| 16 | import sun.misc.Unsafe; |
| 17 | |
| 18 | public class ExploitGenerator extends Generator<Object> { |
| 19 | |
| 20 | private static final GeometricDistribution geom = new GeometricDistribution(); |
| 21 | private static final double MEAN_ARRAY_DEPTH = 1.2; |
| 22 | private final List<Object> dictionary = new ArrayList<>(); |
| 23 | |
| 24 | private final String[] memberDictionary = { |
| 25 | "foo", |
| 26 | "key" |
| 27 | }; |
| 28 | |
| 29 | public ExploitGenerator () { |
| 30 | super(Object.class); |
| 31 | } |
| 32 | |
| 33 | public void configure(Dictionary dict) throws IOException { |
| 34 | |
| 35 | HashSet hashSet = new HashSet(1); |
| 36 | hashSet.add("key"); |
| 37 | |
| 38 | // Read dictionary words |
| 39 | try (InputStream in = ClassLoader.getSystemClassLoader().getResourceAsStream(dict.value())) { |
| 40 | if (in == null) { |
| 41 | throw new FileNotFoundException("Dictionary file not found: " + dict); |
| 42 | } |
| 43 | |
| 44 | BufferedReader br = new BufferedReader(new InputStreamReader(in)); |
| 45 | String item; |
| 46 | while ((item = br.readLine()) != null) { |
| 47 | if (item.equals("java.util.HashSet")) { |
| 48 | dictionary.add(hashSet); |
| 49 | } |
| 50 | else if (item.equals("java.util.HashMap")) { |
| 51 | Field field = hashSet.getClass().getDeclaredField("map"); |
| 52 | field.setAccessible(true); |
| 53 | HashMap hashset_map = (HashMap)field.get(hashSet); |
| 54 | dictionary.add(hashset_map); |
| 55 | } else { |
| 56 | dictionary.add(objectInit(item)); |
| 57 | } |
| 58 | } |
| 59 | } catch (Exception e) { |
| 60 | e.printStackTrace(); |
| 61 | } |
| 62 | } |
| 63 | |
| 64 | public static Object objectInit (String classname) throws Exception { |
| 65 | Class<?> target_classname = Class.forName(classname); |
| 66 | Field f = Unsafe.class.getDeclaredField("theUnsafe"); |
| 67 | f.setAccessible(true); |
| 68 | Unsafe unsafe = (Unsafe) f.get(null); |
| 69 | return unsafe.allocateInstance(target_classname); |
| 70 | } |
| 71 | |
| 72 | |
| 73 | @Override |
| 74 | public Object generate(SourceOfRandomness random, GenerationStatus status) { |
| 75 | HashMap hashMap = new HashMap<>(); |
nothing calls this directly
no outgoing calls
no test coverage detected