feat: MVEL guidance hook

[simonresch]

Hook to guide inputs to MVEL interpreter towards performing OS commands which are detected by the OS command injection sanitizer.

[Copilot]

Pull Request Overview

This PR adds support for detecting MVEL expression language injection vulnerabilities by implementing a guidance hook that directs fuzzing inputs toward OS command execution patterns that trigger the OS command injection sanitizer.

Key changes:

• Added MVEL guidance hook to detect expression language injection via Runtime.exec() calls
• Implemented fuzz test for MVEL expression evaluation
• Integrated MVEL library (version 2.5.2.Final) as a test dependency

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
ExpressionLanguageInjection.kt	Added MVEL guidance hook with attack pattern and method hooks for various MVEL eval/compile methods
ExpressionLanguageInjection.java	Added fuzz test method for MVEL expression evaluation
BUILD.bazel (test)	Added MVEL dependency and fuzzMVELExpression to test methods list, expanded allowed findings
BUILD.bazel (sanitizers)	Added MVEL dependency for sanitizer tests
MODULE.bazel	Added MVEL library to test Maven artifacts
maven_install.json	Added MVEL library metadata and updated artifact hashes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[florianGla]

LGTM!