Shulou(Shulou.com)06/01 Report--

A command execution vulnerability exists when Java calls XMLDecoder to parse the XML file.

The sample XML file is as follows:

Calc

The corresponding Java code is as follows:

Package xmldecoder;import java.io.BufferedInputStream; import java.io.FileInputStream;import java.io.FileNotFoundException;import java.io.IOException; import java.util.ArrayList; import java.util.List; public class XmlDecoderTest {public static void main (String [] args) {/ / TODO Auto-generated method stub java.io.File file = new java.io.File ("d:/tmp/xmldecoder.xml") Java.beans.XMLDecoder xd = null; try {xd = new java.beans.XMLDecoder (new BufferedInputStream (new FileInputStream (file));} catch (FileNotFoundException e) {/ / TODO Auto-generated catch block e.printStackTrace () } Object S2 = xd.readObject (); xd.close ();}}

The execution effect is as follows:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.