n2ryx's Blog|

private void readObject(ObjectInputStream s)
    throws IOException, ClassNotFoundException {

    ObjectInputStream.GetField fields = s.readFields();

    // Read loadFactor (ignore threshold)
    float lf = fields.get("loadFactor", 0.75f);
    if (lf <= 0 || Float.isNaN(lf))
        throw new InvalidObjectException("Illegal load factor: " + lf);

    lf = Math.min(Math.max(0.25f, lf), 4.0f);
    HashMap.UnsafeHolder.putLoadFactor(this, lf);

    reinitialize();

    s.readInt();                // Read and ignore number of buckets
    int mappings = s.readInt(); // Read number of mappings (size)
    if (mappings < 0) {
        throw new InvalidObjectException("Illegal mappings count: " + mappings);
    } else if (mappings == 0) {
        // use defaults
    } else if (mappings > 0) {
        float fc = (float)mappings / lf + 1.0f;
        int cap = ((fc < DEFAULT_INITIAL_CAPACITY) ?
                   DEFAULT_INITIAL_CAPACITY :
                   (fc >= MAXIMUM_CAPACITY) ?
                   MAXIMUM_CAPACITY :
                   tableSizeFor((int)fc));
        float ft = (float)cap * lf;
        threshold = ((cap < MAXIMUM_CAPACITY && ft < MAXIMUM_CAPACITY) ?
                     (int)ft : Integer.MAX_VALUE);

        // Check Map.Entry[].class since it's the nearest public type to
        // what we're actually creating.
        SharedSecrets.getJavaObjectInputStreamAccess().checkArray(s, Map.Entry[].class, cap);
        @SuppressWarnings({"rawtypes","unchecked"})
        Node<K,V>[] tab = (Node<K,V>[])new Node[cap];
        table = tab;

        // Read the keys and values, and put the mappings in the HashMap
        for (int i = 0; i < mappings; i++) {
            @SuppressWarnings("unchecked")
            K key = (K) s.readObject();
            @SuppressWarnings("unchecked")
            V value = (V) s.readObject();
            putVal(hash(key), key, value, false, false);
        }
    }
}

putVal(hash(key), key, value, false, false);

// InsecureDeserializationTask
package org.owasp.webgoat.deserialization;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InvalidClassException;
import java.io.ObjectInputStream;
import java.util.Base64;
import org.dummy.insecure.framework.VulnerableTaskHolder;
import org.owasp.webgoat.assignments.AssignmentEndpoint;
import org.owasp.webgoat.assignments.AssignmentHints;
import org.owasp.webgoat.assignments.AttackResult;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;

@RestController
@AssignmentHints({"insecure-deserialization.hints.1", "insecure-deserialization.hints.2", "insecure-deserialization.hints.3"})
public class InsecureDeserializationTask extends AssignmentEndpoint {
    public InsecureDeserializationTask() {
    }

    @PostMapping({"/InsecureDeserialization/task"})
    @ResponseBody
    public AttackResult completed(@RequestParam String token) throws IOException {
        String b64token = token.replace('-', '+').replace('_', '/');

        long before;
        long after;
        try {
            label71: {
                // base64解码，通过字节流反序列化对象
                ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(b64token)));

                AttackResult var10;
                label64: {
                    label63: {
                        try {
                            before = System.currentTimeMillis();
                            Object o = ois.readObject();
                            // 类必须是VulnerableTaskHolder
                            if (!(o instanceof VulnerableTaskHolder)) {
                                if (o instanceof String) {
                                    var10 = this.failed(this).feedback("insecure-deserialization.stringobject").build();
                                    break label64;
                                }

                                var10 = this.failed(this).feedback("insecure-deserialization.wrongobject").build();
                                break label63;
                            }

                            after = System.currentTimeMillis();
                        } catch (Throwable var12) {
                            try {
                                ois.close();
                            } catch (Throwable var11) {
                                var12.addSuppressed(var11);
                            }

                            throw var12;
                        }

                        ois.close();
                        break label71;
                    }

                    ois.close();
                    return var10;
                }

                ois.close();
                return var10;
            }
        } catch (InvalidClassException var13) {
            return this.failed(this).feedback("insecure-deserialization.invalidversion").build();
        } catch (IllegalArgumentException var14) {
            return this.failed(this).feedback("insecure-deserialization.expired").build();
        } catch (Exception var15) {
            return this.failed(this).feedback("insecure-deserialization.invalidversion").build();
        }

        int delay = (int)(after - before);
        if (delay > 7000) {
            return this.failed(this).build();
        } else {
            return delay < 3000 ? this.failed(this).build() : this.success(this).build();
        }
    }
}