Dynamic (#77)

tests/dynamic_fixtures/javascript/next_route/benign.js

@@ -0,0 +1,25 @@
+// Phase 13 — Next.js API route handler, benign control.
+//
+// execFile (no shell) so payload bytes never reach a shell.
+//
+// nyx-shape: next
+
+'use strict';
+try { require.resolve('next'); } catch (_e) {}
+
+const { execFileSync } = require('child_process');
+
+module.exports = async function handler(req, res) {
+    const host = (req.query && req.query.host) || '';
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    try {
+        execFileSync('true', [host], {
+            encoding: 'utf8',
+            timeout: 5000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        res.status(200).send('ok');
+    } catch (_e) {
+        res.status(200).send('err');
+    }
+};

tests/dynamic_fixtures/javascript/next_route/package-lock.json

@@ -0,0 +1,12 @@
+{
+  "name": "nyx-harness-next",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "nyx-harness-next",
+      "version": "0.0.0"
+    }
+  }
+}

tests/dynamic_fixtures/javascript/next_route/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "nyx-harness-next",
+  "version": "0.0.0",
+  "private": true,
+  "dependencies": {
+    "next": "^14.2.5"
+  }
+}

tests/dynamic_fixtures/javascript/next_route/vuln.js

@@ -0,0 +1,26 @@
+// Phase 13 — Next.js API route handler, vulnerable.
+//
+// Reads `req.query.host` and concatenates it into a shell command.  The
+// `next` package is required for the materialised package.json pin to
+// survive `npm install --no-save`, but the harness builds its own mock
+// req/res via js_shared::emit_next; we never go through the Next router.
+//
+// nyx-shape: next
+
+'use strict';
+// Touching `next` would also load React; the import is intentionally lazy
+// and guarded so test runs without a network-fed install still parse.
+try { require.resolve('next'); } catch (_e) {}
+
+const { execSync } = require('child_process');
+
+module.exports = async function handler(req, res) {
+    const host = (req.query && req.query.host) || '';
+    process.stdout.write('__NYX_SINK_HIT__\n');
+    try {
+        const out = execSync('echo hello ' + host, { encoding: 'utf8', timeout: 5000 });
+        res.status(200).send(out);
+    } catch (e) {
+        res.status(200).send((e.stdout || '') + (e.stderr || ''));
+    }
+};