Skip to content

Commit 335bfef

Browse files
JoyChou93JoyChou93
committed
fix hook socket's bug
1 parent d170c8f commit 335bfef

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+747
-778
lines changed

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ Tomcat's default JSESSION session is valid for 30 minutes, so a 30-minute non-op
190190

191191
## Contributors
192192

193-
Core developers : [JoyChou](https://github.com/JoyChou93).
193+
Core developers : [JoyChou](https://github.com/JoyChou93), [liergou9981](https://github.com/liergou9981)
194194
Other developers: [lightless](https://github.com/lightless233), [Anemone95](https://github.com/Anemone95), [waderwu](https://github.com/waderwu).
195195

196196

‎src/main/java/org/joychou/config/Constants.java

+2-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22

33
public class Constants {
44

5-
private Constants(){}
5+
private Constants() {
6+
}
67

78
public static final String REMEMBER_ME_COOKIE = "rememberMe";
89
}

‎src/main/java/org/joychou/config/SafeDomainParser.java

+10-10
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@
1414

1515
public class SafeDomainParser {
1616

17-
private static Logger logger= LoggerFactory.getLogger(SafeDomainParser.class);
17+
private static Logger logger = LoggerFactory.getLogger(SafeDomainParser.class);
1818

19-
public SafeDomainParser(){
19+
public SafeDomainParser() {
2020

2121
String rootTag = "domains";
2222
String safeDomainTag = "safedomains";
@@ -38,8 +38,8 @@ public SafeDomainParser(){
3838
NodeList rootNode = doc.getElementsByTagName(rootTag); // 解析根节点domains
3939
Node domainsNode = rootNode.item(0);
4040
NodeList child = domainsNode.getChildNodes();
41-
42-
for (int i = 0; i < child.getLength(); i++){
41+
42+
for (int i = 0; i < child.getLength(); i++) {
4343
Node node = child.item(i);
4444
// 解析safeDomains节点
4545
if (node.getNodeName().equals(safeDomainTag)) {
@@ -51,7 +51,7 @@ public SafeDomainParser(){
5151
safeDomains.add(finalTagNode.getTextContent());
5252
}
5353
}
54-
}else if (node.getNodeName().equals(blockDomainTag)) {
54+
} else if (node.getNodeName().equals(blockDomainTag)) {
5555
NodeList finalTagNode = node.getChildNodes();
5656
for (int j = 0; j < finalTagNode.getLength(); j++) {
5757
Node tagNode = finalTagNode.item(j);
@@ -62,7 +62,7 @@ public SafeDomainParser(){
6262
}
6363
}
6464
}
65-
}catch (Exception e){
65+
} catch (Exception e) {
6666
logger.error(e.toString());
6767
}
6868

@@ -96,7 +96,7 @@ public SafeDomainParser(){
9696
Node domainsNode = rootNode.item(0);
9797
NodeList child = domainsNode.getChildNodes();
9898

99-
for (int i = 0; i < child.getLength(); i++){
99+
for (int i = 0; i < child.getLength(); i++) {
100100
Node node = child.item(i);
101101
// 解析safeDomains节点
102102
if (node.getNodeName().equals(ssrfSafeDomainTag)) {
@@ -107,15 +107,15 @@ public SafeDomainParser(){
107107
ssrfSafeDomains.add(tagFinalNode.getTextContent());
108108
}
109109
}
110-
}else if (node.getNodeName().equals(ssrfBlockDomainTag)) {
110+
} else if (node.getNodeName().equals(ssrfBlockDomainTag)) {
111111
NodeList tagChild = node.getChildNodes();
112112
for (int j = 0; j < tagChild.getLength(); j++) {
113113
Node tagFinalNode = tagChild.item(j);
114114
if (tagFinalNode.getNodeName().equals(ssrfFinalTag)) {
115115
ssrfBlockDomains.add(tagFinalNode.getTextContent());
116116
}
117117
}
118-
}else if(node.getNodeName().equals(ssrfBlockIpsTag)){
118+
} else if (node.getNodeName().equals(ssrfBlockIpsTag)) {
119119
NodeList tagChild = node.getChildNodes();
120120
for (int j = 0; j < tagChild.getLength(); j++) {
121121
Node tagFinalNode = tagChild.item(j);
@@ -126,7 +126,7 @@ public SafeDomainParser(){
126126
}
127127
}
128128
}
129-
}catch (Exception e){
129+
} catch (Exception e) {
130130
logger.error(e.toString());
131131
}
132132

‎src/main/java/org/joychou/config/WebConfig.java

+39-27
Original file line numberDiff line numberDiff line change
@@ -15,112 +15,124 @@
1515
public class WebConfig {
1616

1717
private static String[] callbacks;
18-
private static Boolean jsonpReferCheckEnabled = false;
18+
private static Boolean jsonpReferCheckEnabled = false;
1919
private static String[] jsonpRefererHost;
2020
private static String[] referWhitelist;
2121
private static String[] referUris;
2222
private static Boolean referSecEnabled = false;
2323
private static String businessCallback;
24-
private static ArrayList<String> safeDomains= new ArrayList<>();
25-
private static ArrayList<String> blockDomains= new ArrayList<>();
24+
private static ArrayList<String> safeDomains = new ArrayList<>();
25+
private static ArrayList<String> blockDomains = new ArrayList<>();
2626
private static ArrayList<String> ssrfSafeDomains = new ArrayList<>();
27-
private static ArrayList<String> ssrfBlockDomains= new ArrayList<>();
27+
private static ArrayList<String> ssrfBlockDomains = new ArrayList<>();
2828
private static ArrayList<String> ssrfBlockIps = new ArrayList<>();
29+
2930
/**
3031
* application.properties里object自动转jsonp的referer校验开关
32+
*
3133
* @param jsonpReferCheckEnabled jsonp校验开关
3234
*/
3335
@Value("${joychou.security.jsonp.referer.check.enabled}")
34-
public void setJsonpReferCheckEnabled(Boolean jsonpReferCheckEnabled){
36+
public void setJsonpReferCheckEnabled(Boolean jsonpReferCheckEnabled) {
3537
WebConfig.jsonpReferCheckEnabled = jsonpReferCheckEnabled;
3638
}
37-
public static Boolean getJsonpReferCheckEnabled(){
39+
40+
public static Boolean getJsonpReferCheckEnabled() {
3841
return jsonpReferCheckEnabled;
3942
}
4043

4144

4245
@Value("${joychou.security.jsonp.callback}")
43-
public void setJsonpCallbacks(String[] callbacks){
46+
public void setJsonpCallbacks(String[] callbacks) {
4447
WebConfig.callbacks = callbacks;
4548
}
46-
public static String[] getJsonpCallbacks(){
49+
50+
public static String[] getJsonpCallbacks() {
4751
return callbacks;
4852
}
4953

5054

5155
@Value("${joychou.security.referer.enabled}")
52-
public void setReferSecEnabled(Boolean referSecEnabled){
56+
public void setReferSecEnabled(Boolean referSecEnabled) {
5357
WebConfig.referSecEnabled = referSecEnabled;
5458
}
55-
public static Boolean getReferSecEnabled(){
59+
60+
public static Boolean getReferSecEnabled() {
5661
return referSecEnabled;
5762
}
5863

5964

6065
@Value("${joychou.security.referer.host}")
61-
public void setReferWhitelist(String[] referWhitelist){
66+
public void setReferWhitelist(String[] referWhitelist) {
6267
WebConfig.referWhitelist = referWhitelist;
6368
}
64-
public static String[] getReferWhitelist(){
69+
70+
public static String[] getReferWhitelist() {
6571
return referWhitelist;
6672
}
6773

6874

6975
@Value("${joychou.security.referer.uri}")
70-
public void setReferUris(String[] referUris)
71-
{
76+
public void setReferUris(String[] referUris) {
7277
WebConfig.referUris = referUris;
7378
}
74-
public static String[] getReferUris(){
79+
80+
public static String[] getReferUris() {
7581
return referUris;
7682
}
7783

7884

7985
@Value("${joychou.business.callback}")
80-
public void setBusinessCallback(String businessCallback){
86+
public void setBusinessCallback(String businessCallback) {
8187
WebConfig.businessCallback = businessCallback;
8288
}
83-
public static String getBusinessCallback(){
89+
90+
public static String getBusinessCallback() {
8491
return businessCallback;
8592
}
8693

8794

88-
void setSafeDomains(ArrayList<String> safeDomains){
95+
void setSafeDomains(ArrayList<String> safeDomains) {
8996
WebConfig.safeDomains = safeDomains;
9097
}
91-
public static ArrayList<String> getSafeDomains(){
98+
99+
public static ArrayList<String> getSafeDomains() {
92100
return safeDomains;
93101
}
94102

95103

96-
void setBlockDomains(ArrayList<String> blockDomains){
104+
void setBlockDomains(ArrayList<String> blockDomains) {
97105
WebConfig.blockDomains = blockDomains;
98106
}
99-
public static ArrayList<String> getBlockDomains(){
107+
108+
public static ArrayList<String> getBlockDomains() {
100109
return blockDomains;
101110
}
102111

103112

104-
void setSsrfSafeDomains(ArrayList<String> ssrfSafeDomains){
113+
void setSsrfSafeDomains(ArrayList<String> ssrfSafeDomains) {
105114
WebConfig.ssrfSafeDomains = ssrfSafeDomains;
106115
}
107-
public static ArrayList<String> getSsrfSafeDomains(){
116+
117+
public static ArrayList<String> getSsrfSafeDomains() {
108118
return ssrfSafeDomains;
109119
}
110120

111121

112-
void setSsrfBlockDomains(ArrayList<String> ssrfBlockDomains){
122+
void setSsrfBlockDomains(ArrayList<String> ssrfBlockDomains) {
113123
WebConfig.ssrfBlockDomains = ssrfBlockDomains;
114124
}
115-
public static ArrayList<String> getSsrfBlockDomainsDomains(){
125+
126+
public static ArrayList<String> getSsrfBlockDomainsDomains() {
116127
return ssrfBlockDomains;
117128
}
118129

119130

120-
void setSsrfBlockIps(ArrayList<String> ssrfBlockIps){
131+
void setSsrfBlockIps(ArrayList<String> ssrfBlockIps) {
121132
WebConfig.ssrfBlockIps = ssrfBlockIps;
122133
}
123-
public static ArrayList<String> getSsrfBlockIps(){
134+
135+
public static ArrayList<String> getSsrfBlockIps() {
124136
return ssrfBlockIps;
125137
}
126138
}

‎src/main/java/org/joychou/controller/CRLFInjection.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
/**
1212
* Java 1.7/1.8 no CRLF vulns (test in Java 1.7/1.8)
1313
*
14-
* @author JoyChou ([email protected]) @2018-01-03
14+
* @author JoyChou ([email protected]) @2018-01-03
1515
*/
1616
@Controller
1717
@RequestMapping("/crlf")

‎src/main/java/org/joychou/controller/CSRF.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* check csrf using spring-security
1111
* Access http://localhost:8080/csrf/ -> click submit
1212
*
13-
* @author JoyChou ([email protected]) @2019-05-31
13+
* @author JoyChou ([email protected]) @2019-05-31
1414
*/
1515
@Controller
1616
@RequestMapping("/csrf")

‎src/main/java/org/joychou/controller/CommandInject.java

-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ public String codeInject(String filepath) throws IOException {
3535
* Host Injection
3636
* Host: hacked by joychou;cat /etc/passwd
3737
* http://localhost:8080/codeinject/host
38-
*
3938
*/
4039
@GetMapping("/codeinject/host")
4140
public String codeInjectHost(HttpServletRequest request) throws IOException {

‎src/main/java/org/joychou/controller/Cookies.java

+4-3
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@
55

66
import javax.servlet.http.Cookie;
77
import javax.servlet.http.HttpServletRequest;
8+
89
import org.joychou.util.WebUtils;
910
import org.springframework.web.bind.annotation.RestController;
11+
1012
import static org.springframework.web.util.WebUtils.getCookie;
1113

1214
@RestController
@@ -43,7 +45,7 @@ public String vuln03(HttpServletRequest req) {
4345
for (Cookie cookie : cookies) {
4446
// key code. Equals can also be equalsIgnoreCase.
4547
if (NICK.equals(cookie.getName())) {
46-
nick = cookie.getValue();
48+
nick = cookie.getValue();
4749
}
4850
}
4951
}
@@ -58,15 +60,14 @@ public String vuln04(HttpServletRequest req) {
5860
if (cookies != null) {
5961
for (Cookie cookie : cookies) {
6062
if (cookie.getName().equalsIgnoreCase(NICK)) { // key code
61-
nick = cookie.getValue();
63+
nick = cookie.getValue();
6264
}
6365
}
6466
}
6567
return "Cookie nick: " + nick;
6668
}
6769

6870

69-
7071
@RequestMapping(value = "/vuln05")
7172
public String vuln05(@CookieValue("nick") String nick) {
7273
return "Cookie nick: " + nick;

‎src/main/java/org/joychou/controller/Cors.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
import javax.servlet.http.HttpServletResponse;
1212

1313
/**
14-
* @author JoyChou ([email protected]) @2018.10.24
14+
* @author JoyChou ([email protected]) @2018.10.24
1515
* https://github.com/JoyChou93/java-sec-code/wiki/CORS
1616
*/
1717

@@ -106,7 +106,7 @@ public String seccode(HttpServletRequest request, HttpServletResponse response)
106106

107107
// 如果origin不为空并且origin不在白名单内，认定为不安全。
108108
// 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求。
109-
if ( origin != null && SecurityUtil.checkURL(origin) == null ) {
109+
if (origin != null && SecurityUtil.checkURL(origin) == null) {
110110
return "Origin is not safe.";
111111
}
112112
response.setHeader("Access-Control-Allow-Origin", origin);

‎src/main/java/org/joychou/controller/Deserialize.java

+5-5
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ public class Deserialize {
3131
/**
3232
* java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64
3333
* Add the result to rememberMe cookie.
34-
*
34+
* <p>
3535
* http://localhost:8080/deserialize/rememberMe/vuln
3636
*/
3737
@RequestMapping("/rememberMe/vuln")
@@ -40,7 +40,7 @@ public String rememberMeVul(HttpServletRequest request)
4040

4141
Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
4242

43-
if (null == cookie){
43+
if (null == cookie) {
4444
return "No rememberMe cookie. Right?";
4545
}
4646

@@ -57,7 +57,7 @@ public String rememberMeVul(HttpServletRequest request)
5757

5858
/**
5959
* Check deserialize class using black list.
60-
*
60+
* <p>
6161
* http://localhost:8080/deserialize/rememberMe/security
6262
*/
6363
@RequestMapping("/rememberMe/security")
@@ -66,15 +66,15 @@ public String rememberMeBlackClassCheck(HttpServletRequest request)
6666

6767
Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
6868

69-
if (null == cookie){
69+
if (null == cookie) {
7070
return "No rememberMe cookie. Right?";
7171
}
7272
String rememberMe = cookie.getValue();
7373
byte[] decoded = Base64.getDecoder().decode(rememberMe);
7474

7575
ByteArrayInputStream bytes = new ByteArrayInputStream(decoded);
7676

77-
try{
77+
try {
7878
AntObjectInputStream in = new AntObjectInputStream(bytes); // throw InvalidClassException
7979
in.readObject();
8080
in.close();

0 commit comments

Comments
 (0)