test: add jetty ee8 ~ ee10 cases

vul/vul-webapp-jakarta/src/main/java/jakarta/Base64ClassLoaderServlet.java

@@ -0,0 +1,54 @@
+package jakarta;
+
+import jakarta.servlet.*;
+
+import java.io.IOException;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/24
+ */
+public class Base64ClassLoaderServlet extends ClassLoader implements Servlet {
+
+    @Override
+    public void init(ServletConfig config) throws ServletException {
+
+    }
+
+    @Override
+    public ServletConfig getServletConfig() {
+        return null;
+    }
+
+    @Override
+    public void service(ServletRequest req, ServletResponse res) throws ServletException, IOException {
+        String data = req.getParameter("data");
+        try {
+            byte[] bytes = decodeBase64(data);
+            defineClass(null, bytes, 0, bytes.length).newInstance();
+        } catch (Exception e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    static byte[] decodeBase64(String base64Str) throws Exception {
+        try {
+            Class<?> decoderClass = Class.forName("sun.misc.BASE64Decoder");
+            return (byte[]) decoderClass.getMethod("decodeBuffer", String.class).invoke(decoderClass.newInstance(), base64Str);
+        } catch (Exception var4) {
+            Class<?> decoderClass = Class.forName("java.util.Base64");
+            Object decoder = decoderClass.getMethod("getDecoder").invoke((Object) null);
+            return (byte[]) decoder.getClass().getMethod("decode", String.class).invoke(decoder, base64Str);
+        }
+    }
+
+    @Override
+    public String getServletInfo() {
+        return "";
+    }
+
+    @Override
+    public void destroy() {
+
+    }
+}

vul/vul-webapp-jakarta/src/main/java/jakarta/TestServlet.java

@@ -6,15 +6,7 @@ import jakarta.servlet.http.HttpServlet;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.lang.reflect.Constructor;
-import java.lang.reflect.Field;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.*;
-import java.util.zip.GZIPInputStream;
 
 /**
  * @author ReaJason

vul/vul-webapp-jakarta/src/main/webapp/WEB-INF/web.xml

@@ -9,4 +9,39 @@
     <welcome-file-list>
         <welcome-file>index.html</welcome-file>
     </welcome-file-list>
+    <servlet>
+        <servlet-name>test</servlet-name>
+        <servlet-class>jakarta.TestServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>test</servlet-name>
+        <url-pattern>/test</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>upload</servlet-name>
+        <servlet-class>jakarta.UploadServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>upload</servlet-name>
+        <url-pattern>/upload</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>java-deserialize</servlet-name>
+        <servlet-class>jakarta.JavaReadObjServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>java-deserialize</servlet-name>
+        <url-pattern>/java_deserialize</url-pattern>
+    </servlet-mapping>
+
+    <servlet>
+        <servlet-name>b64</servlet-name>
+        <servlet-class>jakarta.Base64ClassLoaderServlet</servlet-class>
+    </servlet>
+    <servlet-mapping>
+        <servlet-name>b64</servlet-name>
+        <url-pattern>/b64</url-pattern>
+    </servlet-mapping>
 </web-app>