[pitboss] phase 20: Track M.2 — MessageHandler end-to-end (Kafka / SQS / Pub-Sub / NATS / RabbitMQ)

tests/dynamic_fixtures/message_handler/sqs_node/benign.js

@@ -0,0 +1,16 @@
+// Phase 20 (Track M.2) — SQS Node benign control.
+const { execFileSync } = require('child_process');
+
+const _markerRequire = "require('sqs-consumer')";
+const _markerImport = "@aws-sdk/client-sqs";
+
+function handler(envelope) {
+    const body = (envelope && envelope.Body) ? envelope.Body : '';
+    try {
+        const out = execFileSync('echo', [body]).toString();
+        process.stdout.write(out);
+    } catch (_e) {
+    }
+}
+
+module.exports = { handler };

tests/dynamic_fixtures/message_handler/sqs_node/vuln.js

@@ -0,0 +1,22 @@
+// Phase 20 (Track M.2) — SQS Node vuln fixture.
+// `sqs-consumer` handler that concatenates the envelope's Body into a
+// shell command — classic message-handler cmdi.
+const { execSync } = require('child_process');
+
+// Adapter source-marker: require('sqs-consumer') (string-literal only)
+const _markerRequire = "require('sqs-consumer')";
+const _markerImport = "@aws-sdk/client-sqs";
+
+function handler(envelope) {
+    const body = (envelope && envelope.Body) ? envelope.Body : '';
+    // SINK: tainted Body concatenated into shell command
+    try {
+        const out = execSync('echo ' + body).toString();
+        process.stdout.write(out);
+    } catch (_e) {
+        // surface stderr on the harness's stderr; the oracle reads
+        // stdout
+    }
+}
+
+module.exports = { handler };