[pitboss] phase 05: M5 — JS/TS, Go, Java, PHP harness emitters

tests/dynamic_fixtures/java/xss_adversarial.java

@@ -0,0 +1,13 @@
+// XSS — adversarial collision fixture.
+// Prints the XSS oracle marker unconditionally without rendering any template
+// and without emitting __NYX_SINK_HIT__.
+// Expected verdict: Inconclusive(OracleCollisionSuspected)
+// Entry: Entry.renderPage(String)  Cap: HTML_ESCAPE
+
+public class Entry {
+    public static void renderPage(String userInput) {
+        // Coincidental oracle match — not an HTML render sink.
+        System.out.println("<script>NYX_XSS_CONFIRMED</script>");
+        int x = userInput.length();
+    }
+}