主要维护的开源项目:
- 一个强大的
Jar
包分析工具:jar-analyzer
JavaWeb漏洞审计工具,构建方法调用链并模拟栈帧进行分析
License: MIT License
主要维护的开源项目:
Jar
包分析工具:jar-analyzerjava.lang.IndexOutOfBoundsException: Index: 0, Size: 0 at java.util.ArrayList.rangeCheck(ArrayList.java:659) at java.util.ArrayList.get(ArrayList.java:435) at code.inspector.core.spring.asm.SpringAnnoAdapter.visit(SpringAnnoAdapter.java:22) at org.objectweb.asm.ClassReader.readElementValue(ClassReader.java:3070) at org.objectweb.asm.ClassReader.readElementValues(ClassReader.java:2993) at org.objectweb.asm.ClassReader.readParameterAnnotations(ClassReader.java:2956) at org.objectweb.asm.ClassReader.readMethod(ClassReader.java:1489) at org.objectweb.asm.ClassReader.accept(ClassReader.java:744) at org.objectweb.asm.ClassReader.accept(ClassReader.java:424) at code.inspector.core.service.system.SpringService.start(SpringService.java:22) at code.inspector.core.Application.parseSpring(Application.java:261) at code.inspector.core.Application.start(Application.java:113) at code.inspector.form.CodeInspector.lambda$null$7(CodeInspector.java:212) at java.lang.Thread.run(Thread.java:748)
目前需要一个包名,应该做成可以自动获取,至少应该有一个输入
现在复杂的业务很多时候不是一条链完成下来的,从controller入口到触发点只是部分漏洞,更多的时候输出和触发不是在同一条链上的。例如在这里进行配置输出,在另外的地方进行触发,就会因为没有输入点而被忽略。
参考README
最简单的加强方式是:new yaml构造方法的desc必须为空参,这样就不会有SafeConstructor误报
以前处理分支的代码应该是有问题的,需要重写
现在的情况下是 a->b->c 中
如果b包含拼接字符串,在c中有危险操作,是无法传递到c到
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.