browserstack-local 1.5.0 → 1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6cc02b00944100bc4c6548ee133ad288a6c96271342c358f1c76398bad4087c
-  data.tar.gz: 128f9be2ca356f0efff2cf5fa9e9d92d7a2e68da5430b8329c5251ee5f2b30d6
+  metadata.gz: e32e052d39ddb27d0c6d4e65796a8d7155896124874e6b98cb7a187f8ac2580b
+  data.tar.gz: a3708dc83e2be4f34aa09efb80a3a7a414449fecef23f19d2cf58db933f114fb
 SHA512:
-  metadata.gz: 8c014452cb36ae15b6f3e2b1e3e722fa0f2b4d0fdfbaff6a8c22960072765e30942fa32a754654e7132ddc68fb6c8339adc3d6bc4ab5e41574144ef266b6ffac
-  data.tar.gz: e6b001e4caeab902ea85c7d0c5cf0ef2f455aee7ce3b36e864b251dc43ec05dee957e44eda2e4f4592d3be464c328bfd60eff7d001c15190e6aab1920ceb2cf6
+  metadata.gz: dfc70f0d1c49f0aeda327cd85bb6ebdd2e920c3757cfea81098a35b1c28925d7b2c621c2b7bb630d781f9a80b8bc003feccb675958594a97b66c50e79842c76a
+  data.tar.gz: 21b7f15d270f6163aa930f424831f5b286ad36560416cfe602ac559c4e13ee62177824e52680aaa94f19f7c70ed0132fd13fa980e999a29da6c2ba87351cc41c

data/lib/browserstack/local.rb

@@ -1,6 +1,7 @@
 require 'browserstack/localbinary'
 require 'browserstack/localexception'
 require 'json'
+require 'fileutils'
 
 module BrowserStack
 
@@ -73,10 +74,16 @@ class Local
         @binary_path
       end
     
-    if @is_windows
-      system("echo > #{@logfile}")
-    else
-      system("echo '' > '#{@logfile}'")
+    # Create/truncate the logfile without a shell. The previous
+    # `system("echo ... > #{@logfile}")` passed @logfile to /bin/sh (or cmd.exe),
+    # so shell metacharacters in a caller-supplied logfile path executed as commands
+    # (CWE-78). File.write treats the path purely as a filename.
+    logfile_dir = File.dirname(@logfile)
+    FileUtils.mkdir_p(logfile_dir) unless File.directory?(logfile_dir)
+    begin
+      File.write(@logfile, "")
+    rescue SystemCallError => e
+      raise BrowserStack::LocalException.new("Unable to open logfile: #{e.message}")
     end
 
     if defined? spawn
@@ -121,12 +128,27 @@ class Local
     @pid = nil
   end
 
+  # Public accessor used by callers for debugging/logging. Return the command
+  # with the access key masked so it is never written to logs, CI artifacts or
+  # error trackers (CWE-312). The real key is still used for execution via
+  # start_command_args / start_command(false).
   def command
-    start_command
+    start_command(true)
+  end
+
+  # Prevent Ruby's default #inspect from dumping @key when a Local instance is
+  # logged or included in an exception payload (CWE-312).
+  def inspect
+    redacted = instance_variables.map do |var|
+      value = var == :@key && !@key.to_s.empty? ? "[REDACTED]" : instance_variable_get(var)
+      "#{var}=#{value.inspect}"
+    end.join(", ")
+    "#<#{self.class}:0x#{format('%016x', object_id << 1)} #{redacted}>"
   end
 
-  def start_command
-    cmd = "#{@binary_path} -d start -logFile '#{@logfile}' #{@folder_flag} #{@key} #{@folder_path} #{@force_local_flag}"
+  def start_command(redact = false)
+    key = redact && !@key.to_s.empty? ? "[REDACTED]" : @key
+    cmd = "#{@binary_path} -d start -logFile '#{@logfile}' #{@folder_flag} #{key} #{@folder_path} #{@force_local_flag}"
     cmd += " -localIdentifier #{@local_identifier_flag}" if @local_identifier_flag
     cmd += " #{@only_flag} #{@only_automate_flag}"
     cmd += " -proxyHost #{@proxy_host}" if @proxy_host

data/lib/browserstack/localbinary.rb

@@ -133,7 +133,14 @@ class LocalBinary
   end
 
   def verify_binary(bin_path)
-    binary_response = IO.popen(bin_path + " --version").readline
+    # Array form: exec's the binary directly, so a path containing shell
+    # metacharacters or spaces is never interpreted by /bin/sh (CWE-78).
+    #
+    # The scanner rule below fires on any non-static first argument to IO.popen
+    # and does not model the array form -- which is exactly the fix here, since
+    # no shell is spawned at all. Suppressed for this rule only.
+    # nosemgrep: ruby.lang.security.dangerous-exec.dangerous-exec
+    binary_response = IO.popen([bin_path, '--version']).readline
     !!(binary_response =~ /BrowserStack Local version \d+\.\d+/)
   rescue StandardError
     false

data/lib/browserstack/version.rb

@@ -1,3 +1,3 @@
 module BrowserStack
-  VERSION = '1.5.0'.freeze
+  VERSION = '1.5.1'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: browserstack-local
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.5.1
 platform: ruby
 authors:
 - BrowserStack