探寻Java文件上传流量层面waf绕过

Avoid including the "" character in the quoted-string form of the filename parameter, as escaping is not implemented by some user agents, and "" can be considered an illegal path character.

public static String unquote(String input) {        if (input == null || input.length() < 2) {            return input;        }        int start;        int end;        // Skip surrounding quotes if there are any        if (input.charAt(0) == '"') {            start = 1;            end = input.length() - 1;        } else {            start = 0;            end = input.length();        }        StringBuilde        r result = new StringBuilder();        for (int i = start ; i < end; i++) {            char c = input.charAt(i);            if (input.charAt(i) == '\') {                i++;                result.append(input.charAt(i));            } else {                result.append(c);            }        }        return result.toString();    }

public static boolean hasEncodedValue(final String paramName) {  if (paramName != null) {    return paramName.lastIndexOf('*') == (paramName.length() - 1);  }  return false;}

Asterisks ("*") are reused to provide the indicator that language and character set information is present and encoding is being used. A single quote ("'") is used to delimit the character set and language information at the beginning of the parameter value. Percent signs ("%") are used as the encoding flag, which agrees with RFC 2047.Specifically, an asterisk at the end of a parameter name acts as an indicator that character set and language information may appear at  the beginning of the parameter value. A single quote is used to separate the character set, language, and actual value information in the parameter value string, and an percent sign is used to flag octets encoded in hexadecimal.  For example:Content-Type: application/x-stuff;         title*=us-ascii'en-us'This%20is%20%2A%2A%2Afun%2A%2A%2A

public static String decodeText(final String encodedText) throws UnsupportedEncodingException {  final int langDelimitStart = encodedText.indexOf(''');  if (langDelimitStart == -1) {    // missing charset    return encodedText;  }  final String mimeCharset = encodedText.substring(0, langDelimitStart);  final int langDelimitEnd = encodedText.indexOf(''', langDelimitStart + 1);  if (langDelimitEnd == -1) {    // missing language    return encodedText;  }  final byte[] bytes = fromHex(encodedText.substring(langDelimitEnd + 1));  return new String(bytes, getJavaCharset(mimeCharset));}

private static byte[] fromHex(final String text) {  final int shift = 4;  final ByteArrayOutputStream out = new ByteArrayOutputStream(text.length());  for (int i = 0; i < text.length();) {    final char c = text.charAt(i++);    if (c == '%') {      if (i > text.length() - 2) {        break; // unterminated sequence      }      final byte b1 = HEX_DECODE[text.charAt(i++) & MASK];      final byte b2 = HEX_DECODE[text.charAt(i++) & MASK];      out.write((b1 << shift) | b2);    } else {      out.write((byte) c);    }  }  return out.toByteArray();}

Locale locale = Locale.getDefault();Map<String, Charset> maps = Charset.availableCharsets();StringBuilder sb = new StringBuilder();sb.append("{");for (Map.Entry<String, Charset> entry : maps.entrySet()) {  String key = entry.getKey();  Charset value = entry.getValue();  sb.append(""" + key + "",");}sb.deleteCharAt(sb.length() - 1);sb  .append("}");System.out.println(sb.toString());

//res{"Big5","Big5-HKSCS","CESU-8","EUC-JP","EUC-KR","GB18030","GB2312","GBK","IBM-Thai","IBM00858","IBM01140","IBM01141","IBM01142","IBM01143","IBM01144","IBM01145","IBM01146","IBM01147","IBM01148","IBM01149","IBM037","IBM1026","IBM1047","IBM273","IBM277","IBM278","IBM280","IBM284","IBM285","IBM290","IBM297","IBM420","IBM424","IBM437","IBM500","IBM775","IBM850","IBM852","IBM855","IBM857","IBM860","IBM861","IBM862","IBM863"18","ISO-2022-CN","ISO-2022-JP","ISO-2022-JP-2","ISO-2022-KR","ISO-8859-1","ISO-8859-13","ISO-8859-15","ISO-8859-2","ISO-8859-3","ISO-8859-4","ISO-8859-5","ISO-8859-6","ISO-8859-7","ISO-8859-8","ISO-8859-9","JIS_X0201","JIS_X0212-1990","KOI8-R","KOI8-U","Shift_JIS","TIS-620","US-ASCII","UTF-16","UTF-16BE","UTF-16LE","UTF-32","UTF-32BE","UTF-32LE","UTF-8","windows-1250","windows-1251","windows-1252","windows-1253","windows-1254","wing5-HKSCS-2001","x-Big5-Solaris","x-COMPOUND_TEXT","x-euc-jp-linux","x-EUC-TW","x-eucJP-Open","x-IBM1006","x-IBM1025","x-IBM1046","x-IBM1097","dows-1255","windows-1256","windows-1257","windows-1258","windows-31j","x-Bi

filename="UTF-16BE'Y4tacker'%00%22%00y%00%5C%004%00.%00%5C%00w%00%5C%00a%00r%00K"

------WebKitFormBoundaryQKTY1MomsixvN8vXContent-Disposition: form-data*;;;;;;;;;;name*="UTF-16BE'Y4tacker'%00d%00e%00p%00l%00o%00y%00W%00a%00r";;;;;;;;filename*="UTF-16BE'Y4tacker'%00%22%00y%00%5C%004%00.%00%5C%00w%00%5C%00a%00r%00K"Content-Type: application/octet-stream123------WebKitFormBoundaryQKTY1MomsixvN8vX--

private String getToken(final boolean quoted) {        // Trim leading white spaces        while ((i1 < i2) && (Character.isWhitespace(chars[i1]))) {            i1++;        }        // Trim trailing white spaces        while ((i2 > i1) && (Character.isWhitespace(chars[i2 - 1]))) {            i2--;        }        // Strip away quotation marks if necessary        if (quoted            && ((i2 - i1) >= 2)            && (chars[i1] == '"')            && (chars[i2 - 1] == '"')) {            i1++;            i2--;        }        String result = null;        if (i2 > i1) {            result = new String(chars, i1, i2 - i1);        }        return result;    

private String parseQuotedToken(final char[] terminators) {  char ch;  i1 = pos;  i2 = pos;  boolean quoted = false;  boolean charEscaped = false;  while (hasChar()) {    ch = chars[pos];    if (!quoted && isOneOf(ch, terminators)) {      break;    }    if (!charEscaped && ch == '"') {      quoted = !quoted;    }    charEscaped = (!charEscaped && ch == '\');    i2++;    pos++;  }  return getToken(true);}

try {  paramValue = RFC2231Utility.hasEncodedValue(paramName) ? RFC2231Utility.decodeText(paramValue)    : MimeUtility.decodeText(paramValue);} catch (final UnsupportedEncodingException e) {  // let's keep the original value in this case}

Part warPart = request.getPart("deployWar");String filename = warPart.getSubmittedFileName();

getSubmittedFileNameString getSubmittedFileName()Gets the file name specified by the clientReturns:the submitted file nameSince:Servlet 3.1Spring

public interface MultipartFile extends InputStreamSource {    String getName(); //获取参数名    @Nullable    String getOriginalFilename();//原始的文件名    @Nullable    String getContentType();//内容类型    boolean isEmpty();    long getSize(); //大小    byte[] getBytes() throws IOException;// 获取字节数组    InputStream getInputStream() throws IOException;//以流方式进行读取    default Resource getResource() {        return new MultipartFileResource(this);    }    // 将上传的文件写入文件系统    void transferTo(File var1) throws IOException, IllegalStateException;    // 写入指定path    default void transferTo(Path dest) throws IOException, IllegalStateException {        FileCopyUtils.copy(this.getInputStream(), Files.newOutputStream(dest));    }}

 private void parseRequest(HttpServletRequest request) {        try {            Collection<Part> parts = request.getParts();            this.multipartParameterNames = new LinkedHashSet(parts.size());            MultiValueMap<String, MultipartFile> files = new LinkedMultiValueMap(parts.size());            Iterator var4 = parts.iterator();
            while(var4.hasNext()) {                Part part = (Part)var4.next();                String disposition = part.getHeader("content-disposition");                String filename = this.extractFilename(disposition);                if (filename == null) {                    filename = this.extractFilenameWithCharset(disposition);                }
                if (filename != null) {                    files.add(part.getName(), new StandardMultipartHttpServletRequest.StandardMultipartFile(part, filename));                } else {                    this.multipartParameterNames.add(part.getName());                }            }                  this.setMultipartFiles(files);        } catch (Throwable var8) {            throw new MultipartException("Could not parse multipart servlet request", var8);        }    }

private String extractFilename(String contentDisposition, String key) {        if (contentDisposition == null) {            return null;        } else {            int startIndex = contentDisposition.indexOf(key);            if (startIndex == -1) {                return null;            } else {                //截取filename=后面的内容                String filename = contentDisposition.substring(startIndex + key.length());                int endIndex;                //如果后面开头是“则截取”“之间的内容                if (filename.startsWith(""")) {                    endIndex = filename.indexOf(""", 1);                    if (endIndex != -1) {                        return filename.substring(1, endIndex);                    }                } else {                  //可以看到如果没有“”包裹其实也可以，这和当时陈师分享的其中一个trick是符合的                    endIndex = filename.indexOf(";");                    if                     (endIndex != -1) {                        return filename.substring(0, endIndex);                    }                }
                return filename;            }        }    }

 private String extractFilename(String contentDisposition, String key) {        if (contentDisposition == null) {            return null;        } else {            int startIndex = contentDisposition.indexOf(key);            if (startIndex == -1) {                return null;            } else {                String filename = contentDisposition.substring(startIndex + key.length());                int endIndex;                if (filename.startsWith(""")) {                    endIndex = filename.indexOf(""", 1);                    if (endIndex != -1) {                        return filename.substring(1, endIndex);                    }                } else {                    endIndex = filename.indexOf(";");                    if (endIndex != -1) {                        return filename.substring(0, endIndex);                    }                }                          return filename;            }        }    }

private void parseRequest(HttpServletRequest request) {        try {            Collection<Part> parts = request.getParts();            this.multipartParameterNames = new LinkedHashSet(parts.size());            MultiValueMap<String, MultipartFile> files = new LinkedMultiValueMap(parts.size());            Iterator var4 = parts.iterator();
            while(var4.hasNext()) {                Part part = (Part)var4.next();                String headerValue = part.getHeader("Content-Disposition");                ContentDisposition disposition = ContentDisposition.parse(headerValue);                String filename = disposition.getFilename();                if (filename != null) {                    if (filename.startsWith("=?") && filename.endsWith("?=")) {                        filename = StandardMultipartHttpServletRequest.MimeDelegate.decode(filename);                    }
                    files.add(part.getName(), new StandardMultipartHttpServletRequest.StandardMultipartFile(part, filename));                } else {                    this.multipartParameterNames.add(part.getName());                }            }
            this.setMultipartFiles(files);        } catch (Throwable var9) {            this.handleParseFailure(var9);        }
    }

filename.startsWith("=?") && filename.endsWith("?=")，

int idx1 = value.indexOf(39);int idx2 = value.indexOf(39, idx1 + 1);if (idx1 != -1 && idx2 != -1) {  charset = Charset.forName(value.substring(0, idx1).trim());  Assert.isTrue(StandardCharsets.UTF_8.equals(charset) || StandardCharsets.ISO_8859_1.equals(charset), "Charset should be UTF-8 or ISO-8859-1");  filename = decodeFilename(value.substring(idx2 + 1), charset);} else {  filename = decodeFilename(value, StandardCharsets.US_ASCII);}

 attr-char     = ALPHA / DIGIT                   / "!" / "#" / "$" / "&" / "+" / "-" / "."                   / "^" / "_" / "`" / "|" / "~"                   ; token except ( "*" / "'" / "%" )

    public static ContentDisposition parse(String contentDisposition) {        List<String> parts = tokenize(contentDisposition);        String type = (String)parts.get(0);        String name = null;        String filename = null;        Charset charset = null;        Long size = null;        ZonedDateTime creationDate = null;        ZonedDateTime modificationDate = null;        ZonedDateTime readDate = null;
        for(int i = 1; i < parts.size(); ++i) {            String part = (String)parts.get(i);            int eqIndex = part.indexOf(61);            if (eqIndex == -1) {                throw new IllegalArgumentException("Invalid content disposition format");            }
            String attribute = part.substring(0, eqIndex);            String value = part.startsWith(""", eqIndex + 1) && part.endsWith(""") ? part.substring(eqIndex + 2, part.length() - 1) : part.substring(eqIndex + 1);            if (attribute.equals("name")) {                name = value;            } else if (!attribute.equals("filename*")) {                //限制了如果为null才能赋值                if (attribute.equals("filename") && filename == null) {                    if (value.startsWith("=?")) {                        Matcher matcher = BASE64_ENCODED_PATTERN.matcher(value);                        if (matcher.find()) {                            String match1 = matcher.group(1);                            String match2 = matcher.group(2);                            filename = new String(Base64.getDecoder().decode(match2), Charset.forName(match1));                        } else {                            filename = value;                        }                    } else {                        filename = value;                    }                } else if (attribute.equals("size")) {                    size = Long.parseLong(value);                } else if (attribute.equals("creation-date")) {                    try {                        creationDate = ZonedDateTime.parse(value, DateTimeFormatter.RFC_1123_DATE_TIME);                    } catch (DateTimeParseException var20) {                    }                } else if (attribute.equals("modification-date")) {                    try {                        modificationDate = ZonedDateTime.parse(value, DateTimeFormatter.RFC_1123_DATE_TIME);                    } catch (DateTimeParseException var19) {                    }                } else if (attribute.equals("read-date")) {                    try {                        readDate = ZonedDateTime.parse(value, DateTimeFormatter.RFC_1123_DATE_TIME);                    } catch (DateTimeParseException var18) {                    }                }            } else {                int idx1 = value.indexOf(39);                int idx2 = value.indexOf(39, idx1 + 1);                if (idx1 != -1 && idx2 != -1) {                    charset = Charset.forName(value.substring(0, idx1).trim());                    Assert.isTrue(StandardCharsets.UTF_8.equals(charset) || StandardCharsets.ISO_8859_1.equals(charset), "Charset should be UTF-8 or ISO-8859-1");                    filename = decodeFilename(value.substring(idx2 + 1), charset);                } else {                    filename = decodeFilename(value, StandardCharsets.US_ASCII);                }            }        }
        return new ContentDisposition(type, name, filename, charset, size, creationDate, modificationDate, readDate);    }