Merge pull request #50 from AI45Lab/fix/box-exec-arg-b64

fix(box): base64-encode exec args/env so quotes survive libkrun env passing

Author: ZhiXiao-Lin

src/guest/init/src/main.rs

@@ -247,31 +247,59 @@ impl ExecConfig {
         // (runtime/src/vm/spec.rs), so this default is only a defensive fallback.
         // Use /bin/sh — universal across distros — never /sbin/init, which does
         // not exist on Alpine and was the original cause of issue #3.
-        let executable = std::env::var("BOX_EXEC_EXEC").unwrap_or_else(|_| "/bin/sh".to_string());
+        // BOX_EXEC_* values are base64-encoded (URL-safe, no pad) by the runtime
+        // when BOX_EXEC_B64=1, so arbitrary bytes (quotes, spaces, `$`, …) survive
+        // libkrun's env serialization. Decode them back; fall back to the raw value
+        // on any decode error or when the marker is absent (older runtime).
+        use base64::Engine;
+        let b64 = std::env::var("BOX_EXEC_B64")
+            .map(|v| v == "1")
+            .unwrap_or(false);
+        let decode = |s: String| -> String {
+            if !b64 {
+                return s;
+            }
+            base64::engine::general_purpose::URL_SAFE_NO_PAD
+                .decode(s.as_bytes())
+                .ok()
+                .and_then(|bytes| String::from_utf8(bytes).ok())
+                .unwrap_or(s)
+        };
+
+        let executable = std::env::var("BOX_EXEC_EXEC")
+            .map(&decode)
+            .unwrap_or_else(|_| "/bin/sh".to_string());
 
         // Parse args from individual env vars (BOX_EXEC_ARGC + BOX_EXEC_ARG_0..N)
         let args: Vec<String> = match std::env::var("BOX_EXEC_ARGC")
             .ok()
             .and_then(|s| s.parse::<usize>().ok())
         {
             Some(argc) => (0..argc)
-                .filter_map(|i| std::env::var(format!("BOX_EXEC_ARG_{}", i)).ok())
+                .filter_map(|i| {
+                    std::env::var(format!("BOX_EXEC_ARG_{}", i))
+                        .ok()
+                        .map(&decode)
+                })
                 .collect(),
             None => vec![],
         };
 
-        let workdir = std::env::var("BOX_EXEC_WORKDIR").unwrap_or_else(|_| "/".to_string());
+        let workdir = std::env::var("BOX_EXEC_WORKDIR")
+            .map(&decode)
+            .unwrap_or_else(|_| "/".to_string());
 
         // Optional container user (image USER directive or CLI --user).
         let user = std::env::var("BOX_EXEC_USER")
             .ok()
+            .map(&decode)
             .filter(|u| !u.is_empty());
 
-        // Collect BOX_EXEC_ENV_* variables
+        // Collect BOX_EXEC_ENV_* variables (values decoded as above).
         let env: Vec<(String, String)> = std::env::vars()
             .filter_map(|(key, value)| {
                 key.strip_prefix("BOX_EXEC_ENV_")
-                    .map(|stripped| (stripped.to_string(), value))
+                    .map(|stripped| (stripped.to_string(), decode(value)))
             })
             .collect();
 

src/runtime/src/vm/spec.rs

@@ -134,14 +134,20 @@ impl VmManager {
             };
             a3s_box_core::env::merge_env_pairs(&mut container_env, &self.config.extra_env);
 
-            // Pass exec + args as individual env vars (avoids spaces being truncated
-            // by libkrun's env serialization).
+            // Pass exec + args as individual env vars, base64-encoded (URL-safe, no
+            // padding) so arbitrary bytes — spaces, quotes, `$`, `;` — survive
+            // libkrun's env serialization intact (a raw `"` in a value was being
+            // corrupted). `BOX_EXEC_B64=1` tells guest-init to decode them.
+            use base64::Engine;
+            let b64 =
+                |s: &str| base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(s.as_bytes());
             let mut env: Vec<(String, String)> = vec![
-                ("BOX_EXEC_EXEC".to_string(), exec),
+                ("BOX_EXEC_B64".to_string(), "1".to_string()),
+                ("BOX_EXEC_EXEC".to_string(), b64(&exec)),
                 ("BOX_EXEC_ARGC".to_string(), args.len().to_string()),
             ];
             for (i, arg) in args.iter().enumerate() {
-                env.push((format!("BOX_EXEC_ARG_{}", i), arg.clone()));
+                env.push((format!("BOX_EXEC_ARG_{}", i), b64(arg)));
             }
 
             // Prototype: deferred-main-spawn. If the host set BOX_DEFERRED_MAIN=1,
@@ -157,20 +163,23 @@ impl VmManager {
 
             // Pass the effective working directory to guest init so PID 1 and
             // the container entrypoint agree even when no OCI WORKDIR is set.
-            env.push(("BOX_EXEC_WORKDIR".to_string(), workdir.clone()));
+            env.push(("BOX_EXEC_WORKDIR".to_string(), b64(&workdir)));
 
             // Pass the container user (image USER / --user) to guest init, which
             // applies it (setgroups+setgid+setuid) to the MAIN process right
             // before exec — after PID 1 has done its root-only setup. This must
             // NOT go through the shim's libkrun set_uid, which would drop guest
             // PID 1 to the user and break init (mount/chroot need root).
             if let Some(user) = &user {
-                env.push(("BOX_EXEC_USER".to_string(), user.clone()));
+                env.push(("BOX_EXEC_USER".to_string(), b64(user)));
             }
 
-            // Pass container environment variables with BOX_EXEC_ENV_ prefix
+            // Pass container environment variables with BOX_EXEC_ENV_ prefix (values
+            // base64-encoded like the rest, so a value containing `"`/spaces/etc.
+            // reaches the container intact). The key stays raw — env names are
+            // restricted to a safe character set.
             for (key, value) in container_env {
-                env.push((format!("BOX_EXEC_ENV_{}", key), value));
+                env.push((format!("BOX_EXEC_ENV_{}", key), b64(&value)));
             }
 
             // Pass user volume mounts to guest init for mounting inside the VM.
@@ -747,6 +756,17 @@ mod tests {
     use tempfile::tempdir;
     use tempfile::TempDir;
 
+    /// Decode a base64 (URL-safe, no pad) `BOX_EXEC_*` value the way guest-init
+    /// does, so assertions can compare against the original raw value.
+    fn b64d(s: &str) -> String {
+        use base64::Engine;
+        base64::engine::general_purpose::URL_SAFE_NO_PAD
+            .decode(s.as_bytes())
+            .ok()
+            .and_then(|bytes| String::from_utf8(bytes).ok())
+            .unwrap_or_else(|| s.to_string())
+    }
+
     fn test_oci_config(workdir: Option<&str>, user: Option<&str>) -> OciImageConfig {
         OciImageConfig {
             entrypoint: Some(vec!["/bin/app".to_string()]),
@@ -1065,12 +1085,12 @@ mod tests {
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_USER" && value == "1000:1000"));
+            .any(|(key, value)| key == "BOX_EXEC_USER" && b64d(value) == "1000:1000"));
         assert!(spec
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_WORKDIR" && value == "/override"));
+            .any(|(key, value)| key == "BOX_EXEC_WORKDIR" && b64d(value) == "/override"));
     }
 
     #[test]
@@ -1117,12 +1137,12 @@ mod tests {
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_USER" && value == "2000:2000"));
+            .any(|(key, value)| key == "BOX_EXEC_USER" && b64d(value) == "2000:2000"));
         assert!(spec
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_WORKDIR" && value == "/oci"));
+            .any(|(key, value)| key == "BOX_EXEC_WORKDIR" && b64d(value) == "/oci"));
     }
 
     #[test]
@@ -1138,7 +1158,7 @@ mod tests {
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_WORKDIR" && value == GUEST_WORKDIR));
+            .any(|(key, value)| key == "BOX_EXEC_WORKDIR" && b64d(value) == GUEST_WORKDIR));
     }
 
     #[test]
@@ -1182,17 +1202,17 @@ mod tests {
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_ENV_FOO" && value == "cli"));
+            .any(|(key, value)| key == "BOX_EXEC_ENV_FOO" && b64d(value) == "cli"));
         assert!(spec
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_ENV_BAR" && value == "image"));
+            .any(|(key, value)| key == "BOX_EXEC_ENV_BAR" && b64d(value) == "image"));
         assert!(spec
             .entrypoint
             .env
             .iter()
-            .any(|(key, value)| key == "BOX_EXEC_ENV_BAZ" && value == "cli"));
+            .any(|(key, value)| key == "BOX_EXEC_ENV_BAZ" && b64d(value) == "cli"));
         assert!(!spec
             .entrypoint
             .env