扫一扫关注公众号，长期致力于安全研究

前言：在分析其漏洞之前，应先对该应用有个基本的了解和使用。本文是笔者之前从网上搜到的资料..来自于Y4师傅

简介

依赖

<dependency>    <groupId>com.alibaba</groupId>    <artifactId>fastjson</artifactId>    <version>1.2.23</version> </dependency>

Fastjson反序列化的类方法调用关系

import com.alibaba.fastjson.*;import com.alibaba.fastjson.serializer.SerializerFeature;
public class Student {    private String name;    private int age;
    public Student() {        System.out.println("Student构造函数");    }
    public String getName() {        return name;    }
    public void setName(String name) {        this.name = name;    }
    public int getAge() {        return age;    }
    public void setAge(int age) {        this.age = age;    }
    public static void main(String[] args) {        Student student = new Student();        student.setName("name");        student.setAge(23333);        System.out.println(JSON.toJSONString(student, SerializerFeature.WriteClassName));    }}

package fastj;
import com.alibaba.fastjson.*;import com.alibaba.fastjson.parser.Feature;import com.alibaba.fastjson.serializer.SerializerFeature;
public class Student {    private String name;    private int age;
    public Student() {        System.out.println("Student构造函数");    }
    public String getName() {        return name;    }

    public int getAge() {        return age;    }

    public static void main(String[] args) {        Student obj = JSON.parseObject("{\"@type\":\"fastj.Student\",\"age\":23333,\"name\":\"yyds\"}", Student.class, Feature.SupportNonPublicField);        System.out.println(obj);        System.out.println(obj.getClass().getName());        System.out.println(obj.getName() + " " + obj.getAge());    }}