| 915 | // } |
| 916 | |
| 917 | function validate_stack_java(stacks) { |
| 918 | var known = { |
| 919 | 'com.thoughtworks.xstream.XStream.unmarshal': "Using xstream library", |
| 920 | 'java.beans.XMLDecoder.readObject': "Using WebLogic XMLDecoder library", |
| 921 | 'org.apache.commons.collections4.functors.InvokerTransformer.transform': "Using Transformer library (v4)", |
| 922 | 'org.apache.commons.collections.functors.InvokerTransformer.transform': "Using Transformer library", |
| 923 | 'org.apache.commons.collections.functors.ChainedTransformer.transform': "Using Transformer library", |
| 924 | 'org.jolokia.jsr160.Jsr160RequestDispatcher.dispatchRequest': "Using JNDI library (JSR 160)", |
| 925 | 'com.sun.jndi.rmi.registry.RegistryContext.lookup': "Using JNDI registry service", |
| 926 | 'org.apache.xbean.propertyeditor.JndiConverter': "Using JNDI binding class", |
| 927 | 'com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig': "Using JTA transaction manager", |
| 928 | 'com.sun.jndi.url.ldap.ldapURLContext.lookup': "Using LDAP factory service", |
| 929 | 'com.alibaba.fastjson.JSON.parse': "Using fastjson library", |
| 930 | 'com.alibaba.fastjson.JSON.parseObject': "Using fastjson library", |
| 931 | 'com.alibaba.fastjson.JSON.parseArray': "Using fastjson library", |
| 932 | 'org.springframework.expression.spel.support.ReflectiveMethodExecutor.execute': "Using SpEL expressions", |
| 933 | 'freemarker.template.utility.Execute.exec': "Using FreeMarker template", |
| 934 | 'org.jboss.el.util.ReflectionUtil.invokeMethod': "Using JBoss EL method", |
| 935 | 'org.codehaus.groovy.runtime.ProcessGroovyMethods.execute': "Using Groovy library", |
| 936 | 'bsh.Reflect.invokeMethod': "Using BeanShell library", |
| 937 | 'jdk.scripting.nashorn/jdk.nashorn.internal.runtime.ScriptFunction.invoke': "Using Nashorn engine", |
| 938 | 'org.apache.shiro.io.DefaultSerializer.deserialize': "Using Shiro framework (DefaultSerializer)", |
| 939 | 'com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase.readObject': "Using C3p0 library" |
| 940 | } |
| 941 | |
| 942 | var userCode = false, reachedInvoke = false, i = 0, message = undefined |
| 943 | |
| 944 | // v1.1.1 要求在堆栈里过滤 com.baidu.openrasp 相关的类，因为没有实现正确而产生了多余的反射堆栈，这里需要兼容下防止误报 |
| 945 | // v1.1.2 修复了这个问题，即堆栈顶部为命令执行的方法 |
| 946 | if (stacks.length > 3 |
| 947 | && stacks[0].startsWith('sun.reflect.GeneratedMethodAccessor') |
| 948 | && stacks[1] == 'sun.reflect.GeneratedMethodAccessorImpl.invoke' |
| 949 | && stacks[2] == 'java.lang.reflect.Method.invoke') |
| 950 | { |
| 951 | i = 3 |
| 952 | } |
| 953 | |
| 954 | for (; i < stacks.length; i ++) { |
| 955 | var method = stacks[i] |
| 956 | |
| 957 | // 检查反射调用 -> 命令执行之间，是否包含用户代码 |
| 958 | if (! reachedInvoke) { |
| 959 | if (method == 'java.lang.reflect.Method.invoke') { |
| 960 | reachedInvoke = true |
| 961 | } |
| 962 | |
| 963 | // 用户代码，即非 JDK、com.baidu.openrasp 相关的函数 |
| 964 | if (! method.startsWith('java.') |
| 965 | && !method.startsWith('sun.') |
| 966 | && !method.startsWith('com.sun.') |
| 967 | && !method.startsWith('com.baidu.openrasp.')) |
| 968 | { |
| 969 | userCode = true |
| 970 | } |
| 971 | } |
| 972 | |
| 973 | if (method.startsWith('ysoserial.Pwner')) { |
| 974 | message = "Using YsoSerial tool" |