[pitboss] phase 17: Track L.15 — Gin / Echo / Fiber / Chi adapters + Axum / Actix / Rocket / Warp adapters

tests/dynamic_fixtures/go_frameworks/chi/benign.go

@@ -0,0 +1,24 @@
+// Phase 17 (Track L.15) — chi benign control fixture.
+package main
+
+import (
+	"net/http"
+	"os/exec"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func Run(w http.ResponseWriter, r *http.Request) {
+	cmd := r.URL.Query().Get("cmd")
+	allow := map[string]string{"ls": "ls", "ps": "ps"}
+	if safe, ok := allow[cmd]; ok {
+		_ = exec.Command(safe).Run()
+	}
+	_, _ = w.Write([]byte("ok"))
+}
+
+func main() {
+	r := chi.NewRouter()
+	r.Get("/run", Run)
+	_ = r
+}

tests/dynamic_fixtures/go_frameworks/chi/vuln.go

@@ -0,0 +1,25 @@
+// Phase 17 (Track L.15) — chi CMDI vuln fixture.
+//
+// The /run route forwards a `cmd` query parameter straight into
+// `os/exec.Command`.  Adapter binding: `r.Get("/run", Run)` with
+// `cmd` flowing through the request query.
+package main
+
+import (
+	"net/http"
+	"os/exec"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func Run(w http.ResponseWriter, r *http.Request) {
+	cmd := r.URL.Query().Get("cmd")
+	_ = exec.Command("sh", "-c", cmd).Run()
+	_, _ = w.Write([]byte("ok"))
+}
+
+func main() {
+	r := chi.NewRouter()
+	r.Get("/run", Run)
+	_ = r
+}

tests/dynamic_fixtures/go_frameworks/echo/benign.go

@@ -0,0 +1,26 @@
+// Phase 17 (Track L.15) — echo benign control fixture.
+//
+// The /run route consults an allow-list before invoking exec, so
+// attacker bytes never reach the sink directly.
+package main
+
+import (
+	"os/exec"
+
+	"github.com/labstack/echo/v4"
+)
+
+func Run(c echo.Context) error {
+	cmd := c.QueryParam("cmd")
+	allow := map[string]string{"ls": "ls", "ps": "ps"}
+	if safe, ok := allow[cmd]; ok {
+		return exec.Command(safe).Run()
+	}
+	return nil
+}
+
+func main() {
+	e := echo.New()
+	e.GET("/run", Run)
+	_ = e
+}

tests/dynamic_fixtures/go_frameworks/echo/vuln.go

@@ -0,0 +1,23 @@
+// Phase 17 (Track L.15) — echo CMDI vuln fixture.
+//
+// The /run route forwards a `cmd` query parameter straight into
+// `os/exec.Command`.  Adapter binding: `e.GET("/run", Run)` with
+// `cmd` flowing through `c.QueryParam`.
+package main
+
+import (
+	"os/exec"
+
+	"github.com/labstack/echo/v4"
+)
+
+func Run(c echo.Context) error {
+	cmd := c.QueryParam("cmd")
+	return exec.Command("sh", "-c", cmd).Run()
+}
+
+func main() {
+	e := echo.New()
+	e.GET("/run", Run)
+	_ = e
+}

tests/dynamic_fixtures/go_frameworks/fiber/benign.go

@@ -0,0 +1,23 @@
+// Phase 17 (Track L.15) — fiber benign control fixture.
+package main
+
+import (
+	"os/exec"
+
+	"github.com/gofiber/fiber/v2"
+)
+
+func Run(c *fiber.Ctx) error {
+	cmd := c.Query("cmd")
+	allow := map[string]string{"ls": "ls", "ps": "ps"}
+	if safe, ok := allow[cmd]; ok {
+		return exec.Command(safe).Run()
+	}
+	return nil
+}
+
+func main() {
+	app := fiber.New()
+	app.Get("/run", Run)
+	_ = app
+}

tests/dynamic_fixtures/go_frameworks/fiber/vuln.go

@@ -0,0 +1,23 @@
+// Phase 17 (Track L.15) — fiber CMDI vuln fixture.
+//
+// The /run route forwards a `cmd` query parameter straight into
+// `os/exec.Command`.  Adapter binding: `app.Get("/run", Run)` with
+// `cmd` flowing through `c.Query`.
+package main
+
+import (
+	"os/exec"
+
+	"github.com/gofiber/fiber/v2"
+)
+
+func Run(c *fiber.Ctx) error {
+	cmd := c.Query("cmd")
+	return exec.Command("sh", "-c", cmd).Run()
+}
+
+func main() {
+	app := fiber.New()
+	app.Get("/run", Run)
+	_ = app
+}

tests/dynamic_fixtures/go_frameworks/gin/benign.go

@@ -0,0 +1,26 @@
+// Phase 17 (Track L.15) — gin benign control fixture.
+//
+// The /run route accepts a `cmd` query parameter but only runs an
+// allow-listed command, so the sink never sees attacker-controlled
+// bytes.  Same adapter binding as the vuln fixture.
+package main
+
+import (
+	"os/exec"
+
+	"github.com/gin-gonic/gin"
+)
+
+func Run(c *gin.Context) {
+	cmd := c.Query("cmd")
+	allow := map[string]string{"ls": "ls", "ps": "ps"}
+	if safe, ok := allow[cmd]; ok {
+		_ = exec.Command(safe).Run()
+	}
+}
+
+func main() {
+	r := gin.Default()
+	r.GET("/run", Run)
+	_ = r
+}

tests/dynamic_fixtures/go_frameworks/gin/vuln.go

@@ -0,0 +1,24 @@
+// Phase 17 (Track L.15) — gin CMDI vuln fixture.
+//
+// The /run route forwards a `cmd` query parameter straight into
+// `os/exec.Command`, so any attacker who reaches the route can
+// execute arbitrary shell.  Adapter binding: `r.GET("/run", Run)`
+// with `cmd` flowing through `c.Query`.
+package main
+
+import (
+	"os/exec"
+
+	"github.com/gin-gonic/gin"
+)
+
+func Run(c *gin.Context) {
+	cmd := c.Query("cmd")
+	_ = exec.Command("sh", "-c", cmd).Run()
+}
+
+func main() {
+	r := gin.Default()
+	r.GET("/run", Run)
+	_ = r
+}