cocaine 0.5.2 → 0.5.3

data/README.md

@@ -34,7 +34,7 @@ line = Cocaine::CommandLine.new("cat", ":file")
 line.command(:file => "ohyeah?'`rm -rf /`.ha!") # => "cat 'ohyeah?'\\''`rm -rf /`.ha!'"
 ```
 
-NOTE: It only does that for arguments interpolated via `run`, NOT argumnets
+NOTE: It only does that for arguments interpolated via `run`, NOT arguments
 passed into `new` (see 'Security' below):
 
 ```ruby

data/lib/cocaine/command_line.rb

@@ -122,11 +122,21 @@ module Cocaine
     end
 
     def interpolate(pattern, interpolations)
-      interpolations.inject(pattern) do |command_string, (key, value)|
-        command_string.gsub(/:\{?#{key}\}?/) { shell_quote(value) }
+      interpolations = stringify_keys(interpolations)
+      pattern.gsub(/:\{?(\w+)\b\}?/) do |match|
+        key = match.tr(":{}", "")
+        interpolations.key?(key) ? shell_quote(interpolations[key]) : match
       end
     end
 
+    def stringify_keys(hash)
+      hash = hash.dup
+      hash.keys.each do |key|
+        hash[key.to_s] = hash.delete(key)
+      end
+      hash
+    end
+
     def shell_quote(string)
       return "" if string.nil?
       if unix?

data/lib/cocaine/version.rb

@@ -1,5 +1,5 @@
 # coding: UTF-8
 
 module Cocaine
-  VERSION = "0.5.2".freeze
+  VERSION = "0.5.3".freeze
 end

data/spec/cocaine/command_line_spec.rb

@@ -64,6 +64,15 @@ describe Cocaine::CommandLine do
     command_string.should == "convert 'a.jpg' 'b.png'"
   end
 
+  it 'does not over-interpolate in a command line' do
+    cmd = Cocaine::CommandLine.new("convert",
+                                   ":hell :{two} :hello",
+                                   :swallow_stderr => false)
+
+    command_string = cmd.command(:hell => "a.jpg", :two => "b.png", :hello => "c.tiff")
+    command_string.should == "convert 'a.jpg' 'b.png' 'c.tiff'"
+  end
+
   it "interpolates when running a command" do
     command = Cocaine::CommandLine.new("echo", ":hello_world")
     command.run(:hello_world => "Hello, world").should match(/Hello, world/)
@@ -95,6 +104,11 @@ describe Cocaine::CommandLine do
     command_string.should == "convert '`rm -rf`.jpg' 'ha'\\''ha.png'"
   end
 
+  it 'cannot recursively introduce a place where user-supplied commands can run' do
+    cmd = Cocaine::CommandLine.new('convert', ':foo :bar')
+    cmd.command(:foo => ':bar', :bar => '`rm -rf`').should == 'convert \':bar\' \'`rm -rf`\''
+  end
+
   it "can quote and interpolate dangerous variables even on windows" do
     on_windows!
     cmd = Cocaine::CommandLine.new("convert",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cocaine
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.5.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-09-27 00:00:00.000000000 Z
+date: 2013-10-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control