Java中的RASP机制实现详解

/**
 * @author linx
 * @date 2017-06-25
*/
public class JavaRASPApp {

 public static void premain(String agentArgs, Instrumentation instru) throws ClassNotFoundException, UnmodifiableClassException {
  System.out.println("premain");
  instru.addTransformer(new ClassTransformer());
 }
}

/**
 * @author linxin
 * @version v1.0
 *     Copyright (c) 2017 by linx
 * @date 2017/6/23.
*/
 public class ClassTransformer implements ClassFileTransformer {
 public byte[] transform(ClassLoader loader, String className, Class<?> classBeingRedefined, ProtectionDomain protectionDomain, byte[] classfileBuffer){
  byte[] transformeredByteCode = classfileBuffer;
  try {

    if (className.equals("co/solinx/demo/Test")) {
      System.out.println(String.format("transform start %s",className));
      ClassReader reader = new ClassReader(classfileBuffer);
      ClassWriter writer = new ClassWriter(ClassWriter.COMPUTE_MAXS);
      ClassVisitor classVisitor = (ClassVisitor) createVisitorIns("co.solinx.demo.visitor.TestVisitor", writer, className);
      reader.accept(classVisitor, ClassReader.EXPAND_FRAMES);
      transformeredByteCode = writer.toByteArray(); 
    }
  } catch (Exception e) {
    e.printStackTrace();
  }catch (Throwable t){
    t.printStackTrace();
  }
  return transformeredByteCode;
}
 public Object createVisitorIns(final String name, ClassVisitor cv, String className)
    throws NoSuchMethodException, InstantiationException, IllegalAccessException, InvocationTargetException, ClassNotFoundException {
  Constructor<?> ctor = Class.forName(name).getDeclaredConstructor(new Class[]{ClassVisitor.class, String.class});
  ctor.setAccessible(true);
  return ctor.newInstance(new Object[]{cv, className});
 }
}

@Override
protected void onMethodEnter() { 
  mv.visitTypeInsn(NEW,"co/solinx/demo/filter/SqlFilter");
  mv.visitInsn(DUP);
  mv.visitMethodInsn(INVOKESPECIAL,"co/solinx/demo/filter/SqlFilter","<init>","()V",false);
  mv.visitVarInsn(ASTORE,2);
  mv.visitVarInsn(ALOAD,2);
  mv.visitVarInsn(ALOAD,1);
  mv.visitMethodInsn(INVOKEVIRTUAL,"co/solinx/demo/filter/SqlFilter", "filter","(Ljava/lang/Object;)Z",false);
  Label label = new Label();
  /**
   * IFEQ filter返回值也就是栈顶int型数值等于true时跳转，抛出异常
   */
  mv.visitJumpInsn(IFEQ, label); 
  mv.visitTypeInsn(NEW, "java/sql/SQLException");
  mv.visitInsn(DUP);
  mv.visitLdcInsn("invalid sql because of security check");
  mv.visitMethodInsn(INVOKESPECIAL, "java/sql/SQLException", "<init>", "(Ljava/lang/String;)V", false);
  mv.visitInsn(ATHROW);
  mv.visitLabel(label);
  /**
   * 必须要调该方法，手动设置Stack Map Table，否则会有 java.lang.VerifyError: Expecting a stackmap frame at branch target 26异常
   * 在jdk1.7中可以使用JVM参数-UseSplitVerifier，关掉class验证，但jdk1.8中该参数已经去掉，所以要在1.8中运行必须调用该方法；
   */
  mv.visitFrame(Opcodes.F_SAME, 0, null, 0, null);
 } 

public class SqlFilter {
public boolean filter(Object sql){
  boolean ret=false;
  System.out.println(String.format("sql filter : %s ",sql));
  if(sql.toString().contains("1=1")){
    ret=true;
  }
  return ret;
}
}