bashkit 0.12.0

Awesomely fast virtual sandbox with bash and file system
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166

//! Tests for BASH_SOURCE array variable

use bashkit::{Bash, ExecutionLimits};
use std::path::Path;
use std::time::Duration;

/// BASH_SOURCE[0] is set when executing a script by path
#[tokio::test]
async fn bash_source_set_in_script() {
    let mut bash = Bash::new();
    let fs = bash.fs();
    fs.write_file(
        Path::new("/test.sh"),
        b"#!/bin/bash\necho \"source=${BASH_SOURCE[0]}\"",
    )
    .await
    .unwrap();
    fs.chmod(Path::new("/test.sh"), 0o755).await.unwrap();

    let result = bash.exec("/test.sh").await.unwrap();
    assert_eq!(result.stdout.trim(), "source=/test.sh");
}

/// BASH_SOURCE[0] is set when sourcing a file
#[tokio::test]
async fn bash_source_set_in_sourced_file() {
    let mut bash = Bash::new();
    let fs = bash.fs();
    fs.write_file(Path::new("/lib.sh"), b"echo \"source=${BASH_SOURCE[0]}\"")
        .await
        .unwrap();

    let result = bash.exec("source /lib.sh").await.unwrap();
    assert_eq!(result.stdout.trim(), "source=/lib.sh");
}

/// Source guard pattern: BASH_SOURCE[0] == $0 when executed directly
#[tokio::test]
async fn bash_source_guard_direct_execution() {
    let mut bash = Bash::new();
    let fs = bash.fs();
    fs.write_file(
        Path::new("/guard.sh"),
        b"#!/bin/bash\nif [[ \"${BASH_SOURCE[0]}\" == \"$0\" ]]; then echo direct; else echo sourced; fi",
    )
    .await
    .unwrap();
    fs.chmod(Path::new("/guard.sh"), 0o755).await.unwrap();

    let result = bash.exec("/guard.sh").await.unwrap();
    assert_eq!(result.stdout.trim(), "direct");
}

/// BASH_SOURCE[0] is set to the resolved path when script is executed via PATH lookup
#[tokio::test]
async fn bash_source_set_via_path_lookup() {
    let mut bash = Bash::new();
    let fs = bash.fs();

    // Create a script in /scripts
    fs.mkdir(Path::new("/scripts"), false).await.unwrap();
    fs.write_file(
        Path::new("/scripts/test.sh"),
        b"#!/bin/bash\necho \"source=${BASH_SOURCE[0]}\"",
    )
    .await
    .unwrap();
    fs.chmod(Path::new("/scripts/test.sh"), 0o755)
        .await
        .unwrap();

    // Add /scripts to PATH and run by name
    let result = bash
        .exec("export PATH=\"/scripts:${PATH}\"\ntest.sh")
        .await
        .unwrap();
    assert_eq!(result.stdout.trim(), "source=/scripts/test.sh");
}

/// Source guard pattern works correctly when script is executed via PATH lookup
#[tokio::test]
async fn bash_source_guard_via_path_lookup() {
    let mut bash = Bash::new();
    let fs = bash.fs();

    fs.mkdir(Path::new("/bin2"), false).await.unwrap();
    fs.write_file(
        Path::new("/bin2/guard.sh"),
        b"#!/bin/bash\nif [[ \"${BASH_SOURCE[0]}\" == \"$0\" ]]; then echo direct; else echo sourced; fi",
    )
    .await
    .unwrap();
    fs.chmod(Path::new("/bin2/guard.sh"), 0o755).await.unwrap();

    let result = bash
        .exec("export PATH=\"/bin2:${PATH}\"\nguard.sh")
        .await
        .unwrap();
    assert_eq!(result.stdout.trim(), "direct");
}

/// Source guard pattern: BASH_SOURCE[0] != $0 when sourced
#[tokio::test]
async fn bash_source_guard_sourced() {
    let mut bash = Bash::new();
    let fs = bash.fs();
    fs.write_file(
        Path::new("/guard.sh"),
        b"if [[ \"${BASH_SOURCE[0]}\" == \"$0\" ]]; then echo direct; else echo sourced; fi",
    )
    .await
    .unwrap();

    let result = bash.exec("source /guard.sh").await.unwrap();
    assert_eq!(result.stdout.trim(), "sourced");
}

/// Timed-out child bash execution must not leak BASH_SOURCE into later exec calls.
#[tokio::test]
async fn bash_source_cleared_after_timed_out_child_bash_script() {
    let mut bash = Bash::builder()
        .limits(ExecutionLimits::new().timeout(Duration::from_millis(50)))
        .build();
    let fs = bash.fs();
    fs.write_file(Path::new("/hang.sh"), b"#!/bin/bash\nsleep 1")
        .await
        .unwrap();
    fs.chmod(Path::new("/hang.sh"), 0o755).await.unwrap();

    let timeout_result = bash.exec("bash /hang.sh").await;
    assert!(
        timeout_result.is_err(),
        "child script should hit execution timeout"
    );

    let result = bash
        .exec("echo \"source=${BASH_SOURCE[0]}\"")
        .await
        .unwrap();
    assert_eq!(result.stdout.trim(), "source=");
}

/// BASH_SOURCE is cleared after a timed-out sourced function call
#[tokio::test(start_paused = true)]
async fn bash_source_cleared_after_timeout_in_sourced_function() {
    let limits = bashkit::ExecutionLimits::new().timeout(std::time::Duration::from_millis(1));
    let mut bash = Bash::builder().limits(limits).build();
    let fs = bash.fs();
    fs.write_file(Path::new("/leak.sh"), b"leakme() { sleep 10; }\nleakme\n")
        .await
        .unwrap();

    let timed_out = bash.exec("source /leak.sh").await;
    assert!(matches!(
        timed_out,
        Err(bashkit::Error::ResourceLimit(
            bashkit::LimitExceeded::Timeout(_)
        ))
    ));

    let result = bash
        .exec(r#"echo "len=${#BASH_SOURCE[@]} first=${BASH_SOURCE[0]}""#)
        .await
        .unwrap();
    assert_eq!(result.stdout.trim(), "len=0 first=");
}