package com.l7tech.server.policy.assertion; import com.l7tech.common.io.XmlUtil; import com.l7tech.common.mime.ContentTypeHeader; import com.l7tech.common.mime.NoSuchPartException; import com.l7tech.common.mime.PartInfo; import com.l7tech.common.mime.PartIterator; import com.l7tech.gateway.common.audit.AssertionMessages; import com.l7tech.gateway.common.audit.Messages.M; import com.l7tech.json.InvalidJsonException; import com.l7tech.json.JSONData; import com.l7tech.message.HttpServletRequestKnob; import com.l7tech.message.JsonKnob; import com.l7tech.message.Message; import com.l7tech.message.MimeKnob; import com.l7tech.message.XmlKnob; import com.l7tech.policy.assertion.AssertionStatus; import com.l7tech.policy.assertion.CodeInjectionProtectionAssertion; import com.l7tech.policy.assertion.CodeInjectionProtectionType; import com.l7tech.policy.assertion.PolicyAssertionException; import com.l7tech.server.message.AuthenticationContext; import com.l7tech.server.message.PolicyEnforcementContext; import com.l7tech.util.ExceptionUtils; import com.l7tech.util.IOUtils; import com.l7tech.util.TextUtils; import java.io.IOException; import java.nio.charset.Charset; import java.util.ArrayList; import java.util.List; import java.util.Map; import java.util.Map.Entry; import java.util.logging.Level; import java.util.logging.Logger; import java.util.regex.Matcher; import java.util.regex.Pattern; import org.apache.commons.codec.DecoderException; import org.apache.commons.codec.binary.Hex; import org.apache.commons.lang3.StringUtils; import org.w3c.dom.Document; import org.w3c.dom.Node; import org.xml.sax.SAXException; public class ServerCodeInjectionProtectionAssertion extends ServerInjectionThreatProtectionAssertion { private static final int d = 16; private static final int e = 24; private static final Logger f; private static final String[] h; public ServerCodeInjectionProtectionAssertion(CodeInjectionProtectionAssertion var1) { super(var1); } @Override protected AssertionStatus doCheckRequest(PolicyEnforcementContext var1, Message var2, String var3, AuthenticationContext var4) throws IOException, PolicyAssertionException { return this.applyThreatProtection(var1, var2, var3); } @Override protected AssertionStatus scanBody(Message param1, String param2) throws IOException { // $VF: Couldn't be decompiled // Please report this to the Vineflower issue tracker, at https://github.com/Vineflower/vineflower/issues with a copy of the class file (if you have the rights to distribute it!) // java.lang.RuntimeException: parsing failure! // at org.jetbrains.java.decompiler.modules.decompiler.decompose.DomHelper.parseGraph(DomHelper.java:211) // at org.jetbrains.java.decompiler.main.rels.MethodProcessor.codeToJava(MethodProcessor.java:174) // // Bytecode: // 00: aload 1 // 01: invokevirtual com/l7tech/message/Message.getMimeKnob ()Lcom/l7tech/message/MimeKnob; // 04: invokeinterface com/l7tech/message/MimeKnob.getFirstPart ()Lcom/l7tech/common/mime/PartInfo; 1 // 09: invokeinterface com/l7tech/common/mime/PartInfo.getActualContentLength ()J 1 // 0e: lstore 3 // 0f: goto 3a // 12: astore 5 // 14: aload 0 // 15: getstatic com/l7tech/gateway/common/audit/AssertionMessages.NO_SUCH_PART Lcom/l7tech/gateway/common/audit/Messages$M; // 18: bipush 2 // 19: anewarray 326 // 1c: dup // 1d: bipush 0 // 1e: aload 0 // 1f: getfield com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.assertion Lcom/l7tech/policy/assertion/Assertion; // 22: checkcast com/l7tech/policy/assertion/CodeInjectionProtectionAssertion // 25: invokevirtual com/l7tech/policy/assertion/CodeInjectionProtectionAssertion.getTargetName ()Ljava/lang/String; // 28: aastore // 29: dup // 2a: bipush 1 // 2b: ldc "1" // 2d: aastore // 2e: aload 5 // 30: invokestatic com/l7tech/util/ExceptionUtils.getDebugException (Ljava/lang/Throwable;)Ljava/lang/Throwable; // 33: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.logAndAudit (Lcom/l7tech/gateway/common/audit/AuditDetailMessage;[Ljava/lang/String;Ljava/lang/Throwable;)V // 36: getstatic com/l7tech/policy/assertion/AssertionStatus.FAILED Lcom/l7tech/policy/assertion/AssertionStatus; // 39: areturn // 3a: lconst_0 // 3b: lload 3 // 3c: lcmp // 3d: ifne 48 // 40: getstatic com/l7tech/policy/assertion/AssertionStatus.NONE Lcom/l7tech/policy/assertion/AssertionStatus; // 43: areturn // 44: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 47: athrow // 48: aload 1 // 49: invokevirtual com/l7tech/message/Message.getMimeKnob ()Lcom/l7tech/message/MimeKnob; // 4c: invokeinterface com/l7tech/message/MimeKnob.getOuterContentType ()Lcom/l7tech/common/mime/ContentTypeHeader; 1 // 51: astore 5 // 53: aload 0 // 54: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.isRequest ()Z // 57: ifeq 7f // 5a: aload 5 // 5c: getstatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.h [Ljava/lang/String; // 5f: bipush 17 // 61: aaload // 62: getstatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.h [Ljava/lang/String; // 65: bipush 8 // 67: aaload // 68: invokevirtual com/l7tech/common/mime/ContentTypeHeader.matches (Ljava/lang/String;Ljava/lang/String;)Z // 6b: ifeq 7f // 6e: goto 75 // 71: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 74: athrow // 75: aload 0 // 76: aload 1 // 77: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Lcom/l7tech/message/Message;)Lcom/l7tech/policy/assertion/AssertionStatus; // 7a: areturn // 7b: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 7e: athrow // 7f: aload 5 // 81: getstatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.h [Ljava/lang/String; // 84: bipush 13 // 86: aaload // 87: getstatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.h [Ljava/lang/String; // 8a: bipush 22 // 8c: aaload // 8d: invokevirtual com/l7tech/common/mime/ContentTypeHeader.matches (Ljava/lang/String;Ljava/lang/String;)Z // 90: ifeq 9e // 93: aload 0 // 94: aload 1 // 95: aload 2 // 96: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Lcom/l7tech/message/Message;Ljava/lang/String;)Lcom/l7tech/policy/assertion/AssertionStatus; // 99: areturn // 9a: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 9d: athrow // 9e: aload 1 // 9f: invokevirtual com/l7tech/message/Message.isXml ()Z // a2: ifeq b0 // a5: aload 0 // a6: aload 1 // a7: aload 2 // a8: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.c (Lcom/l7tech/message/Message;Ljava/lang/String;)Lcom/l7tech/policy/assertion/AssertionStatus; // ab: areturn // ac: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // af: athrow // b0: aload 1 // b1: invokevirtual com/l7tech/message/Message.isJson ()Z // b4: ifeq c2 // b7: aload 0 // b8: aload 1 // b9: aload 2 // ba: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.b (Lcom/l7tech/message/Message;Ljava/lang/String;)Lcom/l7tech/policy/assertion/AssertionStatus; // bd: areturn // be: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // c1: athrow // c2: aload 0 // c3: aload 1 // c4: aload 2 // c5: aload 5 // c7: invokevirtual com/l7tech/common/mime/ContentTypeHeader.getEncoding ()Ljava/nio/charset/Charset; // ca: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Lcom/l7tech/message/Message;Ljava/lang/String;Ljava/nio/charset/Charset;)Lcom/l7tech/policy/assertion/AssertionStatus; // cd: areturn // try (0 -> 5): 6 com/l7tech/common/mime/NoSuchPartException // try (27 -> 33): 33 com/l7tech/common/mime/NoSuchPartException // try (39 -> 51): 52 com/l7tech/common/mime/NoSuchPartException // try (42 -> 58): 58 com/l7tech/common/mime/NoSuchPartException // try (60 -> 74): 74 com/l7tech/common/mime/NoSuchPartException // try (76 -> 84): 84 com/l7tech/common/mime/NoSuchPartException // try (86 -> 94): 94 com/l7tech/common/mime/NoSuchPartException } private AssertionStatus a(Message var1) throws IOException { HttpServletRequestKnob var2 = (HttpServletRequestKnob)var1.getKnob(HttpServletRequestKnob.class); try { if (var2 == null) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE_CONTENT_TYPE, h[6]); return AssertionStatus.FALSIFIED; } } catch (IllegalArgumentException var16) { throw a(var16); } this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_URLENCODED); StringBuilder var3 = new StringBuilder(); Map var4; try { var4 = var2.getRawRequestBodyParameterMap(); } catch (IllegalArgumentException var14) { String[] var13 = h; this.logAndAuditCannotParse(var13[2], var14.getMessage()); return this.getBadMessageStatus(); } for (Entry var6 : var4.entrySet()) { String var7 = (String)var6.getKey(); for (String var11 : (String[])var6.getValue()) { CodeInjectionProtectionType var12 = a(var11, this.assertion.getProtections(), var3); try { if (var12 != null) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_DETECTED, h[16], var7, var3.toString(), var12.getDisplayName()); return AssertionStatus.FALSIFIED; } } catch (IllegalArgumentException var15) { throw a(var15); } } } return AssertionStatus.NONE; } private AssertionStatus a(Message var1, String var2) throws IOException { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_FORMDATA, var2); MimeKnob var3 = var1.getMimeKnob(); try { PartIterator var4 = var3.getParts(); for (int var5 = 0; var4.hasNext(); var5++) { String var21 = Integer.toString(var5); String[] var18 = h; String var6 = var2 + var18[19] + var21; PartInfo var7 = var4.next(); ContentTypeHeader var8 = var7.getContentType(); if (var8.isXml()) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_ATTACHMENT_XML, var6); try { Document var9 = XmlUtil.parse(var7.getInputStream(false)); if (this.a(var9, var6)) { return AssertionStatus.FALSIFIED; } } catch (SAXException var15) { M var22 = AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE; String[] var24 = new String[]{var6, null}; var18 = h; var24[1] = var18[5]; this.logAndAudit(var22, var24, ExceptionUtils.getDebugException(var15)); return this.getBadMessageStatus(); } } else { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_ATTACHMENT_TEXT, var6); try { byte[] var17 = IOUtils.slurpStream(var7.getInputStream(false)); String var10 = new String(var17, var8.getEncoding()); StringBuilder var11 = new StringBuilder(); CodeInjectionProtectionType var12 = a(var10, this.assertion.getProtections(), var11); if (var12 != null) { this.a(var6, var11, var12); return AssertionStatus.FALSIFIED; } } catch (NoSuchPartException var14) { M var23 = AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE; String[] var25 = new String[]{var6, null}; var18 = h; var25[1] = var18[9]; this.logAndAudit(var23, var25, ExceptionUtils.getDebugException(var14)); return this.getBadMessageStatus(); } } } } catch (NoSuchPartException var16) { M var10001 = AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE; String[] var10002 = new String[2]; String[] var13 = h; var10002[0] = var2 + var13[14]; var10002[1] = var13[12]; this.logAndAudit(var10001, var10002, ExceptionUtils.getDebugException(var16)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private AssertionStatus b(Message var1, String var2) throws IOException { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_JSON, var2); String var3 = var2 + h[20]; JsonKnob var4 = var1.getJsonKnob(); try { JSONData var5 = var4.getJsonData(); if (this.a(var5, var3)) { return this.getBadMessageStatus(); } } catch (InvalidJsonException var6) { this.logAndAudit(AssertionMessages.JSON_INVALID_JSON, new String[]{var2}, ExceptionUtils.getDebugException(var6)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private AssertionStatus c(Message var1, String var2) throws IOException { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_XML, var2); String[] var6 = h; String var3 = var2 + var6[20]; try { XmlKnob var4 = var1.getXmlKnob(); Document var5 = var4.getDocumentReadOnly(); if (this.a(var5, var3)) { return AssertionStatus.FALSIFIED; } } catch (SAXException var7) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, new String[]{var3, h[3]}, ExceptionUtils.getDebugException(var7)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private AssertionStatus a(Message var1, String var2, Charset var3) throws IOException { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_BODY_TEXT, var2); String[] var10 = h; String var4 = var2 + var10[20]; MimeKnob var5 = var1.getMimeKnob(); try { byte[] var6 = IOUtils.slurpStream(var5.getEntireMessageBodyAsInputStream()); String var7 = new String(var6, var3); StringBuilder var8 = new StringBuilder(); CodeInjectionProtectionType var9 = a(var7, this.assertion.getProtections(), var8); if (var9 != null) { this.a(var4, var8, var9); return AssertionStatus.FALSIFIED; } } catch (NoSuchPartException var11) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, new String[]{var4, h[18]}, ExceptionUtils.getDebugException(var11)); return this.getBadMessageStatus(); } return AssertionStatus.NONE; } private boolean a(JSONData var1, String var2) throws InvalidJsonException { Object var3 = var1.getJsonObject(); try { this.a(var3); return false; } catch (ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException var5) { this.a(var2 + h[21], new StringBuilder(var5.getEvidence()), var5.getProtectionViolated()); return true; } } private void a(String var1) throws ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException { StringBuilder var2 = new StringBuilder(41); CodeInjectionProtectionType var3 = a(var1, this.assertion.getProtections(), var2); try { if (var3 != null) { throw new ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException(var2.toString(), var3); } } catch (ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException var4) { throw a(var4); } } private void a(List var1) throws ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException { for (Object var3 : var1) { this.a(var3); } } private void a(Object var1) throws ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException { try { if (var1 instanceof Map) { this.a((Map)var1); return; } } catch (ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException var4) { throw a(var4); } try { if (var1 instanceof List) { this.a((List)var1); return; } } catch (ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException var3) { throw a(var3); } try { if (var1 instanceof String) { this.a((String)var1); } } catch (ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException var2) { throw a(var2); } } private void a(Map var1) throws ServerCodeInjectionProtectionAssertion.CodeInjectionDetectedException { for (Entry var3 : var1.entrySet()) { this.a(var3.getKey()); this.a(var3.getValue()); } } private boolean a(Node param1, String param2) { // $VF: Couldn't be decompiled // Please report this to the Vineflower issue tracker, at https://github.com/Vineflower/vineflower/issues with a copy of the class file (if you have the rights to distribute it!) // java.lang.RuntimeException: parsing failure! // at org.jetbrains.java.decompiler.modules.decompiler.decompose.DomHelper.parseGraph(DomHelper.java:211) // at org.jetbrains.java.decompiler.main.rels.MethodProcessor.codeToJava(MethodProcessor.java:174) // // Bytecode: // 000: new java/lang/StringBuilder // 003: dup // 004: bipush 41 // 006: invokespecial java/lang/StringBuilder. (I)V // 009: astore 3 // 00a: aload 1 // 00b: invokeinterface org/w3c/dom/Node.getNodeType ()S 1 // 010: istore 4 // 012: iload 4 // 014: tableswitch 301 1 9 52 164 164 164 301 301 301 301 52 // 048: aload 1 // 049: invokeinterface org/w3c/dom/Node.getAttributes ()Lorg/w3c/dom/NamedNodeMap; 1 // 04e: astore 5 // 050: aload 5 // 052: ifnull 085 // 055: bipush 0 // 056: istore 6 // 058: iload 6 // 05a: aload 5 // 05c: invokeinterface org/w3c/dom/NamedNodeMap.getLength ()I 1 // 061: if_icmpge 085 // 064: aload 5 // 066: iload 6 // 068: invokeinterface org/w3c/dom/NamedNodeMap.item (I)Lorg/w3c/dom/Node; 2 // 06d: astore 7 // 06f: aload 0 // 070: aload 7 // 072: aload 2 // 073: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Lorg/w3c/dom/Node;Ljava/lang/String;)Z // 076: ifeq 07f // 079: bipush 1 // 07a: ireturn // 07b: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 07e: athrow // 07f: iinc 6 1 // 082: goto 058 // 085: aload 1 // 086: invokeinterface org/w3c/dom/Node.getFirstChild ()Lorg/w3c/dom/Node; 1 // 08b: astore 6 // 08d: aload 6 // 08f: ifnull 0b5 // 092: aload 0 // 093: aload 6 // 095: aload 2 // 096: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Lorg/w3c/dom/Node;Ljava/lang/String;)Z // 099: ifeq 0a9 // 09c: goto 0a3 // 09f: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 0a2: athrow // 0a3: bipush 1 // 0a4: ireturn // 0a5: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 0a8: athrow // 0a9: aload 6 // 0ab: invokeinterface org/w3c/dom/Node.getNextSibling ()Lorg/w3c/dom/Node; 1 // 0b0: astore 6 // 0b2: goto 08d // 0b5: goto 141 // 0b8: aload 1 // 0b9: invokeinterface org/w3c/dom/Node.getNodeValue ()Ljava/lang/String; 1 // 0be: aload 0 // 0bf: getfield com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.assertion Lcom/l7tech/policy/assertion/Assertion; // 0c2: checkcast com/l7tech/policy/assertion/CodeInjectionProtectionAssertion // 0c5: invokevirtual com/l7tech/policy/assertion/CodeInjectionProtectionAssertion.getProtections ()[Lcom/l7tech/policy/assertion/CodeInjectionProtectionType; // 0c8: aload 3 // 0c9: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/String;[Lcom/l7tech/policy/assertion/CodeInjectionProtectionType;Ljava/lang/StringBuilder;)Lcom/l7tech/policy/assertion/CodeInjectionProtectionType; // 0cc: astore 6 // 0ce: aload 6 // 0d0: ifnull 141 // 0d3: aload 1 // 0d4: invokeinterface org/w3c/dom/Node.getNodeName ()Ljava/lang/String; 1 // 0d9: astore 7 // 0db: aload 1 // 0dc: invokeinterface org/w3c/dom/Node.getParentNode ()Lorg/w3c/dom/Node; 1 // 0e1: ifnull 0ff // 0e4: aload 1 // 0e5: invokeinterface org/w3c/dom/Node.getParentNode ()Lorg/w3c/dom/Node; 1 // 0ea: invokeinterface org/w3c/dom/Node.getNodeName ()Ljava/lang/String; 1 // 0ef: aload 1 // 0f0: invokeinterface org/w3c/dom/Node.getNodeName ()Ljava/lang/String; 1 // 0f5: invokedynamic makeConcatWithConstants (Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; bsm=java/lang/invoke/StringConcatFactory.makeConcatWithConstants (Ljava/lang/invoke/MethodHandles$Lookup;Ljava/lang/String;Ljava/lang/invoke/MethodType;Ljava/lang/String;[Ljava/lang/Object;)Ljava/lang/invoke/CallSite; args=[ "\u0001/\u0001" ] // 0fa: astore 7 // 0fc: goto 12a // 0ff: aload 1 // 100: instanceof org/w3c/dom/Attr // 103: ifeq 12a // 106: aload 1 // 107: checkcast org/w3c/dom/Attr // 10a: invokeinterface org/w3c/dom/Attr.getOwnerElement ()Lorg/w3c/dom/Element; 1 // 10f: astore 8 // 111: aload 8 // 113: ifnull 12a // 116: aload 8 // 118: invokeinterface org/w3c/dom/Element.getNodeName ()Ljava/lang/String; 1 // 11d: aload 1 // 11e: invokeinterface org/w3c/dom/Node.getNodeName ()Ljava/lang/String; 1 // 123: invokedynamic makeConcatWithConstants (Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; bsm=java/lang/invoke/StringConcatFactory.makeConcatWithConstants (Ljava/lang/invoke/MethodHandles$Lookup;Ljava/lang/String;Ljava/lang/invoke/MethodType;Ljava/lang/String;[Ljava/lang/Object;)Ljava/lang/invoke/CallSite; args=[ "\u0001@\u0001" ] // 128: astore 7 // 12a: aload 0 // 12b: aload 2 // 12c: aload 7 // 12e: getstatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.h [Ljava/lang/String; // 131: bipush 0 // 132: aaload // 133: swap // 134: invokedynamic makeConcatWithConstants (Ljava/lang/String;Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; bsm=java/lang/invoke/StringConcatFactory.makeConcatWithConstants (Ljava/lang/invoke/MethodHandles$Lookup;Ljava/lang/String;Ljava/lang/invoke/MethodType;Ljava/lang/String;[Ljava/lang/Object;)Ljava/lang/invoke/CallSite; args=[ "\u0001\u0001\u0001" ] // 139: aload 3 // 13a: aload 6 // 13c: invokevirtual com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/String;Ljava/lang/StringBuilder;Lcom/l7tech/policy/assertion/CodeInjectionProtectionType;)V // 13f: bipush 1 // 140: ireturn // 141: bipush 0 // 142: ireturn // try (25 -> 32): 32 java/lang/IllegalArgumentException // try (39 -> 46): 47 java/lang/IllegalArgumentException // try (41 -> 51): 51 java/lang/IllegalArgumentException } private void a(StringBuilder var1, CodeInjectionProtectionType var2) { try { if (var2.containsNonIdentifiableCharacters()) { TextUtils.makeIgnorableCharactersViewableAsUnicode(var1); } } catch (IllegalArgumentException var3) { throw a(var3); } } private void a(String var1, StringBuilder var2, CodeInjectionProtectionType var3) { this.a(var2, var3); this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_DETECTED, var1, var2.toString(), var3.getDisplayName()); } private static CodeInjectionProtectionType a(String param0, CodeInjectionProtectionType[] param1, StringBuilder param2) { // $VF: Couldn't be decompiled // Please report this to the Vineflower issue tracker, at https://github.com/Vineflower/vineflower/issues with a copy of the class file (if you have the rights to distribute it!) // java.lang.RuntimeException: parsing failure! // at org.jetbrains.java.decompiler.modules.decompiler.decompose.DomHelper.parseGraph(DomHelper.java:211) // at org.jetbrains.java.decompiler.main.rels.MethodProcessor.codeToJava(MethodProcessor.java:174) // // Bytecode: // 00: aconst_null // 01: astore 3 // 02: bipush -1 // 03: istore 4 // 05: aload 1 // 06: astore 5 // 08: aload 5 // 0a: arraylength // 0b: istore 6 // 0d: bipush 0 // 0e: istore 7 // 10: iload 7 // 12: iload 6 // 14: if_icmpge 91 // 17: aload 5 // 19: iload 7 // 1b: aaload // 1c: astore 8 // 1e: aload 0 // 1f: astore 9 // 21: aload 8 // 23: invokevirtual com/l7tech/policy/assertion/CodeInjectionProtectionType.getPattern ()Ljava/util/regex/Pattern; // 26: astore 10 // 28: aload 8 // 2a: getstatic com/l7tech/policy/assertion/CodeInjectionProtectionType.HEX_HTML_JAVASCRIPT Lcom/l7tech/policy/assertion/CodeInjectionProtectionType; // 2d: if_acmpne 43 // 30: aload 0 // 31: aload 8 // 33: invokevirtual com/l7tech/policy/assertion/CodeInjectionProtectionType.getPattern ()Ljava/util/regex/Pattern; // 36: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/String;Ljava/util/regex/Pattern;)Ljava/lang/String; // 39: astore 9 // 3b: getstatic com/l7tech/policy/assertion/CodeInjectionProtectionType.HTML_JAVASCRIPT Lcom/l7tech/policy/assertion/CodeInjectionProtectionType; // 3e: invokevirtual com/l7tech/policy/assertion/CodeInjectionProtectionType.getPattern ()Ljava/util/regex/Pattern; // 41: astore 10 // 43: new java/lang/StringBuilder // 46: dup // 47: invokespecial java/lang/StringBuilder. ()V // 4a: astore 11 // 4c: aload 9 // 4e: aload 10 // 50: aload 11 // 52: invokestatic com/l7tech/util/TextUtils.scanAndRecordMatch (Ljava/lang/String;Ljava/util/regex/Pattern;Ljava/lang/StringBuilder;)I // 55: istore 12 // 57: iload 12 // 59: bipush -1 // 5a: if_icmpeq 8b // 5d: iload 4 // 5f: bipush -1 // 60: if_icmpeq 78 // 63: goto 6a // 66: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 69: athrow // 6a: iload 12 // 6c: iload 4 // 6e: if_icmpge 8b // 71: goto 78 // 74: invokestatic com/l7tech/server/policy/assertion/ServerCodeInjectionProtectionAssertion.a (Ljava/lang/Exception;)Ljava/lang/Exception; // 77: athrow // 78: iload 12 // 7a: istore 4 // 7c: aload 2 // 7d: bipush 0 // 7e: invokevirtual java/lang/StringBuilder.setLength (I)V // 81: aload 2 // 82: aload 11 // 84: invokevirtual java/lang/StringBuilder.append (Ljava/lang/CharSequence;)Ljava/lang/StringBuilder; // 87: pop // 88: aload 8 // 8a: astore 3 // 8b: iinc 7 1 // 8e: goto 10 // 91: aload 3 // 92: areturn // try (43 -> 49): 50 java/lang/IllegalArgumentException // try (46 -> 55): 56 java/lang/IllegalArgumentException } private static String a(String var0, Pattern var1) { Matcher var2 = var1.matcher(var0); ArrayList var3 = new ArrayList(); ArrayList var4 = new ArrayList(); while (var2.find()) { String var5 = var2.group(); var3.add(var5); String var6; if (d(var5)) { var6 = b(var5); } else { var6 = c(var5); } var4.add(var6); } try { if (var3.isEmpty()) { return var0; } } catch (IllegalArgumentException var7) { throw a(var7); } return StringUtils.replaceEach(var0, var3.toArray(new String[var3.size()]), var4.toArray(new String[var4.size()])); } private static String b(String var0) { String[] var3 = h; String var1 = var0.replace(var3[10], ""); try { return new String(Hex.decodeHex(var1.toCharArray())); } catch (DecoderException var4) { f.log(Level.WARNING, h[15], var0); return var0; } } private static String c(String var0) { String[] var1 = var0.split(h[7]); if (var1.length <= 2) { return new String(new char[]{(char)Integer.parseInt(var1[1], 8)}); } StringBuilder var2 = new StringBuilder(); int var3 = 1; try { while (var3 < var1.length) { var2.append((char)Integer.parseInt(var1[var3], 8)); var3++; } } catch (IllegalArgumentException var4) { throw a(var4); } return var2.toString(); } private static boolean d(String var0) { return StringUtils.startsWith(var0, h[11]); } @Override protected String scan(String var1, StringBuilder var2) { CodeInjectionProtectionType var3 = a(var1, this.assertion.getProtections(), var2); try { if (var3 == null) { return null; } } catch (IllegalArgumentException var4) { throw a(var4); } return var3.getDisplayName(); } @Override protected void logAndAuditRequestAlreadyRouted() { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_ALREADY_ROUTED); } @Override protected void logAndAuditResponseNotRouted() { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SKIP_RESPONSE_NOT_ROUTED); } @Override protected void logAndAuditMessageNotHttp() { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_NOT_HTTP); } @Override protected void logAndAuditScanningUrlPath() { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_URL_PATH); } @Override protected void logAndAuditAttackDetectedInUrlPath(StringBuilder var1, String var2, String var3) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_DETECTED_PATH, h[4], var2, var1.toString(), var3); } @Override protected void logAndAuditScanningUrlQueryString() { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_SCANNING_URL_QUERY_STRING); } @Override protected void logAndAuditAttackDetectedInQueryParameter(StringBuilder var1, String var2, String var3) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_DETECTED_PARAM, h[1], var1.toString(), var2, var3); } @Override protected void logAndAuditAttackRejected() { } @Override protected void logAndAuditCannotParse(String var1, String var2) { this.logAndAudit(AssertionMessages.CODEINJECTIONPROTECTION_CANNOT_PARSE, var1, var2); } static { String[] var5 = new String[23]; int var3 = 0; String var2 = "\u0019\u0018\nr\u0013uk\u0019\u001f\u000b6.\u0018\u000bk\u0014\u0015'.KS\u0019$6\u001e\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u0003a<(\u000bk\u0014\u0015'.KS\u0019$6\u001e\bM\u0014\u001c&d@JU!X\u0001\u0014>\"[FM\u0018\u000bJK\\\u001f\u0007=/]C\u0004M\u0014\u001c&\u0002e\t\u0002e\t\u0013T\u0004\b&\"HFK\u0005K4$JJ\u0014\u0015\u0005&*\tT\u0004\b&\"HFK\u0005\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A)q\u0014\u001cr/]DV\u0015\r<,\u0018AX\u0018\b7/\u0018AV\u0003D\"*LS\\\u0003\nr,JHL\u0001D){E\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u000bX\u0001\u0014>\"[FM\u0018\u000b<\u0004M\u0014\u001c&\u0013\u0019\u001c\u0001!8Y@\\Q)\u001b\u0006}\u0007I\u0010\u0016&k\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A"; int var4 = "\u0019\u0018\nr\u0013uk\u0019\u001f\u000b6.\u0018\u000bk\u0014\u0015'.KS\u0019$6\u001e\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u0003a<(\u000bk\u0014\u0015'.KS\u0019$6\u001e\bM\u0014\u001c&d@JU!X\u0001\u0014>\"[FM\u0018\u000bJK\\\u001f\u0007=/]C\u0004M\u0014\u001c&\u0002e\t\u0002e\t\u0013T\u0004\b&\"HFK\u0005K4$JJ\u0014\u0015\u0005&*\tT\u0004\b&\"HFK\u0005\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A)q\u0014\u001cr/]DV\u0015\r<,\u0018AX\u0018\b7/\u0018AV\u0003D\"*LS\\\u0003\nr,JHL\u0001D){E\u0014k\u0014\u0015'.KS\u0019\u001c\u0001!8Y@\\Q\u0006=/A\u000bX\u0001\u0014>\"[FM\u0018\u000b<\u0004M\u0014\u001c&\u0013\u0019\u001c\u0001!8Y@\\Q)\u001b\u0006}\u0007I\u0010\u0016&k\r\u0019\u001c\u0001!8Y@\\Q\u0006=/A" .length(); char var1 = '\r'; int var7 = -1; label24: while (true) { byte var10000 = 32; String var10001 = var2.substring(++var7, var7 + var1); byte var10002 = -1; while (true) { String var8 = d(var10000, h(var10001)); switch (var10002) { case 0: var5[var3++] = var8; if ((var7 += var1) >= var4) { h = var5; f = Logger.getLogger(ServerCodeInjectionProtectionAssertion.class.getName()); return; } var1 = var2.charAt(var7); break; default: var5[var3++] = var8; if ((var7 += var1) < var4) { var1 = var2.charAt(var7); continue label24; } var2 = "\u0013\u0012\u0000x\u000bab}[\u00189-GH\tU\u0014\u001c5lVLG\u001a"; var4 = "\u0013\u0012\u0000x\u000bab}[\u00189-GH\tU\u0014\u001c5lVLG\u001a".length(); var1 = 14; var7 = -1; } var10000 = 42; var10001 = var2.substring(++var7, var7 + var1); var10002 = 0; } } } private static Exception a(Exception var0) { return var0; } private static char[] h(String var0) { char[] var10000 = var0.toCharArray(); if (var10000.length < 2) { var10000[0] = (char)(var10000[0] ^ 7); } return var10000; } private static String d(int var0, char[] var1) { int var10003 = var1.length; int var10002 = var0; char[] var10001 = var1; int var10000 = var10003; for (int var2 = 0; var10000 > var2; var2++) { var10001[var2] = (char)(var10001[var2] ^ var10002 ^ switch (var2 % 7) { case 0 -> 25; case 1 -> 81; case 2 -> 68; case 3 -> 114; case 4 -> 107; case 5 -> 24; default -> 7; }); } return new String(var10001).intern(); } private class CodeInjectionDetectedException extends Exception { private final String evidence; private final CodeInjectionProtectionType protectionViolated; static final long serialVersionUID = 2972790669655449005L; private CodeInjectionDetectedException(String var2, CodeInjectionProtectionType var3) { this.evidence = var2; this.protectionViolated = var3; } public String getEvidence() { return this.evidence; } public CodeInjectionProtectionType getProtectionViolated() { return this.protectionViolated; } } }