feat: support springmvc shell generate

vul/vul-springboot2/Dockerfile

@@ -0,0 +1,8 @@
+FROM openjdk:8
+WORKDIR /app
+
+COPY build/libs/vul-springboot2.jar /app/app.jar
+
+EXPOSE 8080
+
+ENTRYPOINT java $JAVA_OPTS -jar app.jar

vul/vul-springboot2/build.gradle

@@ -0,0 +1,24 @@
+plugins {
+    id 'org.springframework.boot' version '2.7.6'
+    id 'io.spring.dependency-management' version '1.0.15.RELEASE'
+    id 'java'
+    id 'war'
+}
+
+group = 'com.reajason.javaweb.vul'
+version = ''
+sourceCompatibility = '1.8'
+
+repositories {
+    mavenCentral()
+}
+
+dependencies {
+    implementation 'org.springframework.boot:spring-boot-starter-web'
+    providedRuntime 'org.springframework.boot:spring-boot-starter-tomcat'
+    testImplementation 'org.springframework.boot:spring-boot-starter-test'
+}
+
+tasks.named('test') {
+    useJUnitPlatform()
+}

vul/vul-springboot2/src/main/java/com/reajason/javaweb/vul/springboot2/VulSpringboot2Application.java

@@ -0,0 +1,17 @@
+package com.reajason.javaweb.vul.springboot2;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+
+@SpringBootApplication
+public class VulSpringboot2Application {
+
+    public static void main(String[] args) {
+        SpringApplication.run(VulSpringboot2Application.class, args);
+    }
+}

vul/vul-springboot2/src/main/java/com/reajason/javaweb/vul/springboot2/controller/Base64ClassLoaderController.java

@@ -0,0 +1,22 @@
+package com.reajason.javaweb.vul.springboot2.controller;
+
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Base64;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/b64")
+public class Base64ClassLoaderController extends ClassLoader {
+    @PostMapping
+    public String base64ClassLoader(String data) throws Exception {
+        byte[] bytes = Base64.getDecoder().decode(data);
+        Object o = defineClass(null, bytes, 0, bytes.length).newInstance();
+        return o.toString();
+    }
+}

vul/vul-springboot2/src/main/java/com/reajason/javaweb/vul/springboot2/controller/IndexController.java

@@ -0,0 +1,23 @@
+package com.reajason.javaweb.vul.springboot2.controller;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+public class IndexController {
+
+    @RequestMapping("/test")
+    public String test() {
+        return "";
+    }
+
+    @GetMapping("/")
+    public String index() {
+        return "hello";
+    }
+}

vul/vul-springboot2/src/main/java/com/reajason/javaweb/vul/springboot2/controller/ScriptEngineController.java

@@ -0,0 +1,23 @@
+package com.reajason.javaweb.vul.springboot2.controller;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import javax.script.ScriptEngineManager;
+import javax.script.ScriptException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/js")
+public class ScriptEngineController {
+
+    @PostMapping
+    public ResponseEntity<?> js(String data) throws ScriptException {
+        return ResponseEntity.ok().body(String.valueOf(new ScriptEngineManager().getEngineByName("js").eval(data)));
+    }
+}

vul/vul-springboot2/src/main/java/com/reajason/javaweb/vul/springboot2/controller/SpELController.java

@@ -0,0 +1,22 @@
+package com.reajason.javaweb.vul.springboot2.controller;
+
+import org.springframework.expression.spel.standard.SpelExpressionParser;
+import org.springframework.expression.spel.support.StandardEvaluationContext;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/22
+ */
+@RestController
+@RequestMapping("/spel")
+public class SpELController {
+
+    @PostMapping
+    public ResponseEntity<?> spel(String data) {
+        return ResponseEntity.ok().body(String.valueOf(new SpelExpressionParser().parseExpression(data).getValue(new StandardEvaluationContext())));
+    }
+}

vul/vul-springboot2/src/test/java/com/reajason/javaweb/vul/springboot2/VulSpringboot2ApplicationTests.java

@@ -0,0 +1,13 @@
+package com.reajason.javaweb.vul.springboot2;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.SpringBootTest;
+
+@SpringBootTest
+class VulSpringboot2ApplicationTests {
+
+    @Test
+    void contextLoads() {
+    }
+
+}