Changes for page Engine_XalanJ
on 2012/01/11 23:22
on 2012/01/11 22:36
Summary
-
Page properties (1 modified, 0 added, 0 removed)
-
Attachments (0 modified, 0 added, 1 removed)
Details
- Page properties
-
- Content
-
... ... @@ -25,29 +25,16 @@ 25 25 * Java properties disclosure 26 26 * Java environment disclosure 27 27 28 -== Java properties disclosure==28 +== CheckEnv() == 29 29 30 -The xsl:system-property()standardfunction canbe calledwithnonstandardarguments, mappedtoJava properties.30 +The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]), associated to the Xalan namespace, will display some information about the execution context (packages, paths, versions, ...). The output of the execution of [[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]] is [[attached>>attach:xalanj-checkenv-output.txt]]. 31 31 32 -|=Namespace|=Extension function|=PoC|=Sample output 33 -|http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]] 34 - 35 -== Java environment disclosure == 36 - 37 -The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]) will display some information about the execution context (packages, paths, versions, ...). 38 - 39 -|=Namespace|=Extension function|=PoC|=Sample output 40 -|http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]] 41 - 42 42 == Java code execution == 43 43 44 -The attachedcode will display the current dateusing a newly created "java.util.Date" object. This should be enough to demonstrate Java code execution.34 +The following code will display the current date : 45 45 36 +TODO 46 46 47 -|=Namespace|=Extension function|=PoC|=Sample output 48 -|http:~/~/xml.apache.org/xalan/java/java.util.Date|new()|[[xalanj-java-date.xsl>>attach:xalanj-java-date.xsl]]|Current date: 49 -Wed Jan 11 22:45:07 CET 2012 50 - 51 51 == Execution of external commands == 52 52 53 53 The following code will execute the command "touch /tmp/hello" :
- properties.xml
-
- Author
-
... ... @@ -1,1 +1,0 @@ 1 -xwiki:XWiki.NicolasGregoire - Size
-
... ... @@ -1,1 +1,0 @@ 1 -2.7 KB - Content
-
... ... @@ -1,73 +1,0 @@ 1 -<properties> 2 -<property>awt.toolkit</property> 3 -<property>browser</property> 4 -<property>browser.vendor</property> 5 -<property>browser.version</property> 6 -<property>file.encoding</property> 7 -<property>file.encoding.pkg</property> 8 -<property>file.separator</property> 9 -<property>file.separator.applet</property> 10 -<property>http.agent</property> 11 -<property>java.awt.graphicsenv</property> 12 -<property>java.awt.printerjob</property> 13 -<property>java.class.path</property> 14 -<property>java.class.version</property> 15 -<property>java.class.version.applet</property> 16 -<property>java.endorsed.dirs</property> 17 -<property>java.ext.dirs</property> 18 -<property>java.home</property> 19 -<property>java.io.tmpdir</property> 20 -<property>java.library.path</property> 21 -<property>java.runtime.name</property> 22 -<property>java.runtime.version</property> 23 -<property>java.specification.name</property> 24 -<property>java.specification.vendor</property> 25 -<property>java.specification.version</property> 26 -<property>java.vendor</property> 27 -<property>java.vendor.applet</property> 28 -<property>java.vendor.url</property> 29 -<property>java.vendor.url.applet</property> 30 -<property>java.vendor.url.bug</property> 31 -<property>java.version</property> 32 -<property>java.version.applet</property> 33 -<property>java.vm.info</property> 34 -<property>java.vm.name</property> 35 -<property>java.vm.specification.name</property> 36 -<property>java.vm.specification.vendor</property> 37 -<property>java.vm.specification.version</property> 38 -<property>java.vm.vendor</property> 39 -<property>java.vm.version</property> 40 -<property>javax.accessibility.assistive_technologies</property> 41 -<property>line.separator</property> 42 -<property>line.separator.applet</property> 43 -<property>os.arch</property> 44 -<property>os.arch.applet</property> 45 -<property>os.name</property> 46 -<property>os.name.applet</property> 47 -<property>os.version</property> 48 -<property>os.version.applet</property> 49 -<property>package.restrict.definition.java</property> 50 -<property>package.restrict.definition.sun</property> 51 -<property>path.separator</property> 52 -<property>path.separator.applet</property> 53 -<property>sun.arch.data.model</property> 54 -<property>sun.boot.class.path</property> 55 -<property>sun.boot.library.path</property> 56 -<property>sun.cpu.endian</property> 57 -<property>sun.cpu.isalist</property> 58 -<property>sun.desktop</property> 59 -<property>sun.io.unicode.encoding</property> 60 -<property>sun.java.launcher</property> 61 -<property>sun.jnu.encoding</property> 62 -<property>sun.management.compiler</property> 63 -<property>sun.os.patch.level</property> 64 -<property>user.country</property> 65 -<property>user.dir</property> 66 -<property>user.home</property> 67 -<property>user.language</property> 68 -<property>user.name</property> 69 -<property>user.timezone</property> 70 -<property>user.variant</property> 71 -<property>user.zoneinfo.dir</property> 72 -</properties> 73 -