mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-15 20:05:13 +02:00
21 lines
492 B
Go
21 lines
492 B
Go
// File I/O — positive fixture.
|
|
// Vulnerable: reads file at user-controlled path without sanitization.
|
|
// Entry: ReadFile(userPath string) Cap: FILE_IO
|
|
// Expected verdict: Confirmed (../../../../etc/passwd → "root:" in output)
|
|
|
|
package entry
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
)
|
|
|
|
func ReadFile(userPath string) {
|
|
filePath := filepath.Join("/var/data", userPath)
|
|
fmt.Print("__NYX_SINK_HIT__\n")
|
|
data, err := os.ReadFile(filePath)
|
|
if err == nil {
|
|
fmt.Print(string(data))
|
|
}
|
|
}
|