scriptoriumadmin/fabro
1
0
Fork 0
mirror of https://github.com/fabro-sh/fabro.git synced 2026-09-20 00:11:34 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Stop re-blanking BASH_ENV in fabro's exec policy

Browse source 
The driver's Bash helper now blanks BASH_ENV at launch on every provider
whatever the caller passed, so fabro's exec policy no longer inserts the
blank itself and the test double no longer filters it back out. The
Host-backed test that a caller's startup file never runs stays.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Bryan Helmkamp 2026-09-11 12:36:29 -06:00
parent a39b97c940
commit dfe378c8ae
No known key found for this signature in database
2 changed files with 7 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
lib/components/fabro-sandbox/src/exec.rs
View file

@ -29,8 +29,8 @@ use std::time::Duration;
use fabro_static::EnvVars;
use fabro_types::{CommandTermination, ExecOutputTail};
use sandbox_driver::{
BASH_ENV_VAR, Exec, ExecControls, ExecFailure, ExecResult, ExecSpec, ExecStreamingResult,
SpawnSpec, StdioProcess, Termination,
Exec, ExecControls, ExecFailure, ExecResult, ExecSpec, ExecStreamingResult, SpawnSpec,
StdioProcess, Termination,
};
use tokio_util::sync::CancellationToken;
@ -212,14 +212,13 @@ impl<'a> SandboxExec<'a> {
}
/// The explicit environment after policy: credential-shaped names pass
/// only under `TrustCaller`, and the Bash helper's `BASH_ENV` blank
/// wins over any caller value, so a worker's startup file never runs
/// inside a sandboxed `bash -c`.
/// only under `TrustCaller`. The driver's Bash helper blanks `BASH_ENV`
/// at launch whatever the caller passed, so a worker's startup file
/// never runs inside a sandboxed `bash -c`.
fn apply_env_policy(&self, env: &mut BTreeMap<String, String>) {
if self.env_policy == ExplicitEnvPolicy::FilterSensitive {
env.retain(|key, _| !is_sensitive_env_var(key));
}
env.insert(BASH_ENV_VAR.to_string(), String::new());
}
}
@ -323,7 +322,8 @@ mod tests {
use std::time::Instant;
use sandbox_driver::{
OutputSink, OutputStream, SandboxProvider as _, SandboxSource, SandboxSpec, TransportError,
BASH_ENV_VAR, OutputSink, OutputStream, SandboxProvider as _, SandboxSource, SandboxSpec,
TransportError,
};
use sandbox_driver_host::HostProvider;
use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};

2
lib/components/fabro-sandbox/src/test_support.rs
View file

@ -280,12 +280,10 @@ impl MockSandbox {
}
/// The explicit variables of the last command as the caller passed them.
/// The exec policy's own `BASH_ENV` blank is not the caller's.
pub fn captured_env_vars(&self) -> Option<HashMap<String, String>> {
self.recorded().last().map(|spec| {
spec.env
.iter()
.filter(|(key, _)| key.as_str() != sandbox_driver::BASH_ENV_VAR)
.map(|(k, v)| (k.clone(), v.clone()))
.collect()
})