Spring4Shell 漏洞复现及分析

package player;

public class PersonBean implements java.io.Serializable {

    // name 属性
    private String name = null;
    // deceased 属性
    private boolean deceased = false;

    // 无参构造函数
    public PersonBean() {
    }

    //name 的 getter 方法
    public String getName() {
        return name;
    }
    //name 的 setter 方法
    public void setName(final String value) {
        name = value;
    }
    // deceased 的 getter 方法
    // boolean 类型的特殊 getter
    public boolean isDeceased() {
        return deceased;
    }
    // deceased 的 setter 方法
    public void setDeceased(final boolean value) {
        deceased = value;
    }
}

public class User {
    
    private String name;

    public String getName() {
        return name;
    }
    public void setName(String name) {
        this.name = name;
    }
    
    @Override
    public String toString() {
        return "User{" +
                "name='" + name + '\'' +
                '}';
    }
}

public static void main (String[] args) throws Exception {
    
    // 创建并输出 User 对象的值
    User user = new User();
    System.out.println( user.toString );

    // 创建一个 User.name 的属性描述符
    PropertyDescriptor propertyDescriptor = new PropertyDescriptor( "name", User.class );

    // 获得并调用 User.name 的读方法，也就是 getter --> User.getname()
    Method readMethod = propertyDescriptor.getReadMethod();
    System.out.println( readMethod.invoke( user ) );

    // 获得并调用 User.name 的写方法，也就是 setter --> User.setname()
    Method writeMethod = propertyDescriptor.getWriteMethod();
    writeMethod.invoke( user, "hello" );

    System.out.println( user.toString );
}

public final class CachedIntrospectionResults {

    /**
     * Map keyed by Class containing CachedIntrospectionResults, strongly held.
     * This variant is being used for cache-safe bean classes.
     */
    static final ConcurrentMap<Class<?>, CachedIntrospectionResults> strongClassCache =
            new ConcurrentHashMap<>(64);

    /**
     * Map keyed by Class containing CachedIntrospectionResults, softly held.
     * This variant is being used for non-cache-safe bean classes.
     */
    static final ConcurrentMap<Class<?>, CachedIntrospectionResults> softClassCache =
            new ConcurrentReferenceHashMap<>(64);

    static CachedIntrospectionResults forClass(Class<?> beanClass) throws BeansException {
        
        // 尝试在 strongClassCache 中获得
        CachedIntrospectionResults results = strongClassCache.get(beanClass);
        if (results != null) {
            return results;
        }

        // 获取不到的话在 softClassCache 中获取
        results = softClassCache.get(beanClass);
        if (results != null) {
            return results;
        }

        // 如果都没有获得 创建对象进行获取
        results = new CachedIntrospectionResults(beanClass);
        ConcurrentMap<Class<?>, CachedIntrospectionResults> classCacheToUse;

        if (ClassUtils.isCacheSafe(beanClass, CachedIntrospectionResults.class.getClassLoader()) ||
                isClassLoaderAccepted(beanClass.getClassLoader())) {
            classCacheToUse = strongClassCache;
        }
        else {
            if (logger.isDebugEnabled()) {
                logger.debug("Not strongly caching class [" + beanClass.getName() + "] because it is not cache-safe");
            }
            classCacheToUse = softClassCache;
        }

        // 缓存获得的结果
        CachedIntrospectionResults existing = classCacheToUse.putIfAbsent(beanClass, results);
        return (existing != null ? existing : results);
    }

}

package top.dre4merp;

public class User {
    private String name;
    private Integer age;

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public Integer getAge() {
        return age;
    }

    public void setAge(Integer age) {
        this.age = age;
    }

    @Override
    public String toString() {
        return "User{" +
                "name='" + name + '\'' +
                ", age=" + age +
                '}';
    }
}

package top.dre4merp;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;

@Controller
public class TestController {
    @RequestMapping(path = "/test")
    @ResponseBody
    public String Test(User u){
        return u.toString();
    }
}