java危险函数

https://www.ctolib.com/Cryin-JavaID.html

XXE:
   "SAXReader",
   "DocumentBuilder",
   "XMLStreamReader",
   "SAXBuilder",
   "SAXParser",
   "XMLReader",
   "SAXSource",
   "TransformerFactory",
   "SAXTransformerFactory",
   "SchemaFactory",
   "Unmarshaller",
   "XPathExpression"

JavaObjectDeserialization:
   "readObject",
   "readUnshared",
   "Yaml.load",
   "fromXML",
   "ObjectMapper.readValue",
   "JSON.parseObject"
SSRF:
   "HttpClient",
   "URL",
   "ImageIO",
   "HttpURLConnection",
   "OkHttpClient" 
FILE:
   "MultipartFile",
   "createNewFile",
   "FileInputStream"
Autobinding:
   "@SessionAttributes",
   "@ModelAttribute"
URL-Redirect:
   "sendRedirect",
   "forward",
   "setHeader"
EXEC:
   "getRuntime.exec",
   "ProcessBuilder.start",
   "GroovyShell.evaluate"

可以通过这个脚本来搜索：https://github.com/Cryin/JavaID/blob/master/javaid.py