[pitboss] phase 17: Track L.15 — Gin / Echo / Fiber / Chi adapters + Axum / Actix / Rocket / Warp adapters

tests/dynamic_fixtures/rust_frameworks/actix/benign.rs

@@ -0,0 +1,19 @@
+//! Phase 17 (Track L.15) — actix-web benign control fixture.
+
+use actix_web::{get, web, HttpResponse, Responder};
+use serde::Deserialize;
+use std::process::Command;
+
+#[derive(Deserialize)]
+pub struct RunQuery {
+    pub cmd: String,
+}
+
+#[get("/run")]
+pub async fn run(q: web::Query<RunQuery>) -> impl Responder {
+    let allow = ["ls", "ps"];
+    if allow.contains(&q.cmd.as_str()) {
+        let _ = Command::new(&q.cmd).status();
+    }
+    HttpResponse::Ok().body("ok")
+}

tests/dynamic_fixtures/rust_frameworks/actix/vuln.rs

@@ -0,0 +1,20 @@
+//! Phase 17 (Track L.15) — actix-web CMDI vuln fixture.
+//!
+//! The /run route forwards a `cmd` query parameter straight into
+//! `std::process::Command`.  Adapter binding: `#[get("/run")]` on
+//! `run` with `cmd` arriving via `web::Query<RunQuery>`.
+
+use actix_web::{get, web, HttpResponse, Responder};
+use serde::Deserialize;
+use std::process::Command;
+
+#[derive(Deserialize)]
+pub struct RunQuery {
+    pub cmd: String,
+}
+
+#[get("/run")]
+pub async fn run(q: web::Query<RunQuery>) -> impl Responder {
+    let _ = Command::new("sh").arg("-c").arg(&q.cmd).status();
+    HttpResponse::Ok().body("ok")
+}