@taliesinb/mash 0.0.0-stage → 0.1.0

package/src/vm/emulate.ts

@@ -0,0 +1,337 @@
+/**
+ * In-VM emulation of commands that run other commands on data only known at
+ * runtime: `xargs` (arguments from stdin) and the actions of `find`
+ * (`-exec ... ;`, `-exec ... +`, `-execdir`, `-delete`).
+ *
+ * Instead of handing the whole job to the real binary (where every nested
+ * command is invisible), mash runs `find ... -print0` for the matches, or
+ * reads the xargs input itself, and then runs each resulting command through
+ * the VM. Every one is traced and checked against the policy with its
+ * concrete arguments. `-execdir` runs each command in a subshell whose cwd is
+ * the match's directory. Forms that cannot be emulated command by command
+ * (`-ok`, an action inside a compound find expression, xargs `-p` or an
+ * unknown option) are refused with status 126 rather than handed to the real
+ * binary, whose nested commands would run unchecked.
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import type { Interpreter } from './interp.ts'
+import { Capture, FdTable, NullFile } from './io.ts'
+import type { Proc } from './proc.ts'
+import { runExternal } from './external.ts'
+
+const BSD = process.platform === 'darwin' || process.platform.endsWith('bsd')
+
+export interface EmulationRequest {
+  execId: number
+  /** The resolved path of the real binary (find, for listing matches). */
+  path: string
+  argv: string[]
+  env: Record<string, string>
+  proc: Proc
+  node: import('../parser/ast.ts').SimpleCommand
+}
+
+/** Split xargs input into arguments (default mode: blanks/newlines, with '', "" and \\ quoting). */
+function xargsTokens(text: string): string[] {
+  const out: string[] = []
+  let cur = ''
+  let has = false
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i]
+    if (c === '\\' && i + 1 < text.length) {
+      cur += text[++i]
+      has = true
+    } else if (c === "'" || c === '"') {
+      const end = text.indexOf(c, i + 1)
+      if (end === -1) throw new Error(`unterminated quote in xargs input`)
+      cur += text.slice(i + 1, end)
+      has = true
+      i = end
+    } else if (c === ' ' || c === '\t' || c === '\n') {
+      if (has) out.push(cur)
+      cur = ''
+      has = false
+    } else {
+      cur += c
+      has = true
+    }
+  }
+  if (has) out.push(cur)
+  return out
+}
+
+/**
+ * Refuse a form the emulation cannot run command by command: the real binary
+ * would run its nested commands unchecked.
+ */
+function refuse(interp: Interpreter, req: EmulationRequest, what: string): number {
+  interp.errorMessage(req.proc, `${path.basename(req.argv[0])}: ${what} is not supported by mash (its commands could not be checked against the policy)`)
+  return 126
+}
+
+export interface XargsOptions {
+  nul: boolean; delim: string | null; replace: string | null; replaceOne: string | null; maxArgs: number; maxLines: number
+  noRunIfEmpty: boolean; trace: boolean; eof: string | null; argFile: string | null; command: string[]
+}
+
+/** Parse xargs options, or name the one that cannot be emulated. */
+export function planXargs(argv: string[]): XargsOptions | { refuse: string } {
+  // split bundled short options: `-0r` → `-0 -r`, `-0n1` → `-0 -n1`
+  const args: string[] = []
+  for (let k = 0; k < argv.length; k++) {
+    const a = argv[k]
+    const m = /^-([0rtx]+)([0rtxIndLPEsSJ].*)?$/.exec(a)
+    if (a === '--' || !a.startsWith('-')) {
+      args.push(...argv.slice(k))
+      break
+    }
+    if (m && (m[1].length > 1 || m[2])) {
+      for (const c of m[1]) args.push('-' + c)
+      if (m[2]) args.push('-' + m[2])
+    } else args.push(a)
+  }
+  let nul = false
+  let argFile: string | null = null
+  let replaceOne: string | null = null
+  let delim: string | null = null
+  let replace: string | null = null
+  let maxArgs = Infinity
+  let maxLines = 0
+  let noRunIfEmpty = BSD
+  let trace = false
+  let eof: string | null = null
+  let i = 0
+  for (; i < args.length; i++) {
+    const a = args[i]
+    if (!a.startsWith('-') || a === '-') break
+    if (a === '--') {
+      i++
+      break
+    }
+    const take = (): string | undefined => args[++i]
+    if (a === '-0' || a === '--null') nul = true
+    else if (a === '-r' || a === '--no-run-if-empty') noRunIfEmpty = true
+    else if (a === '-t' || a === '--verbose') trace = true
+    else if (a === '-d') delim = take() ?? null
+    else if (a.startsWith('--delimiter=')) delim = a.slice(12)
+    else if (a === '-I') replace = take() ?? null
+    else if (a === '-i' || a === '--replace') replace = '{}'
+    else if (a.startsWith('-I')) replace = a.slice(2)
+    else if (a.startsWith('--replace=')) replace = a.slice(10)
+    else if (a === '-n') maxArgs = Number(take())
+    else if (/^-n\d+$/.test(a)) maxArgs = Number(a.slice(2))
+    else if (a.startsWith('--max-args=')) maxArgs = Number(a.slice(11))
+    else if (a === '-L') maxLines = Number(take())
+    else if (/^-L\d+$/.test(a)) maxLines = Number(a.slice(2))
+    else if (a === '-P') take() // run sequentially
+    else if (a.startsWith('-P') || a.startsWith('--max-procs=')) continue
+    else if (a === '-E') eof = take() ?? null
+    else if (/^-e/.test(a)) eof = a.length > 2 ? a.slice(2) : null
+    else if (a.startsWith('--eof')) eof = a.startsWith('--eof=') ? a.slice(6) : null
+    else if (a === '-l' || a === '--max-lines') maxLines = 1
+    else if (/^-l\d+$/.test(a)) maxLines = Number(a.slice(2))
+    else if (a.startsWith('--max-lines=')) maxLines = Number(a.slice(12))
+    else if (a === '-a') argFile = take() ?? null
+    else if (a.startsWith('--arg-file=')) argFile = a.slice(11)
+    else if (a === '-J') replaceOne = take() ?? null
+    else if (a === '-s' || a === '-S' || a === '-R') take() // size and replacement limits: no effect on what runs
+    else if (/^-[sSR]\d+$/.test(a) || a.startsWith('--max-chars=') || a.startsWith('--process-slot-var=')) continue
+    else if (a === '-x' || a === '--exit' || a === '-o' || a === '--open-tty') continue
+    else return { refuse: `option ${a}` } // -p (prompts), unknown options
+  }
+  if (Number.isNaN(maxArgs) || Number.isNaN(maxLines)) return { refuse: 'a non-numeric count' }
+  const command = args.slice(i).length > 0 ? args.slice(i) : ['echo']
+  return { nul, delim, replace, replaceOne, maxArgs, maxLines, noRunIfEmpty, trace, eof, argFile, command }
+}
+
+/** Emulate xargs. Options it cannot emulate are refused rather than handed to the real xargs. */
+export async function emulateXargs(interp: Interpreter, req: EmulationRequest): Promise<number | null> {
+  const plan = planXargs(req.argv.slice(1))
+  if ('refuse' in plan) return refuse(interp, req, plan.refuse)
+  const { nul, delim, replace, replaceOne, maxArgs, maxLines, noRunIfEmpty, trace, eof, argFile, command } = plan
+  let text: string
+  if (argFile !== null) {
+    try {
+      text = fs.readFileSync(path.resolve(req.proc.state.cwd, argFile), 'utf8')
+    } catch (e) {
+      interp.errorMessage(req.proc, `xargs: ${argFile}: ${(e as NodeJS.ErrnoException).code === 'ENOENT' ? 'No such file or directory' : (e as Error).message}`)
+      return 1
+    }
+  } else {
+    const stdin = req.proc.fds.get(0)
+    text = stdin?.readable ? new TextDecoder().decode(await stdin.readAll()) : ''
+  }
+
+  // build the list of invocations
+  const invocations: string[][] = []
+  if (replace !== null) {
+    const lines = text.split(nul ? '\0' : delim ?? '\n').map((l) => (nul || delim ? l : l.replace(/^[ \t]+/, ''))).filter((l) => l !== '')
+    for (const line of lines) {
+      if (eof !== null && line === eof) break
+      invocations.push(command.map((c) => c.split(replace!).join(line)))
+    }
+  } else {
+    let items: string[]
+    try {
+      items = nul ? text.split('\0').filter((x) => x !== '') : delim !== null ? text.split(delim).filter((x, k, all) => !(k === all.length - 1 && x === '')) : xargsTokens(text)
+    } catch (e) {
+      interp.errorMessage(req.proc, `xargs: ${(e as Error).message}`)
+      return 1
+    }
+    if (eof !== null) {
+      const k = items.indexOf(eof)
+      if (k >= 0) items = items.slice(0, k)
+    }
+    if (maxLines > 0 && !nul && delim === null) {
+      const lines = text.split('\n').filter((l) => l.trim() !== '')
+      for (let k = 0; k < lines.length; k += maxLines) invocations.push([...command, ...xargsTokens(lines.slice(k, k + maxLines).join('\n'))])
+    } else {
+      const batch = maxArgs === Infinity ? 5000 : maxArgs
+      // BSD -J: the items replace the first argument equal to the marker
+      const at = replaceOne === null ? -1 : command.indexOf(replaceOne)
+      const place = (chunk: string[]): string[] => (at === -1 ? [...command, ...chunk] : [...command.slice(0, at), ...chunk, ...command.slice(at + 1)])
+      for (let k = 0; k < items.length; k += batch) invocations.push(place(items.slice(k, k + batch)))
+    }
+    if (items.length === 0 && !noRunIfEmpty) invocations.push(replaceOne === null ? [...command] : command.filter((c) => c !== replaceOne))
+  }
+
+  // run each invocation through the VM with stdin from /dev/null
+  let status = 0
+  const fds = req.proc.fds.clone()
+  fds.set(0, new NullFile(interp.rt.channel('null', '/dev/null'), interp.rt.listeners))
+  const child = req.proc.derive({ fds })
+  try {
+    for (const argv of invocations) {
+      if (trace) await interp.write(child, 2, argv.join(' ') + '\n').catch(() => {})
+      const s = await interp.runArgv(argv, child, req.node, { skipFunctions: true })
+      if (s === 255) return 124
+      if (s === 127 || s === 126) return s
+      if (s > 128) return 125
+      if (s !== 0) status = BSD ? 1 : 123
+    }
+  } finally {
+    fds.closeAll()
+  }
+  return status
+}
+
+const FIND_ACTIONS = new Set(['-exec', '-execdir', '-ok', '-okdir', '-delete'])
+/** Primaries with output or side effects: with one of these besides the action, listing matches would not be equivalent. */
+const FIND_OUTPUTS = new Set(['-print', '-print0', '-printf', '-fprint', '-fprint0', '-fprintf', '-ls', '-fls'])
+
+export type FindPlan =
+  | { kind: 'real' }
+  | { kind: 'refuse'; what: string }
+  | { kind: 'emulate'; action: string; cmd: string[]; batch: boolean; before: string[]; printEach: boolean }
+
+/**
+ * How `find ARGS` is run. The action is emulated when it is the last element
+ * of the expression and the only action: then `find TESTS -print0`, with the
+ * action replaced in place, lists exactly the files it would act on, however
+ * complex the tests before it are (parentheses, `-o`, `-prune`, `-not`).
+ * An action inside parentheses or followed by more expression, several
+ * actions, and the prompting `-ok`/`-okdir` are refused.
+ */
+export function planFind(args: string[]): FindPlan {
+  const actionAt = args.findIndex((a) => FIND_ACTIONS.has(a))
+  if (actionAt === -1) return { kind: 'real' }
+  const action = args[actionAt]
+  // -ok/-okdir prompt for each match: not emulated, and the real find would run them unchecked
+  if (action === '-ok' || action === '-okdir') return { kind: 'refuse', what: action }
+  let cmd: string[] = []
+  let batch = false
+  let end = actionAt + 1
+  if (action === '-exec' || action === '-execdir') {
+    const term = args.findIndex((a, k) => k > actionAt && (a === ';' || a === '+'))
+    // no terminator, or `{}` not last before `+`: the real find reports the usage error without running anything
+    if (term === -1) return { kind: 'real' }
+    cmd = args.slice(actionAt + 1, term)
+    batch = args[term] === '+'
+    if (batch && cmd[cmd.length - 1] !== '{}') return { kind: 'real' }
+    end = term + 1
+  }
+  let before = args.slice(0, actionAt)
+  // `find … -print -delete`: print each match before acting on it
+  const printEach = before[before.length - 1] === '-print'
+  if (printEach) before = before.slice(0, -1)
+  if (end !== args.length) return { kind: 'refuse', what: `${action} followed by more expression (or inside parentheses)` }
+  if (before.some((a) => FIND_OUTPUTS.has(a))) return { kind: 'refuse', what: `${action} together with other output actions` }
+  return { kind: 'emulate', action, cmd, batch, before, printEach }
+}
+
+/**
+ * Emulate `find`'s `-exec`/`-execdir`/`-delete` actions (see {@link planFind}).
+ * Returns null to run the real find unchanged when there is no action.
+ */
+export async function emulateFind(interp: Interpreter, req: EmulationRequest): Promise<number | null> {
+  const plan = planFind(req.argv.slice(1))
+  if (plan.kind === 'real') return null
+  if (plan.kind === 'refuse') return refuse(interp, req, plan.what)
+  const { action, cmd, batch, before, printEach } = plan
+
+  // 1. list matches with the real find (a read-only invocation)
+  const listArgv = [req.argv[0], ...before, ...(action === '-delete' ? ['-depth'] : []), '-print0']
+  const capture = new Capture(interp.rt.channel('capture', `find matches (${listArgv.join(' ')})`, { nodeId: req.node.id }), interp.rt.listeners)
+  const fds = req.proc.fds.clone()
+  fds.set(1, capture.retain())
+  const lister = req.proc.derive({ fds })
+  let findStatus: number
+  try {
+    findStatus = await runExternal(interp, { execId: req.execId, path: req.path, argv: listArgv, env: req.env, cwd: req.proc.state.cwd, proc: lister, readsStdin: false })
+  } finally {
+    fds.closeAll()
+  }
+  const matches = capture.text().split('\0').filter((m) => m !== '')
+  capture.release()
+
+  // 2. run the action per match (or batched for `+`) through the VM
+  let status = findStatus === 0 ? 0 : 1
+  const run = async (argv: string[]): Promise<number> => interp.runArgv(argv, req.proc, req.node, { skipFunctions: true })
+  if (printEach) await interp.write(req.proc, 1, matches.map((m) => m + '\n').join('')).catch(() => {})
+  if (action === '-delete') {
+    for (const m of matches) {
+      if (m === '.' || m === path.resolve(req.proc.state.cwd)) continue
+      const s = await run(['rm', '-df', '--', m])
+      if (s !== 0) status = 1
+    }
+    return status
+  }
+  if (action === '-execdir') {
+    // each command runs in the directory of its match, with {} as ./NAME
+    const groups = new Map<string, string[]>()
+    for (const m of matches) {
+      const dir = path.resolve(req.proc.state.cwd, path.dirname(m))
+      const name = './' + path.basename(m)
+      if (batch) groups.set(dir, [...(groups.get(dir) ?? []), name])
+      else groups.set(`${groups.size}\0${dir}`, [name])
+    }
+    for (const [key, names] of groups) {
+      const dir = key.includes('\0') ? key.slice(key.indexOf('\0') + 1) : key
+      const sub = req.proc.subshell(interp.rt.nextPid())
+      sub.state.cwd = dir
+      const pwd = sub.state.ensure('PWD')
+      if (!pwd.readonly) pwd.value = { kind: 'string', value: dir }
+      try {
+        const argv = batch ? [...cmd.slice(0, -1), ...names] : cmd.map((c) => c.split('{}').join(names[0]))
+        const s = await interp.runArgv(argv, sub, req.node, { skipFunctions: true })
+        if (s !== 0 && batch) status = 1
+      } finally {
+        sub.fds.closeAll()
+      }
+    }
+    return status
+  }
+  if (batch) {
+    for (let k = 0; k < matches.length; k += 5000) {
+      const argv = [...cmd.slice(0, -1), ...matches.slice(k, k + 5000)]
+      if ((await run(argv)) !== 0) status = 1
+    }
+    return status
+  }
+  for (const m of matches) await run(cmd.map((c) => c.split('{}').join(m)))
+  return status
+}
+
+export { FdTable }