探寻 Java 文件上传流量层面 waf 绕过( 六 ) _waf

可以看到一方面是QP编码，另一方面也是支持 filename* ,同样获取值是截取 " 之间的或者没找到就直接截取 = 后面的部分

文章插图

如果是 filename* 后面的处理逻辑就是else分之，可以看出和我们上面分析spring4还是有点区别就是这里只支持 UTF-8/ISO-8859-1/US_ASCII ，编码受限制

int idx1 = value.indexOf(39);int idx2 = value.indexOf(39, idx1 + 1);if (idx1 != -1 && idx2 != -1) {charset = Charset.forName(value.substring(0, idx1).trim());Assert.isTrue(StandardCharsets.UTF_8.equals(charset) || StandardCharsets.ISO_8859_1.equals(charset), "Charset should be UTF-8 or ISO-8859-1");filename = decodeFilename(value.substring(idx2 + 1), charset);} else {filename = decodeFilename(value, StandardCharsets.US_ASCII);}

但其实仔细想这个结果是符合RFC文档要求的

文章插图

接着我们继续后面会继续执行 decodeFilename

文章插图

代码逻辑很清晰字符串的解码,如果字符串是否在 RFC 5987 文档规定的Header字符就直接调用baos.write写入

attr-char= ALPHA / DIGIT/ "!" / "#" / "$" / "&" / "+" / "-" / "."/ "^" / "_" / "`" / "|" / "~"; token except ( "*" / "'" / "%" )

如果不在要求这一位必须是 % 然后16进制解码后两位，其实就是url解码，简单测试即可

文章插图

"双写"绕过来看看核心部分

public static ContentDisposition parse(String contentDisposition) {List<String> parts = tokenize(contentDisposition);String type = (String)parts.get(0);String name = null;String filename = null;Charset charset = null;Long size = null;ZonedDateTime creationDate = null;ZonedDateTime modificationDate = null;ZonedDateTime readDate = null;for(int i = 1; i < parts.size(); ++i) {String part = (String)parts.get(i);int eqIndex = part.indexOf(61);if (eqIndex == -1) {throw new IllegalArgumentException("Invalid content disposition format");}String attribute = part.substring(0, eqIndex);String value = https://www.isolves.com/it/cxkf/yy/JAVA/2022-07-13/part.startsWith(""", eqIndex + 1) && part.endsWith(""") ? part.substring(eqIndex + 2, part.length() - 1) : part.substring(eqIndex + 1);if (attribute.equals("name")) {name = value;} else if (!attribute.equals("filename*")) {//限制了如果为null才能赋值if (attribute.equals("filename") && filename == null) {if (value.startsWith("=?")) {Matcher matcher = BASE64_ENCODED_PATTERN.matcher(value);if (matcher.find()) {String match1 = matcher.group(1);String match2 = matcher.group(2);filename = new String(Base64.getDecoder().decode(match2), Charset.forName(match1));} else {filename = value;}} else {filename = value;}} else if (attribute.equals("size")) {size = Long.parseLong(value);} else if (attribute.equals("creation-date")) {try {creationDate = ZonedDateTime.parse(value, DateTimeFormatter.RFC_1123_DATE_TIME);} catch (DateTimeParseException var20) {}} else if (attribute.equals("modification-date")) {try {modificationDate = ZonedDateTime.parse(value, DateTimeFormatter.RFC_1123_DATE_TIME);} catch (DateTimeParseException var19) {}} else if (attribute.equals("read-date")) {try {readDate = ZonedDateTime.parse(value, DateTimeFormatter.RFC_1123_DATE_TIME);} catch (DateTimeParseException var18) {}}} else {int idx1 = value.indexOf(39);int idx2 = value.indexOf(39, idx1 + 1);if (idx1 != -1 && idx2 != -1) {charset = Charset.forName(value.substring(0, idx1).trim());Assert.isTrue(StandardCharsets.UTF_8.equals(charset) || StandardCharsets.ISO_8859_1.equals(charset), "Charset should be UTF-8 or ISO-8859-1");filename = decodeFilename(value.substring(idx2 + 1), charset);} else {filename = decodeFilename(value, StandardCharsets.US_ASCII);}}}return new ContentDisposition(type, name, filename, charset, size, creationDate, modificationDate, readDate);}

spring5当中又和spring4逻辑有区别，导致我们又可以"双写"绕过(至于为什么我要打引号可以看看我代码中的注释)，因此如果我们先传 filename=xxx 再传 filename*=xxx ，由于没有前面提到的 filename == null 的判断，造成可以覆盖 filename 的值