/ 
Rex-1.16.1
⭐ Starred 717 / Rex::Test::Base
Security Advisories (1)
CVE-2026-94140 (2026-10-21)

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. The ssh options a caller sets through set_openssh_opt reach the OpenSSH transport but not this command, so there is no configuration that restores host key checking for the transfer. An attacker who can redirect the connection before the real host key is known presents their own and the transfer proceeds: under password authentication sync sends the connection password to that server, an upload writes the selected local files to it, and a download writes what it returns to the local destination.

NAME

Rex::Test::Base - Basic Test Module

DESCRIPTION

This is a basic test module to test your code with the help of local VMs. You can place your tests in the "t" directory.

EXAMPLE

use Rex::Test::Base;
use Data::Dumper;
use Rex -base;

test {
  my $t = shift;

  $t->name("ubuntu test");

  $t->base_vm("http://box.rexify.org/box/ubuntu-server-12.10-amd64.ova");
  $t->vm_auth(user => "root", password => "box");

  $t->run_task("setup");

  $t->has_package("vim");
  $t->has_package("ntp");
  $t->has_package("unzip");

  $t->has_file("/etc/ntp.conf");

  $t->has_service_running("ntp");

  $t->has_content("/etc/passwd", qr{root:x:0:}ms);

  run "ls -l";
  $t->ok($? == 0, "ls -l returns success.");

  $t->finish;
};

1; # last line

METHODS

new(name => $test_name)

Constructor if used in OO mode.

my $test = Rex::Test::Base->new(name => "test_name");

name($name)

The name of the test. A VM called $name will be created for each test. If the VM already exists, Rex will try to reuse it.

memory($amount)

The amount of memory the VM should use, in Megabytes.

cpus($number)

The number of CPUs the VM should use.

vm_auth(%auth)

Authentication options for the VM. It accepts the same parameters as Rex::Box::Base->auth().

base_vm($vm)

The URL to a base image to be used for the test VM.

redirect_port($port)

Redirect local $port to the VM's SSH port (default: 2222).

run_task($task)

The task to run on the test VM. You can run multiple tasks by passing an array reference.

TEST METHODS

has_content($file, $regexp)

Test if the content of $file matches against $regexp.

has_dir($path)

Test if $path is present and is a directory.

has_file($file)

Test if $file is present.

has_package($package, $version)

Test if $package is installed, optionally at $version.

has_service_running($service)

Test if $service is running.

has_service_stopped($service)

Test if $service is stopped.

has_stat($file, $stat)

Test if $file has properties described in hash reference $stat. List of supported checks:

group
owner