Dependency Conflict: duplicate classes "javassist.bytecode.ConstPool.addUtf8Info" in different JARs, have different implementations about fastjsonexploit HOT 3 CLOSED

Code snippet of javassist.bytecode.ConstPool.addUtf8Info in javassist:javassist:3.12.0.GA (shadowed but expected to invoke method):

public int addUtf8Info(String utf8) {	//line 899
  Utf8Info info = (Utf8Info)strings.get(utf8);
  if (info != null)
    return info.index;
  else {
    info = new Utf8Info(utf8, numOfItems);
    strings.put(utf8, info);
    return addItem(info);
  }
}

Code snippet of javassist.bytecode.ConstPool.addUtf8Info in org.javassist:javassist:3.18.2-GA (loaded version):

public int addUtf8Info(String utf8) {	//line 1066
  return addItem(new Utf8Info(utf8, numOfItems));
}

As a result, these conflicting method included in javassist:javassist:3.12.0.GA deals with different cases, which changes the control flows and data flows. So being forced to use these methods in org.javassist:javassist:3.18.2-GA may lead to inconsisitent semantic behaviors.

from fastjsonexploit.

Using the following test case to run on these two versions of methods separately starting from the entry method gadget.getBasicDataSource1ExpCode() in your project, then we can find the return value of getBasicDataSource1ExpCode() is changed.

Test for FastjsonExploit.txt

Please check whether the changes of this variable value will affect your semantic behaviors.

from fastjsonexploit.

@HelloCoCooo Yes, I will refer to it！

from fastjsonexploit.