admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

sandbox: sandbox all taps by default.

Browse Source 
We've been doing this in `brew test-bot`, for our CI and for
homebrew/core long enough that this is a reasonable default that
provides more protection to our users of non-homebrew/core taps.
This commit is contained in:
Mike McQuaid 2017-07-14 17:00:06 +01:00
parent 4ca2efb12d
commit fb310c57b1
2 changed files with 3 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Library/Homebrew/sandbox.rb
View File

@ -3,18 +3,14 @@ require "tempfile"
class Sandbox class Sandbox
SANDBOX_EXEC = "/usr/bin/sandbox-exec".freeze SANDBOX_EXEC = "/usr/bin/sandbox-exec".freeze
SANDBOXED_TAPS = %w[
homebrew/core
].freeze
def self.available? def self.available?
OS.mac? && OS::Mac.version >= "10.6" && File.executable?(SANDBOX_EXEC) OS.mac? && OS::Mac.version >= "10.6" && File.executable?(SANDBOX_EXEC)
end end
def self.formula?(formula) def self.formula?(_formula)
return false unless available? return false unless available?
return false if ARGV.no_sandbox? !ARGV.no_sandbox?
ARGV.sandbox? || SANDBOXED_TAPS.include?(formula.tap.to_s)
end end
def self.test? def self.test?

10
Library/Homebrew/test/sandbox_spec.rb
View File

@ -12,15 +12,7 @@ describe Sandbox do
specify "#formula?" do specify "#formula?" do
f = formula { url "foo-1.0" } f = formula { url "foo-1.0" }
f2 = formula { url "bar-1.0" } expect(described_class).to be_formula(f), "Formulae should be sandboxed."
allow(f2).to receive(:tap).and_return(Tap.fetch("test/tap"))
ENV["HOMEBREW_SANDBOX"] = "1"
expect(described_class).to be_formula(f), "Formulae should be sandboxed if --sandbox was passed."
ENV.delete("HOMEBREW_SANDBOX")
expect(described_class).to be_formula(f), "Formulae should be sandboxed if in a sandboxed tap."
expect(described_class).not_to be_formula(f2), "Formulae should not be sandboxed if not in a sandboxed tap."
end end
specify "#test?" do specify "#test?" do