feat(gen): add POSIX-sh emitter with quoting

This commit is contained in:
2026-08-28 20:12:41 -04:00
parent fa5d22af4b
commit 439aa0d856
3 changed files with 860 additions and 0 deletions
+613
View File
@@ -0,0 +1,613 @@
/* LINK: ../../src/gen/sh_emit.c ../../src/error.c ../../src/span.c */
#define _POSIX_C_SOURCE 200809L /* mkdtemp(3) under -std=c23 */
/* tests/unit/test_sh_emit.c
*
* Unit tests for the POSIX-sh text emitter (todo 15).
*
* The magic LINK comment on line 1 is REQUIRED by tests/run.sh: it lists
* the extra .c sources to compile into this test binary (paths relative
* to tests/unit/, space-separated). munit.c and the include dirs are
* added automatically by the harness.
*
* Strategy: st_sh_quote() is the load-bearing primitive, so the core
* proof is the ROUND-TRIP — the quoted literal, dropped into a real
* shell script as `v=<quoted>; printf '%s' "$v" > <out>`, must reproduce
* the exact input bytes when the script is executed by sh, bash and zsh.
* The same machinery proves the injection attempt stays inert.
*
* No command substitution is used to capture output anywhere here: it
* strips trailing newlines, which would mask a broken round-trip.
*/
#include "munit.h"
#include "error.h"
#include "gen/sh_emit.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <unistd.h>
/* Per-test temp dir, created in setup, removed in teardown. */
static char temp_dir[128];
static void *
setup(const MunitParameter params[], void *user_data)
{
(void)params;
(void)user_data;
if (snprintf(temp_dir, sizeof temp_dir, "/tmp/st_emit_XXXXXX") < 0) {
return NULL;
}
if (mkdtemp(temp_dir) == NULL) {
return NULL;
}
return (void *)1;
}
static void
teardown(void *fixture)
{
char cmd[160];
if (fixture == NULL || temp_dir[0] == '\0') {
return;
}
if (snprintf(cmd, sizeof cmd, "rm -rf -- '%s'", temp_dir) < 0) {
return;
}
(void)system(cmd); /* best-effort; mkdtemp names are [A-Za-z0-9_]* */
temp_dir[0] = '\0';
}
/* Run "<shell> -n <path>", return the shell's exit status, or -1 if the
* command could not even be spawned. */
static int
syntax_check(const char *shell, const char *path)
{
char cmd[512];
int rc;
if (snprintf(cmd, sizeof cmd, "%s -n %s", shell, path) < 0) {
return -1;
}
rc = system(cmd);
if (rc == -1) {
return -1;
}
return WEXITSTATUS(rc);
}
/* Round-trip `value` through one shell: write a script that assigns
* st_sh_quote(value) to a variable and printf's it into a file, execute
* it, and byte-compare the file with the original. Returns the shell's
* exit status, or -1 on setup failure. */
static int
roundtrip_one(const char *shell, const char *value, size_t len,
const char *pathbase)
{
char script_path[512];
char out_path[512];
char *q, *qout;
FILE *f;
FILE *in;
char *got;
long n;
int rc;
q = st_sh_quote_n(value, len, NULL);
if (q == NULL) {
return -1;
}
if (snprintf(script_path, sizeof script_path, "%s/%s.sh", temp_dir,
pathbase) < 0) {
free(q);
return -1;
}
if (snprintf(out_path, sizeof out_path, "%s/%s.out", temp_dir,
pathbase) < 0) {
free(q);
return -1;
}
qout = st_sh_quote(out_path);
if (qout == NULL) {
free(q);
return -1;
}
f = fopen(script_path, "w");
if (f == NULL) {
free(q);
free(qout);
return -1;
}
/* q and qout are st_sh_quote() output: shell-safe by construction. */
if (fprintf(f, "v=%s\nprintf '%%s' \"$v\" > %s\n", q, qout) < 0) {
fclose(f);
free(q);
free(qout);
return -1;
}
fclose(f);
free(q);
free(qout);
{
char cmd[1200];
int spawned;
if (snprintf(cmd, sizeof cmd, "%s %s", shell, script_path) < 0) {
return -1;
}
spawned = system(cmd);
if (spawned == -1) {
return -1;
}
rc = WEXITSTATUS(spawned);
}
if (rc != 0) {
return rc;
}
in = fopen(out_path, "rb");
if (in == NULL) {
return -1;
}
if (fseek(in, 0, SEEK_END) != 0) {
fclose(in);
return -1;
}
n = ftell(in);
if (n < 0 || fseek(in, 0, SEEK_SET) != 0) {
fclose(in);
return -1;
}
got = munit_malloc((size_t)n + 1);
if (fread(got, 1, (size_t)n, in) != (size_t)n) {
free(got);
fclose(in);
return -1;
}
fclose(in);
got[n] = '\0';
if ((size_t)n != len || memcmp(got, value, len) != 0) {
free(got);
return -2; /* round-trip mismatch */
}
free(got);
return 0;
}
/* Round-trip through sh, bash and zsh; -2 means content mismatch. */
static void
roundtrip_assert(const char *value, size_t len, const char *pathbase)
{
munit_assert_int(roundtrip_one("sh", value, len, pathbase), ==, 0);
munit_assert_int(roundtrip_one("bash", value, len, pathbase), ==, 0);
munit_assert_int(roundtrip_one("zsh", value, len, pathbase), ==, 0);
}
static void
roundtrip_assert_str(const char *value, const char *pathbase)
{
roundtrip_assert(value, strlen(value), pathbase);
}
/* --- exact literal format ------------------------------------------------- */
static MunitResult
test_quote_empty(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
char *q = st_sh_quote("");
munit_assert_not_null(q);
munit_assert_string_equal(q, "''");
free(q);
return MUNIT_OK;
}
static MunitResult
test_quote_plain(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
char *q = st_sh_quote("abc");
munit_assert_not_null(q);
munit_assert_string_equal(q, "'abc'");
free(q);
return MUNIT_OK;
}
/* The canonical escape shape is locked byte-for-byte: each `'` becomes
* the 4-char sequence '\'' between the two surrounding quotes. */
static MunitResult
test_quote_literal_format(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
char *q;
q = st_sh_quote("'");
munit_assert_not_null(q);
munit_assert_string_equal(q, "''\\'''");
free(q);
q = st_sh_quote("a'b");
munit_assert_not_null(q);
munit_assert_string_equal(q, "'a'\\''b'");
free(q);
return MUNIT_OK;
}
/* --- round-trips through real shells -------------------------------------- */
static MunitResult
test_quote_roundtrip_fixed(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
static const char *const hostile[] = {
"a'b\"c $d",
"''",
"'''",
"$(rm -rf /)",
"`rm -rf /`",
"\\", "$", "\"", "'", "`",
"line1\nline2\n",
"\nleading",
"trailing\n",
"\t tab\t$HOME\t",
"$PATH ${HOME} ~ *.txt ?[a] ; | & > <",
"#! /bin/sh",
"--prefix=/tmp/x y",
"=;:,%^(){}[]<>!#~",
"h\xC3\xA9llo w\xC3\xB6rld \xE2\x9C\x93", /* UTF-8 */
"",
};
size_t i;
for (i = 0; i < sizeof hostile / sizeof hostile[0]; i++) {
char base[64];
if (snprintf(base, sizeof base, "fixed%zu", i) < 0) {
return MUNIT_ERROR;
}
roundtrip_assert_str(hostile[i], base);
}
return MUNIT_OK;
}
/* xorshift32 with a fixed seed: deterministic property test. */
static uint32_t rng_state = 0x2E3A5B7Fu;
static uint32_t
rng_next(void)
{
uint32_t x = rng_state;
x ^= x << 13;
x ^= x >> 17;
x ^= x << 5;
rng_state = x;
return x;
}
static MunitResult
test_quote_roundtrip_random(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
/* Hostile alphabet: every byte class that matters to a shell. */
static const char alphabet[] =
"'\"\\$`();|&><*?[]{}!~#%^=:,./- \t\n"
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
char buf[80];
int iter;
for (iter = 0; iter < 96; iter++) {
size_t len = (size_t)(rng_next() % sizeof buf);
size_t i;
char base[64];
for (i = 0; i < len; i++) {
buf[i] = alphabet[rng_next() % (sizeof alphabet - 1)];
}
if (snprintf(base, sizeof base, "rnd%d", iter) < 0) {
return MUNIT_ERROR;
}
roundtrip_assert(buf, len, base);
}
return MUNIT_OK;
}
static MunitResult
test_quote_long_single_quotes(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
char *big = munit_malloc(1001);
size_t i;
for (i = 0; i < 1000; i++) {
big[i] = '\'';
}
big[1000] = '\0';
roundtrip_assert_str(big, "big");
free(big);
return MUNIT_OK;
}
/* --- injection proof ------------------------------------------------------ */
static MunitResult
test_quote_injection_inert(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
char marker[512];
char script_path[512];
char out_path[512];
char *payload, *q, *qout;
FILE *f;
FILE *in;
char *got;
long n;
int rc;
(void)params;
(void)data;
if (snprintf(marker, sizeof marker, "%s/PWNED", temp_dir) < 0) {
return MUNIT_ERROR;
}
/* Classic break-out: close the quote, run a command, reopen it. */
payload = munit_malloc(512);
if (snprintf(payload, 512, "'; echo PWNED > %s; echo '", marker) < 0) {
free(payload);
return MUNIT_ERROR;
}
q = st_sh_quote(payload);
munit_assert_not_null(q);
if (snprintf(script_path, sizeof script_path, "%s/inject.sh", temp_dir) < 0) {
free(payload);
free(q);
return MUNIT_ERROR;
}
if (snprintf(out_path, sizeof out_path, "%s/inject.out", temp_dir) < 0) {
free(payload);
free(q);
return MUNIT_ERROR;
}
qout = st_sh_quote(out_path);
munit_assert_not_null(qout);
f = fopen(script_path, "w");
munit_assert_not_null(f);
{
int wr = fprintf(f, "v=%s\nprintf '%%s' \"$v\" > %s\n", q, qout);
munit_assert_int(wr, >=, 0);
}
fclose(f);
free(q);
free(qout);
{
char cmd[1200];
int spawned;
int snrc = snprintf(cmd, sizeof cmd, "sh %s", script_path);
munit_assert_int(snrc, >=, 0);
spawned = system(cmd);
munit_assert_int(spawned, !=, -1);
rc = WEXITSTATUS(spawned);
}
munit_assert_int(rc, ==, 0);
/* The attack command must NOT have run. */
munit_assert_int(access(marker, F_OK), ==, -1);
/* And the output must be the exact payload bytes. */
in = fopen(out_path, "rb");
munit_assert_not_null(in);
munit_assert_int(fseek(in, 0, SEEK_END), ==, 0);
n = ftell(in);
munit_assert_int(n, ==, (long)strlen(payload));
munit_assert_int(fseek(in, 0, SEEK_SET), ==, 0);
got = munit_malloc((size_t)n + 1);
munit_assert_size(fread(got, 1, (size_t)n, in), ==, (size_t)n);
fclose(in);
got[n] = '\0';
munit_assert_memory_equal((size_t)n, got, payload);
free(got);
free(payload);
return MUNIT_OK;
}
/* --- NUL / NULL input handling ------------------------------------------- */
static MunitResult
test_quote_null_input(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
struct st_error *err = NULL;
char *q;
q = st_sh_quote(NULL);
munit_assert_null(q);
q = st_sh_quote_ex(NULL, &err);
munit_assert_null(q);
munit_assert_not_null(err);
munit_assert_int(st_error_category_of(err), ==, ST_ERR_INTERNAL);
munit_assert_int(strlen(st_error_message(err)), >, 0);
st_error_free(err);
return MUNIT_OK;
}
static MunitResult
test_quote_nul_byte(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
struct st_error *err = NULL;
char *q;
/* embedded NUL detected through the length-bounded variant */
q = st_sh_quote_n("a\0b", 3, &err);
munit_assert_null(q);
munit_assert_not_null(err);
munit_assert_int(st_error_category_of(err), ==, ST_ERR_INTERNAL);
st_error_free(err);
/* same input, truncated to the bytes before the NUL: fine */
q = st_sh_quote_n("a\0b", 1, NULL);
munit_assert_not_null(q);
munit_assert_string_equal(q, "'a'");
free(q);
return MUNIT_OK;
}
/* --- emitter helpers: the sample script ----------------------------------- */
/* Assembles a small representative configure-style script exclusively
* through the emitter API, then proves on the ACTUAL emitted bytes:
* - sh -n, bash -n and zsh -n all accept it,
* - none of the banned constructs appear,
* - it actually runs and prints the expected line. */
static MunitResult
test_emit_sample_script(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
static const char *const banned[] = {
"[[ ", "]]", "local ", "==", "<<<", "&>", "set -e",
};
char script_path[512];
FILE *f;
char *q;
FILE *in;
char *bytes;
long n;
size_t i;
if (snprintf(script_path, sizeof script_path, "%s/sample.sh", temp_dir) < 0) {
return MUNIT_ERROR;
}
f = fopen(script_path, "w");
munit_assert_not_null(f);
munit_assert_int(st_sh_emit_str(f, "#!/bin/sh\n"), ==, 0);
munit_assert_int(st_sh_emit_comment(f, "generated sample\nline two"), ==, 0);
munit_assert_int(st_sh_emit_assign_q(f, "prefix", "/usr/local"), ==, 0);
q = st_sh_quote("it's fine");
munit_assert_not_null(q);
munit_assert_int(st_sh_emit_assign(f, "greeting", q), ==, 0);
free(q);
munit_assert_int(st_sh_emit_str(f, "if [ \"$1\" = \"--help\" ]; then\n"
" echo 'usage: configure [--prefix=DIR] [VAR=VALUE]'\n"
" exit 0\n"
"fi\n"
"case \"$1\" in\n"
" --prefix=*)\n"
" prefix=${1#--prefix=}\n"
" ;;\n"
" '')\n"
" ;;\n"
" *)\n"
" echo \"unrecognized option: $1\" >&2\n"
" exit 1\n"
" ;;\n"
"esac\n"
"echo \"prefix is $prefix; greeting is $greeting\"\n"), ==, 0);
fclose(f);
/* lock the comment/assign byte shapes */
in = fopen(script_path, "rb");
munit_assert_not_null(in);
munit_assert_int(fseek(in, 0, SEEK_END), ==, 0);
n = ftell(in);
munit_assert_int(n, >, 0);
munit_assert_int(fseek(in, 0, SEEK_SET), ==, 0);
bytes = munit_malloc((size_t)n + 1);
munit_assert_size(fread(bytes, 1, (size_t)n, in), ==, (size_t)n);
fclose(in);
bytes[n] = '\0';
munit_assert_not_null(strstr(bytes, "# generated sample\n# line two\n"));
munit_assert_not_null(strstr(bytes, "prefix='/usr/local'\n"));
munit_assert_not_null(strstr(bytes, "greeting='it'\\''s fine'\n"));
/* the banned-construct sweep on the real emitted bytes */
for (i = 0; i < sizeof banned / sizeof banned[0]; i++) {
munit_assert_null(strstr(bytes, banned[i]));
}
/* syntax: sh -n / bash -n / zsh -n on the actual file */
munit_assert_int(syntax_check("sh", script_path), ==, 0);
munit_assert_int(syntax_check("bash", script_path), ==, 0);
munit_assert_int(syntax_check("zsh", script_path), ==, 0);
/* behavior: the script must actually run (exit 0, expected echo) */
{
char cmd[1200];
int spawned;
int snrc = snprintf(cmd, sizeof cmd, "sh %s", script_path);
munit_assert_int(snrc, >=, 0);
spawned = system(cmd);
munit_assert_int(spawned, !=, -1);
munit_assert_int(WEXITSTATUS(spawned), ==, 0);
}
free(bytes);
return MUNIT_OK;
}
/* defensive behavior of the emitters (never write on bad input) */
static MunitResult
test_emit_null_guards(const MunitParameter params[], void *data)
{
(void)params;
(void)data;
FILE *f = tmpfile();
munit_assert_not_null(f);
munit_assert_int(st_sh_emit_str(NULL, "x"), ==, -1);
munit_assert_int(st_sh_emit_str(f, NULL), ==, -1);
munit_assert_int(st_sh_emit_comment(NULL, "x"), ==, -1);
munit_assert_int(st_sh_emit_comment(f, NULL), ==, -1);
munit_assert_int(st_sh_emit_assign(NULL, "a", "b"), ==, -1);
munit_assert_int(st_sh_emit_assign(f, NULL, "b"), ==, -1);
munit_assert_int(st_sh_emit_assign(f, "a", NULL), ==, -1);
munit_assert_int(st_sh_emit_assign_q(NULL, "a", "b"), ==, -1);
munit_assert_int(st_sh_emit_assign_q(f, "a", NULL), ==, -1);
fclose(f);
return MUNIT_OK;
}
static MunitTest tests[] = {
{ "/quote/empty", test_quote_empty, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/plain", test_quote_plain, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/literal-format", test_quote_literal_format, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/roundtrip-fixed", test_quote_roundtrip_fixed, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/roundtrip-random", test_quote_roundtrip_random, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/long-single-quotes", test_quote_long_single_quotes, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/injection-inert", test_quote_injection_inert, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/null-input", test_quote_null_input, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/quote/nul-byte", test_quote_nul_byte, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/emit/sample-script", test_emit_sample_script, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ "/emit/null-guards", test_emit_null_guards, setup, teardown, MUNIT_TEST_OPTION_NONE, NULL },
{ NULL, NULL, NULL, NULL, MUNIT_TEST_OPTION_NONE, NULL },
};
static const MunitSuite suite = {
"/sh_emit", tests, NULL, 1, MUNIT_SUITE_OPTION_NONE,
};
int
main(int argc, char *argv[MUNIT_ARRAY_PARAM(argc + 1)])
{
return munit_suite_main(&suite, NULL, argc, argv);
}