mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
14 lines
481 B
Java
14 lines
481 B
Java
|
|
// SSRF — adversarial collision fixture.
|
||
|
|
// Prints "daemon:" unconditionally without making any HTTP request
|
||
|
|
// and without emitting __NYX_SINK_HIT__.
|
||
|
|
// Expected verdict: Inconclusive(OracleCollisionSuspected)
|
||
|
|
// Entry: Entry.fetchUrl(String) Cap: SSRF
|
||
|
|
|
||
|
|
public class Entry {
|
||
|
|
public static void fetchUrl(String targetUrl) {
|
||
|
|
// Coincidental oracle match — not an HTTP sink.
|
||
|
|
System.out.println("daemon: present");
|
||
|
|
int x = targetUrl.length();
|
||
|
|
}
|
||
|
|
}
|