Files
Penetration_Testing_POC/books/U8cloud base64 SQL注入漏洞分析.html
T

194 lines
2.3 MiB
HTML
Raw Normal View History

2024-05-01 12:35:42 +08:00
<!DOCTYPE html> <html><!--
Page saved with SingleFile
url: https://forum.butian.net/share/2879
--><meta charset=utf-8>
<meta http-equiv=X-UA-Compatible content="IE=edge">
<meta name=viewport content="width=device-width, initial-scale=1">
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
<title>U8cloud base64 SQL注入漏洞分析</title>
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
<meta name=description content="奇安信攻防社区-U8cloud base64 SQL注入漏洞分析">
<meta name=author content="QIANXIN Team">
<meta name=copyright content="2021 QIANXIN.com">
<style>@media(max-width:767px){}</style>
<style>/*!
* Bootstrap v3.4.1 (https://getbootstrap.com/)
* Copyright 2011-2019 Twitter, Inc.
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}ul{margin-top:0;margin-bottom:10px}@media(min-width:768px){}code{color:#c7254e}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@m
<style>/*!
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}</style>
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body h2{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body p{margin-top:0;margin-bottom:16px}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
<!--[if lt IE 9]>
<script src="/static/js/html5shiv.min.js"></script>
<script src="/static/js/respond.min.js"></script>
<![endif]-->
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.
* Waves v0.7.5
* http://fian.my.id/Waves
*
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
* Released under the MIT license
* https://github.com/fians/Waves/blob/master/LICENSE
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:transl
<body>
<div class="global-nav mb-50" style="display:none !important">
</div>
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
<!--[if lt IE 9]>
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
</div>
<![endif]-->
</div>
<div class=wrap>
<div class=container>
<div class="row mt-10">
<div class="col-xs-12 col-md-9 main">
<div class=widget-article>
<h3 class="title word-wrap">U8cloud base64 SQL注入漏洞分析</h3>
<ul class=taglist-inline>
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
</ul>
<div class="content mt-10">
<div class="quote mb-20">
U8cloud base64 SQL注入漏洞分析,真的是file/upload/base64导致的SQL注入吗?
</div>
<textarea id=md_view_content style=display:none>0x00 前言
-------
前段时间爆出一个`U8cloud`的SQL注入,路径为`/u8cloud/api/file/upload/base64`,在此之前也做过`U8cloud`的代码审计,没有发现和这个路径类似的路径,正好这次有时间,来复现分析一下这个漏洞到底是怎么回事。
0x01 漏洞复现
---------
按照网上给出的`POC`,利用结果如下图,注入点在请求头的`system`字段。
![image-20240328161532324.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-16165211647bc929797ced0fe0ef5d89b5c4e1bc.png)
但是神奇的是,如果吧路径中的`file/upload/base64`随便替换为其他东西,会发现居然也能成功注入,这就很耐人寻味了,这个漏洞和`file/upload/base64`居然没有半毛钱关系。
![image-20240328161614286.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-85beeb9160cdcb643758731729caae3cae3056f7.png)
0x02 漏洞分析
---------
接下来掏出朋友给的一份编译后的源码,全局搜索`u8cloud/api`,很快就在`webapps/u8c_web/WEB-INF/web.xml`中找到了这个路径,对应的`servlet`是`ExtSystemInvokerServlet`,除了他以外,`/u8cloud/openapi/*`、`/u8cloud/yls/*`、`/u8cloud/extsystem/dst/*`三个路径也都对应到了`ExtSystemInvokerServlet`。
![image-20240328161853625.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-4c9d647d9d42b78f1a4548ca9dc129f8935f02d4.png)
而这个`ExtSystemInvokerServlet`的位置在`fw.jar!\nc\bs\framework\server\extsys\ExtSystemInvokerServlet`。
找到这个类,来看他的`doAction()`方法。重点关注一下`ExtSystemServerEnum`和`serviceName`
![image-20240328162232869.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-e6669ace78c9b3d51ec502bcd1408b1212364402.png)
`ExtSystemServerEnum`是一个枚举类,包含`/u8cloud/yls`、`/u8cloud/extsystem/dst`、`/u8cloud/api/`、`/u8cloud/openapi/`四个常量。
![image-20240328162257202.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-161ffad5779f1b7cea5636902d2d7cfce9a0c959.png)
回到上面的`doAction()`方法,我们要保证我们的`request.getRequestURI()`必须是以上述四个常量之一开头才可以,否则会抛出异常,也就是说不能按照一般的`/servlet/*`路径根据模块名和包名去调用,否则就会报错。
此时,如果我们访问的路径是`/u8cloud/api/file/upload/base64`,就会匹配到`/u8cloud/api/`,然后`serviceName`就被赋值为`u8cloud_api`。
接着一路向下,进入`getServiceObject()`。
![image-20240328163014414.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-c17221eb8cd5c0229bd0b9f75011a1c6a7787719.png)
根据`serviceName`也就是`u8cloud_api`去找对应的类。这里具体逻辑感兴趣的可以自行去分析,偷了个懒。
![image-20240328163048771.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-e46d6e4850d49456a9a3305baa81b81015ec2b85.png)
根据这项目的惯性,一般就是在各种配置文件中进行的配置。全局搜索一下`u8cloud_api`,在`/modules/uap/META-INF/P_API.upm`中找到如下所示的配置,找到`u8c.server.APIServletForJSON`这么一个类。
![image-20240328163229930.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-13a66b468386e99841a2b3f4c2536004a6f74c7c.png)
继续跟进,在`doAction()`方法中,会先判断`request.getPathInfo()`,显然不是以`file.`开头,进入`APIController.forWard(request)`。
![image-20240328163340359.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-511819cc286f5d0ead9e1c4215ae5717e07be206.png)
在`APIController.forWard()`中,会发现存在`checkUser()`进行校验,跟进看一下。
![image-20240328163524035.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-dbc833150d6816095a481b56ca398257925725e6.png)
在这个地方,看到了本次分析的主角`system`,通过`inputData.getSystem()`获取,然后传入`APIOutSysUtil.getOutSysVOByCode()`中。
![image-20240328163600802.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-954b8878d8a91d168a679a53b5ab4c75d5537059.png)
继续跟进一下,明晃晃的字符串拼接就出现了,就造成了`SQL`注入。
![image-20240328163649632.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-47a41ec345fa4c90b36c24d1b347dd3fe6761660.png)
还在校验身份甚至没有到校验授权的时候就完成了注入,这也就是我们请求`/u8cloud/api/f`都可以成功注入的原因了。
![image-20240328163818819.png](https://shs3.b.qianxin.com/attack_forum/2024/03/attach-3c7f8c6490b1cd172295424ab714e664b75c1861.png)
0x03 后续
-------
自此,关于这个漏洞的一些情况就分析完毕了,但是也还是遗留了一些问题,比如`/u8cloud/api/`后的服务模块具体是怎么调用的,感兴趣的师傅们就自行去研究了。</textarea>
<div id=layer-photos-demo>
<div id=md_view><div class=markdown-body><h2 blockindex=0>0x00 前言</h2>
<p blockindex=1>前段时间爆出一个<code>U8cloud</code>的SQL注入,路径为<code>/u8cloud/api/file/upload/base64</code>,在此之前也做过<code>U8cloud</code>的代码审计,没有发现和这个路径类似的路径,正好这次有时间,来复现分析一下这个漏洞到底是怎么回事。</p>
<h2 blockindex=2>0x01 漏洞复现</h2>
<p blockindex=3>按照网上给出的<code>POC</code>,利用结果如下图,注入点在请求头的<code>system</code>字段。</p>
<p blockindex=4><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkgAAAKNCAYAAABr4ucqAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xN9//A8Ve2SojYKza19yy1SlF7tKjRWqVVX1QVRWnV3qpiFFV7VYgZM0ZiEyMECZEEiZGI7Nwkvz/u757mujdxc+/NwPv5eOThOufzOZ/POZ9z7j3nfJZFQkJCMkIIIYQQQgjx/6ytrdNcr1KpMiknQgghhBBCCGG4Nz3LHD1wQPncrHVrLDM6Q0IIIYQQQgghhBBCCCGEENmNVJAIIYQQQgghhBBCCCGEEOK9IxUkQgghhBBCCCGEEEIIIYR470gFiRBCCCGEEEIIIYQQQggh3jtSQSKEEEIIIYQQQgghhBBCiPeOVJAIIYQQQgghhBBCCCGEEOK9Y21tbZ1mAH9/f8qUKZNJ2RFCCCGEEEJkd296hsgO5DlGCCGEEEII8SbSg0QIIYQQQgghhBBCCCGEEO8dqSARQgghhBBCCCGEEEIIIcR7RypIhBBCCCGEEEIIIYQQQgjx3sn+gwcLIYQQQgghhBEeP36c1VkQQgghhBBCZKIiRYqkK7z0IBFCCCGEEEIIIYQQQgghxHtHKkiEEEIIIYQQQgghhBBCCPHekQoSIYQQQgghhBBCCCGEEEK8d6SCxAzCwsI4fvx4VmdDGOldL793ff+MJccle5ByENmZnJ9CiHfZy5cv8fT0zOpsCCGEEEIIkaXMOkn7tWvX8Pb2Ji4ujnLlytG4cWNsbGx0wgUFBREQEGDQNuvUqUOOHDkA8Pb2JjIy0qB4JUuWpHjx4oZn3gRz587F3d2ds2fPYm1tnkPq5+fHhQsXCAsLI1++fJQuXZq6detiYWFhlu3rExkZibe3NxYWFnz00UcZlo65xcTEcPnyZQAaNWqEpWX66v0yovxMdefOHfLnz0/evHlN3pah+3fnzh3OnTtHREQEuXPnplq1atSoUSPNc86YfGaX8yy7lXt2OS7pZe7r79atW7x48YISJUrg7OycEVnOls6fP4+XlxfW1tYMGTIEW1tbg+MmJiayatUqcuXKRZ8+fcySH83vrZOTE5UrV9ab5tmzZwHt31tjf6eNjefv7693AuYcOXJQpEgRihYtatA2U2PI98TTp0/ZtGkTHTt2pEyZMialZ4jMTk+IrBeKj88z8uevTMGC5tmij48PUVFRODo6UqFCBZ31SUlJXLp0CYDixYsrkzxq4hnCHPEePnxISEiITpgcOXJQsGBBChUqZNA2U7N8+XJOnDjB3r17sbKy0hvm+fPnuLq60rp1a0qUKGFSeobIrPQCAgLw8PAgODiYxMRESpQoQZs2bd54TOPi4jh+/Di3b9/GwsKC2rVr06RJkzc+oxkbz1jx8fGcO3eOwMBArK2tKV++PDVr1tSb3puuh7i4OK5duwaAvb293vsCIYQQQoi3mVneCj569Ihhw4bh5eWltbxkyZIsX76cunXrai3fuXMnv//+u0HbPn/+PKVLlwZgzJgxeHt7GxRv0qRJjBw50qCwpvD39+fvv/9m+fLlZnnJGh0dzahRo9i1a5fOug8//JDFixdTp04dk9PR5969e3Tp0gUrKyuePHmSIWlkhKCgILp06aJ8trOzMziuucvPHFauXMnEiRPJlSsXx48fp2TJkkZvy5D9i4+PZ9SoUWzfvl1n3ZQpU/j+++/Nms/scJ5lx3LPDsfFGOa+/mbOnMmBAwcYO3YsP/30U4bkObt5+fIlAwcOJCQkhG+//TZdlSMAixcvZubMmVSsWNFsFSSa39uWLVuydetWnfWxsbFKuaf8vTX2d9rYeCtXrmT16tWphi1Tpgw//PADPXv2NGjbKRnyPREbG0vfvn25fPky5cuXz/AKi8xOT4jswGfLQtZ7Q41+M+llpgqS3377DR8fHxo3boyLi4vO+tjYWAYNGgTAyJEjlc+aeIYwR7wNGzawZcuWVMOWLFmSb775ho4dOxq07ZQePnzI1q1bmTVrVqqVI3FxcYwYMYIbN25QunTpDK8gyYz0VCoVs2fPZvv27SQlJWmt++OPP/jpp5/4/PPP9cb18fFh1KhRWvdpq1evpl69eixatIhcuXKZNZ6x9u/fz6xZswgPD9daXrZsWWbMmEGlSpW0lr/pepg2bRp79uzBwsKCBQsWSAWJEEIIId45Jr8ZDA8Pp3Pnzjx48AAbGxuaNWuGvb09Hh4eBAQE8MUXX3D06FGlkuN1FSpUSLPFccoXRaVLlyYuLk75f1hYmNKqqly5clovMPLnz2/qrhlk6tSp1KxZk06dOplle0OHDuXgwYPkzJmTTz75hLJly/Ly5Uv279+Pr68v3bp1Y9++fVStWtUs6b3vzF1+5nDz5k0AXr16xb1790yqIDFk/2bNmsX27duxs7Oje/fuFCxYkOfPn3Pq1CkSExMzJZ+ZLTuW+/tIykFt6tSphISEUKJECcaPH5+uuNeuXWPevHkZlLP0M/Z32tTfd0tLS6XVq0ql4smTJ0RGRuLv78/333/PnTt3mDx5crr25U3nZ1JSEsOHD1d6UGW0zE5PiOzAZ8ti1htWd5opSpQoofVdFRERwdOnTwEoVaqUVkWDk5OTyfE0LC0tlWepxMREnj59SlRUFAEBAUycOBE/Pz9GjRqVrn2ZP38+VatW5dNPP9W7PikpiYkTJ3Ljxo10bddYmZXelClTcHNzA9THvnHjxiQmJnLo0CHCwsKYNm0aRYoUoUmTJlrx7t+/z7BhwwgPD6dAgQJ06tSJxMREXF1duXDhAuPHj+fPP//USc/YeMbavXu38nvn4OBAo0aNiI6O5uzZs/j5+TF48GDWr19vcAX7zp072bNnDwCDBg3ik08+MVtehRBCCCGyC5MrSH777TcePHiAg4MDu3fvpnr16oB6CIh27doREBDAL7/8wvr16/XGd3d3x97e3qC0Vq1apfX/1atXKy+Tdu/eTUFz9bs3kKenJwcPHuTAgQNm2d6xY8c4ePAgjo6OHDx4kHLlyinrfvvtNzp37szly5eZPXt2qsdTGM7c5Wcu48aNIzk5mRIlStCiRQujt2Po/m3cuBFQPyinbGWdnJxMWFhYhuczs2XXcn/fSDmonTlzRrkG586dS86cOQ2OGxcXx3fffUdCQkJGZS/djP2dNvX33cHBgVOnTmktu3XrFlOnTuXYsWMsWbKENm3aUL9+fYP2403n56tXrxg2bBju7u4Gbc9UmZ2eEFkvFJ8tm1nvnb16VM6ZM0fr/5s3b2bmzJkArFmzJtUGWsbG08iZM6dO7/K7d++yYMECzpw5w5o1a2jWrBm1atUyaD8uXrzIiRMn2LBhg971kZGRTJgwAQ8PD4O2Z6rMSs/Dw0OpHBk9ejRfffWV0lDvu+++o3///jx48AAXFxedCpLff/+d8PBwSpYsyfr168mTJw8APXr0oFevXpw6dYq9e/fSoUMHs8QzxosXL5g9ezagblywYsUKChQoAMDVq1cZOnQor169YubMmTq/u/rcunWLWbNmAdC4ceNUe5ULIYQQQrztTJqkPSQkROn2PXLkSKVyBKBAgQKMGzcOUFeCaFpJvSuSk5OZPHkyXbp0MduQV0ePHgWgb9++WpUjoB5r+JtvvgHUw44J02RE+ZlL0aJFWbJkCT/++GO653PQMHT/IiIiePHiBaCePyIlCwuLNOcWMUc+M1t2Lvf3iZSDWlxcHD/88APJycn06NGDli1bpiv+b7/9hq+vb7qGNXufVKpUiXXr1infY4Y2LHjT+fngwQPatm2Lu7s7DRs2zPAeq5mdnhBZLtSH44sXqitHCtegRuGszlD2VL58eRYtWqS8cN+5c6dB8ZKTk5k7dy5t2rShWrVqOusDAwPp27cvHh4e1K5d2yzz4aUlM9NbsWIFoH7WGjBggNb9a548eRg6dCgAN27cIDY2Vll3/vx5Lly4AMDkyZOVYw7q3kFffvkloK74SsnYeMbatWuXMp/XjBkzlMoRgJo1azJ48GAAzp07x/3799PcVkREBD/88ANxcXEUK1aMWbNm
<p blockindex=5>但是神奇的是,如果吧路径中的<code>file/upload/base64</code>随便替换为其他东西,会发现居然也能成功注入,这就很耐人寻味了,这个漏洞和<code>file/upload/base64</code>居然没有半毛钱关系。</p>
<p blockindex=6><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkQAAALzCAYAAABA9msVAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd1RUx9vA8e+yKCqoWEGxt9g19pYYS+wlUaIYW+zGxFhSNFGjidFoftZExV6xRGPHRDT2logKiCIWEBEBQQSRKu39Y9+9stkFl2UBy/M5x+O6M3Nn7l7wzOyUR5WUlJSGEEIIIYQQQhhgaWmZaXpycnIutUQIIYQQQgghjGdoLGORB+0QQgghhBBCCCGEEEIIIYTIVTIhIoQQQgghhBBCCCGEEEKI155MiAghhBBCCCGEEEIIIYQQ4rWnSktLMzqGiL+/P1WqVMnJ9gghhBBCCCGEWck4RgghhBBCCAGyQ0QIIYQQQgghhBBCCCGEEG8AmRARQgghhBBCCCGEEEIIIcRrzzKvGyCEeEWE3Yc7nlDcDh4/hOoNoVT5vG6VEEIIIYQQQgghhBBCGMWkCZGQkBBzt0MI8dKzhMpNNC+LlodkQP4vEEIIIV57ZcqUyesmmIWMYYQQQgghhHizGBrLyJFZQgghhBBCCCGEEEIIIYR47cmEiBBCCCGEEEIIIYQQQgghXnsyISKEEEIIIYQQQgghhBBCiNeeTIiY2ZMnTzh//nxeN0OY6HV/fq/7/b0q5DkIIYQQ4mUifRMhhBBCCPGmMCmoujFu3LiBj48PiYmJVK5cmaZNm2JpqV9dSEgIQUFBRl2zfv36WFlZAeDj40NsbKxR5cqVK5drwSBXrlzJyZMncXV1Ra1Wm+Wa9+7dw9PTkydPnlCsWDEqVKhA/fr1UalUZrm+IbGxsfj4+KBSqWjSpEmO1WNuCQkJeHt7A9C4cWMsLLI255cTzy+7/P39KV68OLa2ttm+lrH35+/vj4eHB0+fPqVw4cLUrFmT2rVrZ/tnTvt7W7RoUWrUqKGXnpqayuXLlwHd31tTf99NLRcYGMjDhw/18hQoUIDSpUtjZ2dn1DUzYsxziIiIYN++fbz//vtUqFAhW/UZI7frE0IIIbIuDB+fR5QsWZvSpc1zRembaLzJfZN79+5x6tQpHjx4QEpKChUqVKBz584v/EwTExM5ceIEvr6+qFQqGjVqRJs2bV7YXza1nKmePXvGv//+y/3797G0tKR69eo0bNjQYH0v+n1ITEzk6tWrAFhbW1O7du0cabMQQgghRE4y+4TIw4cPmTp1qjJw0HJwcGD+/PnUr19f5/0///yTpUuXGnVtV1dXpTP8448/4uPjY1S5CRMmMGLECKPyZkdgYCC///478+bNM8uX6fHx8cycOZPDhw/rpVWtWpUff/yRevXqZbseQwICAhgxYgRqtRoPD48cqSMnhISEKM/a3d1dmUAzhrmfnzls3bqV+fPnY2Njw86dOylXrpzJ1zLm/pKSkpg5cyaurq56aZMnT+aTTz4xuX54/nvbunVrnJ2d9dITEhKU55f+99bU33dTy7m4uLBjx44M81asWJHRo0fTs2dPo66dnjHPITExkfHjx3Pt2jUqV66c41865HZ9QgghhCl8dixmixc0GPwzTmaaEJG+yZvbN0lOTmb+/Pns2rWL1NRUnbTffvuNb775ho8++shgWR8fHyZOnEhoaKjy3rp162jatClLliyhcOHCZi1nqj///JN58+YRFRWl837VqlWZO3cutWrV0nn/Rb8Ps2fP5sCBA6hUKhYtWiQTIkIIIYR4JZl1QiQ6Oprhw4crq09atmxJoUKFuHDhAg8ePGDs2LHs2LEjww5tlSpVMl0Zkz9/fuV1hQoVSExM1Kk7PDwcgEqVKul05osVK5bdWzPKwoULqVu3Lp06dTLL9aZMmcLJkycpWLAgbdq0oWLFijx9+pTjx4/j5+fHyJEj2bRpEzVr1jRLfW86cz8/c7h16xYAMTExBAQEZGtCxJj7W7ZsGa6urlhZWdGtWzdKlChBZGQkFy9eJCUlxeS6s8vU3/fs/j9hYWFB5cqVAUhJSSE8PJzY2Fju3bvHtGnT8PPzY+LEiVm6lxc9h9TUVKZNm8a1a9eydF1T5XZ9QgghhCl8dixli1det+I56ZvknNyqb+bMmRw8eBDQfPatW7cmJSUFNzc3IiMjmT17NmXKlKFNmzY65e7evcvYsWOJioqiVKlS9OrVi5SUFPbt24e7uztTp05l+fLlevWZWs5U+/fvZ8aMGQDY2NjQsmVL4uLi+Oeff5Sx5JYtW6hSpYpR19u9ezcHDhwAYMSIEXTo0MFsbRVCCCGEyE1mnRBZvHgx9+/fx9ramvXr1ysrTiIiIhg8eDBBQUEsWLCAX3/91WD5bdu2UahQIaPq+uWXX3T+vX37dn7++WcA1q9fT8mSJbNxJ1l36dIlTp48iYuLi1mud+7cOU6ePEnhwoXZunUrlSpVUtK++uorhg0bxrVr11ixYkWGn6cwnrmfn7mMGzeO1NRUHBwcaNWqlcnXMfb+9u7dC8D333+vs8IwLS2NJ0+emFx/dpn6+57d/ycKFSqkfCZat2/fZtGiRZw7d47169fTtm1b3n77baPu40XPISYmhm+//ZZTp04Zdb3syu36hBBCiKwLw2fHdrZ4hb44ay6SvknOyK36Tp06pUyGTJo0iaFDhypH7Y4bN44hQ4YQEBCAs7Oz3oTITz/9RFRUFBUrVmTLli3KsbaOjo44OTlx5swZXF1d6dGjh1nKmeLx48fMnz8fgGrVqrFq1SpKlSoFgKenJ2PGjOHp06f8/PPPrFmz5oXXu3HjBvPmzQOgdevWfP7559luoxBCCCFEXjFbUPXw8HD2798PaFaMpN9+W6JECcaNGwfA6dOniYiIMFe1L4W0tDT+97//0blzZ7MdYXX27FkA+vbtqzMZAmBlZcWgQYMATYdWZE9OPD9zsbOzY/bs2YwdOzbL8VC0jL2/mJgYZTt9o0aNdNJUKpVZYpi8DqpXr86SJUuUz2P37t1GlXvRc7h//z6DBg3i1KlTNGrUiOLFi5u13XldnxBCCJFlYT6cWLpYMxli34AG9nndoJeT9E2ybtWqVQAMGjSIYcOG6fSzbW1tGTNmDADXrl0jISFBSbt48SLu7u4AzJgxQ6d/XKFCBT7++GNAM9GVnqnlTLV3715iYmIAmDt3rjIZAtCwYUNGjhwJwL///svdu3czvVZ0dDSTJ08mMTERBwcH5s2bZ/K4RAghhBDiZWC2nszp06dJTk4GMLiqRbu6PTU1FS+vl2i/uxkcPHgQf3//LG9Pz4w22GLpDCJGajvRz549M1udb6qceH4vE2PvT/v7C2BpafbwQq8VKysrZeXl9evXjSrzoufw119/4e/vT8+ePVm9ejUFChQwW3tfhvqEEEKIrAq7fpQjoWDfYDCTJrQne2HDX2/SNzFecnIyXbt2xdHRkVGjRhnMow1mn5aWpnPE2bFjxwCoXLkyzZo10yvn6OgIaCZStEehZaecqbQ7bKpWrWrweOXOnTsrr0+fPp3hddLS0pg2bRoPHjzAysqKxYsXU7Ro0Wy3TwghhBAiL5ntW89Lly4BUKpUKezt9ZdvFS9enPz58/Ps2TMePnxormrzXEJCAr/++iuDBg2ibNmyZruuthPu6emp7AZJ7+rVq4Cmk/smi4uLIyEhgWLFimUafyYjOfX8Xhav+/3lJW3QS+3kZWaMeQ4lSpRg0aJFdOzY0aztzEhu1yeEEEJknR0NBg/AqXZpIAzjvuZ/c0nfxDiWlpYMHjw40zyBgYGAZqIpfaBzbVyTli1bGixnb29PqVKlCA8Px8fHh7Zt22arnKm0cQjr1q1rML1ChQrY2NgQExOj5DVk3bp1yuTKrFmzJHalEEIIIV4LZpsQ0W61LV++fIZ5XFxcSElJMThh8qrauHEjycnJjBgxwmD6gQMH2LZtGw0bNmTq1KkG84wYMYLY2Fi+//57ateuDcB7773HypUrOXr0KEeOHNEJcnj16lU2b94MoBPnIb3Y2Fi2bNmCm5sbgYGBqFQqKlasSMeOHRk6dKjRsVqMFR8fj4uLC3/++SeBgYGo1Wpq1apF37596dGjh96
<h2 blockindex=7>0x02 漏洞分析</h2>
<p blockindex=8>接下来掏出朋友给的一份编译后的源码,全局搜索<code>u8cloud/api</code>,很快就在<code>webapps/u8c_web/WEB-INF/web.xml</code>中找到了这个路径,对应的<code>servlet</code>是<code>ExtSystemInvokerServlet</code>,除了他以外,<code>/u8cloud/openapi/*</code>、<code>/u8cloud/yls/*</code>、<code>/u8cloud/extsystem/dst/*</code>三个路径也都对应到了<code>ExtSystemInvokerServlet</code>。</p>
<p blockindex=9><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/MAAAOdCAYAAADJAjKJAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd2Ad1Z33//foqnddNUuyumy5yHKVbWzjig0GU2w6BAgQsjyE/SXkeTa9sUs2gZRNAiTsbkIoIYReYmxjG2zce7dlW26SbHXJ6l33/P6Qi8qVLFsS0oXP6y/pTjtnZs7M+c45c8YaPXq0QURERERERERchttAJ0BERERERERELo+CeREREREREREXo2BeRERERERExMUomBcRERERERFxMQrmRURERERERFyMgnkRERERERERF6NgXkRERERERMTFKJgXERERERERcTEK5kVERERERERcjIJ5ERERERERERejYF5ERERERETExSiYFxEREREREXExCuZFREREREREXIyCeREREREREREXo2BeRERERERExMUomBcRERERERFxMQrmRURERERERFyMgnkRERERERERF6NgXkRERERERMTFKJgXERERERERcTEK5kVERERERERcjIJ5ERERERERERejYF5ERERERETExSiYFxEREREREXExCuZFREREREREXIyCeREREREREREXo2BeRERERERExMUomBcRERERERFxMQrmRURERERERFyMgnkRERERERERF6NgXkRERERERMTFKJgXERERERERcTEK5kVERERERERcjPtAJ0D6lklJ5q1vxhBqWZ2nmbM89929vF/beZp8sfkNi+fn98WS6tfE8c1Z/OCtUiqdnCMiIiIiIuIa1DIv/S79jil88twsVn8vjmhjBjo5X0pjpkQzxm7D08ubEVcPIUMlX0RERETEpall/ovmVA7feioPj7a/DU/kj3eE4TVQaZIBt39bHgdSYxnu28zJrQXscgBqmBcRERERcVkK5r9grOYm8gqb2v1mIltQe/iXW83RbL754+yLP6iLvYiIiIiIS3P5zrY2f39GRyowEfmiMMaNpGRf/Cw9ghIRERER6YrLtszb/P1ZMD+Ou2eEUfThJv5fYXOneYxxI2lSLPdMDyMtxhu7jw2bcVBRUU/BmTKWrcxlxYlGWrpppbSFhnDbNdHMHhFAdLAHtsZGSosr2br9DG+sq6DUOF/WhMbyws8SGUY9bzyzlXd9Yvn6DVFMiPYiwK2FovxyNqzL5m9ba6jtsP3QOem8viQYN0c5z/5wLx9UO99GwNVpvH2HHVtzKc98/wAr6/v+ocaV5H/8XVP59YzOnfqtoYm8+nxip9/PrN7J/e9X91maTXoqHz0SiXf2Se5/s4VH74tnfLCD41uy+I+3S/GaNJwfLI4k2auJw1uP8Z/vlFDcxXH0GRLKbdcMYfqwQGKC3PF0tHC2tJqDBwp5Y1UBR7sYTHDG/dN5crI75lgWi39fTMrcBO6baicpzBP3hnpOZRXz9tIc1hY6+mV5ExnHiz9KIMHJuV234wCLXirtdh+22/6zZaTNT+DeKcHEh3hAbT3HjxTyxtJcNpd2HXAbYxE7Lo4H50UwLsYbn5ZGCs+U8dFHp3i3Yggv/CSRJOp5+9dbeSG7bTo9ufr2iSy2lfDBimze3FVDTRfHR0RERETky8rlgvm2QXyMl4UxDnIbOwc0xliMvCGdXy0MxLddQGMj2O5HsN2P1NERjH95F0/tbHS6rYARifz64VhSfNos7+HNUD9vYuLDmDf+FD9+PodDTd0HGrahCfzijniSPc7PZyMmIYI74u1MjN7PE+9VtAvoS3aVcWRxMCPdgpg23oMP1jt/UDE9LRh3y6Ipq4SNdfT5O9B9lf+B483tdw9helRrB5S02ak8lHuS0DujGOllATbGzBrBt85s5Yeb2+9jYwwxU0fyzN0RRLm3zZ8b4VEhzI4KYcaEEJ75XSafnO0u/zbG35rOD2f54X7+GHv4MnJ8PD9KDWTIH/bzj9PdtUD3dvnesjHp9nS+N9374vYDfRmTkcjokUE8+9sDfFjUefvGWCTNHc1vl9gJvHBuexM3LJpHHw8k5LWSbrfa7LAIGBrBvV8N4+brFNSLiIiIiHTkMsF85yC+hcKjBby1IocPj7R0fgc4IJKHF7QG8jW5Z3hxeRGZxU3U40ZgWABzr03kpgQvZt+dxIZ9maztEJCagHC+89XWQLahtIT3Vuaz40wjDd5eDBsVxd2z7IQlJ/Kj26t56LUy6rts3bfImBtD8Jk8nl9dTGaZwR4Twg3XxTEl1J3kuSN5+MA2nj3WJiAqL2JzThKjEtwYmxaK37oCajqu3zOUq1LcMMbB3n2lnaf3Um/yf2TlPr6x+eIbHMlz0/j2RC9M4RmefKWA4g7baiyv7dO0XxAWTOC6Qzz+hiFjUSoPjPBk+s1D2L50P49nu7PgjlRuGupOxqRw/Dbltd+H4TH84K7WQL6usIh3Pi1kZ24DDZ5eJI8Ywl1zw4gJjeRb95az59l8Srva/552bp/ixpblh1lxuIYKTx9GTxjKPVMDCfQN4cF7hrLu6Rzy+nr5kjx+9FQxnhd+sDHnKxO4L/EyzxNPO7dONGxedpiPj7RuPz0jlnsyAvDzt/PoHZFsdJb/0Ci+dXNrIN9SXcFHH59m48k6GgP8mDIzkUVzQugqnLesev7xx52UXZPAXTNCGRqloF5EREREpKNBH8x3DuKbyTtcwJsrclie1UizZTkfzCsxkBE2MKaad1/O4v2CNvPk17DvRCNVt4UTZTnwCwPy2y8ec9VQpvqBqSnmd785yMrK88tXc+hwKdvPpvM/S4KJyIhh7vtlLOsiHrUsb4aSzTd+e5JjjnPryKlkw8F6fv3TVCZ4eTN/egjPZ5XiOJcPy2pk7b4qHk4IxH14GNO8CljVofOA+yg7EzwBRzkb9zTR183yvcl/bVkth8su/u9Zc+5BRVMjx09VdR249jVbJauXl5BpLA6tKOKG1BhCq8/yyqdl5FoWxz+LYNE9obiFejMUONJm0bgJ4SQ4WqirKOU3v85kTd35NNdw5FgZu2rS+euSYHyGRzInKJ+3K7tIQ4wvxa9u5993NF9Y/mBmKQfrJvG7uT7YYiNYEJXDSwV9u7zV0kx+m1dPjLFR7rwDSvdifCl4ZTtP7Wy7/TKyzWSemuqF5/AIZgbk816HtyRiMiJIc7cwjlrefWEvL5wyF5bfu6+csn/N4OvdbLaluobl7x/k45V+XHNNHHdfHUacgnoRERERkQsGbTDfKYh3tHD64Bn+sfw0K0+ee8+9u6DQZp37PFszVU5ex7Zqynjx5fMRZ4dWeWMxLjkAN8uiNrOQVRWdZuHMhkIOLA5mknswY5Jg2YGuk3Jgw+mLgfx5FQX8c18KEzLc8R0aQCyltBlrnDO7Szh+YwBJ7sFMH2Nj1c6LrxIYYzE53Y6vZdF8spQNVZ3T1xt9nf8rZXl7EBfUzSlqmikqbKSuq/OgvpnK859gq2qiGgita6L83OSGmmYaAG8PW6fP9uWu3MuilRdS0mnV+fvPkrMkmGTLl5ghQFfBfE0xH2xvaneuWpbh4Gf5HJ+bxDB8SYx1g4Iuusr3dvneqilm6Y6O23ewaXMxxVNiCLN8iR0CHGu/2IihAa1/nCngg5OODss38v6GUh5KjcB2ic07amtY+WEmq1b5Mm9ePHddHUaignoRERERkcEZzBvjzd2PTeDBOAvT0sSpffm8sSKX1dlNra3XPWnZPV1LNpBMIDffGU3Wu4XsL2vB9KhV2Av7uVik9GyD82Ua6yiqBivQhj3YHWjpIi+N5Bd2bjm3LIvTpQ2AO/i4E9BxwaISNhckkhzlzsR0O7YdxRcH6nMLZPpID4wxHN5fTFmft3T3Xf57w2PCcF68J6zL6aahgJ99+zAb+nzLPdDQQj0Abnh5dDNfST2nnf1+tp7CFhju7oavtxtd7r/eLt9bZfXkOvu9uIFiIAw3vDzbTzLGDf9z4yy0lNbjrNNBc2EdxcDQHibD1NWyemkmq1b7MnduLHfNjCDlXFA/wmcT393QT/kXERERERmkBmUwD2BzA9PSwJ5VR3h6eRnFLT0M4s8rzuf1ndH
<p blockindex=10>而这个<code>ExtSystemInvokerServlet</code>的位置在<code>fw.jar!\nc\bs\framework\server\extsys\ExtSystemInvokerServlet</code>。</p>
<p blockindex=11>找到这个类,来看他的<code>doAction()</code>方法。重点关注一下<code>ExtSystemServerEnum</code>和<code>serviceName</code></p>
<p blockindex=12><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB5EAAAMaCAYAAACvfLEmAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hcV53w8e+5dyTNaNS7ZMuSLclyk3uLa5zETpxeIaSyWQIBXngXWELbd2FZloXNsstmQ08CCYRACOkFx3bsuMZVcu+ymtV7LzP3vH+MJKuMZFszKrZ/n+fJE2tm7r3nnn7PufdcNX36dI0QQgghhBBCCCGEEEIIIYQQQogBTZo0CYDc3NxRDsnwM0Y7AEIIIYQQQgghhBBCCCGEEEIIIcYOmUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEEN1kElkIIYQQQgghhBBCCCGEEEIIIUQ3mUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEEN1kElkIIYQQQgghhBBCCCGEEEIIIUQ3mUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEEN1kElkIIYQQQgghhBBCCCGEEEIIIUQ3mUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEGCO0NrGHxhAVm0ioXY1KGGyjclQhhBA+M8PSmLJgMZns4bWNJ0c7OEIIIYQQQgghRok2srj+4Rk0Z+/k0OGzNFmjM9AohBBCCCF8o+2pzF97F4tmZxLjNAE4+/o/8PvtTSMeFplEFkKIy4w2opm8+kHWrppBhE3Rtv/IaAdJCCGEEEIIIcRoUmHEz1hFRtZ1rKzYz9ZXX2Ln6Tq0kslkIYQQQojLhTZSue7z/8jycUGjHRTgKpxEdkSZfHWuycQATWG+m58ccdMoHeqrhr/TXwcb/OA6G8nA+u1tvFQzsnlJx03gtR+kkUkbf/jxdn50ZviOr3UY33tqHvdFeo6Rv243t7zaOGzHGw4hmRP5+WPJzHC6OLHtBF94uZKay6z8a0cmqz/7RZYkO9C6nbr8Qxw6UOT1t5Pu+y8eWhSKzn+Nnz79Hg19zlUn3MEXv3YL0VSx8+lvsqHw8oqLi6VC0pl37XXMmJZOdHgYQaqN5upz5B/Zxo5N2ylrvbLOW096gK9+/lpCveRtrU/xt+/+mD3NY/+cMx94mk/OdfT73HI101hbTvHRnezavJn8emsUQieEGMuk/fOQ9q/Hd9L+CSGuBlYuh3ccJHTWDBJi53L95yaTvu5/+OOGs7gug+veebMD+XKyQle5+OJ2F02XQZivRNJ/6PHdZdR/cK54kq/dnnFRv63e/G88807e8AboKheYdgefuv8GkpwtlO16iZffyKFF6rQB6amf5puPLSHoAnGkazfxu399icIBfmeLnsXi61cxNT2FqHAHhquZhvKznMnZyPatR6gfYIUOKT9ji5QfcCy4nWuSAtG6hXNb/8D7Hx2irLYZa5Ti4aqbRM4YbzDZoQDFxImarGNudurRDtXFyZwRyLcnKnSdiyc/clF+lRUef7ic03/UJUYyJ+L8nylpkcTqBipGKB8ueGAJv11lh8JcbvmXs+QP4bjzFo9jbpQNsJG1KpElf67k3cso/XVgGtd/9v+wJNmObspj92vPsSGnBPcIpMGEu37Mp5dGoYvf4pmfvHXJk+++bj9UZvIaHnzsHlJDjR6fBhOWkEFWQgZT58zk7V/+ikPVl1FGuAz5M/0NWzBhMamErUhl8tz5bP7d/7Itr8WPoRV9jVb5FWPD1Z7+0v4JX0j7J4QYSUqXcOj1Zzj4bjLz7/4MN8xLJOWm/8unXP/FS5sLRnTgUcavLk/Sfxgbrvb+92jzR/xPmHctKZF2wM64JcuY9FYOR6TYDCt7xr08/OgaEnu+M9YMJSp5JpHjZzA9623++Ku3Ke6Q8jScpPz4R8L4ZGxKoau28/6buyhRCkaxLbjqJpFPnbM4FadIDdAUFbo5YgFSd1w1JP2HLmJKBJMAKpo5F+NgXGo4iwPh7Y7RDtnF27frHDnTkpnmdHNqRwkfX0bpr7VJytrHWDI+CN1ewNbfPsXmvPZRbUDGOm1mcuMjngtgd8MZsjdt5HhBOS1mBHHpy1i+chZRUfO47eG1FP/0XaqulLgseJvfPbUJs+dn6XfzmbtmETBaYfKBLniX5/60i/bOv5UZQmT6NaxYvYykkAyufehTlP7nc5y+wu6IF0KIoZL2rwdp/4QQVyHVXsjel/+Duo5v8snF8aTe/GmWHv8BW8uushFYcUmk/9DD5dx/aNrLmz97i+JBftPRVD5i4blaFez/iILJ15MY3Eb5nu3kXUbjj6Pi9Gv85ql1dN2+Ejj7UT6zJg2tj7HhqZc51fU7dyM1XjbX9jnc/JBnAtlqyif7w3Ucy6ugwx5HyrxbWDonEUfKbdx7+xmeefXogDdVSfkZG6T8gKE6S0NTPWNhHdirbhK5pcrNDza4z39wpXR6xEWR9B8arRWLJ4djKEXJ4TIOXJPKuKAI5mfA20dHO3QXr/H4WR76xtnzH1xO6Z9wIzcuiUXhpnDdLz0TyGJQQbNvICtCod3FbH/uKTYXdZX9fErOHOBM+Rd44oHZOMavYkHau/wtd1SD6zfK1UBNeUOvz3RsK5ftkJGrkZqy4l5L11SUnCK3DL74+DLCwhexbPGbnN5cNYqBFEKIsUPav/Ok/RNCXK2UauLUa7/h40nfYWn8BJbceS05v/yw3ysehOgi/YfzLuv+Ay3UlxVTKWV9VLWffoPf/eCN8x9IegxKddRTXV7f/bejqeuJpXYa+uZnL3EZOv96pgaDtsr5+Pl/Z0N+V/2VR8HxHMqsH/Cp+ZGEz7+eqW8e5YhroJBI+RkLpPxAS2srEAZ2B3ag4UIbDDPjwj8RQgxmVDuWI3bwUBakmaAtjp8t4WgRoAKZkxkyUgG46iUtWEqiqaB+J5u3yl1vFyNu3DjP+1Qqsjlc2L+H2JCzg9x2UCqCxJToUQih8EXHiTfZkw9KGYyfOgeHvnwv84UQwp+k/buySfsnhLhYShew9YP9tGpNYNpSsqTKF4OQ/oMQ4nI1PiUVUyk4t4M9eb3rL6XaObl9NzVagy2F5AmjFEghLkFrS+dri+zBOEY3KMAIPIk8b3YgX05W6CoXX9zpYsJEG3dOMEl2gM2tKaq2WHfMxa6mAZYRcJh8/3qTFDTvbWlnXYCN+6cYTAtVhABVjRb7ct28ec6i1ctdCTrE5N+vNRnn5bu2og4+m20NGPbwiQH8dLpCaYs/rO9gQ/sAL19PsfG/WQaGpXl2XTvb3P1/Zw8xWDPJYF6MQYJdE6AV9S2aU6UW7552kefqv820GQF8Y2L/eX4VbuOp2/snXdmpdp487n0QwXQo1qTZWBwHcUEK062padYcKHLzfr5Fjfb/HR3+jD9HiMHadIO5MYrYIIVpQU2jxbESi3dy3ZRbA+QfH9K/ex9aMWGcwV1pBpkhigC3pqLeYv1RF5tcatjncbU2mbIklS9eF8vcRDv2jnYKCyr44+tneaURLnwGEJIUy6dvSuS6zDDGh9uwdbioKKtn175zPLu+kgIv+a+XuAjmRAI0cuhUCzkTWiA9mIkZkUTpRqovcEeQPTaKh9eOY/WUcFIibARabqqrGtiXU8Jv/1bKsZb+21/z0BJ+s9Lef2fJk3j32Un9Pi5ct5u1r/Ze4EEnpvLWv0wkzUv4WnYfZMFvKgcNd5ehxt8Nf7+Cny62wamTLP1JJXPXTuTxayJJiwpENbdw/GgZv30zn02Vg+circczbXosAI3H9pI3QH73p9R7nuKRayL6fa6SbudLP7m93+fVm/+NZ97J89v2AJkPPM0n5zrQuX/mP3+xm/gVd7Fi4TTio8Iw2muoOLOXne+/zbEK72uqB9k7m1mtvZdT6yjr//eH7AwAV229t18AYETNYNG1q5g+eQ
<p blockindex=13><code>ExtSystemServerEnum</code>是一个枚举类,包含<code>/u8cloud/yls</code>、<code>/u8cloud/extsystem/dst</code>、<code>/u8cloud/api/</code>、<code>/u8cloud/openapi/</code>四个常量。</p>
<p blockindex=14><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB1kAAAFrCAYAAACT9TA+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xU153///e5I416YdRAgApCiN6bqQYbbGxMDLZT3J18nfpNstlsvEl2N2U3PetfEn9J23WysZ04iTd2bMe9m96RKBId0YR6AXXNzPn9IQFCGgEjjSjO6/l4+GFp5pbPvffcKx73fc+5ZsyYMVYAAAAAAAAAAAAAgEviXOkCAAAAAAAAAAAAAOBaQsgKAAAAAAAAAAAAAEEgZAUAAAAAAAAAAACAIBCyAgAAAAAAAAAAAEAQCFkBAAAAAAAAAAAAIAiErAAAAAAAAAAAAAAQBEJWAAAAAAAAAAAAAAgCISsAAAAAAAAAAAAABIGQFQAAAAAAAAAAAACCQMgKAAAAAAAAAAAAAEEgZAUAAAAAAAAAAACAIBCyAgAAAAAAAAAAAEAQCFkBAAAAAAAAAAAAIAiErAAAAAAAAAAAAAAQBEJWAAAAAAAAAAAAAAgCISsAAAAAAAAAAAAABIGQFQAAAAAAAAAAAACCQMgKAAAAAAAAAAAAAEEgZAUAAAAAAAAAAACAIIRd6QIul9zR4frXHEf2tFdff9erEmOudEm4jPLufkwfmRwle+jP+s+fv6mma/z4WxOnrPl36foZYzTQE6sI17nnJWzDaj31jSdUfI1vI84Zuuz7emhesmzpS/rlj59XJccWAAAAAAAAAIAr6u8mZAU+KKx1KXPpP+me+YMURtgG4BqSsfyHenC2R7bkRa189EXVcA0DAAAAAAAAcI0iZAWuNVEzNWfOILlkVb3jz3rl3SKdarHnvvc1qPbKVQcAAAAAAAAAAPCBR8gKXGuGZGuQS5JOKP/lt3SoKkBPMHqHAQAAAAAAAAAA9Bvn4pMAHyBWshef6uoW4e54OqJZLU1XuBYAAAAAAAAAAIC/Q5fck3XKRLe+MNTIVnn1ufVeZWSH6fYMl4ZGSWE+q+PVfr1e5NXGhgv3oIuMdbR4mKMpyY4GRlqFW6NTTVb7S/16+YBXxd4Lzx8e7eimHEfTUhwNjJTCrNWpJqt9J/165aBPRy4yf0+stZox2a3PDXFk23z6/fttequp+7L6Ur+1VgMHhunO4Y5GxhlFWqvK0369t8erN5td+vbCMA2V1WurWvWnU4GX44oyWpwTppmpUmqEkctnVdNoVXDcp1eP+FVj+6cHY97dj+kjk6NkD/1Z//mrfA1ZuEJzp+YqJTFWaqpU6f5NWvfaK9pf7bvgcsKSxmnGwgUalZOlpMRoufwtaqg+rqO71mjde+tU1tzPPTD9fvmdBGXOW67508dooCdOprVaZQc2af2rL2tvpbfHWa0NV+rEWzTnusnKGJSkmCi3XLZNjaerVHuiUNveeUUFxXXy93sv0uCXbz1L9PDXlmuQKrTuZ1/Xhsibteimucoe5FGUadGp0n0qWveCVm85odYL1B+eNkUz589RXk6mkhKiFeZvUX3NCR0rXKd176xWaYBzxo75hL764Ay5j/5VK59v06KP3qrshFaVbnpaz76wQ+ET79PyZdOUFtGoE1v+pL++sE2ne2jHjmesZly/QGNGZMiTECvTelr1lcXat/1trV+7R/Vd5rNhc3TP9+5XjtmrV/7tP7W1o31Fzv6yHlk+UtaXr+e+tlK7/e2fu6Z9Xl/78Di1bvu5fvTHgm7rd6dN06yFc5WXM1SJcVFyvE06XVGs4p3vae37+arp4fwP1f7vibUxGn3fN3XXxAGyLXv16qOPakt1aB8nCEX7D/b4nV13H/ZfzLxH9KXbhsv49+vV//iRttQHXkfUdV/SP64YJce3U89/4zHtbO0+3ZWoP5R6U7/1LNQDX/6osiKMmgqf0C9+s1oNXWq0cXN0zyP3a3iUUVPRk/rl46tU3zFN1h0/1v3XJXZbrklfps8/uqzb59XvfVcrXyruXkcv21/MrC/pi8tHyaUabfz5V/VGceDzYsiy7+nj81JkW/L13LdXaneX4x+q6781RjdMCdOdqUbhXqsNO736zclr/tEfAAAAAAAA4O9Sr4YLHjXKrc8MMwo7czMxzChnkKPPJBklrWvTK6cD3Ki1VmlDw/WV8Y5SXWe+b///gDij6XGOJg82enxdm9YHCGokKT7FpX+e4tKQ8M7fG3nipJlxLk0dYvS79V6tbgz+JnViepjuG2xkrdWuQl+3gLWv9VtrNXRYuL42xlGsOTd/epKjj810lJDvv2iNMckuPTLVpazO2x9mNDBCSkt0dF26Tz/d6NVBX3+GfG5lL/+Sls9MkevMdsQNVObkZRqal6vXVv5EWyoC3zCOGfVR3XvvQqVFdK4vWgkDR2jcwBEaNXmCXvr1f2lH1cX3Ra9ZlzJu+7I+PHfQufYbnqqMCUs1dHie3vzlo9pQ2j0ottal9MWP6P7FmYo47ya6WzGJgxSTOEjpoyYr+w/f13MFNSEt2YlKkifOfe6DhMiOlhemmOR0JTd3mcHXoNrKOnl7uNlv0m/XvctvVdrZdhQuT+ZkzcoYrWEDV+qJl/Z0C3qsNfJMe1j33DlVnrAuxy8tVwlpuRo5YbRe+Pl/a3ddT4FBimbeOVsj09o70GfMfVALTjyvuDvmaIjbSIpU5uyP69aS/frTpvpuc0eNuEv33rdIg6I6rT98gCJiBmhmxgSNn/Ci/vhfL6mkrdP3bSdUWSvlDEjSgBRJx9o/Tk1Jbf/BSVVysqTy9l+Tk5LlGKOq8hPd1h879n49cM8cJXU+/1yx8gwZK8+QsRoz7g0986tndPgiDwr0Zv9fTNyk+3TLhERZ26iDL/2uHwLWvrf/Xh2/AILdf/X523Vi6XANcXKUNy5OW9Z3b1vWujVidK5cxsh7oEB7W9TtWYYrVX+o9LZ+U/2OXnp9qh6+bbgiRy3XorFb9fzuc13orY3W2OUrNDzKyDYX6a2/nAtYQ6Uv7a9+2wYdWjpKI9wejZo8Qm8e3iPb7fqWpVGjkyVJrXs3a0+X4x/K63/YQJc+NtDIbYzkMpo7ztGGEq92M8Q7AAAAAAAAcM0JPmR1OVqSIeXv82pVhVW9yyh3kEu3ZRrFul26c6LVllVelXe9YRjj0qc7AsqWep9eP+jXrlqr1jCjjGRHt+Y4Sot26cEJVoXrvarrehPU7eiTHQGrv8Wv1Qd82lxjVW+MMlMc3TLMUVp0mB6cIh1c5VVJEDcsrdvRJ8a5FG+M6sva9Jsj/u7vtOxj/YoO04Oj2gNWf4tf7+73aWu1lTfSaEJWmBbkOLrQrVnrdvTw5PaAtbXBpzcP+LSrTmoJN8pOdbQ021Gix6XPjfHrqwX+/usNFT5BMydKe9/4H+UfOKnG8BRlTV6iOZOHKDJmlBatuF57fvVOt5vsNm62PnRPe8Dqbzii/HffUFFxuRpdCRo4Yq5mzx0vj2eKlt67RCWPvaTKfuqRq/Dxum5amPa9/j/KP3hSzeEpGjpxseZMzVRUTK4W3rVYRY+90v34xc7RDTe032BvPr5a7765QcerTqvNhis6OUdjFn5I0zIHaMyHP6Ki3b9UUS97VAcSd92n9NlbsgN8k615X/h3zevyqW1Yrae+8YSKAy4tTMPnLVRMySq99v42Ha/xKnbQaE258SbleiI1cP7HtaDo63r9UJegOflGLe8IWFvK87Xp/TU6WFKjtvBEpY2YpznzxsvjmaalH9mv4l+/062nW/sychW19hd6/Fmr4Use0vW5sRp56xwdePWnevxYrCaseEDT0iM1fNJ0RW58W82dlmFjZ2jZPe0BUVvVTm16d5UOltSoNdKj9JELNGf2SMVlLdOdtx/RL57Z2SlgPqnqKisN8CgxySUd88talzxJifJXlKs2OVkDUh2pvD2U9CQnydoWVZVWnb9P4+Zp+cfaA1Zf/QFtfett7TtWqbbIVA0Zv1izp2Uoeshi3XFXsR57ctMFzr9e7v8LsHGztHT5ZMUYo8aiZ/TiuorQv5O3j+2/98evq17sv7ot2nfsTg3NdClz9CS5163qfnzCJ2pETpis9e
<p blockindex=15>回到上面的<code>doAction()</code>方法,我们要保证我们的<code>request.getRequestURI()</code>必须是以上述四个常量之一开头才可以,否则会抛出异常,也就是说不能按照一般的<code>/servlet/*</code>路径根据模块名和包名去调用,否则就会报错。</p>
<p blockindex=16>此时,如果我们访问的路径是<code>/u8cloud/api/file/upload/base64</code>,就会匹配到<code>/u8cloud/api/</code>,然后<code>serviceName</code>就被赋值为<code>u8cloud_api</code>。</p>
<p blockindex=17>接着一路向下,进入<code>getServiceObject()</code>。</p>
<p blockindex=18><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgwAAAPlCAYAAAC+Y8ZzAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeVxc15nn/8+pAqqggAIElJAEBZIACYEka7FsSdZix3bseLez2rHT6XG6k0xnOulJOp3MpHt60kuS6emOf87WnWSyOe7xpBM73uJdiyXZWhFa0GqxSIhNQLFvVef3R4HEUiCQQCDr+369/Hqhqrr3nnvrVmGe55znMYsWLbKIiIiIiIiIiIiIiMg1zTHVAxARERERERERERERkamnhIGIiIiIiIiIiIiIiChhICIiIiIiIiIiIiIiShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiMg1wFon7oRUUtIySHCbqR6OiIiIiIiIiMi0FDXVA7iWOBPnsWDlDeSzi9++cWyqhyMiMmGso4hbPllI+74dHDh4irbQ9AjKW3c2K+64n1VL80n1OAE49bs/55fb2qZ4ZCIiIiIiIiIi048SBleAdcwg79aHuWNjIUlRhq69h6Z6SCIiE8sk4ivcSG7Rzayv28vW3zzFjhMBrJm6xIF1ZHPzZ/8rN812TdkYRERERERERESuJtM6YRCb4uRLy5zkRFsqy4P806EgreMIPllrWDjPyYN+B/44cDkubGu7gnz7lR4OT3Iwy8bmc+tnPs/qzFis7SZQfoAD+09P6jHfL2Lm3cvHP/YBZnk6qHn3KZ5+tpiOKQw+XkzhYz/igaJwla+Ovd/nn57aS2jAeK29gY//r0+TSyfFP/0zni+dvuciVw+bEsUTqx0kRfhsWBviV3/o5vXeke+1y93+vNB7HNxeQsKSQmamLeOWP8lj/ivf5devn6J3ij63sSvv4cZZMVjbwZmtv+LlzQeoaWof9LkUEREREREREZELpnUPg9w5DvJiDdFRDnJyHBSNY7TWWvIXRvHlAgd58WZQsuBKsTHzuOUz/zmcLGgrY+ev/idPPvED3jxUf8XHcjXKWr4Bf7Kb6JhkZq9ey9xpfbcO5l64kvnTOh0nMrGMPcuB3z3Jj/7+73hxdxXdxoP/g/+Fj2/IwmHtlIxp5pxMooyBhm28/Ny7nA10KFkgIiIiIiIiIjKKaR3SPH4mxPF0Q3a05XRlkEMhYKyxnmgn98w1OIHasz38/LilITjg+RDUTfyQz7PWif+OT7N6jgvbXcHW//MdNpV1g4JVY1axdzMVebeQEddF7a5tlI3n/Z9q7iIWFURz7EDvVI9E3u+agvzdpuDgL/MZTv6myEHMldh+CNNdye6nv02g56t89AYf2Xd+ijVHvsnWmiufNHCYvixjWzOtV/zoIiIiIiIiIiJXn2mdMOg4F+Sbrw+I8o8n2O41+B0Ali2Hgxxsj7DtZAbvZ97O7avTMASpfOWH4WSBjEv3iWf52TefvfDAVZJsaTxXR/KMNPKWXoezZCfBq2TccnUyIUvtkGi49Vy57SPu07Rx/Lf/xjtzv84aXxar79tA8Q/fpOUKfxY6OjuBRHDH4gZarujRRURERERERESuPldRkZdxijLnZ8d2TEGsftbKNWQ4DTTvYNPW2is/AJkyHSeOUBWyxCxYTl70VI9GZGoYW8HWV/fSaS0x89ZQNOPKj6GzoyP8gzuO2Ct/eBERERERERGRq860WmFg4538wwYnsyPMQu063cNn9oXGtb+pmtdt7RwKFqUB0Fq6m7LQeBo1R5O+9E7W3riMrIwZeGJjcNoe2lvO0XTmMHvffIn9ZYFR63A7UgpZtWEji/KySPHGY7pbaK0v49i+N9ix7QitNvK2NuUOHv+r+8mgju3f/RrvuD/IrbffRE5GCrGmi+bqY5Ruf46tu8/QPeT4nnVf4Yt3z8eEjvPy//w2u1sjHyP2xi/ypQcW4gge4NlvPMGB7gFNgdPv5rNfvpv0SO//vh/yraf2jOUSEjWjiFU3b2ThvGxmJMXhDHXR1nCaioNvs33Tdmo6R38/LvX69YtpL6HkzBoy5ixi0SIXpfvHl7GK9i3nhvVryZ/nZ4Y3jqhQF62NZ6g8vJ3tb26luiNCc9pFf8xXP7WKmIrf8eSzPdz6sQ+R4+2meuev+Y/nSohe+knuv2clPlc7Z3b/O797bi8tI5zH5Z7/tWr50hi+kGmw53r5/I4QufOd3JNpmO020GOpqAvx4tFeiiO8fwCrV8TwJxkGW9PDH78bHLYyxcY4+e+3OZkPvP1uFz+um/7vQ9fBPbzXvZyFMZnkL0lj+1tXtn9LR0d7+Ad3rBIGIiIiIiIiIiJjMK0SBpfDEWWY6R7wwICfEz0OZgWHbBCCurYQPZNRIsPpJ30GWBuk8sTRMW9mrZNZt32FR2/z4xo0rhg8SRl4kjKYtXAZOU/9A7/d3xhxH7F5H+aRT95KRuyA7aOTcXmSuSFrCYuX/J6n//UFqnpGP28z6z4euf9D+KL7XxdNin8Zq7MKmDvzSX7+wpFBSYPW4n2cuWs+cxzzyC9KYPeO4RXDrY0hryAXpzH0ntjP0S4mPKvjWfgxHnnkZnyugTuOwzszj6KZeSxctoQXfvSvlJyLnHyaiOsXHdPGgZIyNszJYd6S64gqfofeMdxn1hpSVj7Oww+tICVqyPh9uXh9uSxYUsBz3/s3DgVGqgefxg0PrWGBL7x4KOumT7HxzLMkPLiWOTEGcONf82k+VHWcf985/D2aqPtnvKxNZ8NffJP1s8a231O/+3N+ua1twrafWJbCRVH8abbB0f++Ow15mQ5y0x38cls3b7RN/2D/hOg9RHkFFOQ6SM/IBK5swqC7py9ZFxXz/vllJyIiIiIiIiIyiaZXDKWtl3/eFGJgFZcblkRzb8rFg2sp/ij+oSBShSXDvetiuHfIo7YryLdfCXH4csY7kqREPAagldbmXsYcFY9fyy23hJMFnae38tZr73D6XAs9Npq41HksuvleVvqTWfSRj1J66AeU9g6ZgRy/inseDgd7e84dYOdbWzhZ1Ui3O4VZCzayds0CErLv4aH7yvn+MwdGCWJHMX/dzXiqtvCHzXs53dhLfEYByz9wO7kpbmau/zQbS7/GK+8NyMIEdnOs8iEy/U78BdcRs33LsFUIRC8lb14U1gYpP7Rn+PP1b/J/v7Mb5/kHXBR+5Gusyx7b9bMJa7j34XCyINRWTvFbr1JaVku708vMvJtYc9NiUlKWc9cjd1D1xAvU28m5flFR0TTt3UPVHTnMXrCCfNc7HBrLIoPUD3B/X7Kgq7aYnZvf5mRVIz3RSfjy1rF23WJSUlZy10ePU/ajN2mLdPzUXGK3fZ8f/4dl/h1/xIbceBZ8aC0nXv4XflwZz5IHHmPlLDfzr7se97tv0DlgHxN3/1zjnE5unwN7jvaytd7S6jTkzw6vNoh1OfhYkZPdO4IEroHrZ0wHzS1dgJuYhCRirB3+uZ9Enri+ZgwdrXRcsaOKiIiIiIiIiFy9plXCwFhDXeuFmdPWGpqHrgy4Gng8fQsc2ulsH8d22fOY7QRrq9j59M/ZVTMgsFZTQfmpBjrvv54kunCnAtWDN09ZdSu5cWDbS3jxyScoaenfvpyqY/s42fhlPnNPLt7lt1L44gGKRxibMSnM4GV+/L3/oKa/nFLlMY6WNvDoVx8hx5XCkh
<p blockindex=19>根据<code>serviceName</code>也就是<code>u8cloud_api</code>去找对应的类。这里具体逻辑感兴趣的可以自行去分析,偷了个懒。</p>
<p blockindex=20><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABoEAAAJUCAYAAADaeY+mAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gcxcH48e/cnk4nnXrvxWq2invDvWCDAZsOoRMSCJCXN52Q5H1DkpcUEvJLQkgIoSRACAmhdzfce5Fc5W713nu52/n9cSdb5STbupMl2fN5Hh7ku73d2d1pOzM7IzIyMiSXMX9/f8dfddTXiwv8DVBXR70Y+Hdntj+PbbuT/v4EOP6ur693fJbJVUvG4kcDR1av5GA/YZbSn4CAs//u+r2iKIqiKIqiKIqiKIqiKIqiKJcH43AHYLid7Rw5/86ZHh0q59Gpc2b7C+gAAhD19fTpuvH3w18IpGyioY5+gy1EParfR1EURVEURVEURVEURVEURVEuX4bhDoBy/qT0J2tslP0fJUUUXGCnkqIoiqIoiqIoiqIoiqIoiqIolw/VCTSCSOlP5qxZZMb59/3OP46sq5Ywzl8gZT1HDuUPQwgVRVEURVEURVEURVEURVEURRktLvvp4EYcnyjGzYhm3AyQ9fU0APjZp4ADkLKekp39rwWkKIqiKIqiKIqiKIqiKIqiKIoCqhNoRBGinsIjR/AbG0W0vz/C35+ud4KkrKehpIQjhw5QoDqAFEVRFEVRFEVRFEVRFEVRFEU5B5GRkSGHOxCKoiiKoiiKoiiKoiiKoiiKoiiKe6k1gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFUZRLkpQaZt8QgkIj8TWL4Q7ORWcc7gAoiqIoinJ50vySGDttJmns4t21x4Y7OIqiKIqiKKOeNGSx+J5MWrK3ceDgaZr1y6+hS1EURVG6SHMCU5fdyIyJaYRYNABOv/dNXt/SPMwhu7hUJ5CiKIqiKBeVNASTuuQuli3MJMAoaN97aLiDpCiKoiiKcmkQfoRnLiQlaxHzK/ey6e032HaiHilUZ5CiKIpyeZGGBBY98l3mRnsOd1CGneoEGgSvII1vT9ZI9JAU5tv47SEbTapCNeSMwROYuXgh45LjCfL3wmBtobHiNCdz1rJl0yEa+hnhlHbns9w+2Qt56t8886fVtLrpXpmSrueOL11JlKWV8h1v8Ob7OW7btzLyCD8/vrQ0hmvHB5AQaMJisFFb1ciefaW88lkZua2Xx733SUvkzw/EkmmxcnTzUR59s4raURDvzWHB3LcsmqXj/IgNMGLstFJeXse2HcW8+EUNpTbn53DlV+bx+5lGOH6M2U8XUu+mcx2t19EdpFcaSx76OrNivZCyg/r8AxzYVzTgb4RPMlMWLCIzPZlgfz88RTstNcXkH9rM1nVbKG8bHddOlRsjiwy+lq89cT3h1LLjT4+zKs8990KOuZNvP7IAXyf3VsrjfP7k0+xqGfr7nnnfC9yUZZ/5uXXvn/ntG3vRu4VJypnc8cwDpNBGziuP8VGuiotDQeVfyqVgtN3/yz7/009xcOt+fCdkEhE6mcVfSyV55R/455rTWEfwfesyZaKJ/44VyGorX99ipXkUhPlSpAVlMH3hIjJSEgkO8EbT22iuKiDvwEa2bNhFVYe6L0pflnmP850VKee1bc36n/Pcx3lDG6DL3Ggrv4eC17QVXBFlQspWijf9g882HKC8rqVHveByoTqBBiElxkCqlwAEiYmSrFwb2+Rwh+r8pGWa+GGiQNZbeXyDlYpREunNKbdwz31Liew+Z6PmS1DseAJjMsnI+oh/vvARJZ0X73zipiwgPtAMmImeNYcxH+ZwaITHg7gbn+b+2UHIkg957rcfXjaNzl2m3TmLvy00Q+Eprv3pafLP8/xNCbH89bEkpvp1X0bNQFhUEMuiglg8LYSf/vYwH1SN8AjgBlNmRjM5yAgYyVoYyax/V/HJCD9tv3Fj+Nsj8aR5dc8/TMTGhxEbF8rSyaf4+u/y2HcRH2RG43UcbPrpTpqSWPzQfzEr1oxszmPnuy+zJqcU2wD70mKXctcDN5Pg2z39eeMXkUJWRArjJo3no7+8wIGagS/gSMj/RmO5oVwazOOmkWzcyzHbcIfk8qLyL+VSMZrv/+WY/wlZyoH3nmP/J7FMvemrXDklkvirv8Ed1v/HG+sLLmrD12htf7jcmZJu5N77lxHV/fkJC/5R45gQNY6xE8bx7l9e43iTup+XspFQ/7icueP6j+by210iYmIxCoGs3sJnH+ygVAi4TOOy6gQahOPFOsfDBAkekqJCG4d04PKMPxeFNE/imrvtHUB6cz7ZX6wkN6+STnMY8VOuZfakSLzil3PLipM89/bhi1apLdi7gYLUxUR6t1Oxawt5Kh5ckqTmzw8esXcAWRtqee+zItaebqXO6Ena2Ai+uiSM2JBwnny4kQP/l8+pS7ww2bOjmJz0WNItNo5vLWX7CI/30iuYJx+ydwDJ5gbe/SSf1SdbafX2YsrMRL463UJA0hieua2BZa/XXLTRkaPtOrqDlBrxyx5gVownsqOATX/7DevzOgasgEktjavutTeg2hpPkr1uLUcKKmjVAghLnsPc+RMICprC8nuWUfL7T6ge4elPlRuXiYKP+Ptv1qF1/yz5Jr564wQ8hitM5iwy0j04dsA6XCG47Kj8S7mUjOr7fxnnf6KjkN1v/pr6zie4fWY4Cdfcz+wjT7Gp/DJrAVQuiDRN5Np77B1AemsxB9Z9zqHTZbQYA4lKv5K5s1LwjZjHjbed5k8vb1JvailOyebdfPCnDykZYJvO5oqLFp7L1aguv93EIByDsZobaBreoAw71Qk0CK3VNp5a020okSr0hpTv1MWM8wapV7D9lV+yJr/r2udRcCSHcv0p7pgaiP/UxYz74DCHLlL9vuPE+/z9qffPfqDiwSXJd3oM1wUKsDXxyrM5PJvf9dDUxMGj1Wwsh/ceCCMgLoY7U/N56viwBnfINR05zd3fP332gxEe78NmxXClBdBbeP2Pe/j1ybP3b/eBGo7bZvDHWWYir4jm6n/X8HHnxQnXaLuObhFxFVfNCkVgo3DlX+wdQOfgOfFKsgIE0lbClpd/w/qirvw/n9KT+zhZ8SgP3zkRr5iFTEv6hM9PDe0puEqVG5cHYW2ktqKxx2cytI3hanKrra4kMDiU1ImT0PbvHPDNO8V9VP6lXEpG6/1X+R8I0czxd19k+5gfMTs8jlk3LCDnL1/QeBleC+X8+ExfTLoFpF7Jrr89xcpTXQ0seRQfyyGv6Qc8dHUCnuOWMCV8ExtVO77iVCsN5SVUqbxmWI3W8tudWtvaAD8we2EGGs/1g0uY4dybKMrwiolPQBMCireyK69nD48QHRzbspNaKcEYT2zcADuSDFsDjDJ6Jcf54iUElFfyaZ7e5/uKHWVsbweEmfQxaqG5kWbSGH97/lFQwj9P9Lx/Qtj4Yl0ZxVKChx8TEwbYkco/XBY1bTaRmoCGbazfdH5Pi2HR0XgKAZXZHCzs28PfmLOVUx0gRACR8cHuDrJyyZOXRbpuPXGEEl1iGjuF1GF7Fenyo/IvRRl+Kv+zE7KATav20iYlpqTZZKksRxlAbFf7S8kWdp7sOUJOCEnlpk3Yx0VGEDPGe1jCqCiKcr7aWlvtf5i98RreoAy7UfEmUI+FAb
<p blockindex=21>根据这项目的惯性,一般就是在各种配置文件中进行的配置。全局搜索一下<code>u8cloud_api</code>,在<code>/modules/uap/META-INF/P_API.upm</code>中找到如下所示的配置,找到<code>u8c.server.APIServletForJSON</code>这么一个类。</p>
<p blockindex=22><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABcsAAADtCAYAAABgWS1aAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdZ2Ac13nv/+/sovcOAiRAkGDvBMHeSXWK6s2SLMmyff23b5TYiRM7ca7j6xvn/hXbcew4cpGbZElWs6xeKImkRLH3ToIdJEESvffduS8WQwKLBQnsDrgA9/d5g7I7c87MnDkz++wz5xgTJ040sVlcXBwA9fX1dq9aRERERERERERERMR2jmBXQEREREREREREREQk2BQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOQpWC4iIiIiIiIiIiIiIU/BchEREREREREREREJeQqWi4iIiIiIiIiIiEjIU7BcREREREREREREREKeguUiIiIiIiIiIiIiEvIULBcRERERERERERGRkKdguYiIiIiIiIiIiIiEPAXLRURERERERERERCTkKVguIiIiIiIiIiIiIiFPwXIRERERERERERERCXkKlouIiIiIiIiIiIhIyFOwXERERERERERERERCnoLlIiIiIiIiIiIiIhLyFCwXERERERERERERkZCnYLmIiIiIiIiIiIiIhDwFy0VEREREREREREQk5ClYLiIiIiIiIiIiIiIhT8FyEREREREREREREQl5CpaLiIiIiIiIiIiISMhTsFxEREREREREREREQp6C5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOQpWC4iIiIiIiIiIiIiIU/BchEREREREREREREJeQqWi4iIiIiIiIiIiEjIU7BcREREREREREREREKeguUiIiIiIiIiIiIiEvIULBcRERERERERERGRkKdguYiIiIiIiIiIiIiEPAXLRURERERERERERCTkKVguIiIiIiIiIiIiIiFPwXIRERERERERERERCXkKlouIiIiIiIiIiIhIyFOwXERERERERERERERCnoLlIiIiIiIiIiIiIhLyFCwXERERERERERERkZCnYLmIiIiIiIiIiIiIhDwFy0VEREREREREREQk5ClYLiIiIiIiIiIiIiIhT8FyEREREREREREREQl5CpaLiIiIiIiIiIiISMhTsFxEREREREREREREQp6C5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQFxYZGdlvK+/PdYuIiIiIiIiIiIiI2EWZ5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOSFBbsCIiJyeU8++eTF37/1rW8FsSYiIiIiIiIiItcuZZaLiIiIiIiIiIiISMhTsFxEREREREREREREQp6C5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOQpWC4iIiIiIiIiIiIiIS8s2BUQEQk1ZsJyPv8PdzDUMDjz3j/z/GfVmGYWi7/xT8xNNzCPvsh//G4d7YbRb3UIS5/KrPnzGJ2fS1J8NI72BurLT3F832ds27CfGre9ZZt59/JXX1pEnI9tMs2jfPRvP2FHY/9t79ViJt/EF/5uBRlUse3X/4vVxYN/my4nfMQK7rlnKVmxzZRufYlX395D8xXa7UBo/zJ42dl+TCOO3AV3sqBwPEOS44hwXsohMRvW8+IPXqDYhnZ4LfV/19L560//FQzXUvsZ7NT/BNe11P8EQyD7b/yDP+O2iZ422rz7N/zXSztxd3qfac7knh88Qj7N7H32m7xX5PsYhCVPZubSRYwZmUtKQhRGeyN1Zac4uXcNmzYcoq6Hzx+Blh8z7+s8sWJUr/ZT5bp/5+n3i7v9X+1PJLQoWC4yiA279fs8NDcF89w7/Oq/3qVGF2e5AtM0SJr+CPfdUUhKeKf2Ep5ISs4UUnKmMLngM97+3Z84Wq/2JJeXM30RuUlRQBTZs+eQ9+4eDpnBrpX0RqhfP0zTybCb/pr7FmQRFmLbLh7qv/wX6v1HoNT/DG6h3v4jx0xnZNhOjrr6uNzIO3jgoeUMieq0v5zxpAybRPLQCYyf8C6v/P49zrVdfn/6W76ISF8oWC4icrW5XVifx91u607PxHRb/zRx+1jMDo6ht3D3XYWkOA3aqg+y49PPOH62ivbIVLLGLWL27FHEZy5g5ecu8Ltfr7bvA8CZ93jup+twdv7fiJU8etsUwu0pQYLgzK51nMlfQmZsK2XbtlDsBq7UZILY/uUaYFf7iZrJvLlZODGp2vcqqz4tora1U6S0vYFau+p8LfV/19D561f/FQzXUvsZ7NT/BNc11P8EhW3tdyLjxoZz9EB7r4s2I6ZxwwOeQLm7sZjdaz/icHE57VHp5Ey7kTlTs4jKvYXbbznOr18/3CVr3I7yL9ajcQfv/vpdSi7zHldDme8X1P5EQoqC5SIiV1tLG20dv7a3tnT81kRbq+c3V0vz5W8S/WSaDkbNX0y608Cs38XbTz1NUYNVTjElx3ZSdP4rfOHOSUQNX8aMvNWsPmVP2UZ7PTVl9V3rk9rSw7tlsGg9/jbP//DtS//oTbsNUvuXa4Rd7WfocDKdACXs/WAtJyt9LGNTO7ym+r9r6Pz1q/8Kgmuq/Qx26n+C6xrqf4LChv1XXVlOUkoaoyZPwbl/O65e7u+4GYsZGwOmu4ytz/6YtaetYHMxZ4r2Uur+LvcWJJEwfQlj3jnMoR7i4P6Wf5HZRG3pOSr9aSdqfyIhRRN8DmCO2FyGpuv7DJFrTmsTrW4wTTetnW62Wjp+bWtt6qeC08nKigagdu/qToHyS2q3reNoMxhGMpnZ8f1Uj2uYYaKn+K8gaO1frgl2tZ+IiI6symZamu2v5jVL56+EMvU/waX+JzA27L/mY4c47zaJGFtAfh8eTcjOGY7TMODcZnYUd42EG0YrxzZto9o0IWw4Q4fZX74t/Nx/phlFem42EYY+IYgMJorEDkCO2FwmLryFObMmULvqH3mpzPdXq2EpE5ixaDHjRuaSnBiD02yhobKEswc2sHndZkpbLv/NZnhGAbMXzWf0yGEkxUVhtDdRX1HMqb3r2LxhD9XtPiaCGfcIf/vwTMJPv8mv3m5l2T23kJfQwvntr/DmO/sIn3o/t95cSEZEIyU7/8zb7+yi3uy6nlH3/pC7p0VjnniVn/12BxnzVjK/cCwZyQk4WqspO7GDLaveo6iirVv5gda/W/m/20P2otuZVzCKtMRYaK7gwrFtbP5wFcerLj8QmiN5AoULFzJ+VC5JCbE42uqpLz/F0T1r2bqpqNt221F+7u0/4HOzErv938hawf/3byu6/b+nCUoCYdf+C8+YRuGCeYwZkUNyQixh7mYaqks4c2gTWz7ZyIXm/ml/Fn+Pnz0aPTdW0c20dnxIMoxWmltMwKDlMp+crAluzMMv8MNn1mN6ZTCYsUt4+B/vZqjPCW7cFx8VbG3uqYwW2tqAaHC7e36YMND+J1D+nv+B7b+O95gRZExfwYK5U8nJTMLZVkt1yX52rHqbXQ1X5wFMf84fCLz/NdNv5ot/cwvpPjJnWnf/hp+8vKsXtfe//QfKTLqex755G5mUs+mp77E96jqWLJ9P3pBkohwt1J4/yuHN77BxZwltl8kO8qf/sLP/8qf923n9GKz9Z1f+19Hf888OphlO2pQbmDdrKsOGpBETFY7TbKOpvpLqkkPs+eQD9hbXXja7LbDjF7zzFwLb/kD7Lzvuf0wzjOQJN7JwYSHDs5KJcNVTc/4Quz96k+0183j071aQQSWbf/FdPjnbP+3In+NvZ/8R7Pv3wKj/CcX+J9D2byYv4sEn7iU30qD50HM8/exGGr3vP+Pnct/fPMjIaIPmwy/w22fWU297lnLg+y+86SD7SuaROXQ84ydEUrSn9YrLmGY4MbGeyLarqow6X28qr6AGSCSW6Bh7y7ePv/svnjG3fZtCxx52rH2XzXvP0tqv90kiYgcFyweQzkHylEgHptl
<p blockindex=23>继续跟进,在<code>doAction()</code>方法中,会先判断<code>request.getPathInfo()</code>,显然不是以<code>file.</code>开头,进入<code>APIController.forWard(request)</code>。</p>
<p blockindex=24><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABzIAAAMxCAYAAACAePUBAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXxcV3338c+5M9pljSxLli1Zm2VZkiXZ8e7YibPbhJCQBAIlLAmULVB4gBZK26cFWii0QKFpCPRhJyyFQkIIWezscWxHjnfZlrzI1mLJi6xlZC22NDPn+UOSrWVkS5pRJDnf9+uVV+SZe+45986Ze+6c3z3nmKKiIouIiIiIiIiIiIiIiIiIyCTiTHQBREREREREREREREREREQGUyBTRERERERERERERERERCYdBTJFREREREREREREREREZNJRIFNEREREREREREREREREJh0FMkVERERERERERERERERk0lEgU0REREREREREREREREQmHQUyRURERERERERERERERGTSUSBTRERERERERERERERERCYdBTJFREREREREREREREREZNJRIFNEREREREREREREREREJh0FMkVERERERERERERERERk0lEgU0RERERERGQKsdZF9LRkklJmMy3aTHRxRERERERExo17ogsgIiIiIiIiIpdno7NZdutdrLwqn+Q4FwDHHvsMj2xun+CSiYiIiIiIjA8FMkVEREREREQmOetkc+MDf8O16VETXRQREREREZE3zJQJZC69KpJPZxhso49PbvbRbkY2fY5NcvPgaofEINtbG+CXz3TxnG/0U/HEJLn43BIXORGW2mo/397vp22EZZpKxuv8vZlZm8dt//R5lnl6zlvji1/je09WXTJN/r0P8u4lMUP3FfDR1dlMY00FBzY/RWl5A/5gn1Xh/XzxQ6uJukwdtS0v8rN/+RW1w2xn4uex9PobKV4wjxmeBKLMeTqa6qje/ypbXtzMqXNXVl2wc+/lcw9cz7Sg9f8wz3zp33i9Y/Ifc8YdX+eDa5NHtK2/7Md87eevjXOJxsbamVz/11/lurTg53y86697xiJW3XQDhfOySPLE4Pg6OHv6GJW7n2fzpv20BoKnL77vv7m7pGcm986dD/PtX+0k0K+M1q7iPd/6EHmcY/dPPsUT5eNbp6ZK+6X2RyD09mvuPf/B+1ZOw1Y/yncffIqzg963s97OJ//6NmbQyNYHv8hztVdmnVL73e+9KdR+9zeW+8fL7nPGbXzsi28nlWZKv/cFNlZNrXPyZhSz/A6uTovE2k7qNv2Sp18u41RLx4D7ChERERERkSvNlAlkTjZ5cxzmxxjAkJNjKSn3s9VOdKlkSphZQGbCxX8m5cwnzh4bcXC+P+O4iYpLIa0whdkFy1jwyg/41Z/20zkOnRmujHW890PvIHta/6V1Y0mYlUfJrDwKFy/kiR/8N2VN+iKMp8y7/o371yRh6//EQ9/+E83quBqRUOtvdN47ef9965jdfw0q1zSSMhYyfU4xRSVP8Ov/foL67kt/HtGFy5nn3skhfxgOaozUfr155RdH8vc5Buv18YWXfZzW9WNUQr3+TtT1W+335BDy5x/G+8epSPc/PWbNycBtDLZxM08/XsoJY+BNei5EREREROTN48oPZLb4+dpL/oEHOsPFl0scIkPY7eG6AIdnGrIjLMdr/ewPAFfib8hxOn9vZrF5eSQD9kwDzTOSmT5nPjkRG9jnu3xaW/MkP/6fUrr6XjARxKXkU3LTbSzJiGP22o9x58kv85vXmwcmPPIoP/zmBvq6MCOvuo8Pr8vF2nKe++ZvONy3nb+NQSl78nXls/4DPZ2g/rOV7HrxeSpqTtPpSmTmvGu49rpFJCUt5fb330r9d5+k8UrpUKl5gp9980Vc/V+bdzcfvmsRERNVphDY+g38/Jeb6bjUNp3BasBk0ci2n32J/YNaLs/qB3jvNbOHTRVq/bXRi3nr+3qCmIH2ana9sIHyqga6o2eStfQ21iyeTUzW7bzzjkoe+v2BS4+KiC6haEEEh8pG8IUfJ1Om/VL7IxBy+/Vmp/a7nyncfkNo949y5XBM79WwvZW2iS2KiIiIiIjIG+aKD2SagOX0oF95Ni70/XY2+vnqc/2G1FwpHT+DjNf5e7Oy1iF7bg6OMbQc3EbdsrcyPTKXrLmw79AIduBro/lU/YARl2dO1VBVUYXvb/6GFcmxzLt5HbO3/U/PE9q9THcrTadbL/w7pr27968uzp6q50z/+hukLkdddTMliQbrr2fzj7/JS8f76n41Jyr3UHn6E3z83quImXMDy3Of5Jmjozgpk5jxnaX59NkBr9mUc0zZMSvd7TSfqh8yteJUYYyfzqYTdA5+o/3Svbih1t9py26iMBZs4DSv/eTrPFfdl76KmordnAp8lfcsm45n2U0UPn6A/cMUp7mxgekzUph/1WJce7cFnQb6jTBV2i+1PwKht19vdmq/L5rK7XfI949yxeg8dw5IgOgYooGzl0sgIiIiIiJyBXAuv8nkM1U7IURgLlnZUVjr52TtJk6cAGPiyZybGdJeje8wL71cQcBaSCokb2aYittrZnp6z/pkDbvYVzs0SnN29xaOdoExiczOmhHezEVCFGr9nZOVjcsYqNvC61UD0xvTxaHN22i2FtxZZFziq9x5pIL6gCWyYCnzp+qQIBGZUtR+XynG5/4RrH5XTTHnOnsf54qOJWZiiyIiIiIiIvKGGfGIzKVXRfLpDINt9PHJrT4yc9zcmekiIwbcfsvxpgAbyn2Utgd/Gn71skg+NttgT3Xzl6X+ISNRbKSLf1znYh7waul5ftQwzFP1AYt1oCDHxd29+Tt+S21DgGcO+tjeMT5P49t4F1+/3kV6kKf9zx/v5qO7AiPaT0Ssw/pch+UpDrOiwW0trZ2WQycCPFXpp9o3vqMJJjr/6HiHdXMdliY7zIq2RFhDa6fl8MkATx7xUXWJ/K21ZKS5uT3bYf40SIgwuIC285Yz3gAvHQnwSlNg2GkdQ00fFsn5ZHoAjlN/9AzH085Adgoz5uYTa2voCCHvzvp6zlJIAtNJSAIawlVoiIru7Sqxw3R4BQ7w7H/9K1sjwNfSGmwLAJykYlZefwNF8zNJ8sRjus7SdqaKQ7ueZ+vmCtrsMJ9d0q185O/uYjYNbPnPv+e16Ldwy/pryZmdRIw5T+vJQ5RveZxN2+voGnQO49Z+gc/ePg8TOMzT//LvbG8LnkfM1Z/lc3cX4vjL+OM/PUhZV/jrwViOP/sd3+QDVycOed2k3cGnvn3HkNebXvoaD/25KuxlB4hMXc7qG68lPzeDxGkxOL5OzjZUUVX2Eptf3k3zMN/fUD6/cAil/lobQVxcz0Sm/uYGgtbuhjN4gUTiibnEiMHIjr3srVvD7DlFFBVFUb6na/iNwyiU9sumuvnhcofIFj9fKIP3LHZYEG2oqfHx0H4/UWkRPFDkkOG2HK3184N9fpoG5RPq/UO4uGIM63LdrJoJM6MMLr+lucOy57ifp6sDNAf5/oXj+EPJHwafvwB581zckWFIjzbQbalpCPDkQR+7O4emX1Acwd/mDH1mzXjcfPOOobeApw538YWKod+SSdF+ToBQr7/huH7n3/sg714Sgz36W771/W2krr2LtSsWkJqUgNPVTEPldrY+/QTlDd1D9gdqv8NlwtvvEO4frY0mddntXH/NYjJTp+PubqW5bi/bnv4jO9tHFsiMSF3KquuuIT83ixmeWNyB87Q111F7YAtbXtjEySDXHwit/obz/E3V+5dgOjt7FwiIjlEgU0RERERE3jTGNLVsYWEkD8w1uPt+sLkNubMdHphhmLGlm6fOju8PubzCSP7PoPzz5jjMS3H4n60+njk7OZ8tTkhx8bdLXcyJ6H9+DEnTYNU0F8vmGH621cemcQrGTmT+1lpSMyL4/EKHma6+/ff8f/o0w4ppDkvSDT/a0s3WIJ0h1lpy50fyt/mG6EEdBdNiDNNiHLJnWhbs7ObhE8E7YUNJHy4x8/NIAWg9Rk0j1FdVcf7aZCLn5JHtepYDI4uHv+FampqAeJi5gLwZf6SxaeD7xnRx9mTVJae3ipl/D+97/y3Mjul3/iOmExU3nVWZi1i46E/85v
<p blockindex=25>在<code>APIController.forWard()</code>中,会发现存在<code>checkUser()</code>进行校验,跟进看一下。</p>
<p blockindex=26><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABrQAAAONCAYAAADH5YCJAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xcV53//9edUe8azahazbLcSxyXOHbsxHbiNNI7gSTkS2Cpy2N3YVnY/QK78FvYwH6XEEqWACGQBEJ6r04c19iJe69qVhmNJKvXmfP7Y0aypBnZsiVZkvN+Ph5+PMaae+4998659XM/51gzZswwiIiIiIiIiIiIiIiIiIxRttGugIiIiIiIiIiIiIiIiMipKKAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWucZY+xExTtxuDKIj7JGuzoiIiIiIiIiIiIiIiJDFjbaFZDhYaLymH/1TVx0wRScsXYAjj3/Df60vnmUayYiIiIiIiIiIiIiIjI0CmidB4wtjxVf+ieWZkWOdlVERERERERERERERESGnQJa54HoBddzcWYExrRyfO2feX3NLqpOtOCz1OWgiIiIiIiIiIiIiIiMf+M6oDVlZgTfybcw9V18a00X7k9oACd9QjZhloWpWc/rL35IhWXBJ3RbiIiIiIiIiIiIiIjI+cc22hWQobNZgZ+xuYGm0a2KiIiIiIiIiIiIiIjIsFNA6zzQ2tbm/xAVTdToVkVERERERERERERERGTYKaB1HmhrbfV/iIohenSrIiIiIiIiIiIiIiIiMuzG1Rha02eG88/5wTE4KzGMB68PXpWqQx18a7/p8zcTbeffV9rJxfDaBx28GR7GnVNtTI+3iANqmnx8fNTLi8d9tPUbhyohN5z/N8vCjuHt9R08URd6nKpJ08P5twIbptPLI293stE7suNZtba2+D9ERSugJSIiIiIiIiIiIiIi551PdIaWPTGMby60s9hhIyncIizcIi3ZztUXhvGd6TaiTN9gWP1xL7u9YFk2FmTZsPp9D2CMxcJ0fwCrvdrHlq6RX4+Ozg7/h7CI8RWhFBERERERERERERERGYRxFf84eqSLH5Sc/H9OQRifm2DDNHXx8Mc+avtN39nhAwbKjrKYVWAjodHLnw8bjrRAYqLF8sl25sTYyCkI47aqLv5U2yto1ellfWUYF0yApAwb0/f42NM/ppVoY24MGGPYVualyxrZ7CyA2JhY/4fWJlpHfGkiIiIiIiIiIiIiIiLn1rgKaLW1Go72itiEdwaCRV4oqffhDgoeDRxMsiyLDLx8f30XxSYwXQNsrTJ8e2UY08NsLMmBJ2oMvsB8Lcvi4zIvjVl24iJtLHbBHnff+RZk2Ui1LEy7l43VQ1zh07Bs0cRnzWXFoon+6u/cTNHILlJEREREREREREREROScG1cBreG2v6hXMKtbu5d3K8KYng1RSTbS8VHe6+sut2FzG6yMtjE3005Y1cksLGMsLsrwf26o8LLLy6liamfMmFQu+8cfcmlm35kabxOV217mxRf39gTfREREREREREREREREzhef2DG0jPFR3RT8d8uyqGoJ9CMYBnFB3/tYe9z/fUy6xTx7ry+TbFwY45/3R+W+cxZc8jZX4y4vo77znCxORERERERERERERETknPpEZ2h1+UL/vbrCy+9bvdBlqAzx/dESH2UFFllhdi5K9/FhuT/ANTEz0N1gq5dNHoY1O8uvhs2PfY89gV/NsseQkD2XS65dxaxrvk6i79/54xr3qWchIiIiIiIiIiIiIiIyznxiM7ROpa3Rx5pSH2sqDA2hsqyafGw44c/mmjXBItqYPt0NVpf7ODgC2VmW5aW1tgKP2/+vuuIIRzY/w2sbyrGsSHIuvpR0Y4Z9uSIiIiIiIiIiIiIiIqNJAa2zYFmGdaU+vMYQ7rKzKAJI7NXdYNkAqV8jpLauxv8hOYXkc7pkERERERERERERERGRkaeA1lk6cdzHHi9gwcJMG7kZNtIsC5p8rK8/t3WxerLBrOHv5VBERERERERERERERGSUKaB1tjq9rK8Gy7IxOc3GwlR/KKn0uI+yEehu8FSio6L9H9paaTunSxYRERERERERERERERl54zqg1eENjBcVBrHneNmWZbGlxEeTMdgdNi5L8Hc3uPn4ue1uECAqKsb/ob1NAS0RERERERERERERETnvjOuA1vF6Q6cxEGPjlkI7UxMtJiac/OcMMyO6/K5qLx+1gRVuI95mYU742NA8oosMKTo6yv+hvZX2c794ERERERERERERERGRERU22hUYivYKL+8121gVZ2PWNBuzpp38zhjDug/bebR65JZvGcMHxw2XTbIwxnC43EfNOe5uECA8PML/obODjnO+dBERERERERERERERkZE1rjO0LGN4an0Xz5Z5cbcbvGZkM7JCqW4x+IwBn48Py859d4MAra0t/g+OdFLHdYhSREREREREREREREQk2LgPf/g6fLy0zcdLIb8NzpayWr187xXvgN+fCWMMiydY2CyLrlrDxvYhz/KsVB48QNOlLmJjL+Ka+zy8t3Y37hNttDZU0th27oN8IiIiIiIiIiIiIiIiw8mempr6/dGuxLgVG8Y902wkArsPdfJBwyhEswCf5xgNrnlMzYglxjWVafOWMn/JctLr32Vnaeeo1ElERERERERERERERGS4jOsuB0dbVpaNPJsFXh8flo9ePSyrgT1P/IjHn3+PAyVuWtq9/m4QRUREREREREREREREzgPjvsvB0WKMxdIJ/oysdrePzV2MSneD3SyridINT/HXDaNXBxERERERERERERERkZGgDK2zlWRjYax/HK0dx710WqMYzRIRERERERERERERETmPWTNmzFDfdCIiIiIiIiIiIiIiIjJmKUNLRERERERERERERERExjQFtERERERERERERERERGRMU0BLRERERERERERERERExjQFtERERERERERERERERGRMU0BLRERERERERERERERExjQFtERERERERERERERERGRMU0BLRERERERERERERERExrQxGdCKi4sjLi5utKshIiIiIiIiIiIiIiIiY8CYDGiJiIiIiIiIiIiIiIiIdFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERkVNgTCpix8m5uXjl5tKsiEsTYZrHi3rtYNDuPWJsZ7eqIiIiIfOKFjXYFRERERERE5JPF2FKYfMXdXL18JklhFu1b94x2lUSCWQmkzVxO4awVXFq9lbXPPMHGw/UYyxrtmomIiIh8IimgNY4ZU8i1//ebzE/0X0zXvPcjfvlq0SnLTPn0Q9xxYXTwvHxddLTWUVOyn73rX+PDfdV4Q1ykm2n38e37FxN5mgt4c+I9HvuPJyjtN52xL+HTP76
<p blockindex=27>在这个地方,看到了本次分析的主角<code>system</code>,通过<code>inputData.getSystem()</code>获取,然后传入<code>APIOutSysUtil.getOutSysVOByCode()</code>中。</p>
<p blockindex=28><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACE4AAAR/CAYAAAAPADFDAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd5yc1X3v8c+Z2d5776vetZKQUAUJiyKqMabYxhDb14kdx8QluU4c31znGl8XbmLHwTYEF2wwRtgGY0CAUO+9IdRX2t57L3PuH7O72jIrod1Z7a70fb9evFjNzDPn95w5TzvVTJ8+3SIiIiIiIiIiIiIiIiIiIl6TlZUFwLlz50Y5EhG5HMdoByAiIiIiIiIiIiIiIiIiIiIyWtRxQkRERERERERERERERERERK5b6jghIiIiIiIiIiIiIiIiIiIi1y11nBAREREREREREREREREREZHrljpOiIiIiIiIiIiIiIiIiIiIyHVLHSdERERERERERERERERERETkuqWOEyIiIiIiIiIiIiIiIiIiInLdUscJERERERERERERERERERERuW6p44SIiIiIiIiIiIiIiIiIiIhct9RxQkRERERERERERERERERERK5b6jghIiIiIiIiIiIiIiIiIiIi1y0ff3//0Y5BRGRYHOHqAyZD56p1jXYIIiIiIiIiIiIiInINU3usyNin1kYRERERERERERERERERERG5bqnjhIiIiIiIiIiIiIiIiIiIiFy31HFCRERERERERERERERERERErlvqOCEiIiIiIiIiIiIiIiIiIiLXLZ/RDkBEZDi+973v9fz9jSe/MYqRiIiIiIiIiIiIiIiIiMh4pBknRERERERERERERERERERE5LqljhMiIiIiIiIiIiIiIiIiIiJy3VLHCREREREREREREREREREREbluqeOEiIiIiIiIiIiIiIiIiIiIXLfUcUJERERERERERMSLrHXiHxpFRHQCIf5mtMMRERERERGRy/AZ7QBERETGA2dYJhPn3MBE9vP6ljOjHY6IyDXDOqax/KHptBzZzfvHL9DkUuOSiIiMX9Y/jTmr72LBrElEBzkBOP/6P/L7XY2jHJmIiIiIiIhcijpOiIiIXIJ1RJJ980OsXj6NcB9D66EPRjskEZFrTBjx05aTPX0FSysOsf3Vl9l7rhZr1IFCRETGF+tIY/lnn2Bxkt9ohyIiIiIiIiJXSB0nZFyxAZZvLYMUYMMe+H3tyFSom+AsZi9bwbQpWUSHh+FHK03VReR/sJM9W3ZR1jo+KvJ9M9fwsY/dTGJwC2V7f88rfzlCixohBrXiYwv44VwfyD3HqmdLqBtneTXr9rk8tzQASvJ44McFnL/C+G9/ZCHfnu6Ak2dY+OsyXP22t8Hx/OIbmcyik788v4f/fWp85c9Q2ICJ3PxX/4OFyYFY20Zd3nGOHSvw/NlJn+TvH12I/2Xy3dZs5oXvv0zhOCtfI23CAz/g/jmBfV5zdbbQVF9N5YWjfLB7I0fO112TDamZ932Xj88PxZa/yy///VXKB9lHm3wfn/+blURQwa6n/5UtRQM/5xM5kwU3L2dSVhpRYQGYjibqyy9w/uhGdu04Qf1VGsmv68+VuZ7LPwD2PMd3HyVkxnTiY+Zw019NJOvd/+KVzRfoGAf7PGeG5QtJBltl+cpeaBwHMV9LMu79Lg8uCO3zmrUuOtuaaajMI+/9HezacYDqtvHxu+j8eWWCFj/Bl9ZM+FCfrdr6fZ5dlzfCEV3fVH4hIGcNNyT6Ym0zRTteYv229ymrbR7wbCUiIiIiIiJjjzpOjKCJky1fTzfYOss3dzJoQ8hYNd7jHypn8ioeePQe0kMcvV4NIix+AtPjJzB59gzeeu4XHK+2l/yelDu/zSdujMIWv8HP//NNakch/1LnLictIgAIIGnhIjLePMKJS4ctIl2sXybLH/88C5MDsE0X2Pf682w+XELndXIuHA5vnf8czgBCIhIJiUgkbcYipm54jj9sPEP7CP8GV/v8nX/+HB3zZuGMziQtBMoHmcU5NDODSGOwTWfJLx74vn/WvTz0iVUkBPSK1xlKVMoMIpOnMXXam6z95VsUt498Gb6erz8q/1fO2BKOv/4M769LZu7dn+amuYmkrf4i93f+mLXbCq5qY9P1ev97rTHGgY9/MBFJU4lImsqU2ZN57dnfca5p7P+e1/P5U0aXN87/Kr8Qn5yCjzHYql2sf2MfJcaAriUiIiIiIiLjgjpOiPRinRNZ9Yi704SrIZfDmzdyqqCcFmcEsVmLWLRsFlGRc7n9odUUP72O6jFeAVJwaCsF2TcRH9xG+b495LmAsR2yyJhgrZOUjzzKomR/bHs+O37zI7bltV260jP3NX71o/V0d7nyn/kJHl2VibUn2fSjtZzp/lxnA7UjHP94ZvPX8Zs/7KMVwOFHSPxEpi1ZzczkUNJu+Sy3Vz3Jn4/Uj3aYXtV+9hylzCLJpJGc5cP+o50DPmOtk5TUVAA6886Q3+98bv3msPohd6cJV1Mehzet52ReBR0BsaTOuZVFsxMJSLuDe+44xzOvnhzxhmhdf4bmeiz/vZn2Qg6+8iPqOr7CRxfEkX7rJ1l0+vvsKLvOWt1kSOz5v/CrVw/RAYCTwIgEUmav5sY5SfjHLeWue8/ysxf20Kr792uSbTrAm8+8SdElPtPZWH7V4rleqfyC6X4aaKyjYXRDERERERERkSukjhMivfjNvInp4QbbWcTOX/8H24q6G6/yKck9yrmKz/GZB2YRkLycnMx1vHd+NKO9vLZzf+GFH/zl4gtjvKJYZMyIv4VbFsZg6KRw/S/cnSYuw7TXU1N+sUEzoKm966826suKqep9/OlYHFxHA9VlxT3TOleV5nHh2Ekav/B1FieGMuWmFWw//DqV11Ie1p6ioAqSo/1ITsuAo2c9fCiD1DRfAErPnxqwfEHIvBVMDgLrKmfv80+xKb/7+pVHwamjlLm+xQM5EYTNvYlJb5zkRMeI7pGuP0N1PZb/foxp5Oyff8mejH/gxrhUFt65lKPPbaH+Gt5n8ZKOBqrKii+eH8sLKTh1mOLWb/Lgwmj8py5hRsge9g8yq89YofPnENlm6vrfb8lVp/ILra0tQCgEBOIP6jwhIiIiIiIyjjgu/xGRMcQBIznmMDYpGT9joOIIxwsHtio1HNlDbjsYE05iauQIRiIioykxZxEJTgP1u9i6o2y0w7nuGVcBOzYcoMVaiJvF5JjRjsjbCsjPawYgNH0iYdbDlS5qIsmhYG0l+ecqB7ydlJqO0xgo3s2BvL7XL2PaOLtrHzXWgk86ySkjshMyQq798j+QsQXs2nCIFmvxzbyRqbrlkiEypoML23ZRDmBSiEse7YhE5FrX0uy+pyMgkMDRDUVERERERESu0JibcWLODMsXkgy2yvKV/ZCSCnelQEoA+LigoBrWn4Z9g6xPa/0t31wOacDbu+A9H7h/AkwNgWADVQ1wMA9eL4a2S4x+8A+23JoJcyIh1h8cLqhpghMl8HYelLkGbjtliuUrab1fd/9twgzfuXVgGmXnLN884zkGZ4BlVQYsiIFYP/e+VzfB0WJ4pwBq7KVHbvgGWValwbwYiPd3/9B1zXC2FNZdgPyOsRu/tZaURLg7HSaFgE8nVNTDhlOwpX3QzbzCPyCwOwjPHTRcH7DxZz9grw+01/UdO5J2z3d4+IbwAZuYxDX89ZNrBrxetfX7PLsur89rNuIjPPa1u4mngl1P/yv7A27hplVLyEiIJMDRSl3JGU7ufoOdB4s8rnFuY2/nM1++g1gP77Ud/m/+/eVDg+88MOGBH3D/nEBs7iv8+BdHSFp+D4tzJhATHgwtlZSe3cfud9/hXPXAaeR7YrA+RE67lWXL5pOeGIlfZwO1JSc4vP7P7K9dzKe/uoY4qtj902+xuXBkRiD5RYbxyPIEVk0IJTXMBz+Xi6qqRg6dKOP5LeWcav0Q6Tr9WLo8jc/MDSczwhfT0sKpMxX8+t1CttVcZtOIMB5ZlsDqiSEkh/ni295OWWU92w4W89vd9ZRfZr5ar8TvgbVObnlwNv93tj+0VvP9H3/A2hrv/gbWGrJmJvGZBdHMSQogKsCBL53U1LZRWFLNa5sLeS2v45LLBAw
<p blockindex=29>继续跟进一下,明晃晃的字符串拼接就出现了,就造成了<code>SQL</code>注入。</p>
<p blockindex=30><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABl4AAAEbCAYAAAC7hflGAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hc1Z3w8e+5MxqNNOq9d7nLcpELtnHB2MaAIUAIobMskErKppFk3xSWtE3ZDYFACiRACAlLCBBMMTbFvXdbtmV1Wb33MjPn/WMkW9KMZOMZWzL8Ps+TJ1h37twz955+zj1HTZ06VSOEEEIIIYQQQgghhBBCCCG8Zox1AIQQQgghhBBCCCGEEEIIIT4qZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghPiK0NmENjiIiOp5gqxrr4AjxsWQe6wAIIYQQQgjxUWYKyWTSnPlMZBcvbzgx1sERQgyijRyW3zmNzn3bOHS4mA6ndE4JIYS4dGlrGnmrb2DejIlE2UwAFP/zKzy3pWOMQybEx48MvAghhBBCCHEBaCOSCStuZ/WyaYSZFT17j4x1kIQQw6kQYqctIzvnCpbU7WXTS8+z7WQLWskAjBBCiEuLNtK44nNf5/JE/7EOihACGXhxM3uGhS8lK3SDnS9ssdNxjhVuHWHm0QUGYR4+r7WTv7zVy3r7h6+8B0SY+I9ZJtL9NOWlDn55xEG7NAIuGZfy89M6m2u+9w3yQl3hbXjvRzy+tmTUcybe9ii3zApw/y6nnd6uJhrKjnF0yxvsyK/D4SmtTL6Hh+5dgP9Z7pFufo8//9fzlI/wOXNkLvOXL2NyVioRoQEY9k7aaosp3L+BLZuO0DrOZzKqoCxmL72CaVOyiAwNwV/10Nl4itIjm9n63hZqusdf+DNv/hW3zwtG173F7376ErUjPBudfDMPfmkF4dSx9dffYUOF++cu9ec31qwxkdy9OpGVk0NIDjNj7rNTU9PMth2n+MO7jVQ5xvf9UyEhfHplEtdMDyMt3ILNcNBU38aeA1U8/WY1+V3jL/yX37WIJy63QHUJN/1nIcdHiv9pmaz7TgqJdPH0I9v4VZn75873+S26axFPXm4ZdkEnvT126ura2L33FE+tq6Oo98LeP7+ocO5cncRVk0NJDTNjcdppqGtl195K/vh2HYUX+Poj0TEpvPxIJhPp4S8/28JPCy98OHTARFY88AUWJAegdS8tpYc4dKBi1HMuxfzfE0vm9dz66StJsHVRs+N5XnhlP12XSP1HjD868ho+89D1xNLEjse/yboSH8clZxGHtx4kOHcacdGzWP6ZCWS9/Wv+ur4Y+yUQb8+3/Sp8I+PmX3HHvOAhf9PaiaO3k7b6MkoObWLrxl00jFH592FJ/v3h2BZ/k69dl31On218/0c89nrJhQ3Qx5zEXwiYcx2XJVjQuotTm/7Cmx8coqa5E+fH7D4IMV7IwMs4l51kMCFAAYr0dE1OvoNteqxDdXFMnGbhO+kK3WLnmx/YR+zIHc/Xv6SfX8wkUkLO/DMifQI2XXxejTllmPG3RZMwOZr4SXlM2fgkz7925IJUgqzZn+TOu1cSP3gNU1MwEcnTCU+axtScf/HX3/2Lyr4LG59SbvgZ9yyMQFe+xmO/fI2mc/ytpuSV3H7vTaQFD96CK5CQuGxy4rKZPHM6/3rydxxqHF8RqbS4EPvcXEyRWaQFQ227588FZ2QQoRS64yQlp9yPj5fnN9bm3LaAPy2zQnkR1/ywmNJzjD8hkzP40+dSmRgw+P5ZSE6NITklmpWzivjC/5Rw4AI3/s83/Ja0ZH7/YCZ5IYPjv0FMQgSrEyJYPieKH/7yKK/Wj6/4v7ugmb5F0fjFhDI3BI63ef5cbHYIiUpBRzO7yt2P+/z5KQOL1UJiciSJyZGsnFPBN39+nPfaL8zzD5qYztOfT2NK4ODvtxCXFMWapCiW51XwrV8e573Wj3b6BdCWTJY/8EUWJFvRHSXsfPkp1u+v8jjpYICv8v/zLX98KWX2UlLDrYCVxAWLyHhtP0fGV7IV4jSlqzj0z8c4uDaZvBvv48rZ8aRe9WVutf+K598vu6idVWPd/hG+oZSB2T+I8MQphCdOYcrMybz822cp6Bj/z1PybzFWfFF/kfgLcUnJmJVCN2zhzVd3UKUUSFkixJiRgRdfaXbwo/cdQ29opIkf5BhYRjrnHBScclIQo0jz01SUOzjiBCTPvGRcys8vMDubKEDX19EUGUV40gTS/d7msP3s5+qytTz1tx30DvxB+WGLnkjO8muYlWwjfvFn+ET1D3hhV9PQE0++zB9+/jYDXU6WGXdz38pMtM5n/c9foGDgc452hp3puq51Jlff4eq0d3aUsu/dt8kvqaPPGkPq7GtYODOegNQ1fPK6Qh576ei4m/WhTRNZdZer083RVsi+9zZwrKyWLlMYMVmLuHxJLhERs1lz52oq/3ctDeMo/H0nCqgml0SVQnKmmZ0HHG6f0dpEamoKAI6yE5QOSw+X+vMbazogku8/4Oq01x2tvLy2lHcKu+gKDGD2/HTum2sjLDODX3yqldXPNY67WbzaFMq3P+cadLG3NvHPNyvYUNxFs9mfiZPiuG9FDMlRsXz/s20c+q9SisZR+DuPtXCMaHJUMDMnGTy3y72Fp7VibpZrRmxfYRO7h8d/Xz2/k4V88tk6+gBQhEQGkjc3jfvmB2FLSOJHdzVz1eM1tPr4/mlrFN97wDXoojvbef2tEt4q6KTJz8q03CQeWBpOVEISP7m7hWsfraZ+HD0/X9PaROrqe1mQ5I/uLWPTn37O+yW9ozZ6L+X835OyvR9QNmE58YE91O7aQsklVP8RH1+qt5zdL/w3LX0Pccv8WNKuvoeFxx5hU83HrNdOnBdd/Cq//789uGrAZgLC40mZtZpFsxLxj13MJz5ZwG/+vI1uyb8/knTHbl59/DUqR/lMX0ftRQvPx5XEXzBUf29KRysjzIUUQlxEMvDiI8qp3WZ4a5v339vV4OCR9YM6MMd5RU0Mdak+P60N0jLSMZSi+fhOTuVdTbglk9QMOHwuewLb22mqqRzyRkt9TRklx0qwf/3rzI0KJOvKlcTv/JtrBkY/1ddKY23r6X8HdPT1/1cvbTWVQzvqPNzL4LzlTA4E7axl+9M/YX3pwL0voezYfmqcj3BrXjihecuZ/OpRjpzDINLF5D/jSnLCFNpRyZanfs77FQPhL6Wq8ACFtZ/ns7fNICBpGXMy1/JW0ZgGd6iW45Q1QFKUhaT0TDjgKaJkkpLqB0B10XG3juNL/fmNtZgFSVxpA5ydPPebPfx34UBHUTu7DzVS4JjHbxZYib8skav+3sjrfaN928UXPDeJa8MVONp5+tH9PFp6JvyHjzewsQb+eW8MYSlJ3DahlEcKRv26i6uxiX11kBNjZnpWCOxq8fChEGaluza3zC9ocXvjz2fPr7eXksqOMx07VR3
<p blockindex=31>还在校验身份甚至没有到校验授权的时候就完成了注入,这也就是我们请求<code>/u8cloud/api/f</code>都可以成功注入的原因了。</p>
<p blockindex=32><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACJIAAAI8CAYAAACgMRN8AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xU153//9edGfU+mlFFDSE6xphiDAaDsXEhtuNux4lx/I2TTd08NpusN9n9ZrOb/DZZJ/vbTfcmmzhOHKe4925jijHYdBBdBaEyGkmo15nz/WNGqMwIBJKQMO/n48HjMZp7z73n3Dm3cO/nfo41a9YswxiJj48HoKWlZaxWISIiIiIiIiIiIiIiIiIyriZPngzA0aNHx7kmIiIjZxvvCoiIiIiIiIiIiIiIiIiIiIjIxKBAEhEREREREREREREREREREREBFEgiIiIiIiIiIiIiIiIiIiIiIkEKJBERERERERERERERERERERERQIEkIiIiIiIiIiIiIiIiIiIiIhKkQBIRERERERERERERERERERERARRIIiIiIiIiIiIiIiIiIiIiIiJBCiQREREREREREREREREREREREUCBJCIiIiIiIiIiIiIiIiIiIiISpEASEREREREREREREREREREREQEUSCIiIiIiIiIiIiIiIiIiIiIiQQokERERERERERERERERERERERFAgSQiIiIiIiIiIiIiIiIiIiIiEqRAEhEREREREREREREREREREREBFEgiIiIiIiIiIiIiIiIiIiIiIkEKJBERERERERERERERERERERERQIEkIiIiIiIiIiIiIiIiIiIiIhKkQBIRERERERERERERERERERERARRIIiIiIiIiIiIiIiIiIiIiIiJBCiQREREREREREREREREREREREUCBJCIiIiIiIiIiIiIiIiIiIiISpEASEREREREREREREREREREREQEUSCIiIiIiIiIiIiIiIiIiIiIiQQokkQnLGDvRCS6c7kwSoq3xro6IiIiIiIiIiIiIiIiIiMhHnmO8KyAymInOZ8F1N3PpxdNwxdkBKHn6q/x+Y+s410xEREREREREREREREREROSjTYEkMqEYWz5Xfv7vWZYdNd5VERERERERERERERERERERueAokEQmlJiFN3JZViTGtHN8/R94ed1uak604bc0tI2IiIiIiIiIiIiIiIiIiMhYUyDJBDFtdiTfLLAwjT18Y10Pngs0cCJjUg4Oy8LUbeTlZ9+nyrLgAt0WIiIiIiIiIiIiIiIiIiIi55ptvCsg0p/NCnbJ1iZaxrcqIiIiIiIiIiIiIiIiIiIiFxwFksiE0t7REfgQHUP0+FZFRERERERERERERERERETkgqNAEplQOtrbAx+iY4kZ36qIiIiIiIiIiIiIiIiIiIhccBzjXYEL1czZEfxDQWgcj5Xk4KEbQ3+WmkNdfGO/GfCdibHzr6vs5GF46d0uXo1wcNd0GzMTLOKBuhY/Hx718exxPx2WNaBsYl4E//8cCzuG1zd28VjDwOm9psyM4J8LbZhuHw+/3s17vvDzjZb29rbAh+gYBZKIiIiIiIiIiIiIiIiIiIicY8pI8hFhT3Lw9UV2ljhtJEdYOCIs0lPsXHeJg2/OtBFtBgahNB73sccHlmVjYbYNa9B0AGMsFmUEAkc6a/1s7Rn7dnR1dwU+OCIV5SQiIiIiIiIiIiIiIiIiInKO6Vn9ODl6pIfvlPf9nVvo4NOTbJiWHn76oZ/6QfN3d/mBobKBWMwptJHY7OMPhw1H2iApyWLlVDtzY23kFjq4vaaH39f3Cxbp9rGx2sHFkyA508bMvX72Do4lSbIxLxaMMWyv8NFjjW02EoC42LjAh/YW2sd8bSIiIiIiIiIiIiIiIiIiItKfAknGSUe74Wi/SImI7mCQhg/KG/14QoI2hg7isCyLTHz8y8YeykxwvibYVmN4cJWDmQ4bS3PhsTqDP7hcy7L4sMJHc7ad+CgbS9yw1zNwuYXZNtIsC9Pp473aETb4NCxbDAnZ87hy8eRA9XdtoXRsVykiIiIiIiIiIiIiIiIiIiKDKJDkI2J/ab8gkl6dPt6scjAzB6KTbWTgp7Lf5B6PYUsHrIqxMS/LjqOmL+uIMRaXZgY+N1X52O3jVLEsZ8yYNFZ87btckTVwocbXQvX253n22X0ng15ERERERERERERERERERETk3LCNdwVk5IzxU9sS+r1lWdS0BcercUB8yHQ/648HpsdmWMy395uYbOOS2MCyP6j0n7OgDl9rLZ7KChq7z8nqREREREREREREREREREREpB9lJPmI6PGH/762ysdv2n3QY6gOM/1ouZ+KQotsh51LM/y8XxkILJmcFRzWpt3HZi+jmo0koI4tj3ybvcEeaNljScyZx+VrVjPn+q+Q5P9XfrfOc+pFiIiIiIiIiIiIiIiIiIiIyKhSRpKPuI5mP+uO+VlXZWgKl1Wkxc+mE4HsJXMmWcQYM2BYm9pKPwfHIBuJZflor6/C6wn8q606wpEtT/DSpkosK4rcy64gw5hRX6+IiIiIiIiIiIiIiIiIiIgMTYEkFzjLMmw45sdnDBFuO4sjgaR+w9pUDJHqZIzUN9QFPqSkknJO1ywiIiIiIiIiIiIiIiIiIiIKJBFOHPez1wdYsCjLRl6mjXTLghY/GxvPbV2sk9lPrNEfTUdEREREREREREREREREREROSYEkAt0+NtaCZdmYmm5jUVoghOPYcT8VYzCszanERMcEPnS003FO1ywiIiIiIiIiIiIiIiIiIiIKJJkgunwm8MEBced43ZZlsbXcT4sx2J02ViQGhrXZcvzcDmsDEB0dG/jQ2aFAEhERERERERERERERERERkXNMgSQTxPFGQ7cxEGvj1iI705MsJif2/XM5zJiuv6fWxwcdYEXYSLBZmBN+NrWO6SrDiomJDnzobKfz3K9eRERERERERERERERERETkguYY7wpIQGeVj7dbbayOtzFnho05M/qmGWPY8H4nv64du/VbxvDuccOKKRbGGA5X+qk7x8PaAERERAY+dHfRdc7XLiIiIiIiIiIiIiIiIiIicmFTRpIJwjKGxzf28GSFD0+nwWfGNgNJOLVtBr8x4PfzfsW5H9YGoL29LfDBmUGawpxERERERERERERERERERETOKT2qn0D8XX6e2+7nubBTQ7ODWO0+vv2Cb8jpZ8IYw5JJFjbLoqfe8F7niBd5VqoPHqDlCjdxcZdy/X1e3l6/B8+JDtqbqmnuOPfBNSIiIiIiIiIiIiIiIiIiIhcSBZJIQJyDy5IDw9rsPd5D6zgMawPgO/AMr2yfwc3zUkmZcSO3zLgRgJKnv8rvN7aOS51EREREREREREREREREREQuFBraRgDIzraRb7PA5+f9yvGrh2U1sfex7/Ho029zoNxDW6cvMNyOiIiIiIiIiIiIiIiIiIiIjDllJBGMsVg2KZCBpNPjZ0sP4zKsTS/LauHYpsf586bxq4OIiIiIiIiIiIiIiIiIiMiFSBlJBJJtLIoDYww7j/voHqdhbURERERERERERERERERERGR8KSOJYDX6+NoLvt6/xrUuIiIiIiIiIiIiIiIiIiIiMn6UkUREREREREREREREREREREREAAWSiIiIiIiIiIiIiIiIiIiIiEiQAklEREREREREREREREREREREBFAgiYiIiIiIiIiIiIiIiIiIiIgEKZBERERERERERERERERERERERAAFkoiIiIiIiIiIiIiIiIiIiIhIkAJJRERERERERERERERERERERARQIMmYi4+PJz4+fryrISIiIiIiIiIiIiIiIiIiInJaCiQREREREREREREREREREREREUCBJCIiIiIiIiIiIiIiIiIiIiISpEASEREREREREREREREREREREQEUSCIiIiIiIiIiIiIiIiIiIiIiQQokERERERERERERERERERERERFAgSQiIiIiIiIiIiIiIiIiIiIiEqRAEhEREREREREREREREREREREBFEgiIiIiIiIiIiIiIiIiIiIiIkEKJBERERERERERERERERERERERQIEkIiIiIiIiIiIiIiIiIiIiIhKkQBIRERERERGREbInFjJr1T3csm
<h2 blockindex=33>0x03 后续</h2>
<p blockindex=34>自此,关于这个漏洞的一些情况就分析完毕了,但是也还是遗留了一些问题,比如<code>/u8cloud/api/</code>后的服务模块具体是怎么调用的,感兴趣的师傅们就自行去研究了。</p></div></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>