Dynamic (#77)

tests/dynamic_fixtures/javascript/esm_default/benign.js

@@ -0,0 +1,18 @@
+// Phase 13 — ES module default export, benign control.
+//
+// nyx-shape: esm-default
+import { execFileSync } from 'child_process';
+
+export default function runPing(host) {
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    try {
+        execFileSync('true', [host], {
+            encoding: 'utf8',
+            timeout: 5000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        return 'ok';
+    } catch (_e) {
+        return 'err';
+    }
+}

tests/dynamic_fixtures/javascript/esm_default/vuln.js

@@ -0,0 +1,22 @@
+// Phase 13 — ES module default export, vulnerable.
+//
+// `export default` body is the entry the harness imports dynamically.  The
+// harness builder stages this file at `workdir/entry.mjs` (per
+// js_shared::entry_subpath_for_shape) so Node parses it under ESM semantics
+// regardless of the on-disk `.js` extension under the fixture tree.
+
+// nyx-shape: esm-default
+import { execSync } from 'child_process';
+
+export default function runPing(host) {
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    try {
+        const out = execSync('echo hello ' + host, { encoding: 'utf8', timeout: 5000 });
+        process.stdout.write(out);
+        return out;
+    } catch (e) {
+        const out = (e.stdout || '') + (e.stderr || '');
+        process.stdout.write(out);
+        return out;
+    }
+}