[pitboss] phase 13: Track L.11 — Express / Koa / NestJS / Fastify adapters

tests/dynamic_fixtures/ts_frameworks/express/benign.ts

@@ -0,0 +1,27 @@
+// Phase 13 (Track L.11) — Express CMDI benign fixture (TypeScript).
+
+import express, { Request, Response } from 'express';
+import { execFile } from 'child_process';
+
+const app = express();
+
+const ALLOW = new Set(['status', 'uptime', 'version']);
+
+function runCmd(req: Request, res: Response) {
+    const cmd = (req.query.cmd as string) || '';
+    if (!ALLOW.has(cmd)) {
+        res.status(400).send('rejected');
+        return;
+    }
+    execFile('/usr/bin/echo', [cmd], (err, stdout) => {
+        if (err) {
+            res.status(500).send(String(err));
+            return;
+        }
+        res.send(stdout);
+    });
+}
+
+app.get('/run', runCmd);
+
+export { app, runCmd };

tests/dynamic_fixtures/ts_frameworks/express/vuln.ts

@@ -0,0 +1,23 @@
+// Phase 13 (Track L.11) — Express CMDI vuln fixture (TypeScript).
+// Same shape as the JS twin; binds `app.get('/run', runCmd)` and
+// flows `req.query.cmd` straight into `exec`.
+
+import express, { Request, Response } from 'express';
+import { exec } from 'child_process';
+
+const app = express();
+
+function runCmd(req: Request, res: Response) {
+    const cmd = (req.query.cmd as string) || '';
+    exec(cmd, (err, stdout) => {
+        if (err) {
+            res.status(500).send(String(err));
+            return;
+        }
+        res.send(stdout);
+    });
+}
+
+app.get('/run', runCmd);
+
+export { app, runCmd };

tests/dynamic_fixtures/ts_frameworks/fastify/benign.ts

@@ -0,0 +1,25 @@
+// Phase 13 (Track L.11) — Fastify CMDI benign fixture (TypeScript).
+
+import Fastify, { FastifyRequest, FastifyReply } from 'fastify';
+import { execFile } from 'child_process';
+
+const app = Fastify();
+const ALLOW = new Set(['status', 'uptime', 'version']);
+
+async function runCmd(request: FastifyRequest, reply: FastifyReply): Promise<void> {
+    const cmd = ((request.query as Record<string, string>).cmd) || '';
+    if (!ALLOW.has(cmd)) {
+        reply.code(400).send('rejected');
+        return;
+    }
+    const out = await new Promise<string>((resolve) => {
+        execFile('/usr/bin/echo', [cmd], (err, stdout) => {
+            resolve(err ? String(err) : stdout);
+        });
+    });
+    reply.send(out);
+}
+
+app.get('/run', runCmd);
+
+export { app, runCmd };

tests/dynamic_fixtures/ts_frameworks/fastify/vuln.ts

@@ -0,0 +1,18 @@
+// Phase 13 (Track L.11) — Fastify CMDI vuln fixture (TypeScript).
+
+import Fastify, { FastifyRequest, FastifyReply } from 'fastify';
+import { exec } from 'child_process';
+
+const app = Fastify();
+
+async function runCmd(request: FastifyRequest, reply: FastifyReply): Promise<void> {
+    const cmd = ((request.query as Record<string, string>).cmd) || '';
+    const out = await new Promise<string>((resolve) => {
+        exec(cmd, (err, stdout) => resolve(err ? String(err) : stdout));
+    });
+    reply.send(out);
+}
+
+app.get('/run', runCmd);
+
+export { app, runCmd };

tests/dynamic_fixtures/ts_frameworks/koa/benign.ts

@@ -0,0 +1,29 @@
+// Phase 13 (Track L.11) — Koa CMDI benign fixture (TypeScript).
+
+import Koa from 'koa';
+import Router from '@koa/router';
+import { execFile } from 'child_process';
+
+const app = new Koa();
+const router = new Router();
+const ALLOW = new Set(['status', 'uptime', 'version']);
+
+async function runCmd(ctx: Koa.Context): Promise<void> {
+    const cmd = (ctx.query.cmd as string) || '';
+    if (!ALLOW.has(cmd)) {
+        ctx.status = 400;
+        ctx.body = 'rejected';
+        return;
+    }
+    await new Promise<void>((resolve) => {
+        execFile('/usr/bin/echo', [cmd], (err, stdout) => {
+            ctx.body = err ? String(err) : stdout;
+            resolve();
+        });
+    });
+}
+
+router.get('/run', runCmd);
+app.use(router.routes());
+
+export { app, runCmd };

tests/dynamic_fixtures/ts_frameworks/koa/vuln.ts

@@ -0,0 +1,23 @@
+// Phase 13 (Track L.11) — Koa CMDI vuln fixture (TypeScript).
+
+import Koa from 'koa';
+import Router from '@koa/router';
+import { exec } from 'child_process';
+
+const app = new Koa();
+const router = new Router();
+
+async function runCmd(ctx: Koa.Context): Promise<void> {
+    const cmd = (ctx.query.cmd as string) || '';
+    await new Promise<void>((resolve) => {
+        exec(cmd, (err, stdout) => {
+            ctx.body = err ? String(err) : stdout;
+            resolve();
+        });
+    });
+}
+
+router.get('/run', runCmd);
+app.use(router.routes());
+
+export { app, runCmd };

tests/dynamic_fixtures/ts_frameworks/nest/benign.ts

@@ -0,0 +1,22 @@
+// Phase 13 (Track L.11) — NestJS CMDI benign fixture (TypeScript).
+
+import 'reflect-metadata';
+import { Controller, Get, Query } from '@nestjs/common';
+import { execFile } from 'child_process';
+
+const ALLOW = new Set(['status', 'uptime', 'version']);
+
+@Controller('')
+export class AppController {
+    @Get('run')
+    runCmd(@Query('cmd') cmd: string): Promise<string> | string {
+        if (!ALLOW.has(cmd || '')) {
+            return 'rejected';
+        }
+        return new Promise((resolve) => {
+            execFile('/usr/bin/echo', [cmd], (err, stdout) => {
+                resolve(err ? String(err) : stdout);
+            });
+        });
+    }
+}

tests/dynamic_fixtures/ts_frameworks/nest/vuln.ts

@@ -0,0 +1,20 @@
+// Phase 13 (Track L.11) — NestJS CMDI vuln fixture (TypeScript).
+//
+// Adapter binding: `@Controller('')` + `@Get('run')` on
+// `AppController.runCmd` with `cmd` flowing through `@Query('cmd')`.
+
+import 'reflect-metadata';
+import { Controller, Get, Query } from '@nestjs/common';
+import { exec } from 'child_process';
+
+@Controller('')
+export class AppController {
+    @Get('run')
+    runCmd(@Query('cmd') cmd: string): Promise<string> {
+        return new Promise((resolve) => {
+            exec(cmd || '', (err, stdout) => {
+                resolve(err ? String(err) : stdout);
+            });
+        });
+    }
+}