1import * as common from '../common/index.mjs'; 2import * as fixtures from '../common/fixtures.mjs'; 3import { EOL } from 'node:os'; 4import { strictEqual } from 'node:assert'; 5import cp from 'node:child_process'; 6 7// TODO(LiviaMedeiros): test on different platforms 8if (!common.isLinux) 9 common.skip(); 10 11const expectedCWD = process.cwd(); 12const expectedUID = process.getuid(); 13 14for (const tamperedCwd of ['', '/tmp', '/not/existing/malicious/path', 42n]) { 15 Object.prototype.cwd = tamperedCwd; 16 17 cp.exec('pwd', common.mustSucceed((out) => { 18 strictEqual(`${out}`, `${expectedCWD}${EOL}`); 19 })); 20 strictEqual(`${cp.execSync('pwd')}`, `${expectedCWD}${EOL}`); 21 cp.execFile('pwd', common.mustSucceed((out) => { 22 strictEqual(`${out}`, `${expectedCWD}${EOL}`); 23 })); 24 strictEqual(`${cp.execFileSync('pwd')}`, `${expectedCWD}${EOL}`); 25 cp.spawn('pwd').stdout.on('data', common.mustCall((out) => { 26 strictEqual(`${out}`, `${expectedCWD}${EOL}`); 27 })); 28 strictEqual(`${cp.spawnSync('pwd').stdout}`, `${expectedCWD}${EOL}`); 29 30 delete Object.prototype.cwd; 31} 32 33for (const tamperedUID of [0, 1, 999, 1000, 0n, 'gwak']) { 34 Object.prototype.uid = tamperedUID; 35 36 cp.exec('id -u', common.mustSucceed((out) => { 37 strictEqual(`${out}`, `${expectedUID}${EOL}`); 38 })); 39 strictEqual(`${cp.execSync('id -u')}`, `${expectedUID}${EOL}`); 40 cp.execFile('id', ['-u'], common.mustSucceed((out) => { 41 strictEqual(`${out}`, `${expectedUID}${EOL}`); 42 })); 43 strictEqual(`${cp.execFileSync('id', ['-u'])}`, `${expectedUID}${EOL}`); 44 cp.spawn('id', ['-u']).stdout.on('data', common.mustCall((out) => { 45 strictEqual(`${out}`, `${expectedUID}${EOL}`); 46 })); 47 strictEqual(`${cp.spawnSync('id', ['-u']).stdout}`, `${expectedUID}${EOL}`); 48 49 delete Object.prototype.uid; 50} 51 52{ 53 Object.prototype.execPath = '/not/existing/malicious/path'; 54 55 // Does not throw ENOENT 56 cp.fork(fixtures.path('empty.js')); 57 58 delete Object.prototype.execPath; 59} 60