Dynamic (#77)

tests/dynamic_fixtures/php/cli_script/benign.php

@@ -0,0 +1,11 @@
+<?php
+// Phase 15 — CLI script with $argv, benign.
+// Validates $argv[1] then runs a fixed echo.
+
+$payload = $argv[1] ?? '';
+if (!preg_match('/^[A-Za-z0-9]{1,32}$/', $payload)) {
+    echo "invalid\n";
+    exit(0);
+}
+$out = shell_exec("echo hello");
+echo $out;

tests/dynamic_fixtures/php/cli_script/composer.json

@@ -0,0 +1,6 @@
+{
+  "name": "nyx/cli-script-fixture",
+  "require": {
+    "php": ">=8.0"
+  }
+}

tests/dynamic_fixtures/php/cli_script/vuln.php

@@ -0,0 +1,9 @@
+<?php
+// Phase 15 — CLI script with $argv, vulnerable.
+// Top-level body reads $argv[1] and pipes to /bin/sh -c.
+
+echo "__NYX_SINK_HIT__\n";
+
+$payload = $argv[1] ?? '';
+$out = shell_exec("echo hello " . $payload);
+echo $out;