yupd

[bug] java.lang.ClassCircularityError: sun/net/www/protocol/http/HttpURLConnection

2

2023-10-26 12:24:09.791 WARNING localhost.localdomain [__DEFAULT__] [com.jrasp.agent.core.manager.RaspClassFileTransformer._transform] transform: sun/net/www/protocol/http/HttpURLConnection failed, in loader: null java.lang.ClassCircularityError: sun/net/www/protocol/http/HttpURLConnection at java.lang.Class.forName0(Native Method) at java.lang.Class.forName(Class.java:348) at com.jrasp.agent.core.enhance.EventEnhancer$1.getCommonSuperClass(EventEnhancer.java:50) at org.objectweb.asm.SymbolTable.addMergedType(SymbolTable.java:1202) at org.objectweb.asm.Frame.merge(Frame.java:1299) at org.objectweb.asm.Frame.merge(Frame.java:1207) at org.objectweb.asm.MethodWriter.computeAllFrames(MethodWriter.java:1611) at...

上传的压缩包里面包含jsp或exe文件解压会被拦截有办法解决吗？

5

场景是系统升级一般会上传一个zip包，里面包含各种各样的文件。

[bug] request.getRequestURL() 存在绕过的问题

4

例如：对 url `/demo/test.do` 设置黑名单，可以通过 `/demo/;xx/test.do` 绕过。

Could not read from transfer socket: ECONNABORTED 226 Closing data connection.