Add the ssrf module

ssrf/scripts/run-all.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Regenerate every file under docs/output/. Nothing in the article or the chapters was typed by
+# hand; it all came from here.
+set -eu
+cd "$(dirname "$0")/.."
+mvn -B -q compile
+[ -f target/cp.txt ] || mvn -B -q dependency:build-classpath -Dmdep.outputFile=target/cp.txt -Dmdep.includeScope=runtime
+CP="target/classes:$(cat target/cp.txt)"
+
+java -cp "$CP" com.ankurm.ssrf.FilterMatrix > docs/output/filter-matrix.txt
+java -cp "$CP" com.ankurm.ssrf.AndVarargsTrap > docs/output/and-varargs-trap.txt
+
+{
+  for p in "" docsfilter blocklist negated allowlist; do
+    echo "==================================================================================="
+    echo "PROFILE: ${p:-(none) - no InetAddressFilter bean}"
+    echo "==================================================================================="
+    ./scripts/run.sh "$p" >/dev/null 2>&1 || { echo "FAILED TO START"; continue; }
+    ./scripts/exploit.sh
+    echo
+  done
+  ./scripts/stop.sh
+} > docs/output/exploit-by-profile.txt 2>&1
+
+# Two beans of the same type: the context does not start, and the diagnostic blames the wrong
+# thing. Captured deliberately.
+{
+  echo "\$ java -cp ... SsrfDemoApplication --spring.profiles.active=twofilters"
+  timeout 90 java -Xmx256m -cp "$CP" com.ankurm.ssrf.SsrfDemoApplication \
+    --spring.profiles.active=twofilters 2>&1 \
+    | grep -E 'expected single matching bean|APPLICATION FAILED|^Description|^Action|required a single bean|^\t- ' | head -20
+} > docs/output/two-filter-beans.txt 2>&1
+
+mvn -B test 2>&1 | grep -E 'Tests run:|WhereTheFilterRuns' > docs/output/tests.txt
+echo "regenerated:"; ls -1 docs/output/