test: add SpringBoot1 vul case (resolved #22)

vul/vul-springboot1/src/main/java/com/reajason/javaweb/vul/springboot1/ServletInitializer.java

@@ -0,0 +1,15 @@
+package com.reajason.javaweb.vul.springboot1;
+
+import org.springframework.boot.builder.SpringApplicationBuilder;
+import org.springframework.boot.web.support.SpringBootServletInitializer;
+
+/**
+ * @author ReaJason
+ */
+public class ServletInitializer extends SpringBootServletInitializer {
+
+    @Override
+    protected SpringApplicationBuilder configure(SpringApplicationBuilder application) {
+        return application.sources(VulSpringboot1Application.class);
+    }
+}

vul/vul-springboot1/src/main/java/com/reajason/javaweb/vul/springboot1/VulSpringboot1Application.java

@@ -0,0 +1,15 @@
+package com.reajason.javaweb.vul.springboot1;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/26
+ */
+@SpringBootApplication
+public class VulSpringboot1Application {
+    public static void main(String[] args) {
+        SpringApplication.run(VulSpringboot1Application.class, args);
+    }
+}

vul/vul-springboot1/src/main/java/com/reajason/javaweb/vul/springboot1/controller/Base64ClassLoaderController.java

@@ -0,0 +1,22 @@
+package com.reajason.javaweb.vul.springboot1.controller;
+
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/b64")
+public class Base64ClassLoaderController extends ClassLoader {
+    @PostMapping
+    public String base64ClassLoader(String data) throws Exception {
+        byte[] bytes = Base64.getDecoder().decode(data);
+        Object o = defineClass(null, bytes, 0, bytes.length).newInstance();
+        return o.toString();
+    }
+}

vul/vul-springboot1/src/main/java/com/reajason/javaweb/vul/springboot1/controller/IndexController.java

@@ -0,0 +1,23 @@
+package com.reajason.javaweb.vul.springboot1.controller;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+public class IndexController {
+
+    @RequestMapping("/test")
+    public String test() {
+        return "";
+    }
+
+    @GetMapping("/")
+    public String index() {
+        return "hello";
+    }
+}

vul/vul-springboot1/src/main/java/com/reajason/javaweb/vul/springboot1/controller/ScriptEngineController.java

@@ -0,0 +1,23 @@
+package com.reajason.javaweb.vul.springboot1.controller;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.script.ScriptEngineManager;
+import javax.script.ScriptException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/js")
+public class ScriptEngineController {
+
+    @PostMapping
+    public ResponseEntity<?> js(String data) throws ScriptException {
+        return ResponseEntity.ok().body(String.valueOf(new ScriptEngineManager().getEngineByName("js").eval(data)));
+    }
+}

vul/vul-springboot1/src/main/java/com/reajason/javaweb/vul/springboot1/controller/SpELController.java

@@ -0,0 +1,22 @@
+package com.reajason.javaweb.vul.springboot1.controller;
+
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/spel")
+public class SpELController {
+
+    @PostMapping
+    public ResponseEntity<?> spel(String data) {
+        return ResponseEntity.ok().body(String.valueOf(new SpelExpressionParser().parseExpression(data).getValue(new StandardEvaluationContext())));
+    }
+}

vul/vul-springboot1/src/main/resources/application.properties

@@ -0,0 +1,3 @@
+server.port=8080
+logging.level.root=INFO
+logging.level.org.springframework=INFO