zerobox 0.2.2

Sandbox any command with file, network, and credential controls.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

use crate::support::*;

#[test]
fn allow_write_specific_path() {
    let out = run(&[
        "--profile",
        "workspace",
        "--allow-write=/tmp",
        "--",
        "node",
        "-e",
        "require('fs').writeFileSync('/tmp/zerobox-e2e-aw','written');console.log('ok')",
    ]);
    assert!(out.status.success(), "stderr: {}", stderr(&out));
    assert_eq!(stdout(&out).trim(), "ok");
    let content = std::fs::read_to_string("/tmp/zerobox-e2e-aw").expect("read back");
    assert_eq!(content, "written");
}

#[test]
fn allow_write_does_not_grant_other_paths() {
    let out = run(&[
        "--profile",
        "workspace",
        "--allow-write=/tmp",
        "--",
        "node",
        "-e",
        "try{require('fs').writeFileSync('/var/zerobox-e2e-aw','x');process.exit(0)}catch(e){process.exit(1)}",
    ]);
    assert!(!out.status.success());
}

mod deny_write {
    use super::*;

    #[test]
    fn deny_blocks_within_allowed_dir() {
        let dir = setup_tmp("dw1");
        let protected = dir.join(".git");
        std::fs::create_dir_all(&protected).expect("setup");

        let out = run(&[
            "--profile",
            "workspace",
            &format!("--allow-write={}", dir.display()),
            &format!("--deny-write={}", protected.display()),
            "--",
            "node",
            "-e",
            &format!(
                r#"
const fs = require('fs');
let r = [];
try {{ fs.writeFileSync('{}/file.txt','ok'); r.push('file:ok'); }} catch(e) {{ r.push('file:blocked'); }}
try {{ fs.writeFileSync('{}/.git/evil','x'); r.push('git:ok'); }} catch(e) {{ r.push('git:blocked'); }}
console.log(r.join(','));
"#,
                dir.display(),
                dir.display()
            ),
        ]);
        assert!(out.status.success(), "stderr: {}", stderr(&out));
        let result = stdout(&out).trim().to_string();
        assert!(result.contains("file:ok"), "got: {result}");
        assert!(result.contains("git:blocked"), "got: {result}");
    }
}