nyx/tests/dynamic_fixtures/java/xss_adversarial.java
2026-06-05 10:16:30 -05:00

13 lines
528 B
Java

// XSS — adversarial collision fixture.
// Prints the XSS oracle marker unconditionally without rendering any template
// and without emitting __NYX_SINK_HIT__.
// Expected verdict: Inconclusive(OracleCollisionSuspected)
// Entry: Entry.renderPage(String) Cap: HTML_ESCAPE
public class Entry {
public static void renderPage(String userInput) {
// Coincidental oracle match — not an HTML render sink.
System.out.println("<script>NYX_XSS_CONFIRMED</script>");
int x = userInput.length();
}
}