修复 snakeyaml loadJar 漏洞利用封装 bug（thx @Ch1ngg）

pen4uin · pen4uin · commit 70c7b7013d0f · 2024-07-23T23:03:41.000+08:00
diff --git a/jmg-core/src/main/java/jmg/core/util/CtClassUtil.java b/jmg-core/src/main/java/jmg/core/util/CtClassUtil.java
@@ -62,6 +62,6 @@ public void applyFastjsonGroovyASTTransformation() throws Exception {
     // snakeyaml loadJar 的利用需要实现 ScriptEngineFactory 接口
     public void applySnakeYamlScriptEngineFactory() throws Exception {
         config.setImplementsScriptEngineFactory(true);
-        JavassistUtil.addAnnotation(ctClass, "javax.script.ScriptEngineFactory");
+        JavassistUtil.implementInterface(ctClass, "javax.script.ScriptEngineFactory");
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -62,6 +62,6 @@ public void applyFastjsonGroovyASTTransformation() throws Exception {`
`62`	`62`	`// snakeyaml loadJar 的利用需要实现 ScriptEngineFactory 接口`
`63`	`63`	`public void applySnakeYamlScriptEngineFactory() throws Exception {`
`64`	`64`	`config.setImplementsScriptEngineFactory(true);`
`65`		`- JavassistUtil.addAnnotation(ctClass, "javax.script.ScriptEngineFactory");`
	`65`	`+ JavassistUtil.implementInterface(ctClass, "javax.script.ScriptEngineFactory");`
`66`	`66`	`}`
`67`	`67`	`}`