apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-07-21 21:31:03 +02:00
Code Issues Projects Releases Packages Wiki Activity

[pitboss] phase 13: Track L.11 — Express / Koa / NestJS / Fastify adapters

Browse source
This commit is contained in:
pitboss 2026-05-18 12:14:53 -05:00
parent 9ed837be9b
commit 04bf7b997f
27 changed files with 2670 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

25
tests/dynamic_fixtures/ts_frameworks/fastify/benign.ts Normal file
View file

@ -0,0 +1,25 @@
// Phase 13 (Track L.11) — Fastify CMDI benign fixture (TypeScript).
import Fastify, { FastifyRequest, FastifyReply } from 'fastify';
import { execFile } from 'child_process';
const app = Fastify();
const ALLOW = new Set(['status', 'uptime', 'version']);
async function runCmd(request: FastifyRequest, reply: FastifyReply): Promise<void> {
const cmd = ((request.query as Record<string, string>).cmd) || '';
if (!ALLOW.has(cmd)) {
reply.code(400).send('rejected');
return;
}
const out = await new Promise<string>((resolve) => {
execFile('/usr/bin/echo', [cmd], (err, stdout) => {
resolve(err ? String(err) : stdout);
});
});
reply.send(out);
}
app.get('/run', runCmd);
export { app, runCmd };

18
tests/dynamic_fixtures/ts_frameworks/fastify/vuln.ts Normal file
View file

@ -0,0 +1,18 @@
// Phase 13 (Track L.11) — Fastify CMDI vuln fixture (TypeScript).
import Fastify, { FastifyRequest, FastifyReply } from 'fastify';
import { exec } from 'child_process';
const app = Fastify();
async function runCmd(request: FastifyRequest, reply: FastifyReply): Promise<void> {
const cmd = ((request.query as Record<string, string>).cmd) || '';
const out = await new Promise<string>((resolve) => {
exec(cmd, (err, stdout) => resolve(err ? String(err) : stdout));
});
reply.send(out);
}
app.get('/run', runCmd);
export { app, runCmd };