Dynamic (#77)

tests/dynamic_fixtures/json_parse/javascript/benign.js

@@ -0,0 +1,16 @@
+// Phase 11 (Track J.9) — JavaScript JSON_PARSE benign control fixture.
+//
+// JSON.parse then deep-merge into a `Object.create(null)` target, the
+// canonical mitigation; the prototype-less target cannot reach
+// `Object.prototype` so the canary never fires.
+function run(value) {
+    const parsed = JSON.parse(value);
+    const target = Object.create(null);
+    for (const k of Object.keys(parsed)) {
+        if (k === '__proto__' || k === 'constructor') continue;
+        target[k] = parsed[k];
+    }
+    return target;
+}
+
+module.exports = { run };

tests/dynamic_fixtures/json_parse/javascript/vuln.js

@@ -0,0 +1,24 @@
+// Phase 11 (Track J.9) — JavaScript JSON_PARSE vuln fixture.
+//
+// JSON.parse the attacker bytes then naive deep-merge into a vanilla
+// target object.  A `__proto__` key walks into `Object.prototype` and
+// trips the canary trap.
+function run(value) {
+    const parsed = JSON.parse(value);
+    const target = {};
+    deepMerge(target, parsed);
+    return target;
+}
+
+function deepMerge(t, s) {
+    for (const k of Object.keys(s)) {
+        if (s[k] !== null && typeof s[k] === 'object') {
+            if (typeof t[k] !== 'object' || t[k] === null) t[k] = {};
+            deepMerge(t[k], s[k]);
+        } else {
+            t[k] = s[k];
+        }
+    }
+}
+
+module.exports = { run };