[pitboss] phase 17: Track L.15 — Gin / Echo / Fiber / Chi adapters + Axum / Actix / Rocket / Warp adapters

tests/dynamic_fixtures/rust_frameworks/axum/benign.rs

@@ -0,0 +1,27 @@
+//! Phase 17 (Track L.15) — axum benign control fixture.
+//!
+//! The /run route allow-lists the `cmd` value before invoking
+//! `std::process::Command`, so attacker bytes never reach the sink.
+
+use axum::extract::Query;
+use axum::Router;
+use axum::routing::get;
+use serde::Deserialize;
+use std::process::Command;
+
+#[derive(Deserialize)]
+pub struct RunQuery {
+    pub cmd: String,
+}
+
+pub async fn run(Query(q): Query<RunQuery>) -> String {
+    let allow = ["ls", "ps"];
+    if allow.contains(&q.cmd.as_str()) {
+        let _ = Command::new(&q.cmd).status();
+    }
+    "ok".to_owned()
+}
+
+pub fn build() -> Router {
+    Router::new().route("/run", get(run))
+}

tests/dynamic_fixtures/rust_frameworks/axum/vuln.rs

@@ -0,0 +1,26 @@
+//! Phase 17 (Track L.15) — axum CMDI vuln fixture.
+//!
+//! The /run route forwards a `cmd` query parameter straight into
+//! `std::process::Command`.  Adapter binding:
+//! `Router::new().route("/run", get(run))` with `cmd` arriving via
+//! `axum::extract::Query<RunQuery>`.
+
+use axum::extract::Query;
+use axum::Router;
+use axum::routing::get;
+use serde::Deserialize;
+use std::process::Command;
+
+#[derive(Deserialize)]
+pub struct RunQuery {
+    pub cmd: String,
+}
+
+pub async fn run(Query(q): Query<RunQuery>) -> String {
+    let _ = Command::new("sh").arg("-c").arg(&q.cmd).status();
+    "ok".to_owned()
+}
+
+pub fn build() -> Router {
+    Router::new().route("/run", get(run))
+}