[pitboss/grind] deferred session-0012 (20260516T052512Z-20f8)

tests/dynamic_fixtures/stubs_e2e/node/sql/vuln/main.js

@@ -0,0 +1,46 @@
+// Phase 10 (Track D.3) stub-end-to-end fixture: Node + SQL.
+//
+// The verifier publishes:
+//
+//   * NYX_SQL_ENDPOINT — absolute path of a SQLite DB the SqlStub owns.
+//   * NYX_SQL_LOG      — companion log path the harness appends executed
+//     queries to so the host SqlStub picks them up on drain_events().
+//
+// This fixture mirrors the Python sibling at
+// tests/dynamic_fixtures/stubs_e2e/python/sql/vuln/main.py.  It opens
+// the stub DB through Node's experimental stdlib `node:sqlite` module
+// (Node 22.5+), runs a tautology SELECT (OR 1=1), and forwards the
+// executed query to the stub through the JS shim helper
+// `__nyx_stub_sql_record`.  When `node:sqlite` is missing (older Node
+// or stripped runtimes) the DB exec step is skipped but the shim
+// recorder still fires so the stub captures the query regardless.
+
+'use strict';
+
+function main() {
+    const dbPath = process.env.NYX_SQL_ENDPOINT;
+    if (!dbPath) return;
+    const query = "SELECT 1 WHERE 'a' = 'a' OR 1=1 --";
+
+    let driverName = 'none';
+    try {
+        const sqlite = require('node:sqlite');
+        const db = new sqlite.DatabaseSync(dbPath);
+        try {
+            const rows = db.prepare(query).all();
+            for (const row of rows) {
+                process.stdout.write(String(Object.values(row)[0]) + '\n');
+            }
+            driverName = 'node:sqlite';
+        } finally {
+            db.close();
+        }
+    } catch (e) {
+        // node:sqlite unavailable on this Node version; skip the
+        // exec but still record the query so the stub sees the call.
+    }
+
+    __nyx_stub_sql_record(query, { driver: driverName });
+}
+
+main();

tests/stubs_e2e_per_lang.rs

@@ -20,6 +20,7 @@
 
 #![cfg(feature = "dynamic")]
 
+use nyx_scanner::dynamic::lang::javascript::probe_shim as node_probe_shim;
 use nyx_scanner::dynamic::lang::python::probe_shim as python_probe_shim;
 use nyx_scanner::dynamic::stubs::{SqlStub, StubProvider};
 use std::path::PathBuf;
@@ -34,6 +35,14 @@ fn python3_available() -> bool {
         .unwrap_or(false)
 }
 
+fn node_available() -> bool {
+    Command::new("node")
+        .arg("--version")
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false)
+}
+
 fn fixture_path(rel: &str) -> PathBuf {
     PathBuf::from(env!("CARGO_MANIFEST_DIR"))
         .join("tests")
@@ -142,3 +151,103 @@ fn python_sql_shim_recorder_is_noop_without_log_env() {
         events.len()
     );
 }
+
+#[test]
+fn node_sql_stub_captures_tautology_query_via_shim_recorder() {
+    if !node_available() {
+        eprintln!("SKIP: node not available");
+        return;
+    }
+
+    let workdir = TempDir::new().expect("tempdir");
+    let stub = SqlStub::start(workdir.path()).expect("SqlStub::start");
+
+    let endpoint = stub.endpoint();
+    let recording = stub
+        .recording_endpoint()
+        .expect("SqlStub must publish a recording endpoint");
+
+    // Splice the Node probe shim ahead of the fixture source so the
+    // generated program carries the `__nyx_stub_sql_record` helper.
+    // Mirrors the production `JavaScriptEmitter::emit` ordering.
+    let fixture =
+        std::fs::read_to_string(fixture_path("node/sql/vuln/main.js")).expect("read fixture");
+    let mut combined = String::with_capacity(node_probe_shim().len() + fixture.len() + 64);
+    combined.push_str(node_probe_shim());
+    combined.push_str("\n// ── fixture begins ─\n");
+    combined.push_str(&fixture);
+
+    let script_path = workdir.path().join("driver.js");
+    std::fs::write(&script_path, combined).expect("write driver");
+
+    let output = Command::new("node")
+        .arg(&script_path)
+        .env("NYX_SQL_ENDPOINT", &endpoint)
+        .env(recording.0, &recording.1)
+        .output()
+        .expect("node driver");
+    assert!(
+        output.status.success(),
+        "driver must exit 0; stderr = {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let events = stub.drain_events();
+    assert!(
+        !events.is_empty(),
+        "SqlStub must capture at least one event after the Node shim recorder fires"
+    );
+    let tautology = events
+        .iter()
+        .find(|e| e.summary.contains("OR 1=1"))
+        .expect("recorded query must contain the tautology marker");
+    let driver = tautology
+        .detail
+        .get("driver")
+        .map(String::as_str)
+        .expect("Node shim must publish driver detail on the recorded event");
+    assert!(
+        driver == "node:sqlite" || driver == "none",
+        "driver detail must report node:sqlite when available or `none` when the stdlib module is missing; got {driver:?}"
+    );
+}
+
+#[test]
+fn node_sql_shim_recorder_is_noop_without_log_env() {
+    if !node_available() {
+        eprintln!("SKIP: node not available");
+        return;
+    }
+
+    let workdir = TempDir::new().expect("tempdir");
+    let stub = SqlStub::start(workdir.path()).expect("SqlStub::start");
+
+    let endpoint = stub.endpoint();
+    let fixture =
+        std::fs::read_to_string(fixture_path("node/sql/vuln/main.js")).expect("read fixture");
+    let mut combined = String::new();
+    combined.push_str(node_probe_shim());
+    combined.push('\n');
+    combined.push_str(&fixture);
+    let script_path = workdir.path().join("driver_no_log.js");
+    std::fs::write(&script_path, combined).expect("write driver");
+
+    let output = Command::new("node")
+        .arg(&script_path)
+        .env("NYX_SQL_ENDPOINT", &endpoint)
+        .env_remove("NYX_SQL_LOG")
+        .output()
+        .expect("node driver");
+    assert!(
+        output.status.success(),
+        "driver must exit 0 even without NYX_SQL_LOG; stderr = {}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    let events = stub.drain_events();
+    assert!(
+        events.is_empty(),
+        "no events expected when the recording env var is unset, got {} entries",
+        events.len()
+    );
+}