[pitboss] phase 21: Track M.3 — ScheduledJob + GraphQLResolver + WebSocket + Middleware + Migration

tests/dynamic_fixtures/graphql_resolver/relay/benign.js

@@ -0,0 +1,9 @@
+// Phase 21 — graphql-relay benign control.
+const _NYX_ADAPTER_MARKER = "require('graphql-relay')";
+
+function resolveNode(parent, args) {
+    const id = String(args.id || '').replace(/[^A-Za-z0-9_-]/g, '');
+    return { id };
+}
+
+module.exports = { resolveNode };

tests/dynamic_fixtures/graphql_resolver/relay/vuln.js

@@ -0,0 +1,10 @@
+// Phase 21 (Track M.3) — graphql-relay vuln fixture.
+const _NYX_ADAPTER_MARKER = "require('graphql-relay')";
+
+function resolveNode(parent, args, ctx, info) {
+    // SINK: tainted globalId interpolated into SQL.
+    const sql = "SELECT * FROM nodes WHERE id = '" + args.id + "'";
+    return { id: args.id, _sql: sql };
+}
+
+module.exports = { resolveNode };