Dynamic (#77)

tests/dynamic_fixtures/message_handler/sqs_python/benign.py

@@ -0,0 +1,10 @@
+"""Phase 20 (Track M.2) — SQS Python benign control."""
+import os
+import shlex
+
+_NYX_ADAPTER_MARKER = "boto3.client('sqs')"
+
+
+def handler(envelope):
+    body = envelope.get('Body', '') if isinstance(envelope, dict) else str(envelope)
+    os.system("echo " + shlex.quote(body))

tests/dynamic_fixtures/message_handler/sqs_python/vuln.py

@@ -0,0 +1,17 @@
+"""Phase 20 (Track M.2) — SQS Python vuln fixture.
+
+`handler` is a boto3 SQS poller callback that takes the raw envelope's
+`Body` field straight into a shell command.
+
+Adapter marker kept as a string literal so the boto3 dep is not
+required to load the module.
+"""
+import os
+
+_NYX_ADAPTER_MARKER = "boto3.client('sqs')"
+
+
+def handler(envelope):
+    body = envelope.get('Body', '') if isinstance(envelope, dict) else str(envelope)
+    # SINK: tainted Body concatenated into shell command
+    os.system("echo " + body)