[pitboss] phase 08: Track J.6 + Track L.6 — HEADER_INJECTION corpus + every HTTP framework

tests/dynamic_fixtures/header_injection/java/Benign.java

@@ -0,0 +1,16 @@
+// Phase 08 (Track J.6) — Java HEADER_INJECTION benign control fixture.
+//
+// Same shape as `Vuln.java` but URL-encodes the value via
+// `URLEncoder.encode` (the OWASP-recommended defence), so any CRLF
+// bytes in the value land as `%0D%0A` and the wire keeps a single
+// header.
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import javax.servlet.http.HttpServletResponse;
+
+public class Benign {
+    public static void run(HttpServletResponse response, String value) {
+        String encoded = URLEncoder.encode(value, StandardCharsets.UTF_8);
+        response.setHeader("Set-Cookie", encoded);
+    }
+}

tests/dynamic_fixtures/header_injection/java/Vuln.java

@@ -0,0 +1,13 @@
+// Phase 08 (Track J.6) — Java HEADER_INJECTION vuln fixture.
+//
+// The function string-concatenates the attacker-controlled `value`
+// directly into a `Set-Cookie` header set via
+// `HttpServletResponse.setHeader`.  A payload carrying `\r\nSet-Cookie:
+// nyx-injected=pwn` splits the single header into two on the wire.
+import javax.servlet.http.HttpServletResponse;
+
+public class Vuln {
+    public static void run(HttpServletResponse response, String value) {
+        response.setHeader("Set-Cookie", value);
+    }
+}