import com.fasterxml.jackson.databind.ObjectMapper; import java.io.IOException; public class Hello { public static void main(String args[]) throws IOException { Person p = new Person(); p.age = 1; p.name = "Econ"; ObjectMapper mapper = new ObjectMapper(); String json = mapper.writeValueAsString(p); System.out.println(json); // {"age":1,"name":"Econ"} Person p2 = mapper.readValue(json, Person.class); System.out.println(p2); // Person.age=1, Person.name=Econ } } class Person { public int age; public String name; @Override public String toString() { return String.format("Person.age=%d, Person.name=%s", age, name); } }
属性:
JAVA_LANG_OBJECT
OBJECT_AND_NON_CONCRETE
NON_CONCRETE_AND_ARRAYS
NON_FINAL
序列化:
import com.fasterxml.jackson.databind.ObjectMapper; import java.io.IOException; public class Hello { public static void main(String args[]) throws IOException { Person p = new Person(); p.age = 1; p.name = "Econ"; p.object = new Dna(); ObjectMapper mapper = new ObjectMapper(); mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.JAVA_LANG_OBJECT); String json = mapper.writeValueAsString(p); System.out.println(json); // {"age":1,"name":"Econ","object":["Dna",{"length":1}]} Person p2 = mapper.readValue(json, Person.class); System.out.println(p2); // Person.age=1, Person.name=Econ } } class Person { public int age; public String name; public Object object; @Override public String toString() { return String.format("Person.age=%d, Person.name=%s", age, name, object == null ? "null" : object); } } class Dna { public int length = 1; }
反序列化:
import com.fasterxml.jackson.databind.ObjectMapper; import java.io.IOException; public class Hello { public static void main(String args[]) throws IOException { Jacksonunserialize(); } public static void Jacksonunserialize() throws IOException { String json = "{\"age\":1, \"name\":\"econ\"}"; ObjectMapper mapper = new ObjectMapper(); mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_CONCRETE_AND_ARRAYS); Person person = mapper.readValue(json, Person.class); System.out.println(person); // Person.age=1, Person.name=econ } } class Person { public int age; public String name; @Override public String toString() { return String.format("Person.age=%d, Person.name=%s", age, name); } }
反序列化调用栈分析
1.NativeConstructorAccessorImpl (sun.reflect)
gadget类构造
class Dna { String cmd; Dna() { System.out.println("Dna.init()"); } public void setCmd(String cmd) throws IOException { this.cmd = "calc.exe"; System.out.println(String.format("Dna.setCmd(%s)", cmd)); Runtime.getRuntime().exec(cmd); } }
安研 - Java - Jackson反序列化漏洞 - 调试分析
原文:https://www.cnblogs.com/AtesetEnginner/p/12833657.html