[pitboss] phase 08: Track J.6 + Track L.6 — HEADER_INJECTION corpus + every HTTP framework

tests/dynamic_fixtures/header_injection/go/benign.go

@@ -0,0 +1,15 @@
+// Phase 08 (Track J.6) — Go HEADER_INJECTION benign control fixture.
+//
+// Same shape as `vuln.go` but URL-encodes the value via
+// `net/url.QueryEscape` before the header set, so CRLF bytes land as
+// `%0D%0A` and the wire keeps a single header.
+package benign
+
+import (
+	"net/http"
+	"net/url"
+)
+
+func Run(w http.ResponseWriter, value string) {
+	w.Header().Set("Set-Cookie", url.QueryEscape(value))
+}

tests/dynamic_fixtures/header_injection/go/vuln.go

@@ -0,0 +1,13 @@
+// Phase 08 (Track J.6) — Go HEADER_INJECTION vuln fixture.
+//
+// The function assigns the attacker-controlled `value` directly into a
+// `Set-Cookie` header via `http.ResponseWriter.Header().Set`.  A
+// payload carrying `\r\nSet-Cookie: nyx-injected=pwn` splits the
+// single header into two on the wire.
+package vuln
+
+import "net/http"
+
+func Run(w http.ResponseWriter, value string) {
+	w.Header().Set("Set-Cookie", value)
+}