//CommandController:
@RequestMapping({"/cnss"})
@Controller
/* loaded from: summer-0.0.1.jar:BOOT-INF/classes/com/cnss/summer/controller/CommandController.class */
public class CommandController {
    private static final Logger log = LoggerFactory.getLogger(CommandController.class);
    @Autowired
    private CommandFilterConfig config;

    @RequestMapping({"/doCmd"})//访问 /cnss/doCmd
    @ResponseBody
    public void doCmd(@RequestParam String cmd, HttpServletRequest request) throws IOException {
        if (cmd != null) {
            for (String str : this.config.getBlacklist()) {
                if (cmd.contains(str)) {//config的黑名单限制，也就是application.properties的限制
                    return;
                }
            }
            log.info("cmd: {}", cmd);
            try {
                new ProcessBuilder("/bin/sh", "-c", cmd).start().waitFor();//命令执行
            } catch (InterruptedException e) {
                e.printStackTrace();
            }
        }
    }
}
//此处@RequestParam String cmd的意思就是通过get方式传入参数cmd
//而另外一个与其相似的@RequestBody 是通过POST方式传入参数

//HelloController
package com.cnss.summer.controller;

import com.cnss.summer.entity.LoginParam;
import com.cnss.summer.entity.ParseParam;
import com.cnss.summer.entity.ResponseEntity;
import java.io.StringReader;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.Objects;
import java.util.UUID;
import javax.servlet.http.HttpServletRequest;
import javax.validation.Valid;
import javax.validation.constraints.NotEmpty;
import javax.validation.constraints.NotNull;
import org.dom4j.p006io.SAXReader;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.util.DigestUtils;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

@RequestMapping({"/cnss/summer"})
@RestController
/* loaded from: summer-0.0.1.jar:BOOT-INF/classes/com/cnss/summer/controller/HelloController.class */
public class HelloController {
    private static final Logger log = LoggerFactory.getLogger(HelloController.class);

    @RequestMapping({"/login"})
    public ResponseEntity login(@NotNull @Valid @RequestBody LoginParam credentials, HttpServletRequest request) {
        String uuid = UUID.randomUUID().toString();
        log.info("uuid: {}", uuid);
        String uuid2 = DigestUtils.md5DigestAsHex(uuid.getBytes(StandardCharsets.UTF_8));
        request.getSession().setAttribute("username", credentials.getUsername());
        request.getSession().setAttribute("token", uuid2);
        request.getSession().setAttribute("timestamp", Long.valueOf(System.currentTimeMillis()));
        HashMap<String, String> map = new HashMap<>();
        map.put("token", uuid2);
        return new ResponseEntity("200", "Login success!", map);
    }

    @RequestMapping({"/parse"})
    public ResponseEntity parse(@NotNull @RequestBody ParseParam payload, @RequestParam("nammmmme") @NotEmpty @Valid String username, HttpServletRequest request) throws Exception {
        String username1 = (String) request.getSession().getAttribute("username");
        if (!Objects.equals(username, username1) || !Objects.equals(payload.getUsername(), username1)) {
            throw new Exception();
        }
        return new ResponseEntity("200", "Parse success!", new SAXReader().read(new StringReader(payload.getXml())).getRootElement().getText());
    }
}

public class LoginParam {
    @JsonProperty("us3rname")
    @NotEmpty
    private String username;
    @JsonProperty("p@ssword")
    @NotEmpty
    private String password;

    public LoginParam(String username, String password) {
        this.username = username;
        this.password = password;
    }

    public LoginParam() {
    }

    @JsonProperty("us3rname")
    public void setUsername(String username) {
        this.username = username;
    }

    @JsonProperty("p@ssword")
    public void setPassword(String password) {
        this.password = password;
    }
...
}

private String username;
    @NotEmpty
    private String xml;

    public ParseParam(String username, String xml) {
        this.username = username;
        this.xml = xml;
    }

//CommandFilterConfig:
public class CommandFilterConfig {
    @Value("${config.command.allow}")
    private String allow;
    @Value("${config.command.blacklist}")
    private List<String> blacklist;

    public void setAllow(String allow) {
        this.allow = allow;
    }

    public void setBlacklist(List<String> blacklist) {
        this.blacklist = blacklist;
    }

    public boolean equals(Object o) {
        if (o == this) {
            return true;
        }
        if (!(o instanceof CommandFilterConfig)) {
            return false;
        }
        CommandFilterConfig other = (CommandFilterConfig) o;
        if (!other.canEqual(this)) {
            return false;
        }
        Object this$allow = getAllow();
        Object other$allow = other.getAllow();
        if (this$allow == null) {
            if (other$allow != null) {
                return false;
            }
        } else if (!this$allow.equals(other$allow)) {
            return false;
        }
        Object this$blacklist = getBlacklist();
        Object other$blacklist = other.getBlacklist();
        return this$blacklist == null ? other$blacklist == null : this$blacklist.equals(other$blacklist);
    }

    protected boolean canEqual(Object other) {
        return other instanceof CommandFilterConfig;
    }

    public int hashCode() {
        Object $allow = getAllow();
        int result = (1 * 59) + ($allow == null ? 43 : $allow.hashCode());
        Object $blacklist = getBlacklist();
        return (result * 59) + ($blacklist == null ? 43 : $blacklist.hashCode());
    }

    public String toString() {
        return "CommandFilterConfig(allow=" + getAllow() + ", blacklist=" + getBlacklist() + ")";
    }

    public String getAllow() {
        return this.allow;
    }

    public List<String> getBlacklist() {
        return this.blacklist;
    }
}

//ParseFilterConfig
public class ParseFilterConfig {
    @Value("${config.method}")
    private String method;
    @Value("${config.auth.len}")
    private int authLen;
    @Value("${config.auth.expire}")
    private long expire;//获取请求方式method、len、expire

    public void setMethod(String method) {
        this.method = method;
    }

    public void setAuthLen(int authLen) {
        this.authLen = authLen;
    }

    public void setExpire(long expire) {
        this.expire = expire;
    }

    public boolean equals(Object o) {
        if (o == this) {
            return true;
        }
        if (!(o instanceof ParseFilterConfig)) {
            return false;
        }
        ParseFilterConfig other = (ParseFilterConfig) o;
        if (!other.canEqual(this) || getAuthLen() != other.getAuthLen() || getExpire() != other.getExpire()) {
            return false;
        }
        Object this$method = getMethod();
        Object other$method = other.getMethod();
        return this$method == null ? other$method == null : this$method.equals(other$method);
    }

    protected boolean canEqual(Object other) {
        return other instanceof ParseFilterConfig;
    }

    public int hashCode() {
        int result = (1 * 59) + getAuthLen();
        long $expire = getExpire();
        int result2 = (result * 59) + ((int) (($expire >>> 32) ^ $expire));
        Object $method = getMethod();
        return (result2 * 59) + ($method == null ? 43 : $method.hashCode());
    }

    public String toString() {
        return "ParseFilterConfig(method=" + getMethod() + ", authLen=" + getAuthLen() + ", expire=" + getExpire() + ")";
    }

    public String getMethod() {
        return this.method;
    }

    public int getAuthLen() {
        return this.authLen;
    }

    public long getExpire() {
        return this.expire;
    }
}

//commandFilter
package com.cnss.summer.filter;

import com.cnss.summer.config.CommandFilterConfig;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;

@WebFilter(filterName = "commandFilter", urlPatterns = {"/cnss/doCmd"})
/* loaded from: summer-0.0.1.jar:BOOT-INF/classes/com/cnss/summer/filter/CommandFilter.class */
public class CommandFilter implements Filter {
    private static final Logger log = LoggerFactory.getLogger(CommandFilter.class);
    @Autowired
    private CommandFilterConfig config;

    @Override // javax.servlet.Filter
    public void init(FilterConfig filterConfig) throws ServletException {
        super.init(filterConfig);
    }

    @Override // javax.servlet.Filter
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        if (((HttpServletRequest) servletRequest).getRemoteAddr().equals(this.config.getAllow())) {//访问地址
            filterChain.doFilter(servletRequest, servletResponse);
        }
    }

    @Override // javax.servlet.Filter
    public void destroy() {
        super.destroy();
    }
}

//ParseFilter，重要的放在这里
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        String token;
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        if (Objects.equals(request.getMethod(), this.config.getMethod()) && (token = (String) request.getSession().getAttribute("token")) != null) {
            long timestamp = ((Long) request.getSession().getAttribute("timestamp")).longValue();
            long now = System.currentTimeMillis();
            if (now - timestamp <= this.config.getExpire()) {
                if (!Objects.equals(token.substring(0, this.config.getAuthLen()), DigestUtils.md5DigestAsHex(request.getHeader("UUID").getBytes(StandardCharsets.UTF_8)).substring(0, this.config.getAuthLen()))) {
                    request.getSession().invalidate();
                    return;
                }
                request.getSession().setAttribute("timestamp", Long.valueOf(now));
                filterChain.doFilter(servletRequest, servletResponse);
            }
        }
    }

server:
  address: 0.0.0.0
  port: 5000
spring:
  application:
    name: cnss-summer
config:
  method: SUMMMMMER
  auth:
    len: 4
    expire: 5000
  command:
    allow: 127.0.0.1
    blacklist: rm, cat, tac, mv, touch, mkdir, rmdir, whoami, ls

headers = {
        'UUID': str(myuuid),
        'Content-Type': 'application/json',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36'
    }
    request = Request('SUMMMMMER', parseurl, data=json.dumps(data), headers=headers)
    prep = s.prepare_request(request)
    x = s.send(prep)
    print(x.json())