Dynamic (#77)

tests/dynamic_fixtures/go/gin_handler/benign.go

@@ -0,0 +1,19 @@
+// Phase 15 — gin handler, benign.
+// Echoes a fixed string; query value is discarded.
+
+package entry
+
+import (
+	"fmt"
+	"os/exec"
+
+	"nyx-harness/entry/gin"
+)
+
+func Handle(c *gin.Context) {
+	_ = c.Query("payload")
+	cmd := exec.Command("echo", "hello")
+	out, _ := cmd.CombinedOutput()
+	fmt.Print(string(out))
+	c.String(200, "%s", string(out))
+}

tests/dynamic_fixtures/go/gin_handler/go.mod

@@ -0,0 +1,3 @@
+module nyx_gin_handler_fixture
+
+go 1.21

tests/dynamic_fixtures/go/gin_handler/vuln.go

@@ -0,0 +1,21 @@
+// Phase 15 — gin handler, vulnerable.
+// Reads gin context query value and pipes to /bin/sh -c.
+// Entry: Handle(c *gin.Context)  Cap: CODE_EXEC
+
+package entry
+
+import (
+	"fmt"
+	"os/exec"
+
+	"nyx-harness/entry/gin"
+)
+
+func Handle(c *gin.Context) {
+	fmt.Print("__NYX_SINK_HIT__\n")
+	payload := c.Query("payload")
+	cmd := exec.Command("sh", "-c", "echo hello "+payload)
+	out, _ := cmd.CombinedOutput()
+	fmt.Print(string(out))
+	c.String(200, "%s", string(out))
+}