CVE-2020-26258&26259：XStream漏洞复现

    <!-- https://mvnrepository.com/artifact/com.thoughtworks.xstream/xstream -->    <dependencies>        <dependency>            <groupId>com.thoughtworks.xstream</groupId>            <artifactId>xstream</artifactId>            <version>1.4.14</version>        </dependency>    </dependencies>

import com.thoughtworks.xstream.XStream;import com.thoughtworks.xstream.io.json.JettisonMappedXmlDriver;
class Person//JavaBean实体类{    private String name;    private int age;    public Person(String name,int age)    {        this.name=name;        this.age=age;    }    @Override    public String toString()    {        return "Person [name=" + name + ", age=" + age + "]";    }
}
public class Test{    public static void main(String[] args)    {        Person bean=new Person("美女",18);        XStream xstream = new XStream();        //XML序列化        String xml = xstream.toXML(bean);         System.out.println(xml);        //        //XML反序列化        bean=(Person)xstream.fromXML(xml);        System.out.println(bean);
    }}

https://github.com/jas502n/CVE-2020-26259/blob/main/CVE_2020_26258.java

https://github.com/jas502n/CVE-2020-26259/blob/main/CVE_2020_26259.java