WooYun.org

Hashtable formfields = new Hashtable();
    int pos = contentType.indexOf("boundary="); //后台处理上传尽然用boundary=来切割处理数据...
    if (pos != -1) {
      pos += "boundary=".length();
      boundary = "--" + contentType.substring(pos);
      lastboundary = boundary + "--";
    }
    int state = 0;
    DataInputStream in = new DataInputStream(request.getInputStream());
    in.readFully(b);
    in.close();
    String reqcontent = new String(b);
    BufferedReader reqbuf = new BufferedReader(new StringReader(reqcontent));
    boolean flag = true;
    int i = 0;
    while (flag == true) {
      String s = reqbuf.readLine();
      if ((s == lastboundary) || (s == null)) break;
      switch (state) {
      case 0:
        if (s.startsWith(boundary)) {
          state = 1;
          i++; } break;
      case 1:
        pos = s.indexOf("filename="); //在处理filename时，类似filename="xx.xx"中的第一个"双引号会直接带入文件名，这样就导致上传失败，所以上传时抓包去掉第一个双引号"
        if (pos == -1) {
          pos = s.indexOf("name=");
          pos += "name=".length() + 1;
          s = s.substring(pos);
          int l = s.length();
          s = s.substring(0, l - 1);
          fieldname = s;
          state = 3;
        }