feat: support JXPathSpringGzipPacker

vul/vul-springboot3/build.gradle.kts

@@ -19,6 +19,9 @@ dependencies {
     testImplementation("org.junit.jupiter:junit-jupiter")
     testRuntimeOnly("org.junit.platform:junit-platform-launcher")
     runtimeOnly("com.h2database:h2")
+    implementation("ognl:ognl:2.7.3")
+    implementation("commons-jxpath:commons-jxpath:1.3")
+    implementation("commons-beanutils:commons-beanutils:1.9.3")
 }
 
 tasks.test {

vul/vul-springboot3/src/main/java/com/reajason/javaweb/vul/springboot3/controller/JXPathController.java

@@ -0,0 +1,20 @@
+package com.reajason.javaweb.vul.springboot3.controller;
+
+import org.apache.commons.jxpath.JXPathContext;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+@RestController
+@RequestMapping("/jxpath")
+public class JXPathController {
+    @PostMapping
+    protected Object doPost(String data) {
+        JXPathContext context = JXPathContext.newContext(null);
+        return context.getValue(data);
+    }
+}

vul/vul-springboot3/src/main/java/com/reajason/javaweb/vul/springboot3/controller/OgnlController.java

@@ -0,0 +1,25 @@
+package com.reajason.javaweb.vul.springboot3.controller;
+
+import ognl.Ognl;
+import ognl.OgnlContext;
+import ognl.OgnlException;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/**
+ * @author ReaJason
+ * @since 2024/12/14
+ */
+@RestController
+@RequestMapping("/ognl")
+public class OgnlController {
+    @RequestMapping
+    protected Object doPost(String data) {
+        OgnlContext context = new OgnlContext();
+        try {
+            return Ognl.getValue(data, context, context.getRoot());
+        } catch (OgnlException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}

vul/vul-webapp-expression/build.gradle.kts

@@ -18,11 +18,11 @@ dependencies {
     implementation("commons-io:commons-io:2.19.0")
     implementation("org.apache.velocity:velocity:1.7")
     implementation("ognl:ognl:2.7.3")
+    implementation("commons-jxpath:commons-jxpath:1.3")
     implementation("org.mvel:mvel2:2.4.7.Final")
     implementation("org.beanshell:bsh:2.0b5")
     implementation("org.apache.commons:commons-jexl:2.1.1")
     implementation("org.apache.commons:commons-jexl3:3.2.1")
-    implementation("commons-jxpath:commons-jxpath:1.3")
     implementation("com.googlecode.aviator:aviator:5.2.7")
     implementation("org.codehaus.groovy:groovy:3.0.6")
     implementation("org.mozilla:rhino:1.7.14")