From f0a5ee83084513da21aaf594daedfbe7342b77d4 Mon Sep 17 00:00:00 2001
From: Mykhailo Chalyi <mike@chaliy.name>
Date: Sun, 11 Oct 2026 20:29:45 -0500
Subject: [PATCH] test: add test for parameter expansion with command
 substitution

---
 .../integration/blackbox_security_tests.rs    | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/crates/bashkit/tests/integration/blackbox_security_tests.rs b/crates/bashkit/tests/integration/blackbox_security_tests.rs
index f10c6bf1a..f304d2cb4 100644
--- a/crates/bashkit/tests/integration/blackbox_security_tests.rs
+++ b/crates/bashkit/tests/integration/blackbox_security_tests.rs
@@ -2193,3 +2193,39 @@ mod finding_cond_bare_not_print_overflow {
         );
     }
 }
+
+/// Default value with command substitution ${VAR:-$(cmd)}
+#[tokio::test]
+async fn parameter_expansion_default_with_cmdsubst() {
+    let mut bash = tight_bash();
+
+    // Unset variable - should run command substitution
+    let result = bash
+        .exec(r#"unset VAR; echo ${VAR:-$(echo hello)}"#)
+        .await
+        .unwrap();
+    assert!(result.stdout.contains("hello"));
+
+    // Empty variable - should run command substitution (:- means unset OR empty)
+    let result = bash
+        .exec(r#"VAR=""; echo ${VAR:-$(echo hello)}"#)
+        .await
+        .unwrap();
+    assert!(result.stdout.contains("hello"));
+
+    // Set variable - should NOT run command substitution
+    let result = bash
+        .exec(r#"VAR="value"; echo ${VAR:-$(echo hello)}"#)
+        .await
+        .unwrap();
+    assert!(result.stdout.contains("value"));
+    assert!(!result.stdout.contains("hello"));
+
+    // Also test without colon (:-) - only unset, not empty
+    let result = bash
+        .exec(r#"VAR=""; echo ${VAR-$(echo hello)}"#)
+        .await
+        .unwrap();
+    // Empty is considered set, so should print empty
+    assert!(result.stdout.trim().is_empty() || result.stdout == "\n");
+}