nyx/tests/fixtures/taint_termination/heavy_loop.js

// Synthetic fixture: many tainted variables in loops.
// Triggers divergent taint-map hashes on each loop iteration,
// exercising the BFS iteration limit in the taint engine.
// Without the limit the BFS would run forever.

function heavyLoop(req) {
    const userInput = req.query.data;    // source
    let a = userInput;
    let b = a;
    let c = b;
    let d = c;
    let e = d;
    let f = e;
    let g = f;
    let h = g;
    let i = h;
    let j = i;

    // Loop with accumulating taint
    for (let k = 0; k < 100; k++) {
        a = b + c;
        b = c + d;
        c = d + e;
        d = e + f;
        e = f + g;
        f = g + h;
        g = h + i;
        h = i + j;
        i = j + a;
        j = a + b;
    }

    // Nested loop
    for (let m = 0; m < 10; m++) {
        for (let n = 0; n < 10; n++) {
            a = b + c + d;
            b = c + d + e;
            c = d + e + f;
        }
    }

    // Sink: eval with tainted data
    eval(a + b + c + d + e);
}

function multiSource(req, res) {
    const x1 = req.query.a;
    const x2 = req.query.b;
    const x3 = req.query.c;
    const x4 = req.query.d;
    const x5 = req.query.e;
    const x6 = req.query.f;
    const x7 = req.query.g;
    const x8 = req.query.h;

    let result = x1;
    for (let i = 0; i < 20; i++) {
        result = result + x2 + x3;
        const tmp = x4 + x5 + x6;
        result = result + tmp + x7 + x8;
    }

    eval(result);
}