https://baozongwi.xyz/tags/groovy/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/fastjson-1.2.80-deserialization/Tue, 21 Oct 2025 22:08:24 +0800https://baozongwi.xyz/p/fastjson-1.2.80-deserialization/1.2.68 版本修复方案，是将java.lang.Runnable、java.lang.Readable和java.lang.AutoCloseable加入黑名单，那么 1.2.80 用的就是另一个期望类，异常类Throwable。 关键点在于反序列化setter method parameter OR public …