1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.eclipse.jetty.nested;
20
21 import java.io.BufferedInputStream;
22 import java.io.BufferedReader;
23 import java.io.ByteArrayOutputStream;
24 import java.io.File;
25 import java.io.IOException;
26 import java.io.InputStreamReader;
27 import java.io.PrintStream;
28 import java.net.InetSocketAddress;
29 import java.net.ServerSocket;
30 import java.net.Socket;
31 import java.net.SocketAddress;
32 import java.util.concurrent.CountDownLatch;
33
34 import javax.servlet.ServletException;
35 import javax.servlet.ServletOutputStream;
36 import javax.servlet.http.HttpServlet;
37 import javax.servlet.http.HttpServletRequest;
38 import javax.servlet.http.HttpServletResponse;
39
40 import org.eclipse.jetty.util.IO;
41 import org.eclipse.jetty.util.TypeUtil;
42
43 public class TestServlet extends HttpServlet
44 {
45
46
47
48
49 @Override
50 protected void doGet(final HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException
51 {
52 resp.setContentType("text/plain");
53 final PrintStream out = new PrintStream(resp.getOutputStream());
54
55 out.println("Try out evil things.");
56
57 try
58 {
59 out.println("\nList home dir...");
60 for (File f : new File("/home").listFiles())
61 out.println(f);
62 }
63 catch(Throwable e)
64 {
65 e.printStackTrace(out);
66 }
67 try
68 {
69 out.println("\nList tmp dir...");
70 for (File f : new File("/var/tmp").listFiles())
71 out.println(f);
72 }
73 catch(Throwable e)
74 {
75 e.printStackTrace(out);
76 }
77
78 try
79 {
80 out.println("\nCreate a /var/tmp file...");
81 File file = new File("/var/tmp/eviltest");
82
83 out.println(file+" exists="+file.exists());
84 file.createNewFile();
85 file.deleteOnExit();
86 out.println(file+" exists="+file.exists());
87 file.delete();
88 }
89 catch(Throwable e)
90 {
91 e.printStackTrace(out);
92 }
93
94
95 try
96 {
97 out.println("\nOpen a localhost server socket ...");
98
99 ServerSocket socket = new ServerSocket();
100 socket.bind(new InetSocketAddress("localhost",0));
101 out.println("local port = "+socket.getLocalPort());
102 }
103 catch(Throwable e)
104 {
105 e.printStackTrace(out);
106 }
107
108 try
109 {
110 out.println("\nOpen a any server socket ...");
111
112 ServerSocket socket = new ServerSocket();
113 socket.bind(new InetSocketAddress(0));
114 out.println("local port = "+socket.getLocalPort());
115 }
116 catch(Throwable e)
117 {
118 e.printStackTrace(out);
119 }
120 try
121 {
122 out.println("\nTalk to any server socket ...");
123
124 final ServerSocket server = new ServerSocket();
125 server.bind(new InetSocketAddress(0));
126 out.println("local port = "+server.getLocalPort());
127 final int port = server.getLocalPort();
128
129 final CountDownLatch latch = new CountDownLatch(1);
130
131 new Thread()
132 {
133 public void run()
134 {
135 try
136 {
137 Socket inbound = server.accept();
138 out.println("accepted "+inbound);
139 BufferedReader in = new BufferedReader(new InputStreamReader(inbound.getInputStream()));
140 String data= in.readLine();
141 out.println("read "+data);
142 }
143 catch(Throwable e)
144 {
145 e.printStackTrace(out);
146 }
147 finally
148 {
149 latch.countDown();
150 }
151 }
152 }.start();
153
154
155 Socket socket = new Socket("localhost",port);
156 socket.getOutputStream().write("Hello World\n".getBytes());
157
158 latch.await();
159 socket.close();
160 }
161 catch(Throwable e)
162 {
163 e.printStackTrace(out);
164 }
165
166 try
167 {
168 out.println("\nRead to own content ...");
169 out.println("Real path / = "+getServletContext().getRealPath("/"));
170
171 for (File f : new File(getServletContext().getRealPath("/")).listFiles())
172 out.println(f);
173
174 }
175 catch(Throwable e)
176 {
177 e.printStackTrace(out);
178 }
179
180
181 try
182 {
183 out.println("\nWrite own content ...");
184
185 File wibble = new File(getServletContext().getRealPath("/wibble.txt"));
186 if (!wibble.exists())
187 wibble.createNewFile();
188
189 for (File f : new File(getServletContext().getRealPath("/")).listFiles())
190 out.println(f);
191
192 }
193 catch(Throwable e)
194 {
195 e.printStackTrace(out);
196 }
197
198 out.flush();
199 out.close();
200 }
201
202
203 }