Skip to content
No description, website, or topics provided.
Java
Branch: master
Clone or download
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
gradle/wrapper init code Jul 10, 2019
src/main/java/com/leadroyal/breaker Add blacklist for 1.2.59 Aug 1, 2019
.gitignore Add blacklist from jdk Jul 10, 2019
build.gradle init code Jul 10, 2019
gradlew init code Jul 10, 2019
gradlew.bat init code Jul 10, 2019
readme.md Add blacklist for 1.2.59 Aug 1, 2019
settings.gradle init code Jul 10, 2019

readme.md

fastjson blacklist

背景

fastjson 在1.2.42开始,把原本明文的黑名单改成了哈希过的黑名单,防止安全研究者对其进行研究。在 https://github.com/alibaba/fastjson/commit/eebea031d4d6f0a079c3d26845d96ad50c3aaccd 这次commit中体现出来。

-     private String[] denyList = "bsh,com.mchange,com.sun.,java.lang.Thread,java.net.Socket,java.rmi,javax.xml,org.apache.bcel,org.apache.commons.beanutils,org.apache.commons.collections.Transformer,org.apache.commons.collections.functors,org.apache.commons.collections4.comparators,org.apache.commons.fileupload,org.apache.myfaces.context.servlet,org.apache.tomcat,org.apache.wicket.util,org.apache.xalan,org.codehaus.groovy.runtime,org.hibernate,org.jboss,org.mozilla.javascript,org.python.core,org.springframework".split(",");

+        denyHashCodes = new long[]{
+                -8720046426850100497L,
+                 ......
+                8838294710098435315L
+        };

网上没找到类似的仓库,为了弄清楚每个hash到底对应的是什么,就写了个小轮子,跑一下这些case,列出来。

功能

public class Main {
    public static void main(String[] args) throws IOException {
        // 功能1:完善已知列表
        // 使用指定的class去完善
        BreakerUtils.completeDatabase(new String[]{"org.apache.ibatis.datasource.jndi.JndiDataSourceFactory"});
        // 使用指定的jar去完善
        BreakerUtils.completeDatabase(new File("C:\\Users\\leadroyal\\.gradle\\caches\\modules-2\\files-2.1\\com.alibaba\\fastjson\\1.2.24\\a2b82688715ee16d874d90229d204daf3efcac8e\\fastjson-1.2.24.jar"));
        // 使用指定的目录去完善
        BreakerUtils.completeDatabase(new File("C:\\Users\\leadroyal\\.gradle\\caches\\modules-2\\files-2.1\\"), true);


        // 功能2:输入版本号,输出已知和未知的列表
        BreakerUtils.listDatabase(1242);
        BreakerUtils.listDatabase();

        // 功能3:输入classname,输出被ban情况
        BreakerUtils.isBanned("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
    }
}

如何贡献

  • 如果您是maven/gradle用户的话,本地会缓存很多jar包,可以使用扫目录的方式把所有的代码都扫一遍,很方便,可能会扫出有用的东西

  • 直接修改src/java/com/leadroyal/breaker/data代码,并且修改readme,提交pull request就行。

目前的列表

version hash name
1.2.42 -8720046426850100497 org.apache.commons.collections4.comparators
1.2.42 -8109300701639721088 org.python.core
1.2.42 -7966123100503199569 org.apache.tomcat
1.2.42 -7766605818834748097 org.apache.xalan
1.2.42 -6835437086156813536 javax.xml
1.2.42 -4837536971810737970 org.springframework.
1.2.42 -4082057040235125754 org.apache.commons.beanutils
1.2.42 -2364987994247679115 org.apache.commons.collections.Transformer
1.2.42 -1872417015366588117 org.codehaus.groovy.runtime
1.2.42 -254670111376247151 java.lang.Thread
1.2.42 -190281065685395680 javax.net.
1.2.42 313864100207897507 com.mchange
1.2.42 1203232727967308606 org.apache.wicket.util
1.2.42 1502845958873959152 java.util.jar.
1.2.42 3547627781654598988 org.mozilla.javascript
1.2.42 3730752432285826863 java.rmi
1.2.42 3794316665763266033 java.util.prefs.
1.2.42 4147696707147271408 com.sun.
1.2.42 5347909877633654828 java.util.logging.
1.2.42 5450448828334921485 org.apache.bcel
1.2.42 5751393439502795295 java.net.Socket
1.2.42 5944107969236155580 org.apache.commons.fileupload
1.2.42 6742705432718011780 org.jboss
1.2.42 7179336928365889465 org.hibernate
1.2.42 7442624256860549330 org.apache.commons.collections.functors
1.2.42 8838294710098435315 org.apache.myfaces.context.servlet
1.2.43 -2262244760619952081 java.net.URL
1.2.46 -8165637398350707645 junit.
1.2.46 -8083514888460375884 org.apache.ibatis.datasource
1.2.46 -7921218830998286408 org.osjava.sj.
1.2.46 -7768608037458185275 org.apache.log4j.
1.2.46 -6179589609550493385 org.logicalcobwebs.
1.2.46 -5194641081268104286 org.apache.logging.
1.2.46 -3935185854875733362 org.apache.commons.dbcp
1.2.46 -2753427844400776271 com.ibatis.sqlmap.engine.datasource
1.2.46 -1589194880214235129 org.jdom.
1.2.46 1073634739308289776 org.slf4j.
1.2.46 5688200883751798389 javassist.
1.2.46 7017492163108594270 oracle.net
1.2.46 8389032537095247355 org.jaxen.
1.2.48 1459860845934817624 java.net.InetAddress
1.2.48 8409640769019589119 java.lang.Class
1.2.49 4904007817188630457 com.alibaba.fastjson.annotation
1.2.59 5100336081510080343 org.apache.cxf.jaxrs.provider.
1.2.59 6456855723474196908 ch.qos.logback.
1.2.59 8537233257283452655 net.sf.ehcache.transaction.manager.

目前未知的列表

version hash name
1.2.42 33238344207745342

感谢补充

You can’t perform that action at this time.