apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-27 20:29:39 +02:00
Code Issues Projects Releases Packages Wiki Activity

refactor(dynamic): replace reflective invocation with route replay logic for Micronaut and Quarkus, remove annotation stubs, and enhance runtime path binding

Browse source
This commit is contained in:
elipeter 2026-05-26 11:38:12 -05:00
parent 61bfc0cf96
commit 41c7b73575
26 changed files with 1256 additions and 224 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/dynamic_fixtures/java/quarkus_route/Benign.java
View file

@ -1,6 +1,8 @@
// Phase 14 — Quarkus reactive route, benign.
// Quarkus reactive route, benign.
// import io.quarkus.runtime.Quarkus;
import io.quarkus.runtime.Quarkus;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import java.io.BufferedReader;
import java.io.InputStreamReader;

11
tests/dynamic_fixtures/java/quarkus_route/GET.java
View file

@ -1,11 +0,0 @@
// Phase 14 fixture stub — minimal `@GET` Jakarta REST annotation.
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface GET {
}

15
tests/dynamic_fixtures/java/quarkus_route/Path.java
View file

@ -1,15 +0,0 @@
// Phase 14 fixture stub — minimal `@Path` annotation (Jakarta REST).
// Lives in the default package; the fixture imports the symbol as
// plain `@Path` so javac is happy without a Quarkus / Jakarta REST
// Maven dep.
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD})
public @interface Path {
String value() default "";
}

12
tests/dynamic_fixtures/java/quarkus_route/Vuln.java
View file

@ -1,10 +1,10 @@
// Phase 14 — Quarkus reactive route, vulnerable.
//
// `@Path("/run")` on the type + `@GET` on the handler matches the
// Phase 14 [`JavaShape::detect`] for Quarkus. The harness invokes
// `run(payload)` via reflection.
// Quarkus reactive route, vulnerable. The harness keeps the real
// Jakarta REST annotations on the classpath and replays the route
// through those annotations.
// import io.quarkus.runtime.Quarkus;
import io.quarkus.runtime.Quarkus;
import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import java.io.BufferedReader;
import java.io.InputStreamReader;

5
tests/dynamic_fixtures/java/quarkus_route/pom.xml
View file

@ -14,5 +14,10 @@
<artifactId>quarkus-resteasy-reactive</artifactId>
<version>3.8.3</version>
</dependency>
<dependency>
<groupId>jakarta.ws.rs</groupId>
<artifactId>jakarta.ws.rs-api</artifactId>
<version>3.1.0</version>
</dependency>
</dependencies>
</project>