Dynamic (#77)

tests/dynamic_fixtures/java/static_main/Benign.java

@@ -0,0 +1,21 @@
+// Phase 14 — static `main(String[])` entry, benign.
+//
+// Discards `args[0]` and runs a fixed echo — payload never reaches the
+// shell-interpreted slot so the cmdi marker cannot fire.
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+public class Benign {
+    public static void main(String[] args) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        String[] cmd = {"/bin/sh", "-c", "echo hello"};
+        Process p = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        String line;
+        while ((line = reader.readLine()) != null) {
+            System.out.println(line);
+        }
+        p.waitFor();
+    }
+}

tests/dynamic_fixtures/java/static_main/Vuln.java

@@ -0,0 +1,22 @@
+// Phase 14 — static `main(String[])` entry, vulnerable.
+//
+// Payload arrives as `args[0]` and lands in a shell-interpreted
+// `Runtime.exec` invocation.
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+public class Vuln {
+    public static void main(String[] args) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        String input = args.length > 0 ? args[0] : "";
+        String[] cmd = {"/bin/sh", "-c", "echo hello " + input};
+        Process p = Runtime.getRuntime().exec(cmd);
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        String line;
+        while ((line = reader.readLine()) != null) {
+            System.out.println(line);
+        }
+        p.waitFor();
+    }
+}

tests/dynamic_fixtures/java/static_main/pom.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>nyx</groupId>
+  <artifactId>static-main-fixture</artifactId>
+  <version>0.0.1</version>
+  <properties>
+    <maven.compiler.source>17</maven.compiler.source>
+    <maven.compiler.target>17</maven.compiler.target>
+  </properties>
+</project>