T3MP3ST public launch build

bench/cve-hunt/samples/CVE-2017-9805/source.java

@@ -0,0 +1,32 @@
+// Struts2 REST plugin XStreamHandler.toObject() pre-CVE-2017-9805.
+// XStream deserialises XML from HTTP requests with NO type whitelist.
+
+package org.apache.struts2.rest.handler;
+
+import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.io.xml.DomDriver;
+
+import java.io.InputStream;
+import java.io.Reader;
+
+public class XStreamHandler {
+
+    private final XStream xstream;
+
+    public XStreamHandler() {
+        // BUG: default XStream constructor permits *every* Java class to be
+        // instantiated from XML, including ProcessBuilder, dynamic proxies,
+        // and the entire XStream gadget chain.
+        this.xstream = new XStream(new DomDriver());
+    }
+
+    public Object toObject(Reader in, Class<?> clazz) {
+        // No allowlist/security framework configured.
+        // Attacker-controlled XML drives object graph instantiation.
+        return xstream.fromXML(in);
+    }
+
+    public Object toObject(InputStream in, Class<?> clazz) {
+        return xstream.fromXML(in);
+    }
+}