SafeProcess.hpp

Go to the documentation of this file.

#pragma once
 
// Execute programs with an argv vector, never through a command interpreter.
// Output and exit status are bounded/normalized; callbacks can stop a scan.
#include <algorithm>
#include <cerrno>
#include <csignal>
#include <functional>
#include <map>
#include <cstdlib>
#include <sys/stat.h>
#include <string>
#include <vector>
#include <spawn.h>
#include <sys/wait.h>
#include <unistd.h>
 
extern char **environ;
 
namespace bg_process {
struct Result {
    int exit_code = 127;
    std::string output;
    bool truncated = false;
    bool started = false;
    bool ok() const { return started && !truncated && exit_code == 0; }
};
 
// Resolve only executable names; do not interpret shell syntax or options.
inline bool exists_on_path(const std::string& name) {
    if (name.empty() || name.find('/') != std::string::npos || name == "." || name == "..")
        return false;
    const char* path = std::getenv("PATH");
    if (!path) return false;
    const std::string dirs(path);
    std::size_t start = 0;
    do {
        const auto end = dirs.find(':', start);
        const std::string dir = dirs.substr(start, end == std::string::npos ? end : end - start);
        // Empty PATH components mean current directory: not trustworthy for security checks.
        if (!dir.empty()) {
            const std::string file = dir + "/" + name;
            struct stat st{};
            if (::stat(file.c_str(), &st) == 0 && S_ISREG(st.st_mode) &&
                ::access(file.c_str(), X_OK) == 0) return true;
        }
        if (end == std::string::npos) break;
        start = end + 1;
    } while (true);
    return false;
}
 
inline Result run(const std::vector<std::string>& args,
                  bool merge_stderr = false,
                  std::size_t limit = 8U * 1024U * 1024U,
                  const std::map<std::string, std::string>& environment = {},
                  const std::function<bool(const std::string&)>& on_line = {}) {
    Result result;
    if (args.empty() || args[0].empty()) return result;
    for (const auto& arg : args) if (arg.find('\0') != std::string::npos) return result;
 
    int fd[2];
    if (::pipe(fd) != 0) return result;
    posix_spawn_file_actions_t actions;
    if (posix_spawn_file_actions_init(&actions) != 0) {
        ::close(fd[0]); ::close(fd[1]); return result;
    }
    posix_spawn_file_actions_addclose(&actions, fd[0]);
    posix_spawn_file_actions_adddup2(&actions, fd[1], STDOUT_FILENO);
    if (merge_stderr) posix_spawn_file_actions_adddup2(&actions, fd[1], STDERR_FILENO);
    posix_spawn_file_actions_addclose(&actions, fd[1]);
 
    std::vector<char*> argv;
    for (const auto& arg : args) argv.push_back(const_cast<char*>(arg.c_str()));
    argv.push_back(nullptr);
 
    // Apply only explicitly supplied overrides, without invoking /usr/bin/env or shell.
    std::vector<std::string> env_storage;
    std::vector<char*> envp;
    if (!environment.empty()) {
        for (char** p = environ; p && *p; ++p) {
            const std::string item(*p);
            const auto pos = item.find('=');
            if (pos != std::string::npos && environment.find(item.substr(0, pos)) == environment.end())
                env_storage.push_back(item);
        }
        for (const auto& [key, value] : environment) {
            if (key.empty() || key.find('=') != std::string::npos || key.find('\0') != std::string::npos || value.find('\0') != std::string::npos) {
                posix_spawn_file_actions_destroy(&actions);
                ::close(fd[0]); ::close(fd[1]); return result;
            }
            env_storage.push_back(key + "=" + value);
        }
        for (auto& item : env_storage) envp.push_back(item.data());
        envp.push_back(nullptr);
    }
 
    pid_t child = -1;
    const int err = posix_spawnp(&child, args[0].c_str(), &actions, nullptr,
                                 argv.data(), environment.empty() ? environ : envp.data());
    posix_spawn_file_actions_destroy(&actions);
    ::close(fd[1]);
    if (err != 0) { ::close(fd[0]); return result; }
    result.started = true;
    char buf[4096];
    std::string pending;
    std::size_t total = 0;
    bool stopped = false;
    for (;;) {
        const ssize_t n = ::read(fd[0], buf, sizeof(buf));
        if (n < 0 && errno == EINTR) continue;
        if (n <= 0) break;
        total += static_cast<std::size_t>(n);
        if (total > limit) { result.truncated = true; stopped = true; break; }
        if (on_line) {
            pending.append(buf, static_cast<std::size_t>(n));
            std::size_t p;
            while ((p = pending.find('\n')) != std::string::npos) {
                std::string line = pending.substr(0, p + 1);
                pending.erase(0, p + 1);
                if (!on_line(line)) { stopped = true; break; }
            }
            if (stopped) break;
            // Guard against never-ending lines.
            if (pending.size() > 65536) { result.truncated = true; stopped = true; break; }
        } else {
            result.output.append(buf, static_cast<std::size_t>(n));
        }
    }
    if (on_line && !stopped && !pending.empty()) on_line(pending);
    if (stopped) ::kill(child, SIGTERM);
    ::close(fd[0]);
    int status = 0;
    pid_t waited;
    do { waited = ::waitpid(child, &status, 0); } while (waited == -1 && errno == EINTR);
    if (waited == child) {
        if (WIFEXITED(status)) result.exit_code = WEXITSTATUS(status);
        else if (WIFSIGNALED(status)) result.exit_code = 128 + WTERMSIG(status);
    }
    if (stopped) result.truncated = true;
    return result;
}
} // namespace bg_process