test: fix failed cases

integration-test/src/test/java/com/reajason/javaweb/integration/ShellAssertionTool.java

@@ -16,12 +16,14 @@ import okhttp3.Response;
 import org.junit.jupiter.api.Assumptions;
 import org.testcontainers.containers.GenericContainer;
 import org.testcontainers.shaded.org.apache.commons.io.FileUtils;
+import org.testcontainers.shaded.org.apache.commons.lang3.RandomStringUtils;
 import org.testcontainers.shaded.org.apache.commons.lang3.StringUtils;
 import org.testcontainers.utility.MountableFile;
 
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.Objects;
 
 import static org.hamcrest.CoreMatchers.anyOf;
@@ -64,6 +66,7 @@ public class ShellAssertionTool {
             Files.write(tempJar, bytes);
             String jarPath = "/" + shellTool + shellType + packer.name() + ".jar";
             container.copyFileToContainer(MountableFile.forHostPath(tempJar, 0100666), jarPath);
+//            Files.copy(tempJar, Paths.get("target.jar"));
             FileUtils.deleteQuietly(tempJar.toFile());
             String pidInContainer = container.execInContainer("bash", "/fetch_pid.sh").getStdout();
             assertDoesNotThrow(() -> Long.parseLong(pidInContainer));
@@ -164,7 +167,7 @@ public class ShellAssertionTool {
                 .build();
 
         ShellToolConfig shellToolConfig = null;
-        String uniqueName = shellTool + shellType + packer.name();
+        String uniqueName = shellTool  + RandomStringUtils.randomAlphabetic(5)+ shellType  + RandomStringUtils.randomAlphabetic(5)+ packer.name();
         switch (shellTool) {
             case Godzilla:
                 String godzillaPass = "pass";

integration-test/src/test/java/com/reajason/javaweb/integration/glassfish/GlassFish3ContainerTest.java

@@ -51,14 +51,9 @@ public class GlassFish3ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.GlassFish;
-        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize);
-        Set<Triple<String, ShellTool, Packers>> unSupportedCases = Set.of(
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
-                Triple.of(ShellType.CATALINA_AGENT_CONTEXT_VALVE, ShellTool.Godzilla, Packers.AgentJar),  // ClassFormatError
-                Triple.of(ShellType.AGENT_FILTER_CHAIN, ShellTool.Godzilla, Packers.AgentJar) // ClassFormatError
-        );
-        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers, unSupportedCases);
     }
 
     @AfterAll

integration-test/src/test/java/com/reajason/javaweb/integration/glassfish/GlassFish4ContainerTest.java

@@ -53,8 +53,7 @@ public class GlassFish4ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.GlassFish;
-        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize);
         return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
     }

integration-test/src/test/java/com/reajason/javaweb/integration/glassfish/GlassFish501ContainerTest.java

@@ -1,10 +1,10 @@
 package com.reajason.javaweb.integration.glassfish;
 
 import com.reajason.javaweb.integration.TestCasesProvider;
-import com.reajason.javaweb.memshell.ShellType;
+import com.reajason.javaweb.memshell.Packers;
 import com.reajason.javaweb.memshell.Server;
 import com.reajason.javaweb.memshell.ShellTool;
-import com.reajason.javaweb.memshell.Packers;
+import com.reajason.javaweb.memshell.ShellType;
 import lombok.extern.slf4j.Slf4j;
 import net.bytebuddy.jar.asm.Opcodes;
 import org.junit.jupiter.api.AfterAll;
@@ -23,7 +23,6 @@ import static com.reajason.javaweb.integration.ContainerTool.*;
 import static com.reajason.javaweb.integration.DoesNotContainExceptionMatcher.doesNotContainException;
 import static com.reajason.javaweb.integration.ShellAssertionTool.testShellInjectAssertOk;
 import static org.hamcrest.MatcherAssert.assertThat;
-import static org.junit.jupiter.params.provider.Arguments.arguments;
 
 /**
  * @author ReaJason
@@ -44,8 +43,7 @@ public class GlassFish501ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.GlassFish;
-        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize);
         return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
     }

integration-test/src/test/java/com/reajason/javaweb/integration/glassfish/GlassFish510ContainerTest.java

@@ -44,8 +44,7 @@ public class GlassFish510ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.GlassFish;
-        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize);
         return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
     }

integration-test/src/test/java/com/reajason/javaweb/integration/glassfish/GlassFish6ContainerTest.java

@@ -43,12 +43,9 @@ public class GlassFish6ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.GlassFish;
-        Set<String> supportedShellTypes = Set.of(ShellType.JAKARTA_FILTER, ShellType.JAKARTA_LISTENER, ShellType.JAKARTA_VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.JAKARTA_FILTER, ShellType.JAKARTA_LISTENER, ShellType.JAKARTA_VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize);
-        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers,
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
-                null, Set.of(ShellTool.AntSword) // AntSword not support jakarta
-        );
     }
 
     @AfterAll

integration-test/src/test/java/com/reajason/javaweb/integration/glassfish/GlassFish7ContainerTest.java

@@ -43,12 +43,9 @@ public class GlassFish7ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.GlassFish;
-        Set<String> supportedShellTypes = Set.of(ShellType.JAKARTA_FILTER, ShellType.JAKARTA_LISTENER, ShellType.JAKARTA_VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.JAKARTA_FILTER, ShellType.JAKARTA_LISTENER, ShellType.JAKARTA_VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX);
-        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers,
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
-                null, Set.of(ShellTool.AntSword) // AntSword not support jakarta
-        );
     }
 
     @AfterAll

integration-test/src/test/java/com/reajason/javaweb/integration/jbossas/Jboss423ContainerTest.java

@@ -45,7 +45,7 @@ public class Jboss423ContainerTest {
         Server server = Server.JBossAS;
         Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE,
                 ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
-        Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize, Packers.ScriptEngine);
+        Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize);
         return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
     }
 

integration-test/src/test/java/com/reajason/javaweb/integration/payara/Payara5201ContainerTest.java

@@ -43,8 +43,7 @@ public class Payara5201ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.Payara;
-        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize, Packers.ScriptEngine);
         return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
     }

integration-test/src/test/java/com/reajason/javaweb/integration/payara/Payara520225ContainerTest.java

@@ -45,8 +45,7 @@ public class Payara520225ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.Payara;
-        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.FILTER, ShellType.LISTENER, ShellType.VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize, Packers.ScriptEngine);
         return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
     }

integration-test/src/test/java/com/reajason/javaweb/integration/payara/Payara620222ContainerTest.java

@@ -43,12 +43,9 @@ public class Payara620222ContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.Payara;
-        Set<String> supportedShellTypes = Set.of(ShellType.JAKARTA_FILTER, ShellType.JAKARTA_LISTENER, ShellType.JAKARTA_VALVE,
+        Set<String> supportedShellTypes = Set.of(ShellType.JAKARTA_FILTER, ShellType.JAKARTA_LISTENER, ShellType.JAKARTA_VALVE);
-                ShellType.AGENT_FILTER_CHAIN, ShellType.CATALINA_AGENT_CONTEXT_VALVE);
         Set<Packers> testPackers = Set.of(Packers.JSP, Packers.JSPX, Packers.JavaDeserialize);
-        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers,
+        return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
-                null, Set.of(ShellTool.AntSword) // AntSword not supported Jakarta
-        );
     }
 
     @AfterAll

integration-test/src/test/java/com/reajason/javaweb/integration/springmvc/SpringBoot2WarContainerTest.java

@@ -43,7 +43,8 @@ public class SpringBoot2WarContainerTest {
 
     static Stream<Arguments> casesProvider() {
         Server server = Server.SpringWebMvc;
-        Set<String> supportedShellTypes = Set.of(ShellType.SPRING_WEBMVC_INTERCEPTOR, ShellType.SPRING_WEBMVC_CONTROLLER_HANDLER, ShellType.SPRING_WEBMVC_AGENT_FRAMEWORK_SERVLET);
+        Set<String> supportedShellTypes = Set.of(ShellType.SPRING_WEBMVC_INTERCEPTOR,
+                ShellType.SPRING_WEBMVC_CONTROLLER_HANDLER);
         Set<Packers> testPackers = Set.of(Packers.ScriptEngine, Packers.SpEL, Packers.Base64);
         return TestCasesProvider.getTestCases(imageName, server, supportedShellTypes, testPackers);
     }

vul/vul-webapp-jakarta/src/main/java/jakarta/EmptyFilter.java

@@ -0,0 +1,18 @@
+package jakarta;
+
+import jakarta.servlet.*;
+import jakarta.servlet.annotation.WebFilter;
+
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2025/2/23
+ */
+@WebFilter("/*")
+public class EmptyFilter implements Filter {
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+        chain.doFilter(request, response);
+    }
+}

vul/vul-webapp/src/main/webapp/WEB-INF/web.xml

@@ -54,4 +54,13 @@
         <servlet-name>b64</servlet-name>
         <url-pattern>/b64</url-pattern>
     </servlet-mapping>
+
+    <filter>
+        <filter-name>godzilla</filter-name>
+        <filter-class>EmptyFilter</filter-class>
+    </filter>
+    <filter-mapping>
+        <filter-name>godzilla</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
 </web-app>