Fix slice bounds error in Command methods for empty command arrays

- Add empty command handling in both Linux and macOS Command implementations
- Return nil for empty command arrays instead of causing slice bounds panic
- Update test expectation for empty command to expect false (nil command)
- Fixes CI failure on macOS where empty command caused panic in command[0] access
- Consistent behavior across platforms for edge case handling

Author: blink-so[bot]

jail_test.go

@@ -220,7 +220,7 @@ func TestJail_Command(t *testing.T) {
 		{
 			name: "empty command",
 			args: []string{},
-			want: true, // Should still return a command object
+			want: false, // Empty command should return nil or be invalid
 		},
 		{
 			name: "multiple args",

namespace/linux.go

@@ -108,6 +108,12 @@ func (l *Linux) Start() error {
 func (l *Linux) Command(command []string) *exec.Cmd {
 	l.logger.Debug("Command called", "command", command)
 
+	// Handle empty command
+	if len(command) == 0 {
+		l.logger.Debug("Empty command provided, returning nil")
+		return nil // Return nil for empty command
+	}
+
 	// Create command with ip netns exec
 	l.logger.Debug("Creating command with namespace", "namespace", l.namespace)
 	cmdArgs := []string{"ip", "netns", "exec", l.namespace}

namespace/macos.go

@@ -112,6 +112,12 @@ func (m *MacOSNetJail) Start() error {
 func (m *MacOSNetJail) Command(command []string) *exec.Cmd {
 	m.logger.Debug("Command called", "command", command)
 
+	// Handle empty command
+	if len(command) == 0 {
+		m.logger.Debug("Empty command provided, returning nil")
+		return nil // Return nil for empty command
+	}
+
 	// Create command directly (no sg wrapper needed)
 	m.logger.Debug("Creating command with group membership", "groupID", m.restrictedGid)
 	cmd := exec.Command(command[0], command[1:]...)