[pitboss] phase 14: Track B — Java harness emitter shapes

tests/dynamic_fixtures/java/spring_controller/Autowired.java

@@ -0,0 +1,13 @@
+// Phase 14 fixture stub — minimal `@Autowired` annotation.
+// Lives in the default package so the fixture's @Autowired field
+// compiles under plain javac (no Spring Maven dep required).
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.FIELD, ElementType.METHOD, ElementType.CONSTRUCTOR})
+public @interface Autowired {
+}

tests/dynamic_fixtures/java/spring_controller/Benign.java

@@ -0,0 +1,19 @@
+// Phase 14 — Spring `@RestController`, benign.
+//
+// Same shape as the vuln but the controller runs a fixed echo and
+// drops `payload`.
+
+@RestController
+@RequestMapping("/run")
+public class Benign {
+    @Autowired
+    private CommandRunner runner;
+
+    public String run(String payload) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        CommandRunner r = (runner != null) ? runner : new CommandRunner();
+        String out = r.run("echo hello");
+        System.out.print(out);
+        return out;
+    }
+}

tests/dynamic_fixtures/java/spring_controller/CommandRunner.java

@@ -0,0 +1,26 @@
+// Phase 14 fixture stub — Spring-injected helper service.
+// The fixture's controller declares `@Autowired CommandRunner runner;`
+// so the harness exercises the Phase 09 import-extraction path
+// (`@Autowired` is the marker that flags `org.springframework` as a
+// transitive dep).  At runtime the harness instantiates the controller
+// via reflection's default ctor — the @Autowired field stays null
+// because there is no Spring container; the controller's handler
+// guards against null and constructs a fresh CommandRunner on demand.
+
+import java.io.BufferedReader;
+import java.io.InputStreamReader;
+
+public class CommandRunner {
+    public String run(String cmd) throws Exception {
+        Process p = Runtime.getRuntime().exec(new String[] {"/bin/sh", "-c", cmd});
+        BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
+        StringBuilder out = new StringBuilder();
+        String line;
+        while ((line = reader.readLine()) != null) {
+            out.append(line);
+            out.append('\n');
+        }
+        p.waitFor();
+        return out.toString();
+    }
+}

tests/dynamic_fixtures/java/spring_controller/RequestMapping.java

@@ -0,0 +1,12 @@
+// Phase 14 fixture stub — minimal Spring `@RequestMapping`.
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target({ElementType.METHOD, ElementType.TYPE})
+public @interface RequestMapping {
+    String value() default "";
+}

tests/dynamic_fixtures/java/spring_controller/RestController.java

@@ -0,0 +1,11 @@
+// Phase 14 fixture stub — minimal Spring `@RestController`.
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.TYPE)
+public @interface RestController {
+}

tests/dynamic_fixtures/java/spring_controller/Vuln.java

@@ -0,0 +1,22 @@
+// Phase 14 — Spring `@RestController`, vulnerable.
+//
+// Controller declares an `@Autowired CommandRunner` field so the
+// Phase 09 Java import-extractor sees the Spring annotation surface.
+// The harness instantiates the controller via reflection and invokes
+// `run(payload)`; the field stays null at runtime (no Spring DI), so
+// the handler constructs the helper on demand.
+
+@RestController
+@RequestMapping("/run")
+public class Vuln {
+    @Autowired
+    private CommandRunner runner;
+
+    public String run(String payload) throws Exception {
+        System.out.print("__NYX_SINK_HIT__\n");
+        CommandRunner r = (runner != null) ? runner : new CommandRunner();
+        String out = r.run("echo hello " + payload);
+        System.out.print(out);
+        return out;
+    }
+}

tests/dynamic_fixtures/java/spring_controller/pom.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>nyx</groupId>
+  <artifactId>spring-controller-fixture</artifactId>
+  <version>0.0.1</version>
+  <properties>
+    <maven.compiler.source>17</maven.compiler.source>
+    <maven.compiler.target>17</maven.compiler.target>
+  </properties>
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-web</artifactId>
+      <version>6.1.5</version>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework</groupId>
+      <artifactId>spring-context</artifactId>
+      <version>6.1.5</version>
+    </dependency>
+  </dependencies>
+</project>