org.jdom:jdom2:2.0.6" level="project" />
     <orderEntry type="library" name="Maven: org.dom4j:dom4j:2.1.1" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.shiro:shiro-web:1.3.2" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.shiro:shiro-core:1.3.2" level="project" />
     <orderEntry type="library" name="Maven: com.google.guava:guava:21.0" level="project" />
     <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.1" level="project" />
     <orderEntry type="library" name="Maven: commons-lang:commons-lang:2.4" level="project" />

pom.xml

@@ -51,12 +51,14 @@
         </dependency>
 
         <!-- 处理json数据 -->
+        <!-- https://mvnrepository.com/artifact/com.alibaba/fastjson -->
         <dependency>
             <groupId>com.alibaba</groupId>
             <artifactId>fastjson</artifactId>
-            <version>1.2.49</version>
+            <version>1.2.24</version>
         </dependency>
 
+
         <!-- jdom解析xml 最新版本为2.0.6 时间为2015-02-28 https://github.com/hunterhacker/jdom/releases-->
         <!-- https://mvnrepository.com/artifact/org.jdom/jdom2 -->
         <dependency>

src/main/java/org/joychou/controller/Fastjson.java

@@ -0,0 +1,35 @@
+package org.joychou.controller;
+
+import com.alibaba.fastjson.JSON;
+import com.alibaba.fastjson.JSONObject;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+
+
+@Controller
+@RequestMapping("/fastjson")
+public class Fastjson {
+
+    @RequestMapping(value = "deserialize", method = {RequestMethod.POST })
+    @ResponseBody
+    public static String Deserialize(@RequestBody String params) {
+        System.out.println(params);
+        try {
+            JSONObject ob = JSON.parseObject(params);
+            return ob.get("name").toString();
+        }catch (Exception e){
+            e.printStackTrace();
+            return e.toString();
+        }
+    }
+
+    public static void main(String[] args){
+        String str = "{\"name\": \"fastjson\"}";
+        JSONObject jo = JSON.parseObject(str);
+        System.out.println(jo.get("name"));  // fastjson
+    }
+}

src/main/java/org/joychou/controller/Index.java

@@ -1,10 +1,13 @@
 package org.joychou.controller;
 
 
+import com.alibaba.fastjson.JSON;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
 
+import java.util.HashMap;
+import java.util.Map;
 
 
 /**
@@ -18,6 +21,12 @@ public class Index {
     @RequestMapping("/")
     @ResponseBody
     public static String index() {
-        return "Welcome to java sec code home page by JoyChou([email protected])";
+        Map m = new HashMap();
+        m.put("app_name", "java_vul_code");
+        m.put("java_version", System.getProperty("java.version"));
+        m.put("fastjson_version", JSON.VERSION);
+
+        // covert map to string
+        return JSON.toJSONString(m);
     }
 }