| 
 | 1 | +import * as common from '../common/index.mjs';  | 
 | 2 | +import * as fixtures from '../common/fixtures.mjs';  | 
 | 3 | +import { EOL } from 'node:os';  | 
 | 4 | +import { strictEqual } from 'node:assert';  | 
 | 5 | +import cp from 'node:child_process';  | 
 | 6 | + | 
 | 7 | +// TODO(LiviaMedeiros): test on different platforms  | 
 | 8 | +if (!common.isLinux)  | 
 | 9 | +  common.skip();  | 
 | 10 | + | 
 | 11 | +const expectedCWD = process.cwd();  | 
 | 12 | +const expectedUID = process.getuid();  | 
 | 13 | + | 
 | 14 | +for (const tamperedCwd of ['', '/tmp', '/not/existing/malicious/path', 42n]) {  | 
 | 15 | +  Object.prototype.cwd = tamperedCwd;  | 
 | 16 | + | 
 | 17 | +  cp.exec('pwd', common.mustSucceed((out) => {  | 
 | 18 | +    strictEqual(`${out}`, `${expectedCWD}${EOL}`);  | 
 | 19 | +  }));  | 
 | 20 | +  strictEqual(`${cp.execSync('pwd')}`, `${expectedCWD}${EOL}`);  | 
 | 21 | +  cp.execFile('pwd', common.mustSucceed((out) => {  | 
 | 22 | +    strictEqual(`${out}`, `${expectedCWD}${EOL}`);  | 
 | 23 | +  }));  | 
 | 24 | +  strictEqual(`${cp.execFileSync('pwd')}`, `${expectedCWD}${EOL}`);  | 
 | 25 | +  cp.spawn('pwd').stdout.on('data', common.mustCall((out) => {  | 
 | 26 | +    strictEqual(`${out}`, `${expectedCWD}${EOL}`);  | 
 | 27 | +  }));  | 
 | 28 | +  strictEqual(`${cp.spawnSync('pwd').stdout}`, `${expectedCWD}${EOL}`);  | 
 | 29 | + | 
 | 30 | +  delete Object.prototype.cwd;  | 
 | 31 | +}  | 
 | 32 | + | 
 | 33 | +for (const tamperedUID of [0, 1, 999, 1000, 0n, 'gwak']) {  | 
 | 34 | +  Object.prototype.uid = tamperedUID;  | 
 | 35 | + | 
 | 36 | +  cp.exec('id -u', common.mustSucceed((out) => {  | 
 | 37 | +    strictEqual(`${out}`, `${expectedUID}${EOL}`);  | 
 | 38 | +  }));  | 
 | 39 | +  strictEqual(`${cp.execSync('id -u')}`, `${expectedUID}${EOL}`);  | 
 | 40 | +  cp.execFile('id', ['-u'], common.mustSucceed((out) => {  | 
 | 41 | +    strictEqual(`${out}`, `${expectedUID}${EOL}`);  | 
 | 42 | +  }));  | 
 | 43 | +  strictEqual(`${cp.execFileSync('id', ['-u'])}`, `${expectedUID}${EOL}`);  | 
 | 44 | +  cp.spawn('id', ['-u']).stdout.on('data', common.mustCall((out) => {  | 
 | 45 | +    strictEqual(`${out}`, `${expectedUID}${EOL}`);  | 
 | 46 | +  }));  | 
 | 47 | +  strictEqual(`${cp.spawnSync('id', ['-u']).stdout}`, `${expectedUID}${EOL}`);  | 
 | 48 | + | 
 | 49 | +  delete Object.prototype.uid;  | 
 | 50 | +}  | 
 | 51 | + | 
 | 52 | +{  | 
 | 53 | +  Object.prototype.execPath = '/not/existing/malicious/path';  | 
 | 54 | + | 
 | 55 | +  // Does not throw ENOENT  | 
 | 56 | +  cp.fork(fixtures.path('empty.js'));  | 
 | 57 | + | 
 | 58 | +  delete Object.prototype.execPath;  | 
 | 59 | +}  | 
0 commit comments