#!/usr/bin/env bash
# ©AngelaMos | 2026
# exploit-gate.sh

set -uo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

VULNERABLE_IMAGE="ruby:4.0.2-slim"
PATCHED_IMAGE="ruby:4.0.6-slim"

run_probe() {
    local image="$1"
    docker run --rm \
        --network none \
        --read-only \
        --tmpfs /tmp:rw,noexec,nosuid,size=1m \
        --user nobody \
        -e "MATRIX_IMAGE=${image#ruby:}" \
        -v "${HERE}/lib:/app/lib:ro" \
        -v "${HERE}/test/support/exploit_probe.rb:/app/probe.rb:ro" \
        -w /app \
        "${image}" ruby -Ilib /app/probe.rb 2>&1
}

echo "CVE-2026-41316 exploit gate"
echo

vulnerable_output="$(run_probe "${VULNERABLE_IMAGE}")"
vulnerable_status=$?
echo "  ${vulnerable_output}"

patched_output="$(run_probe "${PATCHED_IMAGE}")"
patched_status=$?
echo "  ${patched_output}"

echo
failures=0

if [[ "${vulnerable_output}" == *"outcome=FIRED"* ]]; then
    echo "  PASS   payload executes on the vulnerable image"
else
    echo "  FAIL   payload did not execute on the vulnerable image"
    failures=$((failures + 1))
fi

if [[ "${patched_output}" == *"outcome=BLOCKED"* ]]; then
    echo "  PASS   patched image blocks the same payload"
else
    echo "  FAIL   patched image did not block the payload"
    failures=$((failures + 1))
fi

if [[ ${vulnerable_status} -eq 0 && ${patched_status} -eq 0 ]]; then
    echo "  PASS   observed outcome matched the chain metadata prediction on both"
else
    echo "  FAIL   observed outcome contradicted the chain metadata prediction"
    failures=$((failures + 1))
fi

echo
if [[ ${failures} -eq 0 ]]; then
    echo "GATE PASSED"
    exit 0
fi

echo "GATE FAILED (${failures})"
exit 1