k4n5ha0

兼任mysql5.7以上

为了兼容反向代理将绝对路径改为uri

3

如题

### 问题描述 https://github.com/alibaba/fastjson2/wiki/fastjson2_autotype_cn 以上wiki中描述： 1）显式打开后，会经过内置黑名单过滤。该黑名单能拦截大部分常见风险 2）当打开AutoTypeSupport，虽然内置了一个比较广泛的黑名单 但是下面这个commit中已经删掉了黑名单： https://github.com/alibaba/fastjson2/commit/f7d91ae3d003f185151feea380f9319df2610c17 ### 期待的正确结果 https://github.com/alibaba/fastjson2/wiki/fastjson2_autotype_cn 以上wiki中描述中黑名单的部分和代码实际应一致

防止文件名最后的字符为斜杠或反斜杠的绕过技巧  正则修改后的测试结果 

add a tag like #{} ${} reopen! i have a new idea!

8

Hi! i am a web security engineer. With my communicate, my colleagues accepted use #{} is safe. If don't check code very carefully, useing ${} wil be create a sql...

the old repo: https://github.com/client9/libinjection isn't update any more. Can you update libinjection code from https://github.com/libinjection/libinjection thx :-)

## Summary Two new functions are expected, isSqli and isXss，functions with no log but more speed ### Basic example ``` cfg := coraza.NewWAFConfig(). WithRootFS(coreruleset.FS). WithDirectives("Include @coraza.conf-recommended"). WithDirectivesFromFile("@owasp_crs/REQUEST*.conf") waf, err :=...

https://github.com/Kanatoko/libinjection-Java/issues/22#issue-1117278514 fix this problem

sqlmap 1.6 payload: EXP(~(SELECT * FROM (SELECT CONCAT(0x71707a6a71,(SELECT (CASE WHEN (5931=5931) THEN 1 ELSE 0 END)),0x716b7a7671,0x78))x)) java: rset = stmt.executeQuery ("SELECT * FROM vuln WHERE id = " + id);...

question：

1

private static String listToString(final List l) { StringBuffer buf = new StringBuffer(180); why this StringBuffer init as 180？ thx