Dynamic (#77)

tests/dynamic_fixtures/java/quarkus_route/Benign.java

@@ -0,0 +1,28 @@
+// Quarkus reactive route, benign.
+
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+@Path("/run")
+public class Benign {
+    @GET
+    public String run(String payload) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        if (payload == null) payload = "";
+        String[] cmd = {"/bin/sh", "-c", "echo hello"};
+        Process p = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        StringBuilder out = new StringBuilder();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.append(line);
+            out.append('\n');
+            System.out.println(line);
+        }
+        p.waitFor();
+        return out.toString();
+    }
+}

tests/dynamic_fixtures/java/quarkus_route/Vuln.java

@@ -0,0 +1,31 @@
+// Quarkus reactive route, vulnerable. The harness keeps the real
+// Jakarta REST annotations on the classpath and replays the route
+// through those annotations. Quarkus REST routes are authored with the
+// `jakarta.ws.rs` annotations below, so no live Quarkus runtime is needed.
+
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+@Path("/run")
+public class Vuln {
+    @GET
+    public String run(String payload) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        if (payload == null) payload = "";
+        String[] cmd = {"/bin/sh", "-c", "echo hello " + payload};
+        Process p = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        StringBuilder out = new StringBuilder();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.append(line);
+            out.append('\n');
+            System.out.println(line);
+        }
+        p.waitFor();
+        return out.toString();
+    }
+}

tests/dynamic_fixtures/java/quarkus_route/pom.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>nyx</groupId>
+  <artifactId>quarkus-route-fixture</artifactId>
+  <version>0.0.1</version>
+  <properties>
+    <maven.compiler.source>17</maven.compiler.source>
+    <maven.compiler.target>17</maven.compiler.target>
+  </properties>
+  <dependencies>
+    <!--
+      The route-replay harness reflects over the Jakarta REST annotations
+      (`@Path`/`@GET`) at runtime; it never touches a live Quarkus server,
+      so `jakarta.ws.rs-api` is the only jar it needs.  Pulling the full
+      `quarkus-resteasy-reactive` runtime (Vert.x, Netty, RESTEasy, 200+
+      transitive jars) only bloated `-cp lib/*`, which slowed cold JVM
+      startup past the 5s run timeout on contended CI runners and made
+      this fixture flaky.  Quarkus REST routes are written with these very
+      `jakarta.ws.rs` annotations, so the shape stays faithful.
+    -->
+    <dependency>
+      <groupId>jakarta.ws.rs</groupId>
+      <artifactId>jakarta.ws.rs-api</artifactId>
+      <version>3.1.0</version>
+    </dependency>
+  </dependencies>
+</project>