Java Scriptable.put方法代码示例

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * 文件上传hook点
 *
 * @param name    文件名
 * @param content 文件数据
 */
public static void checkFileUpload(String name, byte[] content) {
    if (name != null && content != null) {
        JSContext cx = JSContextFactory.enterAndInitContext();
        Scriptable params = cx.newObject(cx.getScope());
        params.put("filename", params, name);
        try {
            if (content.length > 4 * 1024) {
                content = Arrays.copyOf(content, 4 * 1024);
            }
            params.put("content", params, new String(content, "UTF-8"));
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
            params.put("content", params, "[rasp error:" + e.getMessage() + "]");
        }

        HookHandler.doCheck(CheckParameter.Type.FILEUPLOAD, params);
    }
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * 文件读取hook点
 *
 * @param file 文件对象
 */
public static void checkReadFile(File file) {
    if (file != null) {
        JSContext cx = JSContextFactory.enterAndInitContext();
        Scriptable params = cx.newObject(cx.getScope());
        params.put("path", params, file.getPath());
        try {
            String path = file.getCanonicalPath();
            if (path.endsWith(".class") || !file.exists()) {
                return;
            }
            params.put("realpath", params, FileUtil.getRealPath(file));
        } catch (IOException e) {
            e.printStackTrace();
        }

        HookHandler.doCheck(CheckParameter.Type.READFILE, params);
    }
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
@Override
protected boolean stepExecute(Context javascriptContext, Scriptable scope) throws EngineException {
	if (isEnabled()) {
		if (super.stepExecute(javascriptContext, scope)) {
			String variableName = getVariableName();
			NodeList list = (NodeList) scope.get(variableName, scope);
			
			Object string = null;
			if (list.getLength() > 0) {
				Node node = list.item(0);
				if (node instanceof Element) {
					Element element = (Element) node;
					string = element.getTextContent();
				} else {
					string = node.getNodeValue();
				}
			}
			scope.put(variableName, scope, string);
			return true;
		}
	}
	return false;
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * ECMA 11.4.3 says that typeof on host object is Implementation-dependent
 */
public void test0() throws Exception
{
       final Function f = new BaseFunction()
       {
       	@Override
       	public Object call(Context _cx, Scriptable _scope, Scriptable _thisObj,
       			Object[] _args)
       	{
       		return _args[0].getClass().getName();
       	}
       };
	final ContextAction action = new ContextAction()
	{
		public Object run(final Context context)
		{
			final Scriptable scope = context.initStandardObjects();
			scope.put("myObj", scope, f);
			return context.evaluateString(scope, "typeof myObj", "test script", 1, null);
		}
	};
	doTest("function", action);
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * xml语句解析hook点
 *
 * @param expandedSystemId
 */
public static void checkXXE(String expandedSystemId) {
    if (expandedSystemId != null && !XXEHook.getLocalExpandedSystemIds().contains(expandedSystemId)) {
        XXEHook.getLocalExpandedSystemIds().add(expandedSystemId);
        JSContext cx = JSContextFactory.enterAndInitContext();
        Scriptable params = cx.newObject(cx.getScope());
        params.put("entity", params, expandedSystemId);
        HookHandler.doCheck(CheckParameter.Type.XXE, params);
    }
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * 检测 c:import
 *
 * @param url
 */
public static void checkJstlImport(String url) {
    if (url != null && !url.startsWith("/") && url.contains("://")) {
        JSContext cx = JSContextFactory.enterAndInitContext();
        Scriptable params = cx.newObject(cx.getScope());
        params.put("url", params, url);
        params.put("function", params, "jstl_import");
        HookHandler.doCheck(CheckParameter.Type.INCLUDE, params);
    }
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * 命令执行hook点
 *
 * @param command 命令列表
 */
public static void checkCommand(List<String> command) {
    if (command != null && !command.isEmpty()) {
        JSContext cx = JSContextFactory.enterAndInitContext();
        Scriptable params = cx.newObject(cx.getScope());
        Scriptable array = cx.newArray(cx.getScope(), command.toArray());
        params.put("command", params, array);
        HookHandler.doCheck(CheckParameter.Type.COMMAND, params);
    }
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
@Override
protected boolean stepExecute(Context javascriptContext, Scriptable scope) throws EngineException {
	if (isEnabled()) {
		if (super.stepExecute(javascriptContext, scope)) {
			NodeList list = getSource().getContextValues();
			if (list != null) {
				scope.put(variableName, scope, list);
				return true;
			}
		}
	}
	return false;
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
private void testCustomizeTypeOf(final String expected, final Scriptable obj)
{
	final ContextAction action = new ContextAction()
	{
		public Object run(final Context context)
		{
			final Scriptable scope = context.initStandardObjects();
			scope.put("myObj", scope, obj);
			return context.evaluateString(scope, "typeof myObj", "test script", 1, null);
		}
	};
	doTest(expected, action);
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * Test that FunctionObject use the right top scope to convert a primitive 
 * to an object
 */
@Test
public void functionObjectPrimitiveToObject() throws Exception {
    final String scriptScope2 = "function f() {\n"
        + "String.prototype.foo = 'from 2'; \n"
        + "var s2 = 's2';\n"
        + "var s2Foo = s2.foo;\n"
        + "var s2FooReadByFunction = myObject.readPropFoo(s2);\n"
        + "if (s2Foo != s2FooReadByFunction)\n"
        + "throw 's2 got: ' + s2FooReadByFunction;\n"
        + "}";

    // define object with custom method
    final MyObject myObject = new MyObject();
    final String[] functionNames = { "readPropFoo" };
    myObject.defineFunctionProperties(functionNames, MyObject.class,
        ScriptableObject.EMPTY);

    final String scriptScope1 = "String.prototype.foo = 'from 1'; scope2.f()";

    final ContextAction action = new ContextAction()
    {
        public Object run(final Context cx)
        {
            final Scriptable scope1 = cx.initStandardObjects(
                new MySimpleScriptableObject("scope1"));
            final Scriptable scope2 = cx.initStandardObjects(
                new MySimpleScriptableObject("scope2"));

            scope2.put("myObject", scope2, myObject);
            cx.evaluateString(scope2, scriptScope2, "source2", 1, null);

            scope1.put("scope2", scope1, scope2);

            return cx.evaluateString(scope1, scriptScope1, "source1", 1, null);
        }
    };
    Utils.runWithAllOptimizationLevels(action);
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
private Scriptable executeModuleScript(Context cx, String id,
        Scriptable exports, ModuleScript moduleScript, boolean isMain)
{
    final ScriptableObject moduleObject = (ScriptableObject)cx.newObject(
            nativeScope);
    URI uri = moduleScript.getUri();
    URI base = moduleScript.getBase();
    defineReadOnlyProperty(moduleObject, "id", id);
    if(!sandboxed) {
        defineReadOnlyProperty(moduleObject, "uri", uri.toString());
    }
    final Scriptable executionScope = new ModuleScope(nativeScope, uri, base);
    // Set this so it can access the global JS environment objects. 
    // This means we're currently using the "MGN" approach (ModuleScript 
    // with Global Natives) as specified here: 
    // <http://wiki.commonjs.org/wiki/Modules/ProposalForNativeExtension>
    executionScope.put("exports", executionScope, exports);
    executionScope.put("module", executionScope, moduleObject);
    moduleObject.put("exports", moduleObject, exports);
    install(executionScope);
    if(isMain) {
        defineReadOnlyProperty(this, "main", moduleObject);
    }
    executeOptionalScript(preExec, cx, executionScope);
    moduleScript.getScript().exec(cx, executionScope);
    executeOptionalScript(postExec, cx, executionScope);
    return ScriptRuntime.toObject(nativeScope,
            ScriptableObject.getProperty(moduleObject, "exports"));
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
public boolean execute(Context javascriptContext, Scriptable scope) throws EngineException {
	if (isEnabled()) {
		if (super.execute(javascriptContext, scope)) {
			evaluate(javascriptContext, scope, expression, "ContextAddTextNode", true);
			scope.put("__tmp__ContextAddTextNode", scope, evaluated);
			evaluate(javascriptContext, scope, "context.addTextNodeUnderRoot('"+tagname+"',__tmp__ContextAddTextNode)", "ContextSet", true);
			scope.delete("__tmp__ContextAddTextNode");
			
			return true;
		}
	}
	return false;
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
/**
 * 检测socket连接的host
 *
 * @param address socket连接地址
 */
public static void checkSocketHost(SocketAddress address) {
    try {
        if (address != null && address instanceof InetSocketAddress) {
            String hostName = ((InetSocketAddress) address).getHostName();
            JSContext cx = JSContextFactory.enterAndInitContext();
            Scriptable params = cx.newObject(cx.getScope());
            params.put("hostname", params, hostName);
            HookHandler.doCheck(CheckParameter.Type.SSRF, params);
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
private Scriptable executeModuleScript(Context cx, String id,
        Scriptable exports, ModuleScript moduleScript, boolean isMain)
{
    final ScriptableObject moduleObject = (ScriptableObject)cx.newObject(
            nativeScope);
    URI uri = moduleScript.getUri();
    URI base = moduleScript.getBase();
    defineReadOnlyProperty(moduleObject, "id", id);
    if(!sandboxed) {
        defineReadOnlyProperty(moduleObject, "uri", uri.toString());
    }
    final Scriptable executionScope = new ModuleScope(nativeScope, uri, base);
    // Set this so it can access the global JS environment objects.
    // This means we're currently using the "MGN" approach (ModuleScript
    // with Global Natives) as specified here:
    // <http://wiki.commonjs.org/wiki/Modules/ProposalForNativeExtension>
    executionScope.put("exports", executionScope, exports);
    executionScope.put("module", executionScope, moduleObject);
    moduleObject.put("exports", moduleObject, exports);
    install(executionScope);
    if(isMain) {
        defineReadOnlyProperty(this, "main", moduleObject);
    }
    executeOptionalScript(preExec, cx, executionScope);
    moduleScript.getScript().exec(cx, executionScope);
    executeOptionalScript(postExec, cx, executionScope);
    return ScriptRuntime.toObject(cx, nativeScope,
            ScriptableObject.getProperty(moduleObject, "exports"));
}
 

import org.mozilla.javascript.Scriptable; //导入方法依赖的package包/类
static public Scriptable copyScope(Context context, Scriptable scope) {
	Scriptable scopeCopy = context.initStandardObjects();
	for (Object id : scope.getIds()) {
		scopeCopy.put(id.toString(), scopeCopy, scope.get(id.toString(), scope));
	}
	return scopeCopy;
}