[pitboss] phase 08: Track J.6 + Track L.6 — HEADER_INJECTION corpus + every HTTP framework

src/dynamic/corpus/header_injection/go.rs

@@ -0,0 +1,56 @@
+//! Go `Cap::HEADER_INJECTION` payloads —
+//! `http.ResponseWriter.Header().Set` CRLF injection.
+//!
+//! Vuln payload: a cookie value followed by `\r\nSet-Cookie:
+//! nyx-injected=pwn`.  Spliced into the host's `w.Header().Set("Set-
+//! Cookie", value)` call without CRLF stripping.
+//!
+//! Benign control: same logical cookie value pre-encoded with
+//! `net/url.QueryEscape`.  Captured value carries `%0D%0A` so the
+//! predicate stays clear.
+
+use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
+use crate::dynamic::oracle::ProbePredicate;
+
+pub const PAYLOADS: &[CuratedPayload] = &[
+    CuratedPayload {
+        bytes: b"nyx-session\r\nSet-Cookie: nyx-injected=pwn",
+        label: "header-injection-go-crlf",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: false,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/go/vuln.go"],
+        oob_nonce_slot: false,
+        probe_predicates: &[ProbePredicate::HeaderInjected {
+            header_name: "Set-Cookie",
+        }],
+        benign_control: Some(PayloadRef {
+            label: "header-injection-go-benign",
+        }),
+        no_benign_control_rationale: None,
+    },
+    CuratedPayload {
+        bytes: b"nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn",
+        label: "header-injection-go-benign",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: true,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/go/benign.go"],
+        oob_nonce_slot: false,
+        probe_predicates: &[],
+        benign_control: None,
+        no_benign_control_rationale: None,
+    },
+];

src/dynamic/corpus/header_injection/java.rs

@@ -0,0 +1,63 @@
+//! Java `Cap::HEADER_INJECTION` payloads —
+//! `HttpServletResponse.setHeader` CRLF injection.
+//!
+//! Vuln payload: a cookie value followed by `\r\nSet-Cookie:
+//! nyx-injected=pwn`.  Concatenated into the host's
+//! `response.setHeader("Set-Cookie", value)` call without CRLF
+//! stripping, the wire response carries the attacker's second
+//! header.  The harness's instrumented `setHeader` records a
+//! `ProbeKind::HeaderEmit { name: "Set-Cookie", value: <raw bytes> }`
+//! probe with the unescaped CRLF intact.
+//!
+//! Benign control: same logical session-id, but the harness's
+//! benign code path runs the value through `URLEncoder.encode(...,
+//! "UTF-8")` so the carried bytes become
+//! `nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn`.  The
+//! captured value has no literal `\r\n`; the
+//! [`ProbePredicate::HeaderInjected`] predicate stays clear.
+
+use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
+use crate::dynamic::oracle::ProbePredicate;
+
+pub const PAYLOADS: &[CuratedPayload] = &[
+    CuratedPayload {
+        bytes: b"nyx-session\r\nSet-Cookie: nyx-injected=pwn",
+        label: "header-injection-java-crlf",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: false,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/java/Vuln.java"],
+        oob_nonce_slot: false,
+        probe_predicates: &[ProbePredicate::HeaderInjected {
+            header_name: "Set-Cookie",
+        }],
+        benign_control: Some(PayloadRef {
+            label: "header-injection-java-benign",
+        }),
+        no_benign_control_rationale: None,
+    },
+    CuratedPayload {
+        bytes: b"nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn",
+        label: "header-injection-java-benign",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: true,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/java/Benign.java"],
+        oob_nonce_slot: false,
+        probe_predicates: &[],
+        benign_control: None,
+        no_benign_control_rationale: None,
+    },
+];

src/dynamic/corpus/header_injection/js.rs

@@ -0,0 +1,56 @@
+//! JavaScript `Cap::HEADER_INJECTION` payloads —
+//! `http.ServerResponse#setHeader` CRLF injection.
+//!
+//! Vuln payload: a cookie value followed by `\r\nSet-Cookie:
+//! nyx-injected=pwn`.  Spliced into the host's
+//! `res.setHeader('Set-Cookie', value)` call without CRLF stripping.
+//!
+//! Benign control: same logical cookie value pre-encoded with
+//! `encodeURIComponent`.  Captured value carries `%0D%0A` so the
+//! predicate stays clear.
+
+use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
+use crate::dynamic::oracle::ProbePredicate;
+
+pub const PAYLOADS: &[CuratedPayload] = &[
+    CuratedPayload {
+        bytes: b"nyx-session\r\nSet-Cookie: nyx-injected=pwn",
+        label: "header-injection-js-crlf",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: false,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/js/vuln.js"],
+        oob_nonce_slot: false,
+        probe_predicates: &[ProbePredicate::HeaderInjected {
+            header_name: "Set-Cookie",
+        }],
+        benign_control: Some(PayloadRef {
+            label: "header-injection-js-benign",
+        }),
+        no_benign_control_rationale: None,
+    },
+    CuratedPayload {
+        bytes: b"nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn",
+        label: "header-injection-js-benign",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: true,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/js/benign.js"],
+        oob_nonce_slot: false,
+        probe_predicates: &[],
+        benign_control: None,
+        no_benign_control_rationale: None,
+    },
+];

src/dynamic/corpus/header_injection/mod.rs

@@ -0,0 +1,31 @@
+//! HTTP response-header CRLF injection (`Cap::HEADER_INJECTION`)
+//! per-language payload slices.
+//!
+//! Phase 08 (Track J.6) carves header injection across the seven HTTP
+//! framework ecosystems Nyx supports: Java (`HttpServletResponse.
+//! setHeader`), Python (`flask.Response.headers.__setitem__`), PHP
+//! (`header()`), Ruby (`Rack::Response#set_header`), JavaScript
+//! (`http.ServerResponse#setHeader`), Go (`http.ResponseWriter.
+//! Header().Set`), Rust (`axum`-style `HeaderMap::insert`).  Every
+//! vuln payload appends a `\r\n` followed by an injected header line
+//! (`Set-Cookie: nyx-injected=pwn`) — once the host code splices the
+//! attacker bytes into the response writer's value argument the wire
+//! actually carries two headers instead of one.  The paired benign
+//! control passes the same logical value through the per-language URL
+//! encoder so the captured value carries `%0d%0a` (not the raw
+//! bytes), the encoded text is preserved verbatim inside a single
+//! header value, and the differential rule stays clear.
+//!
+//! The oracle's
+//! [`crate::dynamic::oracle::ProbePredicate::HeaderInjected`] reads
+//! the per-payload `ProbeKind::HeaderEmit { name, value }` records
+//! and fires when the value contains a literal CRLF byte pair —
+//! vuln passes, benign clears, fulfilling the §4.1 differential rule.
+
+pub mod go;
+pub mod java;
+pub mod js;
+pub mod php;
+pub mod python;
+pub mod ruby;
+pub mod rust;

src/dynamic/corpus/header_injection/php.rs

@@ -0,0 +1,58 @@
+//! PHP `Cap::HEADER_INJECTION` payloads — `header()` CRLF injection.
+//!
+//! Vuln payload: a cookie value followed by `\r\nSet-Cookie:
+//! nyx-injected=pwn`.  Concatenated into the host's `header("Set-
+//! Cookie: " . $value)` call without CRLF stripping, the wire response
+//! carries the attacker's second header.  The harness's instrumented
+//! `header()` records a `ProbeKind::HeaderEmit` probe with the
+//! unescaped CRLF intact.
+//!
+//! Benign control: same logical cookie value pre-encoded with PHP's
+//! `urlencode`.  Captured value carries `%0D%0A` so the predicate
+//! stays clear.
+
+use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
+use crate::dynamic::oracle::ProbePredicate;
+
+pub const PAYLOADS: &[CuratedPayload] = &[
+    CuratedPayload {
+        bytes: b"nyx-session\r\nSet-Cookie: nyx-injected=pwn",
+        label: "header-injection-php-crlf",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: false,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/php/vuln.php"],
+        oob_nonce_slot: false,
+        probe_predicates: &[ProbePredicate::HeaderInjected {
+            header_name: "Set-Cookie",
+        }],
+        benign_control: Some(PayloadRef {
+            label: "header-injection-php-benign",
+        }),
+        no_benign_control_rationale: None,
+    },
+    CuratedPayload {
+        bytes: b"nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn",
+        label: "header-injection-php-benign",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: true,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/php/benign.php"],
+        oob_nonce_slot: false,
+        probe_predicates: &[],
+        benign_control: None,
+        no_benign_control_rationale: None,
+    },
+];

src/dynamic/corpus/header_injection/python.rs

@@ -0,0 +1,62 @@
+//! Python `Cap::HEADER_INJECTION` payloads —
+//! `flask.Response.headers.__setitem__` CRLF injection.
+//!
+//! Vuln payload: a session cookie value followed by `\r\nSet-Cookie:
+//! nyx-injected=pwn`.  Spliced into the host's
+//! `response.headers["Set-Cookie"] = value` assignment without CRLF
+//! stripping, the WSGI layer carries the attacker's second header on
+//! the wire.  The harness's instrumented response writer records a
+//! `ProbeKind::HeaderEmit { name: "Set-Cookie", value: <raw bytes> }`
+//! probe with the unescaped CRLF intact.
+//!
+//! Benign control: same logical cookie value pre-encoded with
+//! `urllib.parse.quote`.  The carried bytes become
+//! `nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn` — no literal
+//! CRLF — and the [`ProbePredicate::HeaderInjected`] predicate stays
+//! clear.
+
+use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
+use crate::dynamic::oracle::ProbePredicate;
+
+pub const PAYLOADS: &[CuratedPayload] = &[
+    CuratedPayload {
+        bytes: b"nyx-session\r\nSet-Cookie: nyx-injected=pwn",
+        label: "header-injection-python-crlf",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: false,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/python/vuln.py"],
+        oob_nonce_slot: false,
+        probe_predicates: &[ProbePredicate::HeaderInjected {
+            header_name: "Set-Cookie",
+        }],
+        benign_control: Some(PayloadRef {
+            label: "header-injection-python-benign",
+        }),
+        no_benign_control_rationale: None,
+    },
+    CuratedPayload {
+        bytes: b"nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn",
+        label: "header-injection-python-benign",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: true,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/python/benign.py"],
+        oob_nonce_slot: false,
+        probe_predicates: &[],
+        benign_control: None,
+        no_benign_control_rationale: None,
+    },
+];

src/dynamic/corpus/header_injection/ruby.rs

@@ -0,0 +1,57 @@
+//! Ruby `Cap::HEADER_INJECTION` payloads —
+//! `Rack::Response#set_header` CRLF injection.
+//!
+//! Vuln payload: a cookie value followed by `\r\nSet-Cookie:
+//! nyx-injected=pwn`.  Spliced into the host's
+//! `response.set_header("Set-Cookie", value)` call without CRLF
+//! stripping, the wire response carries the attacker's second header.
+//!
+//! Benign control: same logical cookie value pre-encoded with
+//! `URI.encode_www_form_component`.  Captured value carries `%0D%0A`
+//! so the predicate stays clear.
+
+use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
+use crate::dynamic::oracle::ProbePredicate;
+
+pub const PAYLOADS: &[CuratedPayload] = &[
+    CuratedPayload {
+        bytes: b"nyx-session\r\nSet-Cookie: nyx-injected=pwn",
+        label: "header-injection-ruby-crlf",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: false,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/ruby/vuln.rb"],
+        oob_nonce_slot: false,
+        probe_predicates: &[ProbePredicate::HeaderInjected {
+            header_name: "Set-Cookie",
+        }],
+        benign_control: Some(PayloadRef {
+            label: "header-injection-ruby-benign",
+        }),
+        no_benign_control_rationale: None,
+    },
+    CuratedPayload {
+        bytes: b"nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn",
+        label: "header-injection-ruby-benign",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: true,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/ruby/benign.rb"],
+        oob_nonce_slot: false,
+        probe_predicates: &[],
+        benign_control: None,
+        no_benign_control_rationale: None,
+    },
+];

src/dynamic/corpus/header_injection/rust.rs

@@ -0,0 +1,57 @@
+//! Rust `Cap::HEADER_INJECTION` payloads — `axum`-style
+//! `HeaderMap::insert` CRLF injection.
+//!
+//! Vuln payload: a cookie value followed by `\r\nSet-Cookie:
+//! nyx-injected=pwn`.  Spliced into a hand-rolled `HeaderMap` insert
+//! that bypasses the `HeaderValue::from_str` validity check (e.g.
+//! `HeaderValue::from_bytes(...).unwrap()` over a tainted slice).
+//!
+//! Benign control: same logical cookie value pre-encoded with the
+//! `percent-encoding` crate.  Captured value carries `%0D%0A` so the
+//! predicate stays clear.
+
+use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
+use crate::dynamic::oracle::ProbePredicate;
+
+pub const PAYLOADS: &[CuratedPayload] = &[
+    CuratedPayload {
+        bytes: b"nyx-session\r\nSet-Cookie: nyx-injected=pwn",
+        label: "header-injection-rust-crlf",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: false,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/rust/vuln.rs"],
+        oob_nonce_slot: false,
+        probe_predicates: &[ProbePredicate::HeaderInjected {
+            header_name: "Set-Cookie",
+        }],
+        benign_control: Some(PayloadRef {
+            label: "header-injection-rust-benign",
+        }),
+        no_benign_control_rationale: None,
+    },
+    CuratedPayload {
+        bytes: b"nyx-session%0D%0ASet-Cookie%3A%20nyx-injected%3Dpwn",
+        label: "header-injection-rust-benign",
+        oracle: Oracle::SinkProbe {
+            predicates: &[ProbePredicate::HeaderInjected {
+                header_name: "Set-Cookie",
+            }],
+        },
+        is_benign: true,
+        provenance: PayloadProvenance::Curated,
+        since_corpus_version: 12,
+        deprecated_at_corpus_version: None,
+        fixture_paths: &["tests/dynamic_fixtures/header_injection/rust/benign.rs"],
+        oob_nonce_slot: false,
+        probe_predicates: &[],
+        benign_control: None,
+        no_benign_control_rationale: None,
+    },
+];

src/dynamic/corpus/registry.rs

@@ -23,7 +23,10 @@
 use std::collections::HashMap;
 use std::sync::OnceLock;
 
-use super::{cmdi, deserialize, fmt_string, ldap, path_trav, sqli, ssrf, ssti, xpath, xss, xxe};
+use super::{
+    cmdi, deserialize, fmt_string, header_injection, ldap, path_trav, sqli, ssrf, ssti, xpath,
+    xss, xxe,
+};
 use super::{CapCorpus, CuratedPayload, Oracle};
 use crate::dynamic::oracle::ProbePredicate;
 use crate::labels::Cap;
@@ -40,7 +43,6 @@ pub const CORPUS_UNSUPPORTED_LANG_NEUTRAL: u32 = Cap::ENV_VAR.bits()
     | Cap::CRYPTO.bits()
     | Cap::UNAUTHORIZED_ID.bits()
     | Cap::DATA_EXFIL.bits()
-    | Cap::HEADER_INJECTION.bits()
     | Cap::OPEN_REDIRECT.bits()
     | Cap::PROTOTYPE_POLLUTION.bits();
 
@@ -74,6 +76,13 @@ const ENTRIES: &[(Cap, Lang, &[CuratedPayload])] = &[
     (Cap::XPATH_INJECTION, Lang::Python, xpath::python::PAYLOADS),
     (Cap::XPATH_INJECTION, Lang::Php, xpath::php::PAYLOADS),
     (Cap::XPATH_INJECTION, Lang::JavaScript, xpath::js::PAYLOADS),
+    (Cap::HEADER_INJECTION, Lang::Java, header_injection::java::PAYLOADS),
+    (Cap::HEADER_INJECTION, Lang::Python, header_injection::python::PAYLOADS),
+    (Cap::HEADER_INJECTION, Lang::Php, header_injection::php::PAYLOADS),
+    (Cap::HEADER_INJECTION, Lang::Ruby, header_injection::ruby::PAYLOADS),
+    (Cap::HEADER_INJECTION, Lang::JavaScript, header_injection::js::PAYLOADS),
+    (Cap::HEADER_INJECTION, Lang::Go, header_injection::go::PAYLOADS),
+    (Cap::HEADER_INJECTION, Lang::Rust, header_injection::rust::PAYLOADS),
 ];
 
 /// Reserved for per-cap oracle defaults.  Empty in Phase 02; populated by
@@ -285,6 +294,7 @@ mod tests {
         assert!(!payloads_for(Cap::XXE).is_empty());
         assert!(!payloads_for(Cap::LDAP_INJECTION).is_empty());
         assert!(!payloads_for(Cap::XPATH_INJECTION).is_empty());
+        assert!(!payloads_for(Cap::HEADER_INJECTION).is_empty());
     }
 
     #[test]
@@ -297,7 +307,6 @@ mod tests {
             Cap::CRYPTO,
             Cap::UNAUTHORIZED_ID,
             Cap::DATA_EXFIL,
-            Cap::HEADER_INJECTION,
             Cap::OPEN_REDIRECT,
             Cap::PROTOTYPE_POLLUTION,
         ];
@@ -332,6 +341,7 @@ mod tests {
             Cap::XXE,
             Cap::LDAP_INJECTION,
             Cap::XPATH_INJECTION,
+            Cap::HEADER_INJECTION,
         ] {
             let has_vuln = payloads_for(cap).iter().any(|p| !p.is_benign);
             assert!(has_vuln, "{cap:?} must have at least one vuln payload");
@@ -383,6 +393,7 @@ mod tests {
             Cap::XXE,
             Cap::LDAP_INJECTION,
             Cap::XPATH_INJECTION,
+            Cap::HEADER_INJECTION,
         ];
         for cap in caps {
             for p in payloads_for(cap) {
@@ -409,6 +420,7 @@ mod tests {
             Cap::XXE,
             Cap::LDAP_INJECTION,
             Cap::XPATH_INJECTION,
+            Cap::HEADER_INJECTION,
         ];
         for cap in caps {
             for p in payloads_for(cap) {
@@ -522,6 +534,7 @@ mod tests {
             Cap::XXE,
             Cap::LDAP_INJECTION,
             Cap::XPATH_INJECTION,
+            Cap::HEADER_INJECTION,
         ];
         for cap in caps {
             for p in payloads_for(cap).iter().filter(|p| p.is_benign) {
@@ -775,6 +788,57 @@ mod tests {
         }
     }
 
+    #[test]
+    fn header_injection_has_per_lang_slices_for_phase_08() {
+        // Phase 08 (Track J.6) acceptance: HEADER_INJECTION registers
+        // payloads in Java / Python / PHP / Ruby / JS / Go / Rust and
+        // the lang-aware lookup never returns empty for any of them.
+        for lang in [
+            Lang::Java,
+            Lang::Python,
+            Lang::Php,
+            Lang::Ruby,
+            Lang::JavaScript,
+            Lang::Go,
+            Lang::Rust,
+        ] {
+            assert!(
+                !payloads_for_lang(Cap::HEADER_INJECTION, lang).is_empty(),
+                "HEADER_INJECTION must have at least one payload for {lang:?}",
+            );
+        }
+        // C / Cpp / TypeScript not yet covered.
+        for lang in [Lang::C, Lang::Cpp, Lang::TypeScript] {
+            assert!(
+                payloads_for_lang(Cap::HEADER_INJECTION, lang).is_empty(),
+                "HEADER_INJECTION has unexpected payloads for {lang:?}",
+            );
+        }
+    }
+
+    #[test]
+    fn header_injection_payloads_pair_benign_controls_per_lang() {
+        for lang in [
+            Lang::Java,
+            Lang::Python,
+            Lang::Php,
+            Lang::Ruby,
+            Lang::JavaScript,
+            Lang::Go,
+            Lang::Rust,
+        ] {
+            let slice = payloads_for_lang(Cap::HEADER_INJECTION, lang);
+            let vuln = slice
+                .iter()
+                .find(|p| !p.is_benign)
+                .expect("each lang must have a HEADER_INJECTION vuln payload");
+            let resolved =
+                super::resolve_benign_control_lang(vuln, Cap::HEADER_INJECTION, lang)
+                    .expect("lang-aware benign control must resolve");
+            assert!(resolved.is_benign);
+        }
+    }
+
     #[test]
     fn deserialize_payloads_pair_benign_controls_per_lang() {
         // The lang-aware resolver must find the paired benign control