1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
|
/* test_runner.c — %f/%d expansion, injection guard, exit status. */
#include "runner.h"
#include <gio/gio.h>
#include <glib.h>
static GMainLoop *g_loop;
static int g_exit_code;
static void
_done_cb(GObject *p_src, GAsyncResult *p_res, gpointer p_data) {
(void)p_src;
(void)p_data;
GError *e = NULL;
g_exit_code = runner_run_finish(NULL, p_res, &e);
g_clear_error(&e);
g_main_loop_quit(g_loop);
}
static void
run_and_wait(Runner *r, GFile *p_file, GFile *p_dir,
const RunnerScript *p_script) {
g_exit_code = -99;
g_loop = g_main_loop_new(NULL, FALSE);
GError *e = NULL;
g_assert_true(runner_run(r, p_file, p_dir, p_script, _done_cb, NULL, &e));
g_assert_no_error(e);
g_main_loop_run(g_loop);
g_main_loop_unref(g_loop);
}
static void
test_true_exit_zero(void) {
Runner *r = runner_new();
RunnerScript s = {"true", "true"};
GFile *f = g_file_new_for_path("/tmp/nonexistent");
run_and_wait(r, f, NULL, &s);
g_assert_cmpint(g_exit_code, ==, 0);
runner_delete(r);
g_object_unref(f);
}
static void
test_false_exit_nonzero(void) {
Runner *r = runner_new();
RunnerScript s = {"false", "false"};
GFile *f = g_file_new_for_path("/tmp/nonexistent");
run_and_wait(r, f, NULL, &s);
g_assert_cmpint(g_exit_code, !=, 0);
runner_delete(r);
g_object_unref(f);
}
static void
test_injection_guard(void) {
GError *e = NULL;
char *d = g_dir_make_tmp("ggaze-runner-XXXXXX", &e);
g_assert_no_error(e);
/* Create a file with a malicious name. */
char *p = g_build_filename(d, ";echo HACKED;.jpg", NULL);
GFile *f = g_file_new_for_path(p);
g_file_replace_contents(f, "x", 1, NULL, FALSE,
G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL);
g_free(p);
GFile *dd = g_file_new_for_path(d);
Runner *r = runner_new();
/* true %f should succeed regardless of the filename (injection guard).
* The single-quoted path is a valid argument to true. */
RunnerScript s = {"true", "true %f"};
run_and_wait(r, f, dd, &s);
g_assert_cmpint(g_exit_code, ==, 0);
runner_delete(r);
g_object_unref(f);
g_object_unref(dd);
GFile *ddd = g_file_new_for_path(d);
GFileEnumerator *en = g_file_enumerate_children(
ddd, "standard::name", G_FILE_QUERY_INFO_NONE, NULL, NULL);
if (en) {
GFileInfo *i;
while ((i = g_file_enumerator_next_file(en, NULL, NULL))) {
GFile *c = g_file_get_child(ddd, g_file_info_get_name(i));
g_file_delete(c, NULL, NULL);
g_object_unref(c);
g_object_unref(i);
}
g_object_unref(en);
}
g_file_delete(ddd, NULL, NULL);
g_object_unref(ddd);
g_free(d);
}
/* Observable injection test: a hostile filename containing shell
* metacharacters that, if executed, would create a sentinel file. The
* single-quoted %f must prevent the ';' from being interpreted. */
static void
test_hostile_filename(void) {
GError *e = NULL;
char *d = g_dir_make_tmp("ggaze-runner-XXXXXX", &e);
g_assert_no_error(e);
/* Sentinel that would be created if the ';' in the name were executed. */
char *sentinel_p = g_build_filename(d, "PWNED", NULL);
GFile *sentinel = g_file_new_for_path(sentinel_p);
/* Hostile filename: ;touch <sentinel>; — if unquoted this runs touch. */
char *name = g_strdup_printf(";touch %s;", sentinel_p);
char *fp = g_build_filename(d, name, NULL);
GFile *f = g_file_new_for_path(fp);
g_file_replace_contents(f, "x", 1, NULL, FALSE,
G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL);
GFile *dd = g_file_new_for_path(d);
Runner *r = runner_new();
RunnerScript s = {"true", "true %f"};
run_and_wait(r, f, dd, &s);
g_assert_cmpint(g_exit_code, ==, 0);
/* The sentinel must NOT exist: the ';' was quoted, not executed. */
g_assert_false(g_file_query_exists(sentinel, NULL));
runner_delete(r);
g_object_unref(sentinel);
g_object_unref(f);
g_object_unref(dd);
g_free(sentinel_p);
g_free(name);
g_free(fp);
GFile *ddd = g_file_new_for_path(d);
GFileEnumerator *en = g_file_enumerate_children(
ddd, "standard::name", G_FILE_QUERY_INFO_NONE, NULL, NULL);
if (en) {
GFileInfo *i;
while ((i = g_file_enumerator_next_file(en, NULL, NULL))) {
GFile *c = g_file_get_child(ddd, g_file_info_get_name(i));
g_file_delete(c, NULL, NULL);
g_object_unref(c);
g_object_unref(i);
}
g_object_unref(en);
}
g_file_delete(ddd, NULL, NULL);
g_object_unref(ddd);
g_free(d);
}
/* Run a command that writes to a temp outfile, wait, then read the outfile
* back and compare its contents to c_expected. Cleans up the outfile. */
static void
_run_and_check_output(const char *c_command, const char *c_expected) {
GError *e = NULL;
char *d = g_dir_make_tmp("ggaze-runner-XXXXXX", &e);
g_assert_no_error(e);
char *out_p = g_build_filename(d, "out.txt", NULL);
GFile *dd = g_file_new_for_path(d);
/* Interpolate the outfile path via %s wrapped in literal single quotes,
* e.g. `printf 'hello world\n' > '/tmp/.../out.txt'`. Temp paths from
* g_dir_make_tmp contain no quotes, so this is safe for the fixtures. */
char *cmd = g_strdup_printf(c_command, out_p);
Runner *r = runner_new();
RunnerScript s = {"obs", cmd};
run_and_wait(r, NULL, dd, &s);
g_assert_cmpint(g_exit_code, ==, 0);
char *contents = NULL;
gsize len = 0;
g_assert_true(g_file_get_contents(out_p, &contents, &len, &e));
g_assert_no_error(e);
g_assert_cmpstr(contents, ==, c_expected);
g_free(contents);
g_free(cmd);
runner_delete(r);
g_object_unref(dd);
g_free(out_p);
GFile *ddd = g_file_new_for_path(d);
GFileEnumerator *en = g_file_enumerate_children(
ddd, "standard::name", G_FILE_QUERY_INFO_NONE, NULL, NULL);
if (en) {
GFileInfo *i;
while ((i = g_file_enumerator_next_file(en, NULL, NULL))) {
GFile *c = g_file_get_child(ddd, g_file_info_get_name(i));
g_file_delete(c, NULL, NULL);
g_object_unref(c);
g_object_unref(i);
}
g_object_unref(en);
}
g_file_delete(ddd, NULL, NULL);
g_object_unref(ddd);
g_free(d);
}
/* Regression: a multi-word command must reach sh -c intact. The buggy
* g_shell_parse_argv code fed sh -c only the first word ("printf"), so the
* outfile would never contain "hello world". */
static void
test_multi_word(void) {
_run_and_check_output("printf 'hello world\\n' > '%s'", "hello world\n");
}
/* Pipeline: '|' must be parsed by sh, not split into argv words. */
static void
test_pipeline(void) {
_run_and_check_output("echo pipeline | cat > '%s'", "pipeline\n");
}
/* Redirection: '>' must be interpreted by the shell. */
static void
test_redirection(void) {
_run_and_check_output("echo redir > '%s'", "redir\n");
}
/* Multiple space-separated arguments survive intact. */
static void
test_spaces_in_args(void) {
_run_and_check_output("printf 'a b c\\n' > '%s'", "a b c\n");
}
int
main(int argc, char **argv) {
g_test_init(&argc, &argv, NULL);
g_test_add_func("/runner/true_exit_zero", test_true_exit_zero);
g_test_add_func("/runner/false_exit_nonzero", test_false_exit_nonzero);
g_test_add_func("/runner/injection_guard", test_injection_guard);
g_test_add_func("/runner/hostile_filename", test_hostile_filename);
g_test_add_func("/runner/multi_word", test_multi_word);
g_test_add_func("/runner/pipeline", test_pipeline);
g_test_add_func("/runner/redirection", test_redirection);
g_test_add_func("/runner/spaces_in_args", test_spaces_in_args);
return g_test_run();
}
|
