overlongMode 生成报错

未关闭

#64 创建于 2026年9月24日 0 条评论 0 个 reaction 已指派 0 人在 GitHub 查看

还没有人认领这个 Issue。

评估

难度: 4/5
预计耗时: 3-5 天
新手友好度: 45/100

Issue 类型: 缺陷
描述清晰度: 基本清楚
活跃度: 活跃
技术栈: java, spring, spring-boot
领域: backend, security

调研方向

The error occurs in SerializationObfuscator.java at line 244 in the changeTC_STRING method when overlongMode=2 is enabled. Start by examining the method to understand how it handles UTF-8 overlong encoding. Look at the array index logic and the input data that leads to the ArrayIndexOutOfBoundsException. Run the specific chain mentioned to reproduce the issue and debug the obfuscation process.

由索引模型根据 Issue 内容生成。

描述

/TextAndMnemonicHashMapToStringHighJDK/RomeToStringBean1/OracleFilteredRowSet/JavaNativePayload.overlongMode=2

比如这个链，如果开了纯2字节 utf8 overlong encoding 混淆则会报错，看起来是混淆器里面处理逻辑的问题

09-24 13:32:46.161 ERROR [8011-exec-10] o.v.j.w.s.p.ChainBuildService     [127.0.0.1] | 12482
java.lang.ArrayIndexOutOfBoundsException: 12482
        at org.vulhub.javachains.nodes.payload.enhance.SerializationObfuscator.changeTC_STRING(SerializationObfuscator.java:244)
        at org.vulhub.javachains.nodes.payload.enhance.SerializationObfuscator.build(SerializationObfuscator.java:76)
        at org.vulhub.javachains.nodes.payload.AbstractJavaNative.marshal(AbstractJavaNative.java:148)
        at org.vulhub.javachains.nodes.payload.JavaNativePayload.marshal(JavaNativePayload.java:30)
        at org.vulhub.javachains.nodes.payload.AbstractJavaNative.invoke(AbstractJavaNative.java:105)
        at org.vulhub.javachains.core.GadgetChainImpl.doCreate(GadgetChainImpl.java:58)
        at org.vulhub.javachains.core.ExecutionEngine.build(ExecutionEngine.java:488)
        at org.vulhub.javachains.web.service.payload.ChainBuildService.build(ChainBuildService.java:62)
        at org.vulhub.javachains.web.service.payload.ChainBuildService.build(ChainBuildService.java:32)
        at org.vulhub.javachains.web.service.payload.PayloadGenerateService.materialize(PayloadGenerateService.java:37)
        at org.vulhub.javachains.web.service.payload.PayloadGenerateService.generate(PayloadGenerateService.java:26)
        at org.vulhub.javachains.web.controller.ApiController.generate(ApiController.java:234)
        at sun.reflect.GeneratedMethodAccessor141.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:190)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:105)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:878)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:792)
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1040)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:943)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:652)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:733)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.vulhub.javachains.web.filter.RequestLoggingFilter.doFilter(RequestLoggingFilter.java:40)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.vulhub.javachains.web.filter.MDCFilter.doFilter(MDCFilter.java:19)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:320)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:126)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:90)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:118)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.vulhub.javachains.web.security.ApiTokenFilter.doFilterInternal(ApiTokenFilter.java:149)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:158)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:132)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:92)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:92)
        at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:77)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:893)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1707)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:750)

主要语言: Shell
星标: 2.2k
派生: 174
PR 合并指标: 30 天内没有已合并 PR

环境准备

提供 Dockerfile 或 Docker Compose 文件
没有 Pull Request 模板
没有贡献指南

从这里开始

先读完整个 Issue，再读项目的贡献指南。
在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
Fork 仓库，在一个分支上完成修改。
提交 Pull Request，并在描述里引用这个 Issue 编号。

vulhub/java-chains 的其他 Issue

让echo链支持输出命令执行结果到响应头中
未关闭
- 哪里不对？
难度 3/5 1-2 天新手友好度 52/100

vulhub/java-chains#65 · 2026年10月1日创建
AspectJLazyMethodGen 相关链报错，无法生成
未关闭
- 哪里不对？
难度 4/5 3-5 天新手友好度 35/100

vulhub/java-chains#63 · 2026年9月24日创建
Hiber2jdbc 相关链无法生成
未关闭
- 哪里不对？
难度 4/5 3-5 天新手友好度 30/100

vulhub/java-chains#62 · 2026年9月24日创建
JNDI 爆破链不支持 ldap://ip:50389/a=XXXXX 格式
未关闭
- 哪里不对？
BUG

难度 3/5 1-2 天新手友好度 52/100

vulhub/java-chains#61 · 1 条评论 · 2026年9月20日创建
mcp服务连不上
未关闭
- 哪里不对？
BUG

难度 4/5 3-5 天新手友好度 25/100

vulhub/java-chains#60 · 2 条评论 · 2026年9月9日创建

查看 vulhub/java-chains 的全部 Issue

相似的 Issue

Piwigo Docker: After update to 16.4.0.b from 16.4.0.a the PIWIGO_UID and PIWIGO_GID are no longer used
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 66/100

Piwigo/piwigo-docker#18 · 2026年10月7日创建
pre-push hook runs the full quality suite on a ref-deletion push, so deleting a tag needs --no-verify
未关闭
- 哪里不对？
bug

难度 2/5 1-3 小时新手友好度 88/100

jlaustill/c-next#1923 · 2026年10月7日创建

维护者通常 1 天内回复
docs: tutorial 7 still references removed A2AStarletteApplication
可能已有人在做 @FOWEPJF255 今天认领。未关闭
- 哪里不对？
难度 1/5 1 小时以内新手友好度 92/100

a2aproject/A2A#2321 · 2026年10月7日创建

维护者通常 1 天内回复
Remove forward button from amendments
未关闭
- 哪里不对？
bug

难度 2/5 1-3 小时新手友好度 74/100

OpenSlides/OpenSlides#7180 · 2026年10月7日创建
golden: test 4 blir ikke målt med OpenCode (bare én tur)
未关闭
- 哪里不对？
难度 2/5 1-3 小时新手友好度 72/100

navikt/copilot#1451 · 2026年10月7日创建

维护者通常 1 天内回复

更多 Shell/Bash Issue

overlongMode 生成报错

哪里不对？

评估

调研方向

描述

环境准备

从这里开始

vulhub/java-chains 的其他 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

相似的 Issue

哪里不对？

哪里不对？

哪里不对？

哪里不对？

哪里不对？

把新 issue 发到你的邮箱