@@ -548,6 +548,13 @@ describe("sanitizeHostExecEnv", () => {
548548AZURE_AUTH_LOCATION: "/tmp/trusted-azure-auth.json",
549549SSH_AUTH_SOCK: "/tmp/trusted-ssh-agent.sock",
550550DOCKER_CONTEXT: "trusted-remote",
551+XDG_CACHE_HOME: "/tmp/trusted-xdg-cache",
552+XDG_CONFIG_DIRS: "/tmp/trusted-xdg-config-dirs:/etc/xdg",
553+XDG_CONFIG_HOME: "/tmp/trusted-xdg-config",
554+XDG_DATA_DIRS: "/tmp/trusted-xdg-data-dirs:/usr/share",
555+XDG_DATA_HOME: "/tmp/trusted-xdg-data",
556+XDG_RUNTIME_DIR: "/tmp/trusted-xdg-runtime",
557+XDG_STATE_HOME: "/tmp/trusted-xdg-state",
551558VIMINIT: ":!touch /tmp/pwned",
552559EXINIT: "silent !touch /tmp/pwned",
553560LUA_INIT_5_4: "os.execute('touch /tmp/pwned')",
@@ -579,6 +586,13 @@ describe("sanitizeHostExecEnv", () => {
579586expect(env.AZURE_AUTH_LOCATION).toBe("/tmp/trusted-azure-auth.json");
580587expect(env.SSH_AUTH_SOCK).toBe("/tmp/trusted-ssh-agent.sock");
581588expect(env.DOCKER_CONTEXT).toBe("trusted-remote");
589+expect(env.XDG_CACHE_HOME).toBe("/tmp/trusted-xdg-cache");
590+expect(env.XDG_CONFIG_DIRS).toBe("/tmp/trusted-xdg-config-dirs:/etc/xdg");
591+expect(env.XDG_CONFIG_HOME).toBe("/tmp/trusted-xdg-config");
592+expect(env.XDG_DATA_DIRS).toBe("/tmp/trusted-xdg-data-dirs:/usr/share");
593+expect(env.XDG_DATA_HOME).toBe("/tmp/trusted-xdg-data");
594+expect(env.XDG_RUNTIME_DIR).toBe("/tmp/trusted-xdg-runtime");
595+expect(env.XDG_STATE_HOME).toBe("/tmp/trusted-xdg-state");
582596expect(env.AWS_CONTAINER_CREDENTIALS_FULL_URI).toBeUndefined();
583597expect(env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI).toBeUndefined();
584598expect(env.CONFIG_SITE).toBeUndefined();
@@ -607,7 +621,13 @@ describe("sanitizeHostExecEnv", () => {
607621TF_PLUGIN_CACHE_DIR: "/tmp/evil-tf-plugin-cache",
608622CFLAGS: "-I/attacker/include",
609623LDFLAGS: "-L/attacker/lib",
624+XDG_CACHE_HOME: "/tmp/evil-cache",
610625XDG_CONFIG_DIRS: "/tmp/evil-config-dirs",
626+XDG_CONFIG_HOME: "/tmp/evil-config",
627+XDG_DATA_DIRS: "/tmp/evil-data-dirs",
628+XDG_DATA_HOME: "/tmp/evil-data",
629+XDG_RUNTIME_DIR: "/tmp/evil-runtime",
630+XDG_STATE_HOME: "/tmp/evil-state",
611631TF_VAR_admin_cidr: "10.0.0.0/24",
612632GITHUB_TOKEN: "ghp-test",
613633DATABASE_URL: "postgres://attacker",
@@ -630,7 +650,13 @@ describe("sanitizeHostExecEnv", () => {
630650expect(env.TF_PLUGIN_CACHE_DIR).toBeUndefined();
631651expect(env.CFLAGS).toBeUndefined();
632652expect(env.LDFLAGS).toBeUndefined();
653+expect(env.XDG_CACHE_HOME).toBeUndefined();
633654expect(env.XDG_CONFIG_DIRS).toBeUndefined();
655+expect(env.XDG_CONFIG_HOME).toBeUndefined();
656+expect(env.XDG_DATA_DIRS).toBeUndefined();
657+expect(env.XDG_DATA_HOME).toBeUndefined();
658+expect(env.XDG_RUNTIME_DIR).toBeUndefined();
659+expect(env.XDG_STATE_HOME).toBeUndefined();
634660expect(env.TF_VAR_admin_cidr).toBeUndefined();
635661expect(env.GITHUB_TOKEN).toBeUndefined();
636662expect(env.DATABASE_URL).toBeUndefined();
@@ -830,10 +856,20 @@ describe("isDangerousHostEnvOverrideVarName", () => {
830856expect(isDangerousHostEnvOverrideVarName("TF_VAR_admin_cidr")).toBe(true);
831857expect(isDangerousHostEnvOverrideVarName("CORECLR_PROFILER_PATH")).toBe(true);
832858expect(isDangerousHostEnvOverrideVarName("coreclr_profiler_path")).toBe(true);
859+expect(isDangerousHostEnvOverrideVarName("XDG_CACHE_HOME")).toBe(true);
860+expect(isDangerousHostEnvOverrideVarName("xdg_cache_home")).toBe(true);
833861expect(isDangerousHostEnvOverrideVarName("XDG_CONFIG_HOME")).toBe(true);
834862expect(isDangerousHostEnvOverrideVarName("xdg_config_home")).toBe(true);
835863expect(isDangerousHostEnvOverrideVarName("XDG_CONFIG_DIRS")).toBe(true);
836864expect(isDangerousHostEnvOverrideVarName("xdg_config_dirs")).toBe(true);
865+expect(isDangerousHostEnvOverrideVarName("XDG_DATA_DIRS")).toBe(true);
866+expect(isDangerousHostEnvOverrideVarName("xdg_data_dirs")).toBe(true);
867+expect(isDangerousHostEnvOverrideVarName("XDG_DATA_HOME")).toBe(true);
868+expect(isDangerousHostEnvOverrideVarName("xdg_data_home")).toBe(true);
869+expect(isDangerousHostEnvOverrideVarName("XDG_RUNTIME_DIR")).toBe(true);
870+expect(isDangerousHostEnvOverrideVarName("xdg_runtime_dir")).toBe(true);
871+expect(isDangerousHostEnvOverrideVarName("XDG_STATE_HOME")).toBe(true);
872+expect(isDangerousHostEnvOverrideVarName("xdg_state_home")).toBe(true);
837873expect(isDangerousHostEnvOverrideVarName("AWS_CONFIG_FILE")).toBe(true);
838874expect(isDangerousHostEnvOverrideVarName("aws_config_file")).toBe(true);
839875expect(isDangerousHostEnvOverrideVarName("yarn_rc_filename")).toBe(true);
@@ -861,7 +897,13 @@ describe("isDangerousHostEnvOverrideVarName", () => {
861897"TF_PLUGIN_CACHE_DIR",
862898"CFLAGS",
863899"LDFLAGS",
900+"XDG_CACHE_HOME",
864901"XDG_CONFIG_DIRS",
902+"XDG_CONFIG_HOME",
903+"XDG_DATA_DIRS",
904+"XDG_DATA_HOME",
905+"XDG_RUNTIME_DIR",
906+"XDG_STATE_HOME",
865907"AWS_SECRET_ACCESS_KEY",
866908"AZURE_CLIENT_SECRET",
867909"DATABASE_URL",
@@ -1113,7 +1155,13 @@ describe("sanitizeHostExecEnvWithDiagnostics", () => {
11131155GITHUB_TOKEN: "ghp-test",
11141156DATABASE_URL: "postgres://attacker",
11151157R_PROFILE_USER: "/tmp/evil-Rprofile",
1158+XDG_CACHE_HOME: "/tmp/evil-cache",
11161159XDG_CONFIG_DIRS: "/tmp/evil-config-dirs",
1160+XDG_CONFIG_HOME: "/tmp/evil-config",
1161+XDG_DATA_DIRS: "/tmp/evil-data-dirs",
1162+XDG_DATA_HOME: "/tmp/evil-data",
1163+XDG_RUNTIME_DIR: "/tmp/evil-runtime",
1164+XDG_STATE_HOME: "/tmp/evil-state",
11171165TF_VAR_admin_cidr: "10.0.0.0/24",
11181166SAFE_KEY: "ok",
11191167},
@@ -1134,7 +1182,13 @@ describe("sanitizeHostExecEnvWithDiagnostics", () => {
11341182"TF_PLUGIN_CACHE_DIR",
11351183"TF_VAR_ADMIN_CIDR",
11361184"VIMINIT",
1185+"XDG_CACHE_HOME",
11371186"XDG_CONFIG_DIRS",
1187+"XDG_CONFIG_HOME",
1188+"XDG_DATA_DIRS",
1189+"XDG_DATA_HOME",
1190+"XDG_RUNTIME_DIR",
1191+"XDG_STATE_HOME",
11381192]);
11391193expect(result.rejectedOverrideInvalidKeys).toStrictEqual([]);
11401194expect(result.env.SAFE_KEY).toBe("ok");
@@ -1149,7 +1203,13 @@ describe("sanitizeHostExecEnvWithDiagnostics", () => {
11491203expect(result.env.GITHUB_TOKEN).toBeUndefined();
11501204expect(result.env.DATABASE_URL).toBeUndefined();
11511205expect(result.env.R_PROFILE_USER).toBeUndefined();
1206+expect(result.env.XDG_CACHE_HOME).toBeUndefined();
11521207expect(result.env.XDG_CONFIG_DIRS).toBeUndefined();
1208+expect(result.env.XDG_CONFIG_HOME).toBeUndefined();
1209+expect(result.env.XDG_DATA_DIRS).toBeUndefined();
1210+expect(result.env.XDG_DATA_HOME).toBeUndefined();
1211+expect(result.env.XDG_RUNTIME_DIR).toBeUndefined();
1212+expect(result.env.XDG_STATE_HOME).toBeUndefined();
11531213expect(result.env.TF_VAR_admin_cidr).toBeUndefined();
11541214});
11551215此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。