using Newtonsoft.Json;
using Newtonsoft.Json.Serialization;
using System.Diagnostics;
using System.Text.Json;
using System.Text.Json.Serialization;
using System.Text.Json.Serialization.Metadata;

namespace NewtonsoftSecurityDemo
{
    [JsonPolymorphic(TypeDiscriminatorPropertyName = "CustomerType")]
    [JsonDerivedType(typeof(PaymentCompletedEvent), "PaymentCompletedEvent")]
    [JsonDerivedType(typeof(OrderCreatedEvent), "OrderCreatedEvent")]
    public class TransactionEvent
    {
        public string EventId { get; set; } = Guid.NewGuid().ToString();

        public DateTime EventTime { get; set; } = DateTime.Now;

        public string OrderId { get; set; }

        // 业务扩展字段（攻击者利用的入口）
        public object ExtData { get; set; }
    }

    public class PaymentCompletedEvent : TransactionEvent
    {
        public decimal Amount { get; set; }
        public string PaymentMethod { get; set; }
    }

    public class OrderCreatedEvent : TransactionEvent
    {
        public string UserId { get; set; }
        public int ItemCount { get; set; }
    }


    // Newtonsoft.Json 安全绑定器（演示白名单校验）
    public class EventSerializationBinder : ISerializationBinder
    {
        // 仅允许的安全类型白名单
        private readonly HashSet<string> _allowedTypes = new()
        {
            "NewtonsoftSecurityDemo.PaymentCompletedEvent",
            "NewtonsoftSecurityDemo.OrderCreatedEvent",
            //"System.Diagnostics.ProcessStartInfo"
        };

        public Type BindToType(string assemblyName, string typeName)
        {
            // 仅允许白名单内的类型
            if (!_allowedTypes.Contains(typeName))
            {
                throw new NotSupportedException($"禁止反序列化未授权类型：{typeName}");
            }
            return Type.GetType($"{typeName}, {assemblyName}") ?? typeof(TransactionEvent);
        }

        public void BindToName(Type serializedType, out string? assemblyName, out string? typeName)
        {
            assemblyName = serializedType.Assembly.FullName;
            typeName = serializedType.FullName;
        }
    }

    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("=== Newtonsoft.Json 命令执行攻击演示 ===");
            Newtonsoft_Attack_ProcessStartInfo();

            Console.WriteLine("\n=== Newtonsoft.Json 文件读取攻击演示 ===");
            Newtonsoft_Attack_FileStream();

            Console.WriteLine("\n=== Newtonsoft.Json 启用 SerializationBinder：安全防护演示 ===");
            Newtonsoft_Secure_WithBinder();

            Console.WriteLine("\n=== System.Text.Json 安全防护演示 ===");
            SystemTextJson_Defense();

            Console.ReadKey();
        }

        /// <summary>
        /// 模拟：注入ProcessStartInfo执行系统命令
        /// </summary>
        static void Newtonsoft_Attack_ProcessStartInfo()
        {
            string maliciousCallbackJson = @$"
                {{
                    ""$type"": ""NewtonsoftSecurityDemo.PaymentCompletedEvent, NewtonsoftSecurityDemo"",
                    ""EventId"": ""{Guid.NewGuid()}"",
                    ""OrderId"": ""ORD_{new Random().Next(1000, 9999)}"",
                    ""Amount"": 999.00,
                    ""PaymentMethod"": ""Alipay"",
                    ""ExtData"": {{
                        ""$type"": ""System.Diagnostics.ProcessStartInfo,System.Diagnostics.Process"",
                        ""FileName"": ""cmd.exe"",
                        ""Arguments"": ""/c echo 'some scripts' > C:\\temp\\attack_log.txt && echo 'doing' >> C:\\temp\\attack_log.txt"",
                        ""UseShellExecute"": true
                    }}
                }}";

            var settings = new JsonSerializerSettings
            {
                TypeNameHandling = TypeNameHandling.Auto,
            };

            var eventData = Newtonsoft.Json.JsonConvert.DeserializeObject<TransactionEvent>(maliciousCallbackJson, settings);
            Console.WriteLine($"处理订单事件：{eventData.OrderId}");

            if (eventData.ExtData is ProcessStartInfo psi)
            {
                Directory.CreateDirectory("C:\\temp");
                Process.Start(psi);
                Console.WriteLine($"  [攻击成功] 执行命令：{psi.Arguments}");
                Console.WriteLine($"  [攻击结果] 生成文件：C:\\temp\\attack_log.txt 文件内容：");
                if (File.Exists("C:\\temp\\attack_log.txt"))
                {
                    string content = File.ReadAllText("C:\\temp\\attack_log.txt");
                    Console.WriteLine($"{content}");
                }
            }
        }

        /// <summary>
        /// 模拟：注入FileInfo读取敏感文件
        /// </summary>
        static void Newtonsoft_Attack_FileStream()
        {
            string targetFile = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Desktop), "appsettings.json");
            if (!File.Exists(targetFile))
            {
                File.WriteAllText(targetFile, "ConnectionString: 123456");
            }

            string maliciousExportJson = @$"
                {{
                    ""$type"": ""NewtonsoftSecurityDemo.OrderCreatedEvent, NewtonsoftSecurityDemo"",
                    ""OrderId"": ""ORD_{new Random().Next(1000, 9999)}"",
                    ""UserId"": ""user_{new Random().Next(100, 999)}"",
                    ""ExtData"": {{
                        ""$type"": ""System.IO.FileInfo"", 
                        ""FileName"": ""{targetFile.Replace("\\", "\\\\")}"" 
                    }}
                }}";

            var settings = new JsonSerializerSettings
            {
                TypeNameHandling = TypeNameHandling.Auto
            };

            var eventData = Newtonsoft.Json.JsonConvert.DeserializeObject<TransactionEvent>(maliciousExportJson, settings);
            Console.WriteLine($"处理订单导出：{eventData.OrderId}");

            // 通过FileInfo读取文件内容（模拟攻击逻辑）
            if (eventData.ExtData is FileInfo fileInfo)
            {
                using (var sr = new StreamReader(fileInfo.OpenRead()))
                {
                    string sensitiveContent = sr.ReadToEnd();
                    Console.WriteLine($"  [攻击成功] 读取敏感文件内容：\n{sensitiveContent}");
                }
            }
        }

        /// <summary>
        /// Newtonsoft.Json 启用SerializationBinder：拦截恶意类型
        /// </summary>
        static void Newtonsoft_Secure_WithBinder()
        {
            string maliciousCallbackJson = @$"
                {{
                    ""$type"": ""NewtonsoftSecurityDemo.PaymentCompletedEvent, NewtonsoftSecurityDemo"",
                    ""EventId"": ""{Guid.NewGuid()}"",
                    ""OrderId"": ""ORD_{new Random().Next(1000, 9999)}"",
                    ""Amount"": 999.00,
                    ""PaymentMethod"": ""Alipay"",
                    ""ExtData"": {{
                        ""$type"": ""System.Diagnostics.ProcessStartInfo,System.Diagnostics.Process"",
                        ""FileName"": ""cmd.exe"",
                        ""Arguments"": ""/c echo 'some scripts' > C:\\temp\\attack_log.txt && echo 'doing' >> C:\\temp\\attack_log.txt"",
                        ""UseShellExecute"": true
                    }}
                }}";

            var settings = new JsonSerializerSettings
            {
                TypeNameHandling = TypeNameHandling.Auto,
                SerializationBinder = new EventSerializationBinder() // 启用白名单校验
            };

            try
            {
                var eventData = Newtonsoft.Json.JsonConvert.DeserializeObject<TransactionEvent>(maliciousCallbackJson, settings);
                if (eventData.ExtData is ProcessStartInfo)
                {
                    Console.WriteLine("  [防护失效] 恶意类型未被拦截（异常）");
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine($"  [防护成功] 拦截未授权类型：{ex.Message}");
            }
        }

        /// <summary>
        /// System.Text.Json 安全防护验证
        /// </summary>
        static void SystemTextJson_Defense()
        {
            string maliciousCallbackJson = @$"
                {{
                    ""CustomerType"": ""PaymentCompletedEvent"",
                    ""EventId"": ""{Guid.NewGuid()}"",
                    ""OrderId"": ""ORD_{new Random().Next(1000, 9999)}"",
                    ""Amount"": 999.00,
                    ""PaymentMethod"": ""Alipay"",
                    ""ExtData"": {{
                        ""$type"": ""System.Diagnostics.ProcessStartInfo,System.Diagnostics.Process"",
                        ""FileName"": ""cmd.exe"",
                        ""Arguments"": ""/c echo 'some scripts' > C:\\temp\\attack_log.txt && echo 'doing' >> C:\\temp\\attack_log.txt"",
                        ""UseShellExecute"": true
                    }}
                }}";

            var eventData = System.Text.Json.JsonSerializer.Deserialize<TransactionEvent>(maliciousCallbackJson);

            Console.WriteLine($"  主对象类型：{eventData.GetType().FullName}");
            Console.WriteLine($"  ExtData 实际类型：{eventData.ExtData.GetType().FullName}");

            if (eventData.ExtData is JsonElement)
            {
                Console.WriteLine("  [防护成功] 恶意类型ProcessStartInfo被拦截，ExtData仅保留原始JSON结构，未反序列化为恶意对象");
            }
            else if (eventData.ExtData is ProcessStartInfo)
            {
                Console.WriteLine("  [防护失效] 恶意类型解析成功");
            }
            else
            {
                Console.WriteLine($"  [正常业务] 解析到合法类型：{eventData.ExtData.GetType().FullName}");
            }

            Console.WriteLine("\n尝试转换ExtData为ProcessStartInfo：");
            try
            {
                var psi = (ProcessStartInfo)eventData.ExtData;
                Console.WriteLine("  [防护失效] 恶意类型解析成功");
            }
            catch (InvalidCastException ex)
            {
                Console.WriteLine($"  [防护成功] 强制转换失败，原因：{ex.Message}");
            }
        }
    }
}

public class EventSerializationBinder : ISerializationBinder
{
    // 仅允许的安全类型白名单
    private readonly HashSet<string> _allowedTypes = new()
    {
        "NewtonsoftSecurityDemo.PaymentCompletedEvent",
        "NewtonsoftSecurityDemo.OrderCreatedEvent",
        //"System.Diagnostics.ProcessStartInfo"
    };

    public Type BindToType(string assemblyName, string typeName)
    {
        // 仅允许白名单内的类型
        if (!_allowedTypes.Contains(typeName))
        {
            throw new NotSupportedException($"禁止反序列化未授权类型：{typeName}");
        }
        return Type.GetType($"{typeName}, {assemblyName}") ?? typeof(TransactionEvent);
    }

    public void BindToName(Type serializedType, out string? assemblyName, out string? typeName)
    {
        assemblyName = serializedType.Assembly.FullName;
        typeName = serializedType.FullName;
    }
}