feat: support more expression packer

vul/vul-webapp-expression/src/main/java/AviatorServlet.java

@@ -0,0 +1,22 @@
+import com.googlecode.aviator.AviatorEvaluator;
+import com.googlecode.aviator.AviatorEvaluatorInstance;
+import groovy.lang.GroovyShell;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+public class AviatorServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        AviatorEvaluatorInstance evaluator = AviatorEvaluator.newInstance();
+        resp.getWriter().println(evaluator.execute(data));
+    }
+}

vul/vul-webapp-expression/src/main/java/GroovyServlet.java

@@ -0,0 +1,20 @@
+import groovy.lang.GroovyShell;
+import ognl.OgnlContext;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+public class GroovyServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        resp.getWriter().println(new GroovyShell().evaluate(data));
+    }
+}

vul/vul-webapp-expression/src/main/java/JEXL2Servlet.java

@@ -0,0 +1,24 @@
+import org.apache.commons.jexl2.Expression;
+import org.apache.commons.jexl2.JexlEngine;
+import org.apache.commons.jexl2.MapContext;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+public class JEXL2Servlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        JexlEngine jexl = new JexlEngine();
+        Expression e = jexl.createExpression(data);
+        MapContext jc = new MapContext();
+        resp.getWriter().println(e.evaluate(jc));
+    }
+}

vul/vul-webapp-expression/src/main/java/JEXL3Servlet.java

@@ -0,0 +1,26 @@
+
+import org.apache.commons.jexl3.JexlBuilder;
+import org.apache.commons.jexl3.JexlEngine;
+import org.apache.commons.jexl3.JexlExpression;
+import org.apache.commons.jexl3.MapContext;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+public class JEXL3Servlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        JexlEngine jexl = new JexlBuilder().create();
+        JexlExpression e = jexl.createExpression(data);
+        MapContext jc = new MapContext();
+        resp.getWriter().println(e.evaluate(jc));
+    }
+}

vul/vul-webapp-expression/src/main/java/JXPathServlet.java

@@ -0,0 +1,21 @@
+import groovy.lang.GroovyShell;
+import org.apache.commons.jxpath.JXPathContext;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+public class JXPathServlet extends HttpServlet {
+    @Override
+    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        JXPathContext context = JXPathContext.newContext(null);
+        resp.getWriter().println(context.getValue(data  ));
+    }
+}

vul/vul-webapp-expression/src/main/webapp/WEB-INF/web.xml

@@ -81,6 +81,51 @@
         <url-pattern>/mvel</url-pattern>
     </servlet-mapping>
 
+    <servlet>
+        <servlet-name>groovy</servlet-name>
+        <servlet-class>GroovyServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>groovy</servlet-name>
+        <url-pattern>/groovy</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>jexl2</servlet-name>
+        <servlet-class>JEXL2Servlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>jexl2</servlet-name>
+        <url-pattern>/jexl2</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>jexl3</servlet-name>
+        <servlet-class>JEXL3Servlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>jexl3</servlet-name>
+        <url-pattern>/jexl3</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>jxpath</servlet-name>
+        <servlet-class>JXPathServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>jxpath</servlet-name>
+        <url-pattern>/jxpath</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>aviator</servlet-name>
+        <servlet-class>AviatorServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>aviator</servlet-name>
+        <url-pattern>/aviator</url-pattern>
+    </servlet-mapping>
+
     <servlet>
         <servlet-name>velocity</servlet-name>
         <servlet-class>VelocityServlet</servlet-class>