| 79 | it('falls back to PlistBuddy without invoking a shell', async () => { |
| 80 | const calls: CapturedCall[] = []; |
| 81 | const failingExecutor: CommandExecutor = async (command, logPrefix, useShell) => { |
| 82 | calls.push({ command: [...command], logPrefix, useShell }); |
| 83 | if (command[0] === 'defaults') { |
| 84 | return { success: false, output: '', error: 'defaults read failed', process: stubProcess }; |
| 85 | } |
| 86 | return { success: true, output: 'com.example.app', process: stubProcess }; |
| 87 | }; |
| 88 | |
| 89 | const maliciousPath = '/tmp/evil" $(id) "bar'; |
| 90 | const result = await extractBundleIdFromAppPath(maliciousPath, failingExecutor); |