32 lines
1.2 KiB
C++
32 lines
1.2 KiB
C++
#include "../src/wizard/shell_quote.hpp"
|
|
#include "../src/SafeProcess.hpp"
|
|
#include <cassert>
|
|
#include <filesystem>
|
|
#include <iostream>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
int main() {
|
|
namespace fs = std::filesystem;
|
|
using BastionGuard::wizard::shell_quote;
|
|
const fs::path marker = fs::temp_directory_path() / "bastionguard-shell-quote-injection-marker";
|
|
fs::remove(marker);
|
|
|
|
const std::vector<std::string> inputs{
|
|
"", "plain", "a b", "has'single'quotes", "semi;colon", "-n",
|
|
"$(touch " + marker.string() + ")", "`touch " + marker.string() + "`",
|
|
"foo\\bar", "line1\nline2", "unicode: piè"
|
|
};
|
|
for (const auto& input : inputs) {
|
|
const std::string inner = "/usr/bin/printf %s " + shell_quote(input);
|
|
// Exercise both shell layers used by elev_cmd (excluding elevation).
|
|
const std::string outer = "/bin/bash -c " + shell_quote(inner);
|
|
const auto result = bg_process::run({"/bin/sh", "-c", outer});
|
|
if (!result.ok() || result.output != input) {
|
|
std::cerr << "Shell quoting regression for input " << input << "\n";
|
|
return 1;
|
|
}
|
|
assert(!fs::exists(marker));
|
|
}
|
|
std::cout << "Wizard shell quoting, nested invocation and injection tests: OK\n";
|
|
}
|