security: use safe temp directory in std usage example

examples/std-usage.sh

@@ -11,8 +11,9 @@ base_init app_args --source "${BASH_SOURCE[0]}" -- "$@"
 
 base_std_import file/lib_file.sh
 
-example_file="${TMPDIR:-/tmp}/base-bash-libs-example.$$"
-trap 'rm -f "$example_file"' EXIT
+example_dir=""
+base_std_make_temp_dir example_dir base-bash-libs-example || exit $?
+example_file="$example_dir/example"
 
 printf 'example\n' > "$example_file"
 base_file_update_file_section "$example_file" "# BEGIN base-bash-libs" "# END base-bash-libs" "managed=true"

tests/examples.bats

@@ -0,0 +1,39 @@
+#!/usr/bin/env bats
+
+load ../lib/bash/tests/test_helper.sh
+
+setup() {
+    setup_test_tmpdir
+}
+
+@test "std usage example does not follow a predictable temp-file symlink" {
+    local wrapper="$TEST_TMPDIR/run-std-usage.sh"
+    local target="$TEST_TMPDIR/protected-target"
+    local temp_root="$TEST_TMPDIR/temp-root"
+    local predictable_prefix="$temp_root/base-bash-libs-example."
+    local predictable_path_file="$TEST_TMPDIR/predictable-path"
+    local predictable_path
+    local created_path
+
+    mkdir -p "$temp_root"
+    cat > "$wrapper" <<EOF
+#!/usr/bin/env bash
+target="$target"
+predictable_path="$predictable_prefix\$\$"
+printf 'original\\n' > "\$target"
+ln -s "\$target" "\$predictable_path"
+printf '%s\\n' "\$predictable_path" > "$predictable_path_file"
+TMPDIR="$temp_root" exec "$BASE_REPO_ROOT/examples/std-usage.sh"
+EOF
+    chmod +x "$wrapper"
+
+    bats_run bash "$wrapper"
+
+    [ "$status" -eq 0 ]
+    [ "$(<"$target")" = original ]
+    predictable_path="$(<"$predictable_path_file")"
+    [ -L "$predictable_path" ]
+    created_path="$(printf '%s\n' "$output" | sed -n 's/^example_file=//p')"
+    [ -n "$created_path" ]
+    [ ! -e "$created_path" ]
+}

tests/lint-warnings.sh

@@ -41,6 +41,7 @@ lint_files=(
     examples/std-usage.sh
     examples/cookbook-cleanup-temp.sh
     examples/cookbook-args-lists-strings.sh
+    tests/examples.bats
     lib/bash/std/lib_std.sh
     lib/bash/file/lib_file.sh
     lib/bash/git/lib_git.sh

tests/validate.sh

@@ -64,6 +64,7 @@ required_files=(
     examples/std-usage.sh
     examples/cookbook-cleanup-temp.sh
     examples/cookbook-args-lists-strings.sh
+    tests/examples.bats
     tests/release.bats
     tests/namespace-contract.bats
     tests/api-manifest.bats
@@ -417,6 +418,7 @@ run_stage "ShellCheck error profile" shellcheck --severity=error \
     examples/std-usage.sh \
     examples/cookbook-cleanup-temp.sh \
     examples/cookbook-args-lists-strings.sh \
+    tests/examples.bats \
     lib/bash/tests/test_helper.sh \
     "${manifest_shellcheck_paths[@]}" \
     tests/release.bats \
@@ -451,6 +453,7 @@ bats_files=(
     tests/library-bundle.bats
     tests/vendor.bats
     tests/integrations.bats
+    tests/examples.bats
     tests/reference-apps.bats
     tests/first-party-cutover.bats
 )