Server-side template injection with information disclosure via user-supplied objects 1 SSTI Lab 5 23/11/2024