[pitboss] phase 13: Track L.11 — Express / Koa / NestJS / Fastify adapters

tests/dynamic_fixtures/js_frameworks/fastify/benign.js

@@ -0,0 +1,28 @@
+// Phase 13 (Track L.11) — Fastify CMDI benign fixture.
+//
+// The `/run` route accepts a `cmd` query parameter but rejects
+// everything outside an allowlist before invoking
+// `child_process.execFile` with a fixed argv.
+
+const fastify = require('fastify')();
+const { execFile } = require('child_process');
+
+const ALLOW = new Set(['status', 'uptime', 'version']);
+
+async function runCmd(request, reply) {
+    const cmd = request.query.cmd || '';
+    if (!ALLOW.has(cmd)) {
+        reply.code(400).send('rejected');
+        return;
+    }
+    const out = await new Promise((resolve) => {
+        execFile('/usr/bin/echo', [cmd], (err, stdout) => {
+            resolve(err ? String(err) : stdout);
+        });
+    });
+    reply.send(out);
+}
+
+fastify.get('/run', runCmd);
+
+module.exports = { app: fastify, runCmd };

tests/dynamic_fixtures/js_frameworks/fastify/vuln.js

@@ -0,0 +1,20 @@
+// Phase 13 (Track L.11) — Fastify CMDI vuln fixture.
+//
+// The `/run` route forwards a `cmd` query parameter straight into
+// `child_process.exec`.  Adapter binding: `fastify.get('/run', runCmd)`
+// with `cmd` flowing through `request.query.cmd`.
+
+const fastify = require('fastify')();
+const { exec } = require('child_process');
+
+async function runCmd(request, reply) {
+    const cmd = request.query.cmd || '';
+    const out = await new Promise((resolve) => {
+        exec(cmd, (err, stdout) => resolve(err ? String(err) : stdout));
+    });
+    reply.send(out);
+}
+
+fastify.get('/run', runCmd);
+
+module.exports = { app: fastify, runCmd };