Changes for page Engine_XalanJ
on 2012/01/11 22:37
on 2012/01/11 23:22
Summary
-
Page properties (1 modified, 0 added, 0 removed)
-
Attachments (0 modified, 1 added, 0 removed)
Details
- Page properties
-
- Content
-
... ... @@ -25,16 +25,29 @@ 25 25 * Java properties disclosure 26 26 * Java environment disclosure 27 27 28 +== Java properties disclosure == 29 + 30 +The xsl:system-property() standard function can be called with non standard arguments, mapped to Java properties. 31 + 32 +|=Namespace|=Extension function|=PoC|=Sample output 33 +|http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]] 34 + 28 28 == Java environment disclosure == 29 29 30 -The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]) ,associated to the Xalan namespace,will display some information about the execution context (packages, paths, versions, ...).The output of the execution of [[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]] is [[attached>>attach:xalanj-checkenv-output.txt]].37 +The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]) will display some information about the execution context (packages, paths, versions, ...). 31 31 39 +|=Namespace|=Extension function|=PoC|=Sample output 40 +|http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]] 41 + 32 32 == Java code execution == 33 33 34 -The followingcode will display the current date:44 +The attached code will display the current date using a newly created "java.util.Date" object. This should be enough to demonstrate Java code execution. 35 35 36 -TODO 37 37 47 +|=Namespace|=Extension function|=PoC|=Sample output 48 +|http:~/~/xml.apache.org/xalan/java/java.util.Date|new()|[[xalanj-java-date.xsl>>attach:xalanj-java-date.xsl]]|Current date: 49 +Wed Jan 11 22:45:07 CET 2012 50 + 38 38 == Execution of external commands == 39 39 40 40 The following code will execute the command "touch /tmp/hello" :
- properties.xml
-
- Author
-
... ... @@ -1,0 +1,1 @@ 1 +xwiki:XWiki.NicolasGregoire - Size
-
... ... @@ -1,0 +1,1 @@ 1 +2.7 KB - Content
-
... ... @@ -1,0 +1,73 @@ 1 +<properties> 2 +<property>awt.toolkit</property> 3 +<property>browser</property> 4 +<property>browser.vendor</property> 5 +<property>browser.version</property> 6 +<property>file.encoding</property> 7 +<property>file.encoding.pkg</property> 8 +<property>file.separator</property> 9 +<property>file.separator.applet</property> 10 +<property>http.agent</property> 11 +<property>java.awt.graphicsenv</property> 12 +<property>java.awt.printerjob</property> 13 +<property>java.class.path</property> 14 +<property>java.class.version</property> 15 +<property>java.class.version.applet</property> 16 +<property>java.endorsed.dirs</property> 17 +<property>java.ext.dirs</property> 18 +<property>java.home</property> 19 +<property>java.io.tmpdir</property> 20 +<property>java.library.path</property> 21 +<property>java.runtime.name</property> 22 +<property>java.runtime.version</property> 23 +<property>java.specification.name</property> 24 +<property>java.specification.vendor</property> 25 +<property>java.specification.version</property> 26 +<property>java.vendor</property> 27 +<property>java.vendor.applet</property> 28 +<property>java.vendor.url</property> 29 +<property>java.vendor.url.applet</property> 30 +<property>java.vendor.url.bug</property> 31 +<property>java.version</property> 32 +<property>java.version.applet</property> 33 +<property>java.vm.info</property> 34 +<property>java.vm.name</property> 35 +<property>java.vm.specification.name</property> 36 +<property>java.vm.specification.vendor</property> 37 +<property>java.vm.specification.version</property> 38 +<property>java.vm.vendor</property> 39 +<property>java.vm.version</property> 40 +<property>javax.accessibility.assistive_technologies</property> 41 +<property>line.separator</property> 42 +<property>line.separator.applet</property> 43 +<property>os.arch</property> 44 +<property>os.arch.applet</property> 45 +<property>os.name</property> 46 +<property>os.name.applet</property> 47 +<property>os.version</property> 48 +<property>os.version.applet</property> 49 +<property>package.restrict.definition.java</property> 50 +<property>package.restrict.definition.sun</property> 51 +<property>path.separator</property> 52 +<property>path.separator.applet</property> 53 +<property>sun.arch.data.model</property> 54 +<property>sun.boot.class.path</property> 55 +<property>sun.boot.library.path</property> 56 +<property>sun.cpu.endian</property> 57 +<property>sun.cpu.isalist</property> 58 +<property>sun.desktop</property> 59 +<property>sun.io.unicode.encoding</property> 60 +<property>sun.java.launcher</property> 61 +<property>sun.jnu.encoding</property> 62 +<property>sun.management.compiler</property> 63 +<property>sun.os.patch.level</property> 64 +<property>user.country</property> 65 +<property>user.dir</property> 66 +<property>user.home</property> 67 +<property>user.language</property> 68 +<property>user.name</property> 69 +<property>user.timezone</property> 70 +<property>user.variant</property> 71 +<property>user.zoneinfo.dir</property> 72 +</properties> 73 +