Dynamic (#77)

tests/dynamic_fixtures/graphql_resolver/juniper/benign.rs

@@ -0,0 +1,10 @@
+//! Phase 21 — Juniper resolver benign control.
+// use juniper::graphql_object;
+
+pub fn resolve_user(id: &str) -> String {
+    let safe: String = id
+        .chars()
+        .filter(|c| c.is_ascii_alphanumeric() || *c == '_' || *c == '-')
+        .collect();
+    format!("user-{}", safe)
+}

tests/dynamic_fixtures/graphql_resolver/juniper/vuln.rs

@@ -0,0 +1,15 @@
+//! Phase 21 (Track M.3) — Juniper GraphQL resolver vuln fixture.
+//!
+//! `resolve_user(id)` is a Juniper resolver (substring marker only —
+//! the real `juniper` crate is not on the workdir's Cargo.toml).  The
+//! resolver builds a SQL query via raw string concat — classic
+//! GraphQL → SQLi shape.
+
+// use juniper::graphql_object;
+
+pub fn resolve_user(id: &str) -> String {
+    // SINK: tainted id concatenated into SQL.
+    let query = format!("SELECT * FROM users WHERE id = '{}'", id);
+    let _ = query;
+    format!("user-{}", id)
+}