docs(configuration): improve clarity and formatting in configuration documentation

tests/dynamic_fixtures/json_parse_depth/python/vuln.py

@@ -0,0 +1,23 @@
+# Python JSON_PARSE depth-bomb vuln fixture.
+#
+# Models a config-driven JSON ingest endpoint that picks the parser
+# input based on the request payload tag - `*_DEEP` routes through a
+# deeply-nested array literal (256 levels) that drives `json.loads`
+# past the 64-level depth budget; `*_SHALLOW` routes through a flat
+# `[]` parse that leaves the predicate clear.  This shape is needed by
+# the differential runner: the vuln-payload attempt and the
+# benign-control attempt both load the same fixture, and only the
+# payload-routed deep branch trips the `JsonParseExcessiveDepth`
+# predicate.
+import json
+
+
+def run(value):
+    if isinstance(value, (bytes, bytearray)):
+        value = value.decode("utf-8", "replace")
+    elif not isinstance(value, str):
+        value = str(value)
+    if "DEEP" in value:
+        nested = "[" * 256 + "]" * 256
+        return json.loads(nested)
+    return json.loads("[]")

tests/header_injection_corpus.rs

@@ -785,17 +785,16 @@ mod e2e_phase_08 {
         let outcome = match run_spec(&spec, &opts) {
             Ok(outcome) => outcome,
             Err(RunError::BuildFailed { stderr, attempts }) => {
-                eprintln!(
-                    "SKIP js_raw: harness build failed after {attempts} attempts: {stderr}",
-                );
+                eprintln!("SKIP js_raw: harness build failed after {attempts} attempts: {stderr}",);
                 return;
             }
             Err(e) => panic!("run_spec(js_raw) errored: {e:?}"),
         };
         assert_confirmed(Lang::JavaScript, &outcome);
-        let any_wire_frame_marker = outcome.attempts.iter().any(|a| {
-            String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len")
-        });
+        let any_wire_frame_marker = outcome
+            .attempts
+            .iter()
+            .any(|a| String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len"));
         assert!(
             any_wire_frame_marker,
             "js_raw fixture must exercise the tier-(b) wire-frame harness branch; \
@@ -882,9 +881,10 @@ mod e2e_phase_08 {
             Err(e) => panic!("run_spec(rust_raw) errored: {e:?}"),
         };
         assert_confirmed(Lang::Rust, &outcome);
-        let any_wire_frame_marker = outcome.attempts.iter().any(|a| {
-            String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len")
-        });
+        let any_wire_frame_marker = outcome
+            .attempts
+            .iter()
+            .any(|a| String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len"));
         assert!(
             any_wire_frame_marker,
             "rust_raw fixture must exercise the tier-(b) wire-frame harness branch; \
@@ -920,9 +920,10 @@ mod e2e_phase_08 {
             Err(e) => panic!("run_spec(python_raw) errored: {e:?}"),
         };
         assert_confirmed(Lang::Python, &outcome);
-        let any_wire_frame_marker = outcome.attempts.iter().any(|a| {
-            String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len")
-        });
+        let any_wire_frame_marker = outcome
+            .attempts
+            .iter()
+            .any(|a| String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len"));
         assert!(
             any_wire_frame_marker,
             "python_raw fixture must exercise the tier-(b) wire-frame harness branch; \
@@ -1003,9 +1004,10 @@ mod e2e_phase_08 {
             Err(e) => panic!("run_spec(ruby_raw) errored: {e:?}"),
         };
         assert_confirmed(Lang::Ruby, &outcome);
-        let any_wire_frame_marker = outcome.attempts.iter().any(|a| {
-            String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len")
-        });
+        let any_wire_frame_marker = outcome
+            .attempts
+            .iter()
+            .any(|a| String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len"));
         assert!(
             any_wire_frame_marker,
             "ruby_raw fixture must exercise the tier-(b) wire-frame harness branch; \
@@ -1079,17 +1081,16 @@ mod e2e_phase_08 {
         let outcome = match run_spec(&spec, &opts) {
             Ok(outcome) => outcome,
             Err(RunError::BuildFailed { stderr, attempts }) => {
-                eprintln!(
-                    "SKIP php_raw: harness build failed after {attempts} attempts: {stderr}",
-                );
+                eprintln!("SKIP php_raw: harness build failed after {attempts} attempts: {stderr}",);
                 return;
             }
             Err(e) => panic!("run_spec(php_raw) errored: {e:?}"),
         };
         assert_confirmed(Lang::Php, &outcome);
-        let any_wire_frame_marker = outcome.attempts.iter().any(|a| {
-            String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len")
-        });
+        let any_wire_frame_marker = outcome
+            .attempts
+            .iter()
+            .any(|a| String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len"));
         assert!(
             any_wire_frame_marker,
             "php_raw fixture must exercise the tier-(b) wire-frame harness branch; \
@@ -1182,9 +1183,10 @@ mod e2e_phase_08 {
             Err(e) => panic!("run_spec(java_raw) errored: {e:?}"),
         };
         assert_confirmed(Lang::Java, &outcome);
-        let any_wire_frame_marker = outcome.attempts.iter().any(|a| {
-            String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len")
-        });
+        let any_wire_frame_marker = outcome
+            .attempts
+            .iter()
+            .any(|a| String::from_utf8_lossy(&a.outcome.stdout).contains("wire_frame_len"));
         assert!(
             any_wire_frame_marker,
             "java_raw fixture must exercise the tier-(b) wire-frame harness branch; \

tests/json_parse_corpus.rs

@@ -10,6 +10,8 @@
 
 #![cfg(feature = "dynamic")]
 
+mod common;
+
 use nyx_scanner::dynamic::corpus::{payloads_for_lang, resolve_benign_control_lang};
 use nyx_scanner::dynamic::oracle::{Oracle, ProbePredicate, oracle_fired};
 use nyx_scanner::dynamic::probe::{ProbeKind, ProbeWitness, SinkProbe};
@@ -97,6 +99,117 @@ fn canary_predicate_fires_only_on_canary_property() {
     assert!(!oracle_fired(&oracle, &outcome(), &[]));
 }
 
+// Runs the depth-bomb fixture through the dynamic runner. The same fixture
+// handles the vulnerable and benign payloads; the payload tag picks the branch.
+mod e2e_json_parse_depth {
+    use crate::common::fixture_harness::FIXTURE_LOCK;
+    use nyx_scanner::dynamic::runner::{RunError, RunOutcome, run_spec};
+    use nyx_scanner::dynamic::sandbox::{SandboxBackend, SandboxOptions};
+    use nyx_scanner::dynamic::spec::{
+        EntryKind, HarnessSpec, PayloadSlot, SpecDerivationStrategy, default_toolchain_id,
+    };
+    use nyx_scanner::evidence::DifferentialVerdict;
+    use nyx_scanner::labels::Cap;
+    use nyx_scanner::symbol::Lang;
+    use std::path::PathBuf;
+    use std::process::Command;
+    use tempfile::TempDir;
+
+    fn command_available(bin: &str) -> bool {
+        Command::new(bin)
+            .arg("--version")
+            .output()
+            .map(|o| o.status.success())
+            .unwrap_or(false)
+    }
+
+    fn build_spec(lang: Lang, fixture: &str, entry_name: &str) -> (HarnessSpec, TempDir) {
+        let fixture_src = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("tests/dynamic_fixtures/json_parse_depth")
+            .join(match lang {
+                Lang::Python => "python",
+                _ => unreachable!("JSON_PARSE depth e2e covers Python only"),
+            })
+            .join(fixture);
+        let tmp = TempDir::new().expect("create tempdir");
+        let dst = tmp.path().join(fixture);
+        std::fs::copy(&fixture_src, &dst).expect("copy fixture into tempdir");
+
+        let entry_file = dst.to_string_lossy().into_owned();
+        let mut digest = blake3::Hasher::new();
+        digest.update(b"e2e-json-parse|");
+        digest.update(fixture.as_bytes());
+        let spec_hash = format!("{:016x}", {
+            let bytes = digest.finalize();
+            u64::from_le_bytes(bytes.as_bytes()[..8].try_into().unwrap())
+        });
+
+        let spec = HarnessSpec {
+            finding_id: spec_hash.clone(),
+            entry_file: entry_file.clone(),
+            entry_name: entry_name.to_owned(),
+            entry_kind: EntryKind::Function,
+            lang,
+            toolchain_id: default_toolchain_id(lang).into(),
+            payload_slot: PayloadSlot::Param(0),
+            expected_cap: Cap::JSON_PARSE,
+            constraint_hints: vec![],
+            sink_file: entry_file,
+            sink_line: 1,
+            spec_hash: spec_hash.clone(),
+            derivation: SpecDerivationStrategy::FromFlowSteps,
+            stubs_required: vec![],
+            framework: None,
+            java_toolchain: nyx_scanner::dynamic::spec::JavaToolchain::default(),
+        };
+
+        (spec, tmp)
+    }
+
+    fn run(lang: Lang, fixture: &str, entry_name: &str) -> Option<RunOutcome> {
+        if !command_available("python3") {
+            eprintln!("SKIP {lang:?} {fixture}: missing toolchain python3");
+            return None;
+        }
+        let _guard = FIXTURE_LOCK.lock().unwrap_or_else(|e| e.into_inner());
+        let (spec, _tmp) = build_spec(lang, fixture, entry_name);
+        let opts = SandboxOptions {
+            backend: SandboxBackend::Process,
+            ..SandboxOptions::default()
+        };
+        match run_spec(&spec, &opts) {
+            Ok(outcome) => Some(outcome),
+            Err(RunError::BuildFailed { stderr, attempts }) => {
+                eprintln!(
+                    "SKIP {lang:?} {fixture}: harness build failed after {attempts} attempts: {stderr}",
+                );
+                None
+            }
+            Err(e) => panic!("run_spec({lang:?} {fixture}) errored: {e:?}"),
+        }
+    }
+
+    fn assert_confirmed(lang: Lang, outcome: &RunOutcome) {
+        assert!(
+            outcome.triggered_by.is_some(),
+            "{lang:?} JSON_PARSE depth bomb must confirm via run_spec; got {outcome:?}",
+        );
+        let diff = outcome
+            .differential
+            .as_ref()
+            .expect("confirmed run must carry a DifferentialOutcome");
+        assert_eq!(diff.verdict, DifferentialVerdict::Confirmed);
+    }
+
+    #[test]
+    fn python_vuln_confirms_via_run_spec() {
+        let Some(outcome) = run(Lang::Python, "vuln.py", "run") else {
+            return;
+        };
+        assert_confirmed(Lang::Python, &outcome);
+    }
+}
+
 #[test]
 fn json_parse_unsupported_for_other_langs() {
     for lang in [