How to Log a Malicious Password Into a JVM

If I'm the bad guy then I put a string in my malicious password or my malicious HTTP header. It would maybe have a dollar sign or something around it to tell the interpreter that it's code. The interpreter will then run that code and do whatever it does. That's how this was triggered. People would just put a URL containing a malicious jar and then click the URL for logging.