What causes "Invalid el type ${System.getProperty("el")}" in frohoff/ysoserial?

Set a supported value: -Del=jsf (or the exact values accepted in Myfaces1 source, e.g. matching the EL classes on the classpath)

frohoff/ysoserial · error · IllegalArgumentException

Invalid el type

Error message

Invalid el type ${System.getProperty("el")}

What it means

Myfaces1 supports multiple EL expression payload types selected via the 'el' system property; getDependencies() returns the matching dependency set only for known values, otherwise it throws IllegalArgumentException listing the current value of System.getProperty("el").

Solutions

Set a supported value: -Del=jsf (or the exact values accepted in Myfaces1 source, e.g. matching the EL classes on the classpath)
Read Myfaces1.java to see the recognized el type strings and their required dependencies
Add the matching EL/JSP API dependencies for the chosen el type

Example fix

// before
java -Del=el22 -jar ysoserial.jar Myfaces1 "..."
// after
java -Del=jsf -jar ysoserial.jar Myfaces1 "..."

Defensive patterns

Strategy: validation

Validate before calling

String el = System.getProperty("el"); if (!Set.of("jsf","spring","jsf52").contains(el)) throw new IllegalArgumentException("unsupported el type: " + el);

Try / catch

try { deps = new Myfaces1().getDependencies(); } catch (IllegalArgumentException e) { printValidElTypes(); }

Prevention

Set -Del to a value accepted by the Myfaces1 source
Match the el type to the EL API on the classpath
Update the flag when switching JDK/target versions

When it happens

Trigger: Running with -Del=<unrecognized value> (or not setting 'el' when the code path expects it) so getDependencies() falls through all known el-type branches and hits the throw.

Common situations: Typo in the el property value; switching Myfaces1 variants between JDK7/8 EL implementations and keeping the old -Del flag; forgetting the flag entirely.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of frohoff/ysoserial@218bcffcaa (2026-09-12). Data as JSON: /api/errors/19982f3e506c808f. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/ysoserial/payloads/Myfaces1.java:73

                "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
                "org.mortbay.jasper:apache-el:8.0.27",
                "javax.servlet:javax.servlet-api:3.1.0",

                // deps for mocking the FacesContext
                "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"
            };
        } else if ( "juel".equals(System.getProperty("el")) ) {
            return new String[] {
                "org.apache.myfaces.core:myfaces-impl:2.2.9", "org.apache.myfaces.core:myfaces-api:2.2.9",
                "de.odysseus.juel:juel-impl:2.2.7", "de.odysseus.juel:juel-api:2.2.7",
                "javax.servlet:javax.servlet-api:3.1.0",

                // deps for mocking the FacesContext
                "org.mockito:mockito-core:1.10.19", "org.hamcrest:hamcrest-core:1.1", "org.objenesis:objenesis:2.1"
            };
        }

        throw new IllegalArgumentException("Invalid el type " + System.getProperty("el"));
    }

    public static Object makeExpressionPayload ( String expr ) throws IllegalArgumentException, IllegalAccessException, Exception  {
        FacesContextImpl fc = new FacesContextImpl((ServletContext) null, (ServletRequest) null, (ServletResponse) null);
        ELContext elContext = new FacesELContext(new CompositeELResolver(), fc);
        Reflections.getField(FacesContextImplBase.class, "_elContext").set(fc, elContext);
        ExpressionFactory expressionFactory = ExpressionFactory.newInstance();

        ValueExpression ve1 = expressionFactory.createValueExpression(elContext, expr, Object.class);
        ValueExpressionMethodExpression e = new ValueExpressionMethodExpression(ve1);
        ValueExpression ve2 = expressionFactory.createValueExpression(elContext, "${true}", Object.class);
        ValueExpressionMethodExpression e2 = new ValueExpressionMethodExpression(ve2);

        return Gadgets.makeMap(e2, e);
    }


    public static void main ( final String[] args ) throws Exception {

View on GitHub (pinned to 218bcffcaa)