[pitboss] phase 20: Track M.2 — MessageHandler end-to-end (Kafka / SQS / Pub-Sub / NATS / RabbitMQ)

tests/dynamic_fixtures/message_handler/pubsub_go/benign.go

@@ -0,0 +1,19 @@
+// Phase 20 (Track M.2) — Google Pub/Sub Go benign control.
+package entry
+
+import (
+	"os"
+	"os/exec"
+)
+
+const _adapterMarker = "cloud.google.com/go/pubsub"
+
+func OnMessage(payload string) {
+	cmd := exec.Command("echo", payload)
+	out, _ := cmd.Output()
+	os.Stdout.Write(out)
+}
+
+var NyxHandlers = map[string]interface{}{
+	"OnMessage": OnMessage,
+}

tests/dynamic_fixtures/message_handler/pubsub_go/vuln.go

@@ -0,0 +1,24 @@
+// Phase 20 (Track M.2) — Google Pub/Sub Go vuln fixture.
+//
+// Adapter source-marker: cloud.google.com/go/pubsub (string-literal only).
+// The handler signature accepts a string so the Phase 20 harness
+// dispatch falls through to the NYX_PAYLOAD env var.
+package entry
+
+import (
+	"os"
+	"os/exec"
+)
+
+const _adapterMarker = "cloud.google.com/go/pubsub"
+
+func OnMessage(payload string) {
+	// SINK: tainted payload concatenated into shell command
+	cmd := exec.Command("sh", "-c", "echo "+payload)
+	out, _ := cmd.Output()
+	os.Stdout.Write(out)
+}
+
+var NyxHandlers = map[string]interface{}{
+	"OnMessage": OnMessage,
+}