feat: support XMLDecoderDefineClass packer

vul/vul-webapp-jakarta/src/main/java/jakarta/ScriptEngineServlet.java

@@ -0,0 +1,27 @@
+package jakarta;
+
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+import javax.script.ScriptEngineManager;
+import javax.script.ScriptException;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/3
+ */
+public class ScriptEngineServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        try {
+            Object eval = new ScriptEngineManager().getEngineByName("js").eval(data);
+            resp.getWriter().println(eval.toString());
+        } catch (ScriptException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml

@@ -45,6 +45,15 @@
         <url-pattern>/b64</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>js</servlet-name>
+        <servlet-class>jakarta.ScriptEngineServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>js</servlet-name>
+        <url-pattern>/js</url-pattern>
+    </servlet-mapping>
+
     <filter>
         <filter-name>empty</filter-name>
         <filter-class>jakarta.EmptyFilter</filter-class>