fix(test): stream resource fault configuration through stdin

scripts/inbound-plan-resource-fault-runtime.py

@@ -229,6 +229,7 @@ def execute(config):
                 'sourceSha256': source_hash, 'runtimeChanged': False,
                 'upstreamImageId': target['Image'], 'upstreamFingerprint': upstream_fingerprint}
     if action == 'prepare': return runtime.prepare(config)
+    STAGE = 'RUNTIME_STATE_READ'
     state = runtime.load()
     if action == 'status':
         result = runtime.summary(state)
@@ -255,8 +256,8 @@ def execute(config):
 
 
 def main(config):
-    import fcntl
     validate_scope(config['scope'])
+    import fcntl
     file = Path('/tmp') / ('chongchong-inbound-resource-' + config['scope']['marker'] + '.action.lock')
     if file.is_symlink(): raise RuntimeError('UNSAFE_ACTION_LOCK')
     fd = os.open(file, os.O_RDWR | os.O_CREAT, 0o600)
@@ -267,7 +268,16 @@ def main(config):
     finally: os.close(fd)
 
 
+def read_stdin_config(stream=None):
+    """One bounded UTF-8 JSON stdin protocol; configuration is never argv."""
+    global STAGE
+    STAGE = 'READ_STDIN_CONFIG'
+    raw = (sys.stdin.buffer if stream is None else stream).read(1024 * 1024 + 1)
+    if len(raw) > 1024 * 1024: raise RuntimeError('RUNTIME_STDIN_CONFIG_TOO_LARGE')
+    return json.loads(raw.decode('utf-8'))
+
+
 if __name__ == '__main__':
-    try: print('INBOUND_RESOURCE_JSON=' + json.dumps({'ok': True, 'data': main(json.loads(base64.b64decode(sys.argv[1])))}))
+    try: print('INBOUND_RESOURCE_JSON=' + json.dumps({'ok': True, 'data': main(read_stdin_config())}))
     except Exception as error:
         print('INBOUND_RESOURCE_JSON=' + json.dumps(safe_diagnostic(error)))