
Exploit pour CVE-2016-9177 ciblant le framework web Spark Java, démontrant une vulnérabilité de traversée de répertoire dans la version 2.5.1 pour les tests de sécurité et l'analyse des vulnérabilités.
Spark 2.9.4 est sorti !!
<dependency>
<groupId>com.sparkjava</groupId>
<artifactId>spark-core</artifactId>
<version>2.9.4</version>
</dependency>
Sponsorisez le projet ici https://github.com/sponsors/perwendel
Pour la documentation, rendez-vous sur : http://sparkjava.com/documentation
Pour les questions d'utilisation, veuillez utiliser Stack Overflow avec le tag “spark-java”
Javadoc : http://javadoc.io/doc/com.sparkjava/spark-core
Lors des commits sur le projet, veuillez utiliser le format Spark configuré dans https://github.com/perwendel/spark/blob/master/config/spark_formatter_intellij.xml
<dependency>
<groupId>com.sparkjava</groupId>
<artifactId>spark-core</artifactId>
<version>2.9.4</version>
</dependency>
import static spark.Spark.*;
public class HelloWorld {
public static void main(String[] arg){
get("/hello", (request, response) -> "Hello World!");
}
}
Voir à : http://localhost:4567/hello
Consultez et essayez les exemples dans le code source. Vous pouvez aussi consulter la javadoc. Après avoir récupéré le source depuis github, exécutez :
mvn javadoc:javadoc
Le résultat se trouve dans /target/site/apidocs
Exemple simple montrant quelques fonctionnalités de base
import static spark.Spark.*;
/**
* A simple example just showing some basic functionality
*/
public class SimpleExample {
public static void main(String[] args) {
// port(5678); <- Uncomment this if you want spark to listen to port 5678 instead of the default 4567
get("/hello", (request, response) -> "Hello World!");
post("/hello", (request, response) ->
"Hello World: " + request.body()
);
get("/private", (request, response) -> {
response.status(401);
return "Go Away!!!";
});
get("/users/:name", (request, response) -> "Selected user: " + request.params(":name"));
get("/news/:section", (request, response) -> {
response.type("text/xml");
return "<?xml version=\"1.0\" encoding=\"UTF-8\"?><news>" + request.params("section") + "</news>";
});
get("/protected", (request, response) -> {
halt(403, "I don't think so!!!");
return null;
});
get("/redirect", (request, response) -> {
response.redirect("/news/world");
return null;
});
get("/", (request, response) -> "root");
}
}
Un exemple CRUD simple montrant comment créer, obtenir, mettre à jour et supprimer des ressources de livres
import static spark.Spark.*;
import java.util.HashMap;
import java.util.Map;
import java.util.Random;
/**
* A simple CRUD example showing how to create, get, update and delete book resources.
*/
public class Books {
/**
* Map holding the books
*/
private static Map<String, Book> books = new HashMap<String, Book>();
public static void main(String[] args) {
final Random random = new Random();
// Creates a new book resource, will return the ID to the created resource
// author and title are sent in the post body as x-www-urlencoded values e.g. author=Foo&title=Bar
// you get them by using request.queryParams("valuename")
post("/books", (request, response) -> {
String author = request.queryParams("author");
String title = request.queryParams("title");
Book book = new Book(author, title);
int id = random.nextInt(Integer.MAX_VALUE);
books.put(String.valueOf(id), book);
response.status(201); // 201 Created
return id;
});
// Gets the book resource for the provided id
get("/books/:id", (request, response) -> {
Book book = books.get(request.params(":id"));
if (book != null) {
return "Title: " + book.getTitle() + ", Author: " + book.getAuthor();
} else {
response.status(404); // 404 Not found
return "Book not found";
}
});
// Updates the book resource for the provided id with new information
// author and title are sent in the request body as x-www-urlencoded values e.g. author=Foo&title=Bar
// you get them by using request.queryParams("valuename")
put("/books/:id", (request, response) -> {
String id = request.params(":id");
Book book = books.get(id);
if (book != null) {
String newAuthor = request.queryParams("author");
String newTitle = request.queryParams("title");
if (newAuthor != null) {
book.setAuthor(newAuthor);
}
if (newTitle != null) {
book.setTitle(newTitle);
}
return "Book with id '" + id + "' updated";
} else {
response.status(404); // 404 Not found
return "Book not found";
}
});
// Deletes the book resource for the provided id
delete("/books/:id", (request, response) -> {
String id = request.params(":id");
Book book = books.remove(id);
if (book != null) {
return "Book with id '" + id + "' deleted";
} else {
response.status(404); // 404 Not found
return "Book not found";
}
});
// Gets all available book resources (ids)
get("/books", (request, response) -> {
String ids = "";
for (String id : books.keySet()) {
ids += id + " ";
}
return ids;
});
}
public static class Book {
public String author, title;
public Book(String author, String title) {
this.author = author;
this.title = title;
}
public String getAuthor() {
return author;
}
public void setAuthor(String author) {
this.author = author;
}
public String getTitle() {
return title;
}
public void setTitle(String title) {
this.title = title;
}
}
}
Exemple montrant un filtre d'authentification très simple (et stupide) qui est exécuté avant toutes les autres ressources
import static spark.Spark.*;
import java.util.HashMap;
import java.util.Map;
/**
* Example showing a very simple (and stupid) authentication filter that is
* executed before all other resources.
*
* When requesting the resource with e.g.
* http://localhost:4567/hello?user=some&password=guy
* the filter will stop the execution and the client will get a 401 UNAUTHORIZED with the content 'You are not welcome here'
*
* When requesting the resource with e.g.
* http://localhost:4567/hello?user=foo&password=bar
* the filter will accept the request and the request will continue to the /hello route.
*
* Note: There is a second "before filter" that adds a header to the response
* Note: There is also an "after filter" that adds a header to the response
*/
public class FilterExample {
private static Map<String, String> usernamePasswords = new HashMap<String, String>();