test: pin the array-form behaviour with a real binary at a hostile path

The existing injection test returns false post-fix via Errno::ENOENT rather
than by demonstrating that the named file is executed verbatim, so it would
also pass under a character-allowlist remediation instead of the array form.

Putting the metacharacters in the directory name of a real, executable
script asserts both halves at once: the injected command never runs, and
the legitimate binary at that hostile-looking path still verifies. This is
the same shape as the reproduction that exercises the vulnerability through
$HOME. Verified to fail before the fix on the injection assertion.

Author: 07souravkunda

test/browserstack-local-test.rb

@@ -172,6 +172,31 @@ def test_verify_binary_does_not_interpret_shell_metacharacters_in_path
     File.delete(marker) if marker && File.exist?(marker)
   end
 
+  # Stronger form of the above: a REAL binary living under a hostile-looking
+  # directory name. Pins the array-form behaviour itself rather than just an
+  # ENOENT, so a future "fix" that swapped the array form for a character
+  # allowlist would fail here — the injected command must not run AND the
+  # legitimate binary at that path must still verify.
+  def test_verify_binary_runs_a_real_binary_at_a_path_containing_shell_metacharacters
+    skip 'needs a POSIX shell to stand in for the binary' if Gem.win_platform?
+
+    marker = File.join(Dir.tmpdir, "bs_local_verify_dir_injection_#{Process.pid}")
+    File.delete(marker) if File.exist?(marker)
+
+    base = Dir.mktmpdir('bs_local')
+    dir = File.join(base, "h;touch #{marker};echo BrowserStack Local version 9.9;#")
+    FileUtils.mkdir_p(dir)
+    bin = File.join(dir, 'BrowserStackLocal')
+    File.write(bin, "#!/bin/sh\necho 'BrowserStack Local version 9.9'\n")
+    FileUtils.chmod(0755, bin)
+
+    assert_equal true, BrowserStack::LocalBinary.new(auth_token: 'fake').send(:verify_binary, bin)
+    refute File.exist?(marker), 'shell metacharacters in the binary path were executed'
+  ensure
+    File.delete(marker) if marker && File.exist?(marker)
+    FileUtils.remove_entry(base) if base && File.directory?(base)
+  end
+
   # Same fix, benign side: a legitimate path containing spaces must still verify
   # (the shell used to split it and the check failed for every such user).
   def test_verify_binary_accepts_a_path_containing_spaces