Dynamic (#77)

tests/dynamic_fixtures/go/flag_cli/benign.go

@@ -0,0 +1,18 @@
+// Phase 15 — flag.Parse CLI, benign.
+// Echoes a fixed string; argv is discarded.
+
+package entry
+
+import (
+	"flag"
+	"fmt"
+	"os/exec"
+)
+
+func Run() {
+	flag.Parse()
+	_ = flag.Args()
+	cmd := exec.Command("echo", "hello")
+	out, _ := cmd.CombinedOutput()
+	fmt.Print(string(out))
+}

tests/dynamic_fixtures/go/flag_cli/go.mod

@@ -0,0 +1,3 @@
+module nyx_flag_cli_fixture
+
+go 1.21

tests/dynamic_fixtures/go/flag_cli/vuln.go

@@ -0,0 +1,23 @@
+// Phase 15 — flag.Parse CLI, vulnerable.
+// Reads the first non-flag argv positional and pipes to /bin/sh -c.
+// Entry: Run()  Cap: CODE_EXEC
+
+package entry
+
+import (
+	"flag"
+	"fmt"
+	"os/exec"
+)
+
+func Run() {
+	fmt.Print("__NYX_SINK_HIT__\n")
+	flag.Parse()
+	payload := ""
+	if flag.NArg() > 0 {
+		payload = flag.Arg(0)
+	}
+	cmd := exec.Command("sh", "-c", "echo hello "+payload)
+	out, _ := cmd.CombinedOutput()
+	fmt.Print(string(out))
+}