apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-07-06 20:42:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Dynamic (#77)

Browse source
This commit is contained in:
Eli Peter 2026-06-05 10:16:30 -05:00 • committed by GitHub
parent 55247b7fcd
commit 991c84a1eb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1464 changed files with 225448 additions and 1985 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tests/dynamic_fixtures/rust/clap_cli/benign.rs Normal file
View file

@ -0,0 +1,14 @@
//! Phase 16 — clap-driven CLI, benign.
//!
//! Marker comment for shape detection: `use clap::Parser;`
use std::process::Command;
pub fn run(_args: Vec<String>) {
println!("__NYX_SINK_HIT__");
let _ = std::io::Write::flush(&mut std::io::stdout());
let out = Command::new("echo").arg("hello").output();
if let Ok(o) = out {
print!("{}", String::from_utf8_lossy(&o.stdout));
}
}

20
tests/dynamic_fixtures/rust/clap_cli/vuln.rs Normal file
View file

@ -0,0 +1,20 @@
//! Phase 16 — clap-driven CLI, vulnerable.
//!
//! Marker comment for shape detection: `use clap::Parser;`
//! Signature: `pub fn run(args: Vec<String>)` — last positional arg is the
//! tainted input that is concatenated into a shell command.
use std::process::Command;
pub fn run(args: Vec<String>) {
println!("__NYX_SINK_HIT__");
let _ = std::io::Write::flush(&mut std::io::stdout());
let payload = args.last().cloned().unwrap_or_default();
let out = Command::new("sh")
.arg("-c")
.arg(format!("echo hello {}", payload))
.output();
if let Ok(o) = out {
print!("{}", String::from_utf8_lossy(&o.stdout));
}
}