feat: support mvel packer

vul/vul-webapp-expression/build.gradle

@@ -21,6 +21,7 @@ dependencies {
     implementation 'commons-io:commons-io:2.+'
     implementation 'org.apache.velocity:velocity:1.7'
     implementation 'ognl:ognl:2.7.3'
+    implementation 'org.mvel:mvel2:2.4.7.Final'
     implementation 'org.springframework:spring-expression:4.3.0.RELEASE'
     providedCompile 'de.odysseus.juel:juel-api:2.2.7'
     providedCompile "javax.servlet:servlet-api:2.5"

vul/vul-webapp-expression/src/main/java/MVELServlet.java

@@ -0,0 +1,19 @@
+import org.mvel2.MVEL;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+public class MVELServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        resp.getWriter().println(MVEL.eval(data));
+    }
+}

vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml

@@ -72,6 +72,15 @@
         <url-pattern>/ognl</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>mvel</servlet-name>
+        <servlet-class>MVELServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>mvel</servlet-name>
+        <url-pattern>/mvel</url-pattern>
+    </servlet-mapping>
+
     <servlet>
         <servlet-name>velocity</servlet-name>
         <servlet-class>VelocityServlet</servlet-class>