[pitboss] phase 17: Track L.15 — Gin / Echo / Fiber / Chi adapters + Axum / Actix / Rocket / Warp adapters

tests/dynamic_fixtures/rust_frameworks/rocket/benign.rs

@@ -0,0 +1,13 @@
+//! Phase 17 (Track L.15) — rocket benign control fixture.
+
+use rocket::get;
+use std::process::Command;
+
+#[get("/run?<cmd>")]
+pub fn run(cmd: String) -> &'static str {
+    let allow = ["ls", "ps"];
+    if allow.contains(&cmd.as_str()) {
+        let _ = Command::new(&cmd).status();
+    }
+    "ok"
+}

tests/dynamic_fixtures/rust_frameworks/rocket/vuln.rs

@@ -0,0 +1,14 @@
+//! Phase 17 (Track L.15) — rocket CMDI vuln fixture.
+//!
+//! The /run route forwards a `cmd` query parameter straight into
+//! `std::process::Command`.  Adapter binding: `#[get("/run?<cmd>")]`
+//! on `run` with `cmd` arriving via the function's positional arg.
+
+use rocket::get;
+use std::process::Command;
+
+#[get("/run?<cmd>")]
+pub fn run(cmd: String) -> &'static str {
+    let _ = Command::new("sh").arg("-c").arg(&cmd).status();
+    "ok"
+}