Make a mutating script refuse three ways

short · 55 min · Objective 3.1

Task

Write a script that changes something on a set of targets, then prove it fails closed on an empty target set, an implausibly large one, and an argument it does not understand.

Steps

  1. Write lab/mutate.sh (or the equivalent in your language of choice) that selects targets by a filter and applies a change to each. Make DRY RUN the default, with an explicit flag required to apply.
  2. Add three refusals: exit non-zero on an empty target set, on a target set above a defined cap, and on ANY argument the script does not recognise.
  3. Demonstrate each refusal and capture the output in lab/mutate-refusals.txt, with the exit code printed after each.
  4. Demonstrate the dry run on a real target set and capture it in lab/mutate-dryrun.txt, then apply for real to a small set.
  5. Make it idempotent -- check state before acting -- and prove it by running twice and showing the second run changes nothing.

Verify

sh lab/mutate.sh --nonsense-flag; echo "unknown arg exit=$?"
grep -Ec 'exit=[1-9]' lab/mutate-refusals.txt
grep -Eci 'would change|dry run|no changes applied' lab/mutate-dryrun.txt
sh lab/mutate.sh --apply; sh lab/mutate.sh --apply

Three non-zero exits captured, a dry run that names what it WOULD do, and a second apply that changes nothing. The unknown-argument refusal is the one worth having: an ignored flag means the operator asked for something the script did not do, and the failure is silent, immediate and wide.

Notes

Keep this script as a template. Every later automation in this course should start from it rather than from a blank file -- the safety properties are the part that is forgotten under time pressure.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.