External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add support for environment protection (scrubbing) (#327)

Browse Source 
* feat: Add support for environment variable protection for sandbox

* chore: Update dangerous env var list

* fix: Split profiles for improved environment protection

* fix: pipx sandbox profile separation

* chore: Show sandbox scrub info on error exit

* fix: Code review fixes

* test: Add e2e for sandbox environment scrubbing
This commit is contained in:
Abhisek Datta
2026-06-11 11:40:33 +05:30
committed by GitHub
parent 7620097613
commit c7244f921a
39 changed files with 1385 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/runner/childexit_test.go
+13 -4
View File
@@ -55,7 +55,7 @@ func TestDecideExit(t *testing.T) {
runErr := errors.New("npm failed")
t.Run("plain child exit becomes a transparent ChildExitError", func(t *testing.T) {
err := decideExit(runErr, 1, false, true, "npm")
err := decideExit(runErr, 1, false, true, "npm", 0)
var ce *ChildExitError
require.True(t, errors.As(err, &ce))
@@ -63,10 +63,19 @@ func TestDecideExit(t *testing.T) {
assert.True(t, ce.Transparent())
assert.False(t, ce.IsSignaled())
assert.Equal(t, "npm", ce.PMName)
assert.Equal(t, 0, ce.ScrubbedEnvCount())
})
t.Run("scrubbed env count is carried for the exit hint", func(t *testing.T) {
err := decideExit(runErr, 1, false, true, "npm", 3)
var ce *ChildExitError
require.True(t, errors.As(err, &ce))
assert.Equal(t, 3, ce.ScrubbedEnvCount())
})
t.Run("signaled child exit is transparent and signaled", func(t *testing.T) {
err := decideExit(runErr, 130, true, true, "npm")
err := decideExit(runErr, 130, true, true, "npm", 0)
var ce *ChildExitError
require.True(t, errors.As(err, &ce))
@@ -75,7 +84,7 @@ func TestDecideExit(t *testing.T) {
})
t.Run("unresolved exit is a visible launch failure", func(t *testing.T) {
err := decideExit(runErr, -1, false, false, "npm")
err := decideExit(runErr, -1, false, false, "npm", 0)
usefulErr, ok := usefulerror.AsUsefulError(err)
require.True(t, ok)
@@ -94,7 +103,7 @@ func TestClassifyTransparentChildExit(t *testing.T) {
childErr := exec.Command("sh", "-c", "exit 1").Run()
require.Error(t, childErr)
err := classify(childErr, "npm")
err := classify(childErr, "npm", 0)
var ce *ChildExitError
require.True(t, errors.As(err, &ce))