[pitboss] phase 21: Track M.3 — ScheduledJob + GraphQLResolver + WebSocket + Middleware + Migration

tests/dynamic_fixtures/websocket/actioncable/benign.rb

@@ -0,0 +1,9 @@
+# Phase 21 — ActionCable benign control.
+# class ChatChannel < ApplicationCable::Channel
+require 'shellwords'
+
+class ChatChannel
+  def receive(data)
+    system("echo " + Shellwords.escape(data.to_s))
+  end
+end

tests/dynamic_fixtures/websocket/actioncable/vuln.rb

@@ -0,0 +1,14 @@
+# Phase 21 (Track M.3) — Rails ActionCable channel vuln fixture.
+#
+# `ChatChannel#receive(data)` splices the inbound WebSocket message
+# bytes into a shell command via Kernel#system — classic ActionCable
+# → cmdi shape.
+
+# class ChatChannel < ApplicationCable::Channel
+
+class ChatChannel
+  def receive(data)
+    # SINK: tainted data concatenated into shell command.
+    system("echo " + data.to_s)
+  end
+end

tests/dynamic_fixtures/websocket/channels/benign.py

@@ -0,0 +1,15 @@
+"""Phase 21 — Django Channels benign control."""
+import os
+import shlex
+
+_NYX_ADAPTER_MARKER = "from channels.generic.websocket import WebsocketConsumer"
+
+
+class ChatConsumer:
+    def receive(self, text_data=None, bytes_data=None):
+        payload = text_data if text_data is not None else (bytes_data or b"").decode("utf-8", "replace")
+        os.system("echo " + shlex.quote(str(payload)))
+
+
+def receive(text_data=None, bytes_data=None):
+    return ChatConsumer().receive(text_data, bytes_data)

tests/dynamic_fixtures/websocket/channels/vuln.py

@@ -0,0 +1,20 @@
+"""Phase 21 (Track M.3) — Django Channels WebsocketConsumer vuln fixture.
+
+`ChatConsumer.receive(text_data=None, bytes_data=None)` splices the
+inbound frame into a shell command via `os.system`.
+"""
+import os
+
+_NYX_ADAPTER_MARKER = "from channels.generic.websocket import WebsocketConsumer"
+
+
+class ChatConsumer:
+    def receive(self, text_data=None, bytes_data=None):
+        payload = text_data if text_data is not None else (bytes_data or b"").decode("utf-8", "replace")
+        # SINK: tainted frame body concatenated into shell command.
+        os.system("echo " + str(payload))
+
+
+# Module-level alias for the harness to resolve `receive` directly.
+def receive(text_data=None, bytes_data=None):
+    return ChatConsumer().receive(text_data, bytes_data)

tests/dynamic_fixtures/websocket/socketio/benign.py

@@ -0,0 +1,9 @@
+"""Phase 21 — python-socketio benign control."""
+import os
+import shlex
+
+_NYX_ADAPTER_MARKER = "import socketio"
+
+
+def message(sid, data):
+    os.system("echo " + shlex.quote(str(data)))

tests/dynamic_fixtures/websocket/socketio/vuln.py

@@ -0,0 +1,14 @@
+"""Phase 21 (Track M.3) — python-socketio handler vuln fixture.
+
+`message(sid, data)` is a Socket.IO event handler.  It splices the
+inbound message into a shell command via `os.system`.
+"""
+import os
+
+_NYX_ADAPTER_MARKER = "import socketio"
+_NYX_EVENT_MARKER = "@sio.on('message')"
+
+
+def message(sid, data):
+    # SINK: tainted message body concatenated into shell command.
+    os.system("echo " + str(data))

tests/dynamic_fixtures/websocket/ws/benign.js

@@ -0,0 +1,8 @@
+// Phase 21 — `ws` WebSocket benign control.
+const _NYX_ADAPTER_MARKER = "require('ws')";
+
+function onMessage(data) {
+    return 'echoed: ' + JSON.stringify(String(data));
+}
+
+module.exports = { onMessage };

tests/dynamic_fixtures/websocket/ws/vuln.js

@@ -0,0 +1,15 @@
+// Phase 21 (Track M.3) — `ws` WebSocket handler vuln fixture.
+//
+// `onMessage(data)` is the `on('message', ...)` listener on a
+// WebSocketServer instance.  It splices the message bytes into a
+// child-process command — classic WS → cmdi shape.
+const _NYX_ADAPTER_MARKER = "require('ws')";
+
+const { execSync } = require('child_process');
+
+function onMessage(data) {
+    // SINK: tainted message body concatenated into shell command.
+    return execSync('echo ' + String(data)).toString();
+}
+
+module.exports = { onMessage };