[pitboss] phase 13: Track B — JavaScript + TypeScript harness emitter shapes

tests/dynamic_fixtures/javascript/browser_event/benign.js

@@ -0,0 +1,19 @@
+// Phase 13 — browser-side event handler, benign control.
+//
+// Uses `textContent` so the payload's `<script>` tag is HTML-escaped before
+// serialisation; the XSS oracle marker cannot appear in stdout because
+// `<` becomes `&lt;`.
+
+'use strict';
+// nyx-shape: browser-event
+
+function clickHandler(payload) {
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    const el = document.getElementById('out');
+    if (el) {
+        el.textContent = String(payload);
+    }
+    return el ? el.textContent : '';
+}
+
+module.exports = { clickHandler };

tests/dynamic_fixtures/javascript/browser_event/package-lock.json

@@ -0,0 +1,12 @@
+{
+  "name": "nyx-harness-jsdom",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "nyx-harness-jsdom",
+      "version": "0.0.0"
+    }
+  }
+}

tests/dynamic_fixtures/javascript/browser_event/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "nyx-harness-jsdom",
+  "version": "0.0.0",
+  "private": true,
+  "dependencies": {
+    "jsdom": "^24.1.1"
+  }
+}

tests/dynamic_fixtures/javascript/browser_event/vuln.js

@@ -0,0 +1,21 @@
+// Phase 13 — browser-side event handler, vulnerable.
+//
+// Harness spins up jsdom (js_shared::emit_browser_event), assigns
+// `globalThis.document`, then calls `clickHandler(payload)`.  The handler
+// writes payload into innerHTML — the XSS oracle's `<script>NYX_XSS_CONFIRMED
+// </script>` payload appears in the serialised DOM the harness mirrors to
+// stdout.
+
+'use strict';
+// nyx-shape: browser-event
+
+function clickHandler(payload) {
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    const el = document.getElementById('out');
+    if (el) {
+        el.innerHTML = String(payload);
+    }
+    return el ? el.innerHTML : '';
+}
+
+module.exports = { clickHandler };