[pitboss] phase 14: Track L.12 — Spring / Quarkus / Micronaut / Jakarta Servlet adapters

tests/dynamic_fixtures/java/micronaut_route/Benign.java

@@ -0,0 +1,30 @@
+// Phase 14 — Micronaut `@Controller`, benign.
+//
+// Same shape as the vuln but echoes a constant string instead of
+// concatenating the path variable into a shell command.
+
+import io.micronaut.http.annotation.Controller;
+import io.micronaut.http.annotation.Get;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+@Controller("/run")
+public class Benign {
+    @Get("/{id}")
+    public String show(String id) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        String[] cmd = {"/bin/sh", "-c", "echo hello"};
+        Process p = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        StringBuilder out = new StringBuilder();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.append(line);
+            out.append('\n');
+            System.out.println(line);
+        }
+        p.waitFor();
+        return out.toString();
+    }
+}

tests/dynamic_fixtures/java/micronaut_route/Controller.java

@@ -0,0 +1,17 @@
+// Phase 14 fixture stub — minimal Micronaut `@Controller`.
+// Lives in `io.micronaut.http.annotation` so the fixture's
+// `import io.micronaut.http.annotation.Controller;` compiles under
+// plain javac (no Micronaut Maven dep required).
+
+package io.micronaut.http.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.TYPE)
+public @interface Controller {
+    String value() default "";
+}

tests/dynamic_fixtures/java/micronaut_route/Get.java

@@ -0,0 +1,14 @@
+// Phase 14 fixture stub — minimal Micronaut `@Get`.
+
+package io.micronaut.http.annotation;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface Get {
+    String value() default "";
+}

tests/dynamic_fixtures/java/micronaut_route/Vuln.java

@@ -0,0 +1,32 @@
+// Phase 14 — Micronaut `@Controller`, vulnerable.
+//
+// `@Controller("/run")` on the class + `@Get("/{id}")` on the handler
+// matches the Phase 14 [`JavaShape::MicronautRoute`].  The harness
+// invokes `show(payload)` via reflection.
+
+import io.micronaut.http.annotation.Controller;
+import io.micronaut.http.annotation.Get;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+@Controller("/run")
+public class Vuln {
+    @Get("/{id}")
+    public String show(String id) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        if (id == null) id = "";
+        String[] cmd = {"/bin/sh", "-c", "echo hello " + id};
+        Process p = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        StringBuilder out = new StringBuilder();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.append(line);
+            out.append('\n');
+            System.out.println(line);
+        }
+        p.waitFor();
+        return out.toString();
+    }
+}

tests/dynamic_fixtures/java/micronaut_route/pom.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>nyx</groupId>
+  <artifactId>micronaut-route-fixture</artifactId>
+  <version>0.0.1</version>
+  <properties>
+    <maven.compiler.source>17</maven.compiler.source>
+    <maven.compiler.target>17</maven.compiler.target>
+  </properties>
+  <dependencies>
+    <dependency>
+      <groupId>io.micronaut</groupId>
+      <artifactId>micronaut-http</artifactId>
+      <version>4.4.0</version>
+    </dependency>
+  </dependencies>
+</project>