feat: support rhino and jinjava packer

vul/vul-webapp-expression/build.gradle

@@ -27,6 +27,8 @@ dependencies {
     implementation 'commons-jxpath:commons-jxpath:1.3'
     implementation 'com.googlecode.aviator:aviator:5.2.7'
     implementation 'org.codehaus.groovy:groovy:3.0.6'
+    implementation 'org.mozilla:rhino:1.7.14'
+    implementation 'com.hubspot.jinjava:jinjava:2.4.5'
     implementation 'org.springframework:spring-expression:4.3.0.RELEASE'
     providedCompile 'de.odysseus.juel:juel-api:2.2.7'
     providedCompile "javax.servlet:servlet-api:2.5"

vul/vul-webapp-expression/src/main/java/AviatorServlet.java

@@ -1,6 +1,5 @@
 import com.googlecode.aviator.AviatorEvaluator;
 import com.googlecode.aviator.AviatorEvaluatorInstance;
-import groovy.lang.GroovyShell;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;

vul/vul-webapp-expression/src/main/java/GroovyServlet.java

@@ -1,5 +1,4 @@
 import groovy.lang.GroovyShell;
-import ognl.OgnlContext;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;

vul/vul-webapp-expression/src/main/java/JXPathServlet.java

@@ -1,4 +1,3 @@
-import groovy.lang.GroovyShell;
 import org.apache.commons.jxpath.JXPathContext;
 
 import javax.servlet.ServletException;
@@ -16,6 +15,6 @@ public class JXPathServlet extends HttpServlet {
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         String data = req.getParameter("data");
         JXPathContext context = JXPathContext.newContext(null);
-        resp.getWriter().println(context.getValue(data  ));
+        resp.getWriter().println(context.getValue(data));
     }
 }

vul/vul-webapp-expression/src/main/java/JinJavaServlet.java

@@ -0,0 +1,23 @@
+import com.google.common.collect.Maps;
+import com.hubspot.jinjava.Jinjava;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.Map;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class JinJavaServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        Jinjava jnj = new Jinjava();
+        Map<String, Object> context = Maps.newHashMap();
+        resp.getWriter().println(jnj.render(data, context));
+    }
+}

vul/vul-webapp-expression/src/main/java/RhinoServlet.java

@@ -0,0 +1,25 @@
+import org.mozilla.javascript.Context;
+import org.mozilla.javascript.Scriptable;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class RhinoServlet extends HttpServlet {
+
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        try (Context cx = Context.enter()) {
+            Scriptable scope = cx.initStandardObjects();
+            Object result = cx.evaluateString(scope, data, null, 1, null);
+            resp.getWriter().print(Context.toString(result));
+        }
+    }
+}

vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml

@@ -126,6 +126,24 @@
         <url-pattern>/aviator</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>rhino</servlet-name>
+        <servlet-class>RhinoServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>rhino</servlet-name>
+        <url-pattern>/rhino</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>jinjava</servlet-name>
+        <servlet-class>JinJavaServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>jinjava</servlet-name>
+        <url-pattern>/jinjava</url-pattern>
+    </servlet-mapping>
+
     <servlet>
         <servlet-name>velocity</servlet-name>
         <servlet-class>VelocityServlet</servlet-class>

vul/vul-webapp-expression/src/test/java/AviatorServletTest.java

@@ -1,7 +1,6 @@
 import com.googlecode.aviator.AviatorEvaluator;
 import com.googlecode.aviator.AviatorEvaluatorInstance;
 import org.junit.jupiter.api.Test;
-import org.springframework.util.ClassUtils;
 
 /**
  * @author ReaJason