<?xml version="1
.0" encoding="UTF
-8"?>
<project xmlns="http://maven
.apache
.org/POM/4
.0.0" xmlns:xsi="http://www
.w3
.org/
2001/XMLSchema
-instance"
xsi:schemaLocation="http://maven
.apache
.org/POM/4
.0.0 https://maven
.apache
.org/xsd/maven
-4
.0.0.xsd">
<modelVersion>4
.0.0</modelVersion>
<!
-- Spring Boot 启动父依赖
-->
<parent>
<groupId>org
.springframework
.boot</groupId>
<artifactId>
spring-boot-starter
-parent</artifactId>
<version>
2.2.0.RELEASE</version>
<relativePath/> <!
-- lookup parent from repository
-->
</parent>
<groupId>com
.zjh
.student_mis</groupId>
<artifactId>student_mis</artifactId>
<version>
0.0.1
-SNAPSHOT</version>
<name>student_mis</name>
<description>Demo project for
Spring Boot</description>
<properties>
<mybatis
-spring-boot>1
.2.0</mybatis
-spring-boot>
<mysql
-connector>5
.1
.39</mysql
-connector>
<
java.version>1
.8</
java.version>
<repositories>
<repository>
<id>alimaven</id>
<url>https://maven
.aliyun
.com/repository/public</url>
</repository>
</repositories>
<pluginRepositories>
<pluginRepository>
<id>alimaven</id>
<url>https://maven
.aliyun
.com/repository/public</url>
</pluginRepository>
</pluginRepositories>
</properties>
<dependencies>
<!
-- 阿里fastjson包JSON转换
-->
<dependency>
<groupId>com
.alibaba</groupId>
<artifactId>fastjson</artifactId>
<version>1
.2.6
2</version>
</dependency>
<dependency>
<groupId>org
.projectlombok</groupId>
<artifactId>lombok</artifactId>
</dependency>
<dependency>
<groupId>org
.springframework
.boot</groupId>
<artifactId>
spring-boot-starter</artifactId>
</dependency>
<!
-- Spring Boot Web 依赖
-->
<dependency>
<groupId>org
.springframework
.boot</groupId>
<artifactId>
spring-boot-starter
-web</artifactId>
</dependency>
<!
-- MySQL 连接驱动依赖
-->
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql
-connector
-java</artifactId>
<version>5
.1
.47</version>
</dependency>
<dependency>
<groupId>com
.mchange</groupId>
<artifactId>c3p
0</artifactId>
<version>
0.9
.5
.2</version>
</dependency>
<dependency>
<groupId>com
.alibaba</groupId>
<artifactId>druid</artifactId>
<version>
RELEASE</version>
</dependency>
<!
-- 分页插件
-->
<dependency>
<groupId>com
.github
.pagehelper</groupId>
<artifactId>pagehelper
-spring-boot-starter</artifactId>
<version>1
.2.3</version>
</dependency>
<!
-- Spring Boot Mybatis 依赖
-->
<dependency>
<groupId>org
.mybatis
.spring.boot</groupId>
<artifactId>mybatis
-spring-boot-starter</artifactId>
<version>1
.3
.1</version>
</dependency>
<dependency>
<groupId>org
.springframework
.boot</groupId>
<artifactId>
spring-boot-starter
-thymeleaf</artifactId>
</dependency>
<dependency>
<groupId>org
.springframework
.boot</groupId>
<artifactId>
spring-boot-starter
-test</artifactId>
<scope>test</scope>
<exclusions>
<exclusion>
<groupId>org
.junit
.vintage</groupId>
<artifactId>junit
-vintage
-engine</artifactId>
</exclusion>
</exclusions>
</dependency>
<!
-- Junit
-->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4
.1
2</version>
</dependency>
<!
--token
-->
<dependency>
<groupId>com
.auth
0</groupId>
<artifactId>
java-jwt</artifactId>
<version>3
.4
.0</version>
</dependency>
<!
-- <dependency>
-->
<!
-- <groupId>org
.testng</groupId>
-->
<!
-- <artifactId>testng</artifactId>
-->
<!
-- <version>
RELEASE</version>
-->
<!
-- <scope>compile</scope>
-->
<!
-- </dependency>
-->
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org
.springframework
.boot</groupId>
<artifactId>
spring-boot-maven
-plugin</artifactId>
</plugin>
<plugin>
<groupId>org
.mybatis
.generator</groupId>
<artifactId>mybatis
-generator
-maven
-plugin</artifactId>
<version>1
.3
.2</version>
<configuration>
<configurationFile>GeneratorMapper
.xml</configurationFile>
<verbose>true</verbose>
<overwrite>true</overwrite>
</configuration>
</plugin>
</plugins>
<resources>
<resource>
<directory>src/main/
java</directory>
<includes>
<include>**/*
.xml</include>
</includes>
</resource>
<resource>
<directory>src/main/resources</directory>
<includes>
<include>**/*
.*</include>
</includes>
</resource>
<resource>
<directory>src/main/webapp</directory>
<targetPath>META
-INF/resources</targetPath>
<includes>
<include>**/*
.*</include>
</includes>
</resource>
</resources>
</build>
</project>
以上问题结合该代码进行说明具体解决办法
文章讲述了Thymeleaf2.2.0版本中的安全漏洞，当lang参数被注入时，可能导致内网访问。作者通过创建Index-en.html和index.html页面，利用Scanner类执行系统命令，实现了计算器功能并成功复现了漏洞。
扫一扫
1802
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
