Dynamic (#77)

tests/dynamic_fixtures/class_method/ruby/benign.rb

@@ -0,0 +1,11 @@
+# Phase 19 (Track M.1) — class-method benign control for Ruby.
+require 'shellwords'
+
+class UserService
+  def initialize
+  end
+
+  def run(input)
+    `true #{Shellwords.escape(input)}`
+  end
+end

tests/dynamic_fixtures/class_method/ruby/vuln.rb

@@ -0,0 +1,13 @@
+# Phase 19 (Track M.1) — class-method vuln fixture for Ruby.
+#
+# UserService#run pipes user input into a shell, classic OS command
+# injection.  Default `.new` ctor — no mock deps needed.
+class UserService
+  def initialize
+  end
+
+  def run(input)
+    # SINK: tainted input → shell
+    `true #{input}`
+  end
+end