Merge pull request #37 from Progmasoft/fix/child-environment

Withhold secret-looking variables from the processes the runner starts

6 files changed, 106 insertions, 2 deletions

diff --git a/src/Progmasoft/Runner/Options.cpp b/src/Progmasoft/Runner/Options.cpp
index 383ed68d..13cf4be7 100644
--- a/src/Progmasoft/Runner/Options.cpp
+++ b/src/Progmasoft/Runner/Options.cpp
@@ -361,6 +361,17 @@ namespace Progmasoft::Catch3::Runner
                      options.isolate = true;
                      return Status::Ok();
                  }},
+                {"pass-env",
+                 '\0',
+                 Takes::kValue,
+                 "NAME",
+                 "Running",
+                 "give the tests the variable NAME, which they do not get "
+                 "because its name looks like a secret (repeatable)",
+                 [](Options &options, const std::optional<std::string> &value) {
+                     options.passedEnvironment.push_back(*value);
+                     return Status::Ok();
+                 }},
                 {"timeout",
                  '\0',
                  Takes::kValue,
diff --git a/src/Progmasoft/Runner/Options.hpp b/src/Progmasoft/Runner/Options.hpp
index 35e6c302..256f5ac7 100644
--- a/src/Progmasoft/Runner/Options.hpp
+++ b/src/Progmasoft/Runner/Options.hpp
@@ -138,6 +138,8 @@ namespace Progmasoft::Catch3::Runner
         unsigned jobs = 0;
         bool inProcess = false;
         bool isolate = false;
+        /// Variables the tests keep although their names look like secrets.
+        std::vector<std::string> passedEnvironment;
         /// The per-test limit; zero disables it.
         std::chrono::milliseconds timeout{0};
         bool timeoutGiven = false;
diff --git a/src/Progmasoft/Runner/Process.cpp b/src/Progmasoft/Runner/Process.cpp
index c1d01302..85987210 100644
--- a/src/Progmasoft/Runner/Process.cpp
+++ b/src/Progmasoft/Runner/Process.cpp
@@ -1,9 +1,12 @@
 // Copyright (c) 2026 Progmasoft.
 // SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0
 #include <algorithm>
+#include <cctype>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <iterator>
+#include <string_view>
 #include <thread>
 
 #include "Process.hpp"
@@ -39,8 +42,64 @@ extern char **environ;
 
 namespace Progmasoft::Catch3::Runner
 {
+    bool
+    IsSecretVariable(std::string_view name)
+    {
+        std::string upper;
+        upper.reserve(name.size());
+        for (const char character : name)
+        {
+            upper.push_back(character >= 'a' && character <= 'z'
+                                ? static_cast<char>(character - 'a' + 'A')
+                                : character);
+        }
+        constexpr std::string_view kSecretWords[] = {
+            "TOKEN",   "SECRET", "PASSWORD",    "PASSWD",     "CREDENTIAL",
+            "API_KEY", "APIKEY", "PRIVATE_KEY", "ACCESS_KEY",
+        };
+        return std::any_of(std::begin(kSecretWords),
+                           std::end(kSecretWords),
+                           [&](std::string_view word) {
+                               return upper.find(word) != std::string::npos;
+                           });
+    }
+
     namespace
     {
+        /// Whether a variable of this process stays out of a child: a secret
+        /// that the options do not keep. Windows spells names in any case.
+        bool
+        Withheld(std::string_view name, const std::vector<std::string> &kept)
+        {
+            if (!IsSecretVariable(name))
+            {
+                return false;
+            }
+            return std::none_of(
+                kept.begin(),
+                kept.end(),
+                [&](const std::string &keptName) {
+                    if (keptName.size() != name.size())
+                    {
+                        return false;
+                    }
+#if defined(_WIN32)
+                    return std::equal(
+                        keptName.begin(),
+                        keptName.end(),
+                        name.begin(),
+                        [](char left, char right) {
+                            return std::toupper(
+                                       static_cast<unsigned char>(left))
+                                   == std::toupper(
+                                       static_cast<unsigned char>(right));
+                        });
+#else
+                    return keptName == name;
+#endif
+                });
+        }
+
 #if defined(_WIN32)
         HANDLE
         AsHandle(std::intptr_t value) noexcept
@@ -175,7 +234,8 @@ namespace Progmasoft::Catch3::Runner
 
         std::wstring
         EnvironmentBlock(
-            const std::vector<std::pair<std::string, std::string>> &additions)
+            const std::vector<std::pair<std::string, std::string>> &additions,
+            const std::vector<std::string> &kept)
         {
             std::vector<std::wstring> entries;
             wchar_t *current = GetEnvironmentStringsW();
@@ -184,6 +244,13 @@ namespace Progmasoft::Catch3::Runner
                 for (const wchar_t *entry = current; *entry != L'\0';
                      entry += wcslen(entry) + 1)
                 {
+                    // A leading '=' marks the hidden per-drive variables.
+                    const std::wstring_view text{ entry };
+                    const auto equals = text.find(L'=', 1);
+                    if (Withheld(Narrow(text.substr(0, equals)), kept))
+                    {
+                        continue;
+                    }
                     entries.emplace_back(entry);
                 }
                 FreeEnvironmentStringsW(current);
@@ -215,6 +282,12 @@ namespace Progmasoft::Catch3::Runner
                 block += entry;
                 block.push_back(L'\0');
             }
+            // A block ends in an empty entry; one without variables is two
+            // terminators.
+            if (entries.empty())
+            {
+                block.push_back(L'\0');
+            }
             block.push_back(L'\0');
             return block;
         }
@@ -634,7 +707,8 @@ namespace Progmasoft::Catch3::Runner
             }
             AppendQuotedArgument(commandLine, Widen(options.arguments[index]));
         }
-        std::wstring environment = EnvironmentBlock(options.environment);
+        std::wstring environment
+            = EnvironmentBlock(options.environment, options.keptEnvironment);
         const std::wstring directory = options.workingDirectory.wstring();
 
         PROCESS_INFORMATION information{};
@@ -957,6 +1031,12 @@ namespace Progmasoft::Catch3::Runner
              entry != nullptr && *entry != nullptr;
              ++entry)
         {
+            const std::string_view text{ *entry };
+            if (Withheld(text.substr(0, text.find('=')),
+                         options.keptEnvironment))
+            {
+                continue;
+            }
             environmentStorage.emplace_back(*entry);
         }
         for (const auto &[name, value] : options.environment)
diff --git a/src/Progmasoft/Runner/Process.hpp b/src/Progmasoft/Runner/Process.hpp
index 733bdbf7..3e0a1dd2 100644
--- a/src/Progmasoft/Runner/Process.hpp
+++ b/src/Progmasoft/Runner/Process.hpp
@@ -121,6 +121,9 @@ namespace Progmasoft::Catch3::Runner
         std::vector<std::string> arguments;
         /// Variables added to, or replacing, those of this process.
         std::vector<std::pair<std::string, std::string>> environment;
+        /// Variables of this process the child keeps although their names
+        /// look like secrets; see `IsSecretVariable`.
+        std::vector<std::string> keptEnvironment;
         /// The working directory; empty keeps the current one.
         std::filesystem::path workingDirectory;
         bool searchPath = false;
@@ -230,6 +233,12 @@ namespace Progmasoft::Catch3::Runner
     [[nodiscard]] unsigned
     HardwareThreads() noexcept;
 
+    /// Whether a variable of this name holds a secret that a child does not
+    /// inherit: its name contains, in any case, TOKEN, SECRET, PASSWORD,
+    /// PASSWD, CREDENTIAL, API_KEY, APIKEY, PRIVATE_KEY or ACCESS_KEY.
+    [[nodiscard]] bool
+    IsSecretVariable(std::string_view name);
+
     /// The value of an environment variable; empty when it is not set.
     [[nodiscard]] std::string
     ReadEnvironment(const char *name);
diff --git a/src/Progmasoft/Runner/ProjectConfig.cpp b/src/Progmasoft/Runner/ProjectConfig.cpp
index e382b5c5..7a466f34 100644
--- a/src/Progmasoft/Runner/ProjectConfig.cpp
+++ b/src/Progmasoft/Runner/ProjectConfig.cpp
@@ -68,6 +68,7 @@ namespace Progmasoft::Catch3::Runner
                 { "jobs", ValueKind::kCount },
                 { "in-process", ValueKind::kFlag },
                 { "isolate", ValueKind::kFlag },
+                { "pass-env", ValueKind::kWords },
                 { "timeout", ValueKind::kNumber },
                 { "adaptive-timeout",
                   ValueKind::kNegated,
diff --git a/src/Progmasoft/Runner/Scheduler.cpp b/src/Progmasoft/Runner/Scheduler.cpp
index 4637a851..56a2aa36 100644
--- a/src/Progmasoft/Runner/Scheduler.cpp
+++ b/src/Progmasoft/Runner/Scheduler.cpp
@@ -994,6 +994,7 @@ namespace Progmasoft::Catch3::Runner
                 const std::size_t id = ++workersStarted_;
                 child.environment.emplace_back("CATCH3_WORKER",
                                                std::to_string(id));
+                child.keptEnvironment = options_.passedEnvironment;
                 auto process = ChildProcess::Start(child);
                 if (!process)
                 {