[pitboss] phase 02: M2 — Python end-to-end excellence with all hardening baked in

tests/dynamic_fixtures/python/xss_adversarial.py

@@ -0,0 +1,13 @@
+"""XSS — adversarial collision fixture.
+
+Outputs the XSS marker string unconditionally without it being a real
+HTML sink (e.g., a test that checks for a string literal).
+Expected verdict: Inconclusive(OracleCollisionSuspected).
+"""
+
+
+def render_comment(user_input):
+    """Prints oracle marker outside of any HTML rendering context."""
+    # Coincidental match — not an HTML sink.
+    print("<script>NYX_XSS_CONFIRMED</script>")
+    return user_input