feat: support bsh packer

vul/vul-webapp-expression/build.gradle

@@ -22,6 +22,7 @@ dependencies {
     implementation 'org.apache.velocity:velocity:1.7'
     implementation 'ognl:ognl:2.7.3'
     implementation 'org.mvel:mvel2:2.4.7.Final'
+    implementation 'org.beanshell:bsh:2.0b5'
     implementation 'org.apache.commons:commons-jexl:2.1.1'
     implementation 'org.apache.commons:commons-jexl3:3.2.1'
     implementation 'commons-jxpath:commons-jxpath:1.3'

vul/vul-webapp-expression/src/main/java/BeanShellServlet.java

@@ -0,0 +1,26 @@
+import bsh.EvalError;
+import bsh.Interpreter;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class BeanShellServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        Interpreter i = new Interpreter();
+        try {
+            Object eval = i.eval(data);
+            resp.getWriter().println(eval);
+        } catch (EvalError e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java

@@ -1,4 +1,3 @@
-
 import org.apache.commons.jexl3.JexlBuilder;
 import org.apache.commons.jexl3.JexlEngine;
 import org.apache.commons.jexl3.JexlExpression;

vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml

@@ -126,6 +126,15 @@
         <url-pattern>/aviator</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>bsh</servlet-name>
+        <servlet-class>BeanShellServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>bsh</servlet-name>
+        <url-pattern>/bsh</url-pattern>
+    </servlet-mapping>
+
     <servlet>
         <servlet-name>rhino</servlet-name>
         <servlet-class>RhinoServlet</servlet-class>

vul/vul-webapp-expression/src/test/java/JEXL3ServletTest.java

@@ -1,4 +1,3 @@
-import org.apache.commons.jexl2.Expression;
 import org.apache.commons.jexl3.*;
 import org.junit.jupiter.api.Test;