| 1 | //go:build windows |
| 2 | |
| 3 | package builtin |
| 4 | |
| 5 | import ( |
| 6 | "testing" |
| 7 | |
| 8 | "reasonix/internal/sandbox" |
| 9 | ) |
| 10 | |
| 11 | // Restricted presets must not demand an OS sandbox on Windows: the platform |
| 12 | // has none, so demanding one turned every shell call into a fail-closed |
| 13 | // "sandbox unavailable" error (#10292) instead of the tool-layer boundary the |
| 14 | // presets actually provide here. |
| 15 | func TestWindowsPresetsNeverDemandOSSandbox(t *testing.T) { |
| 16 | previous := bashSandboxCommand |
| 17 | bashSandboxCommand = func(spec sandbox.Spec, sh sandbox.Shell, command string) ([]string, bool) { |
| 18 | if spec.Enforce() { |
| 19 | t.Fatalf("Windows launch asked for confinement: %+v", spec) |
| 20 | } |
| 21 | return []string{sh.Path, "-Command", command}, false |
| 22 | } |
| 23 | t.Cleanup(func() { bashSandboxCommand = previous }) |
| 24 | sh := sandbox.Shell{Kind: sandbox.ShellPowerShell, Path: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`} |
| 25 | for _, preset := range []string{"read-only", "workspace-write", "danger-full-access"} { |
| 26 | b := bash{shell: sh, workDir: t.TempDir(), sb: sandbox.Spec{Mode: "enforce", WriteRoots: []string{`C:\work`}}} |
| 27 | ctx := sandbox.WithPermissionPreset(t.Context(), preset) |
| 28 | if spec := b.specForCall(ctx); spec.Enforce() { |
| 29 | t.Fatalf("%s: effective spec demands confinement: %+v", preset, spec) |
| 30 | } |
| 31 | prepared, lease, err := b.prepareLaunch(ctx, sh, "Write-Output ok", nil) |
| 32 | if lease != nil { |
| 33 | lease.Release() |
| 34 | } |
| 35 | if err != nil || prepared.Wrapped { |
| 36 | t.Fatalf("%s: prepareLaunch wrapped=%v err=%v", preset, prepared.Wrapped, err) |
| 37 | } |
| 38 | } |
| 39 | } |
| 40 |