Dynamic (#77)

tests/dynamic_fixtures/class_method/php/benign.php

@@ -0,0 +1,10 @@
+<?php
+// Phase 19 (Track M.1) — class-method benign control for PHP.
+
+class UserService {
+    public function __construct() {}
+
+    public function run($input) {
+        return shell_exec('true ' . escapeshellarg($input));
+    }
+}

tests/dynamic_fixtures/class_method/php/vuln.php

@@ -0,0 +1,14 @@
+<?php
+// Phase 19 (Track M.1) — class-method vuln fixture for PHP.
+//
+// UserService::run concatenates user input into a shell command;
+// default ctor, no stubbed deps needed.
+
+class UserService {
+    public function __construct() {}
+
+    public function run($input) {
+        // SINK: tainted input → shell.
+        return shell_exec('true ' . $input);
+    }
+}