[pitboss] phase 21: Track M.3 — ScheduledJob + GraphQLResolver + WebSocket + Middleware + Migration

tests/dynamic_fixtures/migration/django/benign.py

@@ -0,0 +1,11 @@
+"""Phase 21 — Django migration benign control."""
+_NYX_ADAPTER_MARKER = "from django.db import migrations"
+
+
+def upgrade(table_name="users"):
+    safe = "".join(c for c in str(table_name) if c.isalnum() or c == "_")
+    return "CREATE INDEX idx_" + safe + " ON users(name)"
+
+
+class Migration:
+    operations = []

tests/dynamic_fixtures/migration/django/vuln.py

@@ -0,0 +1,23 @@
+"""Phase 21 (Track M.3) — Django migration vuln fixture.
+
+The migration declares `operations = [...]` with a
+`migrations.RunSQL` op whose statement is built from an external
+table name via raw string concatenation.
+"""
+_NYX_ADAPTER_MARKER = "from django.db import migrations"
+
+
+class _RunSQL:
+    def __init__(self, sql):
+        self.sql = sql
+
+
+def upgrade(table_name="users"):
+    # SINK: tainted table name spliced into raw DDL.
+    sql = "CREATE INDEX idx_" + str(table_name) + " ON users(name)"
+    op = _RunSQL(sql)
+    return op
+
+
+class Migration:
+    operations = []