/* * Decompiled with CFR 0.152. * * Could not load the following classes: * com.l7tech.common.io.XmlUtil * com.l7tech.common.mime.ContentTypeHeader * com.l7tech.common.mime.NoSuchPartException * com.l7tech.common.mime.PartInfo * com.l7tech.common.mime.PartIterator * com.l7tech.gateway.common.audit.AssertionMessages * com.l7tech.gateway.common.audit.AuditDetailMessage * com.l7tech.json.InvalidJsonException * com.l7tech.json.JSONData * com.l7tech.message.HttpServletRequestKnob * com.l7tech.message.JsonKnob * com.l7tech.message.Message * com.l7tech.message.MimeKnob * com.l7tech.message.XmlKnob * com.l7tech.policy.assertion.AssertionStatus * com.l7tech.policy.assertion.CodeInjectionProtectionAssertion * com.l7tech.policy.assertion.CodeInjectionProtectionType * com.l7tech.policy.assertion.PolicyAssertionException * com.l7tech.util.ExceptionUtils * com.l7tech.util.IOUtils * com.l7tech.util.TextUtils * org.apache.commons.codec.DecoderException * org.apache.commons.codec.binary.Hex * org.apache.commons.lang3.StringUtils */ package com.l7tech.server.policy.assertion; import com.l7tech.common.io.XmlUtil; import com.l7tech.common.mime.ContentTypeHeader; import com.l7tech.common.mime.NoSuchPartException; import com.l7tech.common.mime.PartInfo; import com.l7tech.common.mime.PartIterator; import com.l7tech.gateway.common.audit.AssertionMessages; import com.l7tech.gateway.common.audit.AuditDetailMessage; import com.l7tech.json.InvalidJsonException; import com.l7tech.json.JSONData; import com.l7tech.message.HttpServletRequestKnob; import com.l7tech.message.JsonKnob; import com.l7tech.message.Message; import com.l7tech.message.MimeKnob; import com.l7tech.message.XmlKnob; import com.l7tech.policy.assertion.AssertionStatus; import com.l7tech.policy.assertion.CodeInjectionProtectionAssertion; import com.l7tech.policy.assertion.CodeInjectionProtectionType; import com.l7tech.policy.assertion.PolicyAssertionException; import com.l7tech.server.message.AuthenticationContext; import com.l7tech.server.message.PolicyEnforcementContext; import com.l7tech.server.policy.assertion.ServerInjectionThreatProtectionAssertion; import com.l7tech.util.ExceptionUtils; import com.l7tech.util.IOUtils; import com.l7tech.util.TextUtils; import java.io.IOException; import java.io.InputStream; import java.nio.charset.Charset; import java.util.ArrayList; import java.util.List; import java.util.Map; import java.util.logging.Level; import java.util.logging.Logger; import java.util.regex.Matcher; import java.util.regex.Pattern; import org.apache.commons.codec.DecoderException; import org.apache.commons.codec.binary.Hex; import org.apache.commons.lang3.StringUtils; import org.w3c.dom.Attr; import org.w3c.dom.Document; import org.w3c.dom.Element; import org.w3c.dom.NamedNodeMap; import org.w3c.dom.Node; import org.xml.sax.SAXException; public class ServerCodeInjectionProtectionAssertion extends ServerInjectionThreatProtectionAssertion { private static final int d = 16; private static final int e = 24; private static final Logger f; private static final String[] h; public ServerCodeInjectionProtectionAssertion(CodeInjectionProtectionAssertion codeInjectionProtectionAssertion) { super(codeInjectionProtectionAssertion); } @Override protected AssertionStatus doCheckRequest(PolicyEnforcementContext policyEnforcementContext, Message message, String string, AuthenticationContext authenticationContext) throws IOException, PolicyAssertionException { return this.applyThreatProtection(policyEnforcementContext, message, string); } @Override protected AssertionStatus scanBody(Message message, String string) throws IOException { ContentTypeHeader contentTypeHeader; block18: { long l2; try { l2 = message.getMimeKnob().getFirstPart().getActualContentLength(); } catch (NoSuchPartException noSuchPartException) { this.logAndAudit((AuditDetailMessage)AssertionMessages.NO_SUCH_PART, new String[]{((CodeInjectionProtectionAssertion)this.assertion).getTargetName(), "1"}, ExceptionUtils.getDebugException((Throwable)noSuchPartException)); return AssertionStatus.FAILED; } try { if (0L == l2) { return AssertionStatus.NONE; } } catch (NoSuchPartException noSuchPartException) { throw ServerCodeInjectionProtectionAssertion.a((Exception)((Object)noSuchPartException)); } contentTypeHeader = message.getMimeKnob().getOuterContentType(); try { try { if (!this.isRequest() || !contentTypeHeader.matches(h[17], h[8])) break block18; } catch (NoSuchPartException noSuchPartException) { throw ServerCodeInjectionProtectionAssertion.a((Exception)((Object)noSuchPartException)); } return this.a(message); } catch (NoSuchPartException noSuchPartException) { throw ServerCodeInjectionProtectionAssertion.a((Exception)((Object)noSuchPartException)); } } try { if (contentTypeHeader.matches(h[13], h[22])) { return this.a(message, string); } } catch (NoSuchPartException noSuchPartException) { throw ServerCodeInjectionProtectionAssertion.a((Exception)((Object)noSuchPartException)); } try { if (message.isXml()) { return this.c(message, string); } } catch (NoSuchPartException noSuchPartException) { throw ServerCodeInjectionProtectionAssertion.a((Exception)((Object)noSuchPartException)); } try { if (message.isJson()) { return this.b(message, string); } } catch (NoSuchPartException noSuchPartException) { throw ServerCodeInjectionProtectionAssertion.a((Exception)((Object)noSuchPartException)); } return this.a(message, string, contentTypeHeader.getEncoding()); } private AssertionStatus a(Message message) throws IOException { Map map; HttpServletRequestKnob httpServletRequestKnob = (HttpServletRequestKnob)message.getKnob(HttpServletRequestKnob.class); try { if (httpServletRequestKnob == null) { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE_CONTENT_TYPE, h[6]); return AssertionStatus.FALSIFIED; } } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_URLENCODED); StringBuilder stringBuilder = new StringBuilder(); try { map = httpServletRequestKnob.getRawRequestBodyParameterMap(); } catch (IllegalArgumentException illegalArgumentException) { String[] stringArray = h; this.logAndAuditCannotParse(stringArray[2], illegalArgumentException.getMessage()); return this.getBadMessageStatus(); } for (Map.Entry entry : map.entrySet()) { String string = (String)entry.getKey(); for (String string2 : (String[])entry.getValue()) { CodeInjectionProtectionType codeInjectionProtectionType = ServerCodeInjectionProtectionAssertion.a(string2, ((CodeInjectionProtectionAssertion)this.assertion).getProtections(), stringBuilder); try { if (codeInjectionProtectionType == null) continue; this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_DETECTED, h[16], string, stringBuilder.toString(), codeInjectionProtectionType.getDisplayName()); return AssertionStatus.FALSIFIED; } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } } } return AssertionStatus.NONE; } private AssertionStatus a(Message message, String string) throws IOException { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_FORMDATA, string); MimeKnob mimeKnob = message.getMimeKnob(); try { PartIterator partIterator = mimeKnob.getParts(); int n2 = 0; while (partIterator.hasNext()) { block10: { Object object; String[] stringArray = h; String string2 = string + stringArray[19] + Integer.toString(n2); PartInfo partInfo = partIterator.next(); ContentTypeHeader contentTypeHeader = partInfo.getContentType(); if (contentTypeHeader.isXml()) { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_ATTACHMENT_XML, string2); try { object = XmlUtil.parse((InputStream)partInfo.getInputStream(false)); if (this.a((Node)object, string2)) { return AssertionStatus.FALSIFIED; } break block10; } catch (SAXException sAXException) { String[] stringArray2 = new String[2]; stringArray2[0] = string2; stringArray = h; stringArray2[1] = stringArray[5]; this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, stringArray2, ExceptionUtils.getDebugException((Throwable)sAXException)); return this.getBadMessageStatus(); } } this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_ATTACHMENT_TEXT, string2); try { object = IOUtils.slurpStream((InputStream)partInfo.getInputStream(false)); String string3 = new String((byte[])object, contentTypeHeader.getEncoding()); StringBuilder stringBuilder = new StringBuilder(); CodeInjectionProtectionType codeInjectionProtectionType = ServerCodeInjectionProtectionAssertion.a(string3, ((CodeInjectionProtectionAssertion)this.assertion).getProtections(), stringBuilder); if (codeInjectionProtectionType != null) { this.a(string2, stringBuilder, codeInjectionProtectionType); return AssertionStatus.FALSIFIED; } } catch (NoSuchPartException noSuchPartException) { String[] stringArray3 = new String[2]; stringArray3[0] = string2; stringArray = h; stringArray3[1] = stringArray[9]; this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, stringArray3, ExceptionUtils.getDebugException((Throwable)noSuchPartException)); return this.getBadMessageStatus(); } } ++n2; } } catch (NoSuchPartException noSuchPartException) { String[] stringArray = new String[2]; String[] stringArray4 = h; stringArray[0] = string + stringArray4[14]; stringArray[1] = stringArray4[12]; this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, stringArray, ExceptionUtils.getDebugException((Throwable)noSuchPartException)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private AssertionStatus b(Message message, String string) throws IOException { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_JSON, string); String string2 = string + h[20]; JsonKnob jsonKnob = message.getJsonKnob(); try { JSONData jSONData = jsonKnob.getJsonData(); if (this.a(jSONData, string2)) { return this.getBadMessageStatus(); } } catch (InvalidJsonException invalidJsonException) { this.logAndAudit((AuditDetailMessage)AssertionMessages.JSON_INVALID_JSON, new String[]{string}, ExceptionUtils.getDebugException((Throwable)invalidJsonException)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private AssertionStatus c(Message message, String string) throws IOException { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_XML, string); String[] stringArray = h; String string2 = string + stringArray[20]; try { XmlKnob xmlKnob = message.getXmlKnob(); Document document = xmlKnob.getDocumentReadOnly(); if (this.a(document, string2)) { return AssertionStatus.FALSIFIED; } } catch (SAXException sAXException) { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, new String[]{string2, h[3]}, ExceptionUtils.getDebugException((Throwable)sAXException)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private AssertionStatus a(Message message, String string, Charset charset) throws IOException { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_TEXT, string); String[] stringArray = h; String string2 = string + stringArray[20]; MimeKnob mimeKnob = message.getMimeKnob(); try { byte[] byArray = IOUtils.slurpStream((InputStream)mimeKnob.getEntireMessageBodyAsInputStream()); String string3 = new String(byArray, charset); StringBuilder stringBuilder = new StringBuilder(); CodeInjectionProtectionType codeInjectionProtectionType = ServerCodeInjectionProtectionAssertion.a(string3, ((CodeInjectionProtectionAssertion)this.assertion).getProtections(), stringBuilder); if (codeInjectionProtectionType != null) { this.a(string2, stringBuilder, codeInjectionProtectionType); return AssertionStatus.FALSIFIED; } } catch (NoSuchPartException noSuchPartException) { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, new String[]{string2, h[18]}, ExceptionUtils.getDebugException((Throwable)noSuchPartException)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private boolean a(JSONData jSONData, String string) throws InvalidJsonException { Object object = jSONData.getJsonObject(); try { this.a(object); } catch (CodeInjectionDetectedException codeInjectionDetectedException) { this.a(string + h[21], new StringBuilder(codeInjectionDetectedException.getEvidence()), codeInjectionDetectedException.getProtectionViolated()); return true; } return false; } private void a(String string) throws CodeInjectionDetectedException { StringBuilder stringBuilder = new StringBuilder(41); CodeInjectionProtectionType codeInjectionProtectionType = ServerCodeInjectionProtectionAssertion.a(string, ((CodeInjectionProtectionAssertion)this.assertion).getProtections(), stringBuilder); try { if (codeInjectionProtectionType != null) { throw new CodeInjectionDetectedException(stringBuilder.toString(), codeInjectionProtectionType); } } catch (CodeInjectionDetectedException codeInjectionDetectedException) { throw ServerCodeInjectionProtectionAssertion.a(codeInjectionDetectedException); } } private void a(List list) throws CodeInjectionDetectedException { for (Object object : list) { this.a(object); } } private void a(Object object) throws CodeInjectionDetectedException { block8: { block9: { block7: { try { if (!(object instanceof Map)) break block7; this.a((Map)object); break block8; } catch (CodeInjectionDetectedException codeInjectionDetectedException) { throw ServerCodeInjectionProtectionAssertion.a(codeInjectionDetectedException); } } try { if (!(object instanceof List)) break block9; this.a((List)object); break block8; } catch (CodeInjectionDetectedException codeInjectionDetectedException) { throw ServerCodeInjectionProtectionAssertion.a(codeInjectionDetectedException); } } try { if (object instanceof String) { this.a((String)object); } } catch (CodeInjectionDetectedException codeInjectionDetectedException) { throw ServerCodeInjectionProtectionAssertion.a(codeInjectionDetectedException); } } } private void a(Map map) throws CodeInjectionDetectedException { for (Map.Entry entry : map.entrySet()) { this.a(entry.getKey()); this.a(entry.getValue()); } } /* * Enabled force condition propagation * Lifted jumps to return sites */ private boolean a(Node node, String string) { StringBuilder stringBuilder = new StringBuilder(41); short s2 = node.getNodeType(); switch (s2) { case 1: case 9: { NamedNodeMap namedNodeMap = node.getAttributes(); if (namedNodeMap != null) { for (int i2 = 0; i2 < namedNodeMap.getLength(); ++i2) { Node node2 = namedNodeMap.item(i2); try { if (!this.a(node2, string)) continue; return true; } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } } } Node node3 = node.getFirstChild(); while (true) { try { try { if (node3 == null) return false; if (this.a(node3, string)) { return true; } } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } node3 = node3.getNextSibling(); } } case 2: case 3: case 4: { Element element; CodeInjectionProtectionType codeInjectionProtectionType = ServerCodeInjectionProtectionAssertion.a(node.getNodeValue(), ((CodeInjectionProtectionAssertion)this.assertion).getProtections(), stringBuilder); if (codeInjectionProtectionType == null) return false; Object object = node.getNodeName(); if (node.getParentNode() != null) { object = node.getParentNode().getNodeName() + "/" + node.getNodeName(); } else if (node instanceof Attr && (element = ((Attr)node).getOwnerElement()) != null) { object = element.getNodeName() + "@" + node.getNodeName(); } this.a(string + h[0] + (String)object, stringBuilder, codeInjectionProtectionType); return true; } } return false; } private void a(StringBuilder stringBuilder, CodeInjectionProtectionType codeInjectionProtectionType) { try { if (codeInjectionProtectionType.containsNonIdentifiableCharacters()) { TextUtils.makeIgnorableCharactersViewableAsUnicode((StringBuilder)stringBuilder); } } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } } private void a(String string, StringBuilder stringBuilder, CodeInjectionProtectionType codeInjectionProtectionType) { this.a(stringBuilder, codeInjectionProtectionType); this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_DETECTED, string, stringBuilder.toString(), codeInjectionProtectionType.getDisplayName()); } private static CodeInjectionProtectionType a(String string, CodeInjectionProtectionType[] codeInjectionProtectionTypeArray, StringBuilder stringBuilder) { CodeInjectionProtectionType codeInjectionProtectionType = null; int n2 = -1; for (CodeInjectionProtectionType codeInjectionProtectionType2 : codeInjectionProtectionTypeArray) { int n3; StringBuilder stringBuilder2; block6: { String string2 = string; Pattern pattern = codeInjectionProtectionType2.getPattern(); if (codeInjectionProtectionType2 == CodeInjectionProtectionType.HEX_HTML_JAVASCRIPT) { string2 = ServerCodeInjectionProtectionAssertion.a(string, codeInjectionProtectionType2.getPattern()); pattern = CodeInjectionProtectionType.HTML_JAVASCRIPT.getPattern(); } stringBuilder2 = new StringBuilder(); n3 = TextUtils.scanAndRecordMatch((String)string2, (Pattern)pattern, (StringBuilder)stringBuilder2); try { try { if (n3 == -1) continue; if (n2 == -1) break block6; } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } if (n3 >= n2) continue; } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } } n2 = n3; stringBuilder.setLength(0); stringBuilder.append((CharSequence)stringBuilder2); codeInjectionProtectionType = codeInjectionProtectionType2; } return codeInjectionProtectionType; } private static String a(String string, Pattern pattern) { Matcher matcher = pattern.matcher(string); ArrayList arrayList = new ArrayList(); ArrayList arrayList2 = new ArrayList(); while (matcher.find()) { String string2 = matcher.group(); arrayList.add(string2); String string3 = ServerCodeInjectionProtectionAssertion.d(string2) ? ServerCodeInjectionProtectionAssertion.b(string2) : ServerCodeInjectionProtectionAssertion.c(string2); arrayList2.add(string3); } try { if (arrayList.isEmpty()) { return string; } } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } return StringUtils.replaceEach((String)string, (String[])arrayList.toArray(new String[arrayList.size()]), (String[])arrayList2.toArray(new String[arrayList2.size()])); } private static String b(String string) { String[] stringArray = h; String string2 = string.replace(stringArray[10], ""); try { return new String(Hex.decodeHex((char[])string2.toCharArray())); } catch (DecoderException decoderException) { f.log(Level.WARNING, h[15], string); return string; } } private static String c(String string) { String[] stringArray = string.split(h[7]); if (stringArray.length > 2) { StringBuilder stringBuilder = new StringBuilder(); try { for (int i2 = 1; i2 < stringArray.length; ++i2) { stringBuilder.append((char)Integer.parseInt(stringArray[i2], 8)); } } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } return stringBuilder.toString(); } return new String(new char[]{(char)Integer.parseInt(stringArray[1], 8)}); } private static boolean d(String string) { return StringUtils.startsWith((CharSequence)string, (CharSequence)h[11]); } @Override protected String scan(String string, StringBuilder stringBuilder) { String string2; CodeInjectionProtectionType codeInjectionProtectionType = ServerCodeInjectionProtectionAssertion.a(string, ((CodeInjectionProtectionAssertion)this.assertion).getProtections(), stringBuilder); try { string2 = codeInjectionProtectionType == null ? null : codeInjectionProtectionType.getDisplayName(); } catch (IllegalArgumentException illegalArgumentException) { throw ServerCodeInjectionProtectionAssertion.a(illegalArgumentException); } return string2; } @Override protected void logAndAuditRequestAlreadyRouted() { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_ALREADY_ROUTED); } @Override protected void logAndAuditResponseNotRouted() { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SKIP_RESPONSE_NOT_ROUTED); } @Override protected void logAndAuditMessageNotHttp() { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_NOT_HTTP); } @Override protected void logAndAuditScanningUrlPath() { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_URL_PATH); } @Override protected void logAndAuditAttackDetectedInUrlPath(StringBuilder stringBuilder, String string, String string2) { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_DETECTED_PATH, h[4], string, stringBuilder.toString(), string2); } @Override protected void logAndAuditScanningUrlQueryString() { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_URL_QUERY_STRING); } @Override protected void logAndAuditAttackDetectedInQueryParameter(StringBuilder stringBuilder, String string, String string2) { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_DETECTED_PARAM, h[1], stringBuilder.toString(), string, string2); } @Override protected void logAndAuditAttackRejected() { } @Override protected void logAndAuditCannotParse(String string, String string2) { this.logAndAudit((AuditDetailMessage)AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, string, string2); } /* * Unable to fully structure code */ static { block10: { block9: { var5 = new String[23]; var3_1 = 0; var2_2 = "\u0019\u0018\nr\u0013uk\u0019\u001f\u000b6.\u0018\u000bk\u0014\u0015'.KS\u0019$6\u001e\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u0003a<(\u000bk\u0014\u0015'.KS\u0019$6\u001e\bM\u0014\u001c&d@JU!X\u0001\u0014>\"[FM\u0018\u000bJK\\\u001f\u0007=/]C\u0004M\u0014\u001c&\u0002e\t\u0002e\t\u0013T\u0004\b&\"HFK\u0005K4$JJ\u0014\u0015\u0005&*\tT\u0004\b&\"HFK\u0005\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A)q\u0014\u001cr/]DV\u0015\r<,\u0018AX\u0018\b7/\u0018AV\u0003D\"*LS\\\u0003\nr,JHL\u0001D){E\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u000bX\u0001\u0014>\"[FM\u0018\u000b<\u0004M\u0014\u001c&\u0013\u0019\u001c\u0001!8Y@\\Q)\u001b\u0006}\u0007I\u0010\u0016&k\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A"; var4_3 = "\u0019\u0018\nr\u0013uk\u0019\u001f\u000b6.\u0018\u000bk\u0014\u0015'.KS\u0019$6\u001e\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u0003a<(\u000bk\u0014\u0015'.KS\u0019$6\u001e\bM\u0014\u001c&d@JU!X\u0001\u0014>\"[FM\u0018\u000bJK\\\u001f\u0007=/]C\u0004M\u0014\u001c&\u0002e\t\u0002e\t\u0013T\u0004\b&\"HFK\u0005K4$JJ\u0014\u0015\u0005&*\tT\u0004\b&\"HFK\u0005\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A)q\u0014\u001cr/]DV\u0015\r<,\u0018AX\u0018\b7/\u0018AV\u0003D\"*LS\\\u0003\nr,JHL\u0001D){E\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u000bX\u0001\u0014>\"[FM\u0018\u000b<\u0004M\u0014\u001c&\u0013\u0019\u001c\u0001!8Y@\\Q)\u001b\u0006}\u0007I\u0010\u0016&k\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A".length(); var1_4 = 13; var0_5 = -1; lbl7: // 2 sources while (true) { v0 = 32; v1 = ++var0_5; v2 = var2_2.substring(v1, v1 + var1_4); v3 = -1; break block9; break; } lbl13: // 1 sources while (true) { var5[var3_1++] = ServerCodeInjectionProtectionAssertion.d(v0, ServerCodeInjectionProtectionAssertion.h(v2)); if ((var0_5 += var1_4) < var4_3) { var1_4 = var2_2.charAt(var0_5); ** continue; } var2_2 = "\u0013\u0012\u0000x\u000bab}[\u00189-GH\tU\u0014\u001c5lVLG\u001a"; var4_3 = "\u0013\u0012\u0000x\u000bab}[\u00189-GH\tU\u0014\u001c5lVLG\u001a".length(); var1_4 = 14; var0_5 = -1; lbl22: // 2 sources while (true) { v0 = 42; v4 = ++var0_5; v2 = var2_2.substring(v4, v4 + var1_4); v3 = 0; break block9; break; } break; } lbl28: // 1 sources while (true) { var5[var3_1++] = ServerCodeInjectionProtectionAssertion.d(v0, ServerCodeInjectionProtectionAssertion.h(v2)); if ((var0_5 += var1_4) < var4_3) { var1_4 = var2_2.charAt(var0_5); ** continue; } break block10; break; } } switch (v3) { default: { ** continue; } ** case 0: lbl39: // 1 sources ** continue; } } ServerCodeInjectionProtectionAssertion.h = var5; ServerCodeInjectionProtectionAssertion.f = Logger.getLogger(ServerCodeInjectionProtectionAssertion.class.getName()); } private static Exception a(Exception exception) { return exception; } private static char[] h(String string) { char[] cArray = string.toCharArray(); if (cArray.length < 2) { cArray = cArray; cArray[0] = (char)(cArray[0] ^ 7); } return cArray; } /* * Handled impossible loop by duplicating code * Enabled aggressive block sorting */ private static String d(int n2, char[] cArray) { char[] cArray2; block11: { int n3; int n4; int n5; block10: { n5 = n2; cArray2 = cArray; n4 = cArray.length; n3 = 0; if (!true) break block10; n4 = n4; if (n4 <= n3) break block11; } do { n5 = n5; cArray2 = cArray2; int n6 = n3; cArray2[n6] = (char)(cArray2[n6] ^ (n5 ^ (switch (n3 % 7) { case 0 -> 25; case 1 -> 81; case 2 -> 68; case 3 -> 114; case 4 -> 107; case 5 -> 24; default -> 7; }))); ++n3; n4 = n4; } while (n4 > n3); } return new String(cArray2).intern(); } private class CodeInjectionDetectedException extends Exception { private final String evidence; private final CodeInjectionProtectionType protectionViolated; static final long serialVersionUID = 2972790669655449005L; private CodeInjectionDetectedException(String string, CodeInjectionProtectionType codeInjectionProtectionType) { this.evidence = string; this.protectionViolated = codeInjectionProtectionType; } public String getEvidence() { return this.evidence; } public CodeInjectionProtectionType getProtectionViolated() { return this.protectionViolated; } } }