DDCTF2018 2道web writeup

package com.eliteams.quick4j.web.controller;
// 删除了导入包

@Controller
@RequestMapping({"/user"})
public class UserController
{
  public static final String hintFile = "/flag/hint.txt";
  @Resource
  private UserService userService;
  
  @RequestMapping(value={"/login"}, method={org.springframework.web.bind.annotation.RequestMethod.POST})
  public String login(@Valid User user, BindingResult result, Model model, HttpServletRequest request)
  {
    try
    {
      Subject subject = SecurityUtils.getSubject();
      if (subject.isAuthenticated()) {
        return "redirect:/";
      }
      if (result.hasErrors())
      {
        model.addAttribute("error", "参数错误！");
        return "login";
      }
      if ((user.getUsername().isEmpty()) || (user.getUsername() == null) || 
        (user.getPassword().isEmpty()) || (user.getPassword() == null)) {
        return "login";
      }
      subject.login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));
      
      User authUserInfo = this.userService.selectByUsername(user.getUsername());
      request.getSession().setAttribute("userInfo", authUserInfo);
    }
    catch (AuthenticationException e)
    {
      model.addAttribute("error", "用户名或密码错误 ！");
      return "login";
    }
    return "redirect:/";
  }
  
  @RequestMapping(value={"/logout"}, method={org.springframework.web.bind.annotation.RequestMethod.GET})
  public String logout(HttpSession session)
  {
    session.removeAttribute("userInfo");
    
    Subject subject = SecurityUtils.getSubject();
    subject.logout();
    return "login";
  }
  
  @RequestMapping(value={"/admin"}, produces={"text/html;charset=UTF-8"})
  @ResponseBody
  @RequiresRoles({"admin"})
  public String admin()
  {
    return "拥有admin角色,能访问";
  }
  
  @RequestMapping(value={"/create"}, produces={"text/html;charset=UTF-8"})
  @ResponseBody
  @RequiresPermissions({"user:create"})
  public String create()
  {
    return "拥有user:create权限,能访问";
  }
  
  @RequestMapping(value={"/getInfomation"}, produces={"text/html;charset=UTF-8"})
  @ResponseBody
  @RequiresRoles({"guest"})
  public ResponseEntity<byte[]> download(HttpServletRequest request, String filename)
    throws IOException
  {
    if ((filename.contains("../")) || (filename.contains("./")) || (filename.contains("..\\")) || (filename.contains(".\\"))) {
      return null;
    }
    String path = request.getServletContext().getRealPath("/");
    System.out.println(path);
    
    File file = new File(path + File.separator + filename);
    HttpHeaders headers = new HttpHeaders();
    
    String downloadFielName = new String(filename.getBytes("UTF-8"), "iso-8859-1");
    
    headers.setContentDispositionFormData("attachment", downloadFielName);
    
    headers.setContentType(MediaType.APPLICATION_OCTET_STREAM);
    return new ResponseEntity(FileUtils.readFileToByteArray(file), headers, HttpStatus.CREATED);
  }
  
  @RequestMapping(value={"/nicaicaikan_url_23333_secret"}, produces={"text/html;charset=UTF-8"})
  @ResponseBody
  @RequiresRoles({"super_admin"})
  public String xmlView(String xmlData)
  {
    if (xmlData.length() >= 1000) {
      return "Too long~~";
    }
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    
    factory.setExpandEntityReferences(true);
    try
    {
      DocumentBuilder builder = factory.newDocumentBuilder();
      
      InputStream xmlInputStream = new ByteArrayInputStream(xmlData.getBytes());
      
      Document localDocument = builder.parse(xmlInputStream);
    }
    catch (ParserConfigurationException e)
    {
      e.printStackTrace();
      return "ParserConfigurationException";
    }
    catch (SAXException e)
    {
      e.printStackTrace();
      return "SAXException";
    }
    catch (IOException e)
    {
      e.printStackTrace();
      return "IOException";
    }
    return "ok~ try to read /flag/hint.txt";
  }
}