basic sandbox

jqlang · Aug 25, 2024 · c57f385 · c57f385
1 parent ba3c7e6
commit c57f385
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/src/builtin.c b/src/builtin.c
@@ -1351,9 +1351,15 @@ static jv f_output(jq_state *jq, jv input, jv filename, jv data) {
     return ret_error(filename, jv_string("filename must be a string"));
 
   const char *name_str = jv_string_value(filename);
-  int sandbox = 0; // TODO: --sandbox
+  int sandbox = 1;
+  {
+    // TODO: replace this when --sandbox is implemented
+    const char *disable_sandbox = getenv("JQ_DISABLE_SANDBOX");
+    if (disable_sandbox && *disable_sandbox)
+      sandbox = 0;
+  }
   if (sandbox) {
-    fprintf(stderr, "jq: dry run: %s\n", name_str);
+    fprintf(stderr, "jq: dry run: %s (set JQ_DISABLE_SANDBOX=1)\n", name_str);
   } else {
     FILE *fp = fopen(name_str, "wb");
     if (!fp) {

diff --git a/tests/shtest b/tests/shtest
@@ -278,7 +278,7 @@ grep "Expected string key after ',' in object, not '\\['" $d/err > /dev/null
 ## Test IO
 
 # output
-cat <<EOF | (cd $d; $VALGRIND $Q $JQ -r 'to_entries[] | _experimental_output(.key;.value) | .key' >keys)
+cat <<EOF | (cd $d; JQ_DISABLE_SANDBOX=1 $VALGRIND $Q $JQ -r 'to_entries[] | _experimental_output(.key;.value) | .key' >keys)
 {
   "a.txt": "aaa",
   "b/b.json": "invalid",