Dynamic (#77)

tests/dynamic_fixtures/java/spring_controller/Benign.java

@@ -0,0 +1,26 @@
+// Spring `@RestController`, benign.
+//
+// Same shape as the vuln but the controller runs a fixed echo and
+// drops `payload`.
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/run")
+public class Benign {
+    @Autowired
+    private CommandRunner runner;
+
+    @GetMapping
+    public String run(@RequestParam("payload") String payload) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        CommandRunner r = (runner != null) ? runner : new CommandRunner();
+        String out = r.run("echo hello");
+        System.out.print(out);
+        return out;
+    }
+}

tests/dynamic_fixtures/java/spring_controller/CommandRunner.java

@@ -0,0 +1,19 @@
+// Spring-injected helper service used by the controller fixtures.
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+public class CommandRunner {
+    public String run(String cmd) throws Exception {
+        Process p = Runtime.getRuntime().exec(new String[] {"/bin/sh", "-c", cmd});
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        StringBuilder out = new StringBuilder();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.append(line);
+            out.append('\n');
+        }
+        p.waitFor();
+        return out.toString();
+    }
+}

tests/dynamic_fixtures/java/spring_controller/Vuln.java

@@ -0,0 +1,23 @@
+// Spring `@RestController`, vulnerable.
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/run")
+public class Vuln {
+    @Autowired
+    private CommandRunner runner;
+
+    @GetMapping
+    public String run(@RequestParam("payload") String payload) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        CommandRunner r = (runner != null) ? runner : new CommandRunner();
+        String out = r.run("echo hello " + payload);
+        System.out.print(out);
+        return out;
+    }
+}

tests/dynamic_fixtures/java/spring_controller/pom.xml

@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>nyx</groupId>
+  <artifactId>spring-controller-fixture</artifactId>
+  <version>0.0.1</version>
+  <properties>
+    <maven.compiler.source>17</maven.compiler.source>
+    <maven.compiler.target>17</maven.compiler.target>
+  </properties>
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-web</artifactId>
+      <version>6.1.5</version>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-webmvc</artifactId>
+      <version>6.1.5</version>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-context</artifactId>
+      <version>6.1.5</version>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-test</artifactId>
+      <version>6.1.5</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>jakarta.servlet</groupId>
+      <artifactId>jakarta.servlet-api</artifactId>
+      <version>6.0.0</version>
+    </dependency>
+  </dependencies>
+</project>