44import org .dom4j .io .SAXReader ;
55import org .slf4j .Logger ;
66import org .slf4j .LoggerFactory ;
7+ import org .springframework .data .web .ProjectedPayload ;
8+ import org .springframework .http .HttpEntity ;
9+ import org .springframework .http .ResponseEntity ;
710import org .springframework .web .bind .annotation .*;
811
912import javax .servlet .http .HttpServletRequest ;
2730import org .apache .commons .digester3 .Digester ;
2831import org .jdom2 .input .SAXBuilder ;
2932import org .joychou .util .WebUtils ;
33+ import org .xmlbeam .annotation .XBRead ;
3034
3135/**
3236 * Java xxe vuln and security code.
3842@ RequestMapping ("/xxe" )
3943public class XXE {
4044
41- private static Logger logger = LoggerFactory .getLogger (XXE .class );
42- private static String EXCEPT = "xxe except" ;
45+ private static final Logger logger = LoggerFactory .getLogger (XXE .class );
46+ private static final String EXCEPT = "xxe except" ;
4347
4448 @ PostMapping ("/xmlReader/vuln" )
4549 public String xmlReaderVuln (HttpServletRequest request ) {
@@ -226,16 +230,15 @@ public String DigesterSec(HttpServletRequest request) {
226230 }
227231
228232
229- // 有回显
230- @ RequestMapping (value = "/DocumentBuilder/vuln01" , method = RequestMethod .POST )
233+ /**
234+ * Use request.getInputStream to support UTF16 encoding.
235+ */
236+ @ RequestMapping (value = "/DocumentBuilder/vuln" , method = RequestMethod .POST )
231237 public String DocumentBuilderVuln01 (HttpServletRequest request ) {
232238 try {
233- String body = WebUtils .getRequestBody (request );
234- logger .info (body );
235239 DocumentBuilderFactory dbf = DocumentBuilderFactory .newInstance ();
236240 DocumentBuilder db = dbf .newDocumentBuilder ();
237- StringReader sr = new StringReader (body );
238- InputSource is = new InputSource (sr );
241+ InputSource is = new InputSource (request .getInputStream ());
239242 Document document = db .parse (is ); // parse xml
240243
241244 // 遍历xml节点name和value
@@ -249,7 +252,6 @@ public String DocumentBuilderVuln01(HttpServletRequest request) {
249252 buf .append (String .format ("%s: %s\n " , node .getNodeName (), node .getTextContent ()));
250253 }
251254 }
252- sr .close ();
253255 return buf .toString ();
254256 } catch (Exception e ) {
255257 e .printStackTrace ();
@@ -258,43 +260,6 @@ public String DocumentBuilderVuln01(HttpServletRequest request) {
258260 }
259261 }
260262
261-
262- // 有回显
263- @ RequestMapping (value = "/DocumentBuilder/vuln02" , method = RequestMethod .POST )
264- public String DocumentBuilderVuln02 (HttpServletRequest request ) {
265- try {
266- String body = WebUtils .getRequestBody (request );
267- logger .info (body );
268-
269- DocumentBuilderFactory dbf = DocumentBuilderFactory .newInstance ();
270- DocumentBuilder db = dbf .newDocumentBuilder ();
271- StringReader sr = new StringReader (body );
272- InputSource is = new InputSource (sr );
273- Document document = db .parse (is ); // parse xml
274-
275- // 遍历xml节点name和value
276- StringBuilder result = new StringBuilder ();
277- NodeList rootNodeList = document .getChildNodes ();
278- for (int i = 0 ; i < rootNodeList .getLength (); i ++) {
279- Node rootNode = rootNodeList .item (i );
280- NodeList child = rootNode .getChildNodes ();
281- for (int j = 0 ; j < child .getLength (); j ++) {
282- Node node = child .item (j );
283- // 正常解析XML，需要判断是否是ELEMENT_NODE类型。否则会出现多余的的节点。
284- if (child .item (j ).getNodeType () == Node .ELEMENT_NODE ) {
285- result .append (String .format ("%s: %s\n " , node .getNodeName (), node .getFirstChild ()));
286- }
287- }
288- }
289- sr .close ();
290- return result .toString ();
291- } catch (Exception e ) {
292- logger .error (e .toString ());
293- return EXCEPT ;
294- }
295- }
296-
297-
298263 @ RequestMapping (value = "/DocumentBuilder/Sec" , method = RequestMethod .POST )
299264 public String DocumentBuilderSec (HttpServletRequest request ) {
300265 try {
@@ -447,6 +412,31 @@ private static void response(NodeList rootNodeList){
447412 }
448413 }
449414
415+ /**
416+ * Receiving POST requests supporting both JSON and XML.
417+ * CVE-2018-1259
418+ */
419+ @ PostMapping (value = "/xmlbeam/vuln" )
420+ HttpEntity <String > post (@ RequestBody UserPayload user ) {
421+ try {
422+ logger .info (user .toString ());
423+ return ResponseEntity .ok (String .format ("hello, %s!" , user .getUserName ()));
424+ }catch (Exception e ){
425+ e .printStackTrace ();
426+ return ResponseEntity .ok ("error" );
427+ }
428+ }
429+
430+ /**
431+ * The projection interface using XPath and JSON Path expression to selectively pick elements from the payload.
432+ */
433+ @ ProjectedPayload
434+ public interface UserPayload {
435+ @ XBRead ("//userName" )
436+ String getUserName ();
437+ }
438+
439+
450440 public static void main (String [] args ) {
451441 }
452442
0 commit comments