class SpEL {

    /**
     * Use Spel to execute cmd. <p>
     * T(java.lang.Runtime).getRuntime().exec("open -a Calculator")
     */
    @RequestMapping("/spel/vuln1")
    public String spel_vuln1(String value) {
        ExpressionParser parser = new SpelExpressionParser();
        return parser.parseExpression(value).getValue().toString();
    }

    /**
     * Use Spel to execute cmd. <p>
     * #{T(java.lang.Runtime).getRuntime().exec('open -a Calculator')}
     * Exploit must add <code>#{}</code> if using TemplateParserContext.
     */
    @RequestMapping("spel/vuln2")
    public String spel_vuln2(String value) {<FILL_FUNCTION_BODY>}

    /**
     * Use SimpleEvaluationContext to fix.
     */
    @RequestMapping("spel/sec")
    public String spel_sec(String value) {
        SimpleEvaluationContext context = SimpleEvaluationContext.forReadOnlyDataBinding().build();
        SpelExpressionParser parser = new SpelExpressionParser();
        Expression expression = parser.parseExpression(value, new TemplateParserContext());
        Object x = expression.getValue(context);
        return x.toString();
    }

    public static void main(String[] args) {
        ExpressionParser parser = new SpelExpressionParser();
        String expression = "1+1";
        String result = parser.parseExpression(expression).getValue().toString();
        System.out.println(result);
    }

}

        StandardEvaluationContext context = new StandardEvaluationContext();
        SpelExpressionParser parser = new SpelExpressionParser();
        Expression expression = parser.parseExpression(value, new TemplateParserContext());
        Object x = expression.getValue(context);    // trigger vulnerability point
        return x.toString();   // response
    
<no_super_class>