WebGoat JAVA反序列化漏洞分析复现

@RestController@AssignmentHints({"insecure-deserialization.hints.1", "insecure-deserialization.hints.2", "insecure-deserialization.hints.3"})public class InsecureDeserializationTask extends AssignmentEndpoint {  @PostMapping({"/InsecureDeserialization/task"})  @ResponseBody  public AttackResult completed(@RequestParam String token) throws IOException {    long before, after;    String b64token = token.replace('-', '+').replace('_', '/');    try {      ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(b64token)));      try {        before = System.currentTimeMillis();        Object o = ois.readObject();        if (!(o instanceof org.dummy.insecure.framework.VulnerableTaskHolder)) {          if (o instanceof String) {            AttackResult attackResult1 = failed(this).feedback("insecure-deserialization.stringobject").build();            ois.close();            return attackResult1;          }           AttackResult attackResult = failed(this).feedback("insecure-deserialization.wrongobject").build();          ois.close();          return attackResult;        }         after = System.currentTimeMillis();        ois.close();      } catch (Throwable throwable) {        try {          ois.close();        } catch (Throwable throwable1) {          throwable.addSuppressed(throwable1);        }         throw throwable;      }     } catch (InvalidClassException e) {      return failed(this).feedback("insecure-deserialization.invalidversion").build();    } catch (IllegalArgumentException e) {      return failed(this).feedback("insecure-deserialization.expired").build();    } catch (Exception e) {      return failed(this).feedback("insecure-deserialization.invalidversion").build();    }     int delay = (int)(after - before);    if (delay > 7000)      return failed(this).build();     if (delay < 3000)      return failed(this).build();     return success(this).build();  }}