Dynamic (#77)

tests/dynamic_fixtures/websocket/actioncable/benign.rb

@@ -0,0 +1,9 @@
+# Phase 21 — ActionCable benign control.
+# class ChatChannel < ApplicationCable::Channel
+require 'shellwords'
+
+class ChatChannel
+  def receive(data)
+    system("echo " + Shellwords.escape(data.to_s))
+  end
+end

tests/dynamic_fixtures/websocket/actioncable/vuln.rb

@@ -0,0 +1,14 @@
+# Phase 21 (Track M.3) — Rails ActionCable channel vuln fixture.
+#
+# `ChatChannel#receive(data)` splices the inbound WebSocket message
+# bytes into a shell command via Kernel#system — classic ActionCable
+# → cmdi shape.
+
+# class ChatChannel < ApplicationCable::Channel
+
+class ChatChannel
+  def receive(data)
+    # SINK: tainted data concatenated into shell command.
+    system("echo " + data.to_s)
+  end
+end