fastlane 2.238.0 → 2.241.0

data/produce/lib/produce/service.rb

@@ -88,7 +88,6 @@ module Produce
     end
 
     # rubocop:disable Metrics/PerceivedComplexity
-    # rubocop:disable Require/MissingRequireStatement
     def update(on, options)
       updated = valid_services_for(options).count
 
@@ -420,10 +419,9 @@ module Produce
 
     def bundle_id
       return @bundle_id if @bundle_id
-      UI.message("Starting login with user '#{Produce.config[:username]}'")
-      Spaceship.login(Produce.config[:username], nil)
-      Spaceship.select_team
-      UI.message("Successfully logged in")
+
+      Produce.authenticate_connect_api!
+
       @bundle_id ||= Spaceship::ConnectAPI::BundleId.find(Produce.config[:app_identifier].to_s)
     end
   end

data/produce/lib/produce.rb

@@ -2,5 +2,4 @@ require_relative 'produce/manager'
 require_relative 'produce/options'
 require_relative 'produce/developer_center'
 require_relative 'produce/itunes_connect'
-require_relative 'produce/available_default_languages'
 require_relative 'produce/module'

data/scan/lib/scan/options.rb

@@ -207,6 +207,13 @@ module Scan
                                      conflict_block: proc do |value|
                                        UI.user_error!("You can't use 'thread_sanitizer' and 'address_sanitizer' options in one run")
                                      end),
+        FastlaneCore::ConfigItem.new(key: :collect_test_diagnostics,
+                                     env_name: "SCAN_COLLECT_TEST_DIAGNOSTICS",
+                                     description: "Whether verbose and long-running diagnostics (like sysdiagnoses or log archives) are collected when testing. Valid values are: on-failure or never. If not specified, the value in the test plan is used. Equivalent to -collect-test-diagnostics (Xcode 14 and up)",
+                                     optional: true,
+                                     verify_block: proc do |value|
+                                       UI.user_error!("Invalid collect_test_diagnostics #{value}") unless ['on-failure', 'never'].include?(value)
+                                     end),
 
         # output
         FastlaneCore::ConfigItem.new(key: :open_report,
@@ -527,6 +534,11 @@ module Scan
                                      description: "Skips resolution of Swift Package Manager dependencies",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :disallow_xcodebuild_settings_lookup,
+                                     env_name: "SCAN_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP",
+                                     description: "Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually",
+                                     type: Boolean,
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :disable_package_automatic_updates,
                                      env_name: "SCAN_DISABLE_PACKAGE_AUTOMATIC_UPDATES",
                                      description: "Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild",

data/scan/lib/scan/runner.rb

@@ -327,7 +327,7 @@ module Scan
 
     def open_report
       if !Helper.ci? && Scan.cache[:open_html_report_path]
-        `open --hide '#{Scan.cache[:open_html_report_path]}'`
+        system("open", "--hide", Scan.cache[:open_html_report_path])
       end
     end
 

data/scan/lib/scan/test_command_generator.rb

@@ -44,9 +44,9 @@ module Scan
 
       options = []
       options += project_path_array unless config[:xctestrun]
-      options << "-sdk '#{config[:sdk]}'" if config[:sdk]
+      options << "-sdk #{config[:sdk].shellescape}" if config[:sdk]
       options << destination if destination # generated in `detect_values`
-      options << "-toolchain '#{config[:toolchain]}'" if config[:toolchain]
+      options << "-toolchain #{config[:toolchain].to_s.shellescape}" if config[:toolchain]
       if config[:derived_data_path] && !options.include?("-derivedDataPath #{config[:derived_data_path].shellescape}")
         options << "-derivedDataPath #{config[:derived_data_path].shellescape}"
       end
@@ -68,6 +68,9 @@ module Scan
       options << "-enableCodeCoverage #{config[:code_coverage] ? 'YES' : 'NO'}" unless config[:code_coverage].nil?
       options << "-enableAddressSanitizer #{config[:address_sanitizer] ? 'YES' : 'NO'}" unless config[:address_sanitizer].nil?
       options << "-enableThreadSanitizer #{config[:thread_sanitizer] ? 'YES' : 'NO'}" unless config[:thread_sanitizer].nil?
+      if config[:collect_test_diagnostics] && FastlaneCore::Helper.xcode_at_least?(14)
+        options << "-collect-test-diagnostics #{config[:collect_test_diagnostics]}"
+      end
       if FastlaneCore::Helper.xcode_at_least?(11)
         if config[:cloned_source_packages_path] && !options.include?("-clonedSourcePackagesDirPath #{config[:cloned_source_packages_path].shellescape}")
           options << "-clonedSourcePackagesDirPath #{config[:cloned_source_packages_path].shellescape}"
@@ -77,14 +80,14 @@ module Scan
           options << "-packageCachePath #{config[:package_cache_path].shellescape}"
         end
 
-        options << "-testPlan '#{config[:testplan]}'" if config[:testplan]
+        options << "-testPlan #{config[:testplan].shellescape}" if config[:testplan]
 
         # detect_values will ensure that these values are present as Arrays if
         # they are present at all
-        options += config[:only_test_configurations].map { |name| "-only-test-configuration '#{name}'" } if config[:only_test_configurations]
-        options += config[:skip_test_configurations].map { |name| "-skip-test-configuration '#{name}'" } if config[:skip_test_configurations]
+        options += config[:only_test_configurations].map { |name| "-only-test-configuration #{name.shellescape}" } if config[:only_test_configurations]
+        options += config[:skip_test_configurations].map { |name| "-skip-test-configuration #{name.shellescape}" } if config[:skip_test_configurations]
       end
-      options << "-xctestrun '#{config[:xctestrun]}'" if config[:xctestrun]
+      options << "-xctestrun #{config[:xctestrun].shellescape}" if config[:xctestrun]
       options << config[:xcargs] if config[:xcargs]
 
       # Number of retries does not equal xcodebuild's -test-iterations number
@@ -127,7 +130,7 @@ module Scan
     end
 
     def pipe
-      pipe = ["| tee '#{xcodebuild_log_path}'"]
+      pipe = ["| tee #{xcodebuild_log_path.shellescape}"]
 
       # disable_xcpretty is now deprecated and directs to use output_style of raw
       if Scan.config[:disable_xcpretty] || Scan.config[:output_style] == 'raw'
@@ -182,7 +185,7 @@ module Scan
       formatter = []
       if (custom_formatter = Scan.config[:xcpretty_formatter] || Scan.config[:formatter])
         if custom_formatter.end_with?(".rb")
-          formatter << "-f '#{custom_formatter}'"
+          formatter << "-f #{custom_formatter.shellescape}"
         else
           formatter << "-f `#{custom_formatter}`"
         end
@@ -234,7 +237,7 @@ module Scan
     # Generate destination parameters
     def destination
       unless Scan.cache[:destination]
-        Scan.cache[:destination] = [*Scan.config[:destination]].map { |dst| "-destination '#{dst}'" }.join(' ')
+        Scan.cache[:destination] = [*Scan.config[:destination]].map { |dst| "-destination #{dst.shellescape}" }.join(' ')
       end
       Scan.cache[:destination]
     end

data/scan/lib/scan/test_result_parser.rb

@@ -3,6 +3,7 @@ require_relative 'module'
 module Scan
   class TestResultParser
     def parse_result(output)
+      UI.deprecated("Scan::TestResultParser is deprecated and will be removed in a future version of fastlane; scan no longer uses it. Read the test counts from the result bundle with Trainer::TestParser, or from the <testsuites> attributes of the JUnit report.")
       unless output
         return {
             tests: 0,

data/scan/lib/scan/xcpretty_reporter_options_generator.rb

@@ -49,7 +49,7 @@ module Scan
         type = raw_type.strip
         output_path = File.join(File.expand_path(@output_directory), determine_output_file_name(type))
         reporter << "--report #{type}"
-        reporter << "--output '#{output_path}'"
+        reporter << "--output #{output_path.shellescape}"
 
         if type == "html" && @open_report
           Scan.cache[:open_html_report_path] = output_path
@@ -62,7 +62,7 @@ module Scan
       @temp_junit_report = Tempfile.new("junit_report")
       Scan.cache[:temp_junit_report] = @temp_junit_report.path
       reporter << "--report junit"
-      reporter << "--output '#{Scan.cache[:temp_junit_report]}'"
+      reporter << "--output #{Scan.cache[:temp_junit_report].shellescape}"
       return reporter
     end
 

data/screengrab/lib/screengrab/page.html.erb

@@ -65,18 +65,18 @@
     </style>
   </head>
   <body><% image_counter = 0 %><% @data.each do |language, content| %>
-    <h1 id="<%= language %>" class="language"><%= language %></h1>
+    <h1 id="<%= ERB::Util.h(language) %>" class="language"><%= ERB::Util.h(language) %></h1>
     <hr>
     <table><% content.each do |device_name, screens| %>
       <tr>
         <th colspan="<%= screens.count %>">
-          <a id="<%= language %>-<%= device_name %>" class="deviceName" href="#<%= language %>-<%= device_name %>"><%= device_name %></a>
+          <a id="<%= ERB::Util.h(language) %>-<%= ERB::Util.h(device_name) %>" class="deviceName" href="#<%= ERB::Util.h(language) %>-<%= ERB::Util.h(device_name) %>"><%= ERB::Util.h(device_name) %></a>
         </th>
       </tr>
       <tr><% screens.each do |screen_path| %><% next if screen_path.include?"_framed.png" %>
         <td><% image_counter += 1 %>
-          <a href="<%= screen_path %>" target="_blank" class="screenshotLink">
-            <img class="screenshot" src="<%= screen_path %>" style="width: 100%;" alt="<%= language %> <%= device_name %>" data-counter="<%= image_counter %>">
+          <a href="<%= ERB::Util.h(screen_path) %>" target="_blank" class="screenshotLink">
+            <img class="screenshot" src="<%= ERB::Util.h(screen_path) %>" style="width: 100%;" alt="<%= ERB::Util.h(language) %> <%= ERB::Util.h(device_name) %>" data-counter="<%= image_counter %>">
           </a>
         </td><% end %>
       </tr><% end %>
@@ -128,9 +128,14 @@
           imageDisplay.alt             = img.alt;
           imageDisplay.dataset.counter = img.dataset.counter;
 
-          imageInfo.innerHTML          = '<h3>'+img.alt+'</h3>';
-          imageInfo.innerHTML         += decodeURI(img.src.split("/").pop());
-          imageInfo.innerHTML         += '<br />'+tmpImg.height+'&times;'+tmpImg.width+'px';
+          // textContent, not innerHTML: file names must not be interpreted as HTML
+          var imageTitle               = document.createElement('h3');
+          imageTitle.textContent       = img.alt;
+          imageInfo.textContent        = '';
+          imageInfo.appendChild(imageTitle);
+          imageInfo.appendChild(document.createTextNode(decodeURI(img.src.split("/").pop())));
+          imageInfo.appendChild(document.createElement('br'));
+          imageInfo.appendChild(document.createTextNode(tmpImg.height+'\u00d7'+tmpImg.width+'px'));
 
           overlay.style.display        = "block";
         });

data/screengrab/lib/screengrab/reports_generator.rb

@@ -30,7 +30,7 @@ module Screengrab
 
       export_path = File.expand_path(export_path)
       UI.success("Successfully created HTML file with an overview of all the screenshots: '#{export_path}'")
-      system("open '#{export_path}'") unless Screengrab.config[:skip_open_summary]
+      system("open", export_path) unless Screengrab.config[:skip_open_summary]
     end
   end
 end

data/sigh/lib/assets/resign.sh

@@ -321,6 +321,23 @@ else
     error "Error: Only can resign .app files and .ipa files."
 fi
 
+# Stop if a symbolic link resolves outside the temporary directory: later steps write through such links.
+# Resolved with the cd -P and pwd -P builtins, as realpath and readlink -f are missing on older macOS.
+TEMP_DIR_PHYSICAL="$(cd -P "$TEMP_DIR" && pwd -P)"
+checkStatus
+while IFS= read -d '' -r link; do
+    target="$(readlink "$link")"
+    [[ "$target" == /* ]] || target="$(dirname "$link")/$target"
+    if [ -d "$target" ]; then
+        resolved="$(cd -P "$target" 2>/dev/null && pwd -P)"
+    else
+        resolved="$(cd -P "$(dirname "$target")" 2>/dev/null && pwd -P)/$(basename "$target")"
+    fi
+    if [[ "$resolved" != "$TEMP_DIR_PHYSICAL" && "$resolved" != "$TEMP_DIR_PHYSICAL"/* ]]; then
+        error "Error: '${link#"$TEMP_DIR"/}' is a symbolic link to '$(readlink "$link")', outside of '$ORIGINAL_FILE'. Remove it before resigning."
+    fi
+done < <(find "$TEMP_DIR" -type l -print0)
+
 # check the keychain
 if [ "${KEYCHAIN}" != "" ]; then
     security list-keychains -s "$KEYCHAIN"
@@ -665,9 +682,18 @@ function resign {
         # Get the old and the new team ID
         # Old team ID is not part of app entitlements, have to get it from old embedded provisioning profile
         security cms -D -i "$TEMP_DIR/old-embedded.mobileprovision" > "$TEMP_DIR/old-embedded-profile.plist"
-        OLD_TEAM_ID=$(PlistBuddy -c "Print :TeamIdentifier:0" "$TEMP_DIR/old-embedded-profile.plist")
+        OLD_TEAM_ID=$(PlistBuddy -c "Print :TeamIdentifier:0" "$TEMP_DIR/old-embedded-profile.plist" 2>/dev/null)
+        if [ "$OLD_TEAM_ID" == "" ]; then
+            OLD_TEAM_ID="$OLD_APP_ID"
+        fi
         # New team ID is part of profile entitlements
-        NEW_TEAM_ID=$(PlistBuddy -c "Print com.apple.developer.team-identifier" "$PROFILE_ENTITLEMENTS" | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
+        NEW_TEAM_ID=$(PlistBuddy -c "Print :com.apple.developer.team-identifier" "$PROFILE_ENTITLEMENTS" 2>/dev/null | grep -E '^[A-Z0-9]*' -o | tr -d '\n')
+        if [ "$NEW_TEAM_ID" == "" ]; then
+            NEW_TEAM_ID="$TEAM_IDENTIFIER"
+        fi
+        if [ "$NEW_TEAM_ID" == "" ]; then
+            NEW_TEAM_ID="$NEW_APP_ID"
+        fi
 
         log "Patching profile entitlements with values from app entitlements"
         PATCHED_ENTITLEMENTS="$TEMP_DIR/patchedEntitlements"
@@ -866,13 +892,16 @@ function resign {
         OLD_BUNDLE_ID="$(PlistBuddy -c "Print :CFBundleIdentifier" "$TEMP_DIR/oldInfo.plist")"
         NEW_BUNDLE_ID="$(bundle_id_for_provision "$NEW_PROVISION")"
         log "Replacing old bundle ID '$OLD_BUNDLE_ID' with new bundle ID '$NEW_BUNDLE_ID' in patched entitlements"
-        # Note: ideally we'd match against the opening <string> tag too, but this isn't possible
-        # because $OLD_BUNDLE_ID and $NEW_BUNDLE_ID do not include the team ID prefix which is
-        # present in the entitlements file.
-        # e.g. <string>AB1GP98Q19.com.example.foo</string>
-        #         vs
-        #      com.example.foo
-        /usr/bin/sed -i .bak "s!${OLD_BUNDLE_ID}</string>!${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
+        # Anchor the replacement to OLD_TEAM_ID prefix, app group prefix, or the opening <string> tag
+        # so that if NEW_BUNDLE_ID contains OLD_BUNDLE_ID as a suffix (e.g. enterprise.com.example.foo),
+        # the already-correct values (like <TEAM_ID>.enterprise.com.example.foo) do not have their
+        # suffix duplicated.
+        ESCAPED_OLD_BUNDLE_ID="${OLD_BUNDLE_ID//./\\.}"
+        if [ -n "$OLD_TEAM_ID" ] && [ -n "$NEW_TEAM_ID" ]; then
+            /usr/bin/sed -i .bak "s!<string>${OLD_TEAM_ID}\.${ESCAPED_OLD_BUNDLE_ID}</string>!<string>${NEW_TEAM_ID}.${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
+        fi
+        /usr/bin/sed -i .bak "s!<string>group\.${ESCAPED_OLD_BUNDLE_ID}</string>!<string>group.${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
+        /usr/bin/sed -i .bak "s!<string>${ESCAPED_OLD_BUNDLE_ID}</string>!<string>${NEW_BUNDLE_ID}</string>!g" "$PATCHED_ENTITLEMENTS"
 
         log "Resigning application using certificate: '$CERTIFICATE'"
         log "and patched entitlements:"

data/sigh/lib/sigh/local_manage.rb

@@ -134,7 +134,7 @@ module Sigh
 
       profiles = []
       profile_paths.each do |profile_path|
-        profile = Plist.parse_xml(`security cms -D -i '#{profile_path}' 2> /dev/null`) # /dev/null: https://github.com/fastlane/fastlane/issues/6387
+        profile = FastlaneCore::ProvisioningProfile.parse(profile_path)
         profile['Path'] = profile_path
         profiles << profile
       end

data/sigh/lib/sigh/options.rb

@@ -63,6 +63,11 @@ module Sigh
                                      code_gen_sensitive: true,
                                      default_value: CredentialsManager::AppfileConfig.try_fetch_value(:app_identifier),
                                      default_value_dynamic: true),
+        FastlaneCore::ConfigItem.new(key: :offline_profile,
+                                     env_name: "SIGH_OFFLINE_PROFILE",
+                                     description: "Enable profile with 'Offline Support' (7 day validity). Requires Apple ID login, not supported with App Store Connect API key authentication",
+                                     is_string: false,
+                                     default_value: false),
 
         # App Store Connect API
         FastlaneCore::ConfigItem.new(key: :api_key_path,

data/sigh/lib/sigh/resign.rb

@@ -45,10 +45,10 @@ module Sigh
       entitlements = "-e #{entitlements.shellescape}" if entitlements
 
       provisioning_options = create_provisioning_options(provisioning_profiles)
-      version = "-n #{version}" if version
+      version = "-n #{version.shellescape}" if version
       display_name = "-d #{display_name.shellescape}" if display_name
-      short_version = "--short-version #{short_version}" if short_version
-      bundle_version = "--bundle-version #{bundle_version}" if bundle_version
+      short_version = "--short-version #{short_version.shellescape}" if short_version
+      bundle_version = "--bundle-version #{bundle_version.shellescape}" if bundle_version
       verbose = "-v" if FastlaneCore::Globals.verbose?
       bundle_id = "-b '#{new_bundle_id}'" if new_bundle_id
       use_app_entitlements_flag = "--use-app-entitlements" if use_app_entitlements

data/sigh/lib/sigh/runner.rb

@@ -34,6 +34,10 @@ module Sigh
         UI.message("Successfully logged in")
       end
 
+      if Sigh.config[:offline_profile] && !Spaceship::ConnectAPI.token.nil?
+        UI.user_error!("The 'offline_profile' option requires logging in with an Apple ID. Apple's App Store Connect API (API key authentication) does not support the 'Offline Support' profile setting")
+      end
+
       profiles = [] if Sigh.config[:skip_fetch_profiles]
       profiles ||= fetch_profiles # download the profile if it's there
 
@@ -185,7 +189,8 @@ module Sigh
         profile_type: profile_type,
         bundle_id_id: bundle_id.id,
         certificate_ids: certificates_to_use.map(&:id),
-        device_ids: devices_to_use.map(&:id)
+        device_ids: devices_to_use.map(&:id),
+        is_offline_profile: Sigh.config[:offline_profile]
       )
 
       profile

data/snapshot/lib/snapshot/options.rb

@@ -268,6 +268,11 @@ module Snapshot
                                      description: "Skips resolution of Swift Package Manager dependencies",
                                      type: Boolean,
                                      default_value: false),
+        FastlaneCore::ConfigItem.new(key: :disallow_xcodebuild_settings_lookup,
+                                     env_name: "SNAPSHOT_DISALLOW_XCODEBUILD_SETTINGS_LOOKUP",
+                                     description: "Raises an error instead of fetching build settings by running `xcodebuild -showBuildSettings`, which can take a long time on large projects. The error names the required build setting, so the corresponding option can be specified manually",
+                                     type: Boolean,
+                                     default_value: false),
         FastlaneCore::ConfigItem.new(key: :disable_package_automatic_updates,
                                      env_name: "SNAPSHOT_DISABLE_PACKAGE_AUTOMATIC_UPDATES",
                                      description: "Prevents packages from automatically being resolved to versions other than those recorded in the `Package.resolved` file. This translates in the option `-disableAutomaticPackageResolution` being passed to xcodebuild",

data/snapshot/lib/snapshot/page.html.erb

@@ -96,38 +96,38 @@
       <button class="tabLink" onclick="openTab(event, 'byScreen')">By Screen</button>
     </div>
     <div id="byLanguage" class="tabContent"><h1 class="tabTitle">By Language:</h1><% image_counter = 0 %><% @data_by_language.each do |language, content| %>
-      <h2 id="<%= language %>"><%= language %></h2>
+      <h2 id="<%= ERB::Util.h(language) %>"><%= ERB::Util.h(language) %></h2>
       <hr>
       <table><% content.each do |device_name, screens| %>
         <tr>
           <th colspan="<%= screens.count %>">
-            <a id="<%= language %>-<%= device_name %>" class="deviceName" href="#<%= language %>-<%= device_name %>"><%= device_name %></a>
+            <a id="<%= ERB::Util.h(language) %>-<%= ERB::Util.h(device_name) %>" class="deviceName" href="#<%= ERB::Util.h(language) %>-<%= ERB::Util.h(device_name) %>"><%= ERB::Util.h(device_name) %></a>
           </th>
         </tr>
         <tr><% screens.each do |screen_path| %><% next if screen_path.include?"_framed.png" %>
           <td><% image_counter += 1 %>
-            <a href="<%= screen_path %>" target="_blank" class="screenshotLink">
-              <img class="screenshot" src="<%= screen_path %>" style="width: 100%;" alt="<%= language %> <%= device_name %>" data-tab="1" data-counter="<%= image_counter %>">
+            <a href="<%= ERB::Util.h(screen_path) %>" target="_blank" class="screenshotLink">
+              <img class="screenshot" src="<%= ERB::Util.h(screen_path) %>" style="width: 100%;" alt="<%= ERB::Util.h(language) %> <%= ERB::Util.h(device_name) %>" data-tab="1" data-counter="<%= image_counter %>">
             </a>
           </td><% end %>
         </tr><% end %>
       </table><% end %>
     </div>
     <div id="byScreen" class="tabContent"><h1 class="tabTitle">By Screen:</h1><% image_counter = 0 %><% @data_by_screen.each do |screen, content| %>
-      <h2 id="<%= screen %>" class="screen"><%= screen %></h2>
+      <h2 id="<%= ERB::Util.h(screen) %>" class="screen"><%= ERB::Util.h(screen) %></h2>
       <hr>
       <table><% content.each do |device_name, screens| %>
         <tr>
           <th colspan="<%= screens.count %>">
-            <a id="<%= screen %>-<%= device_name %>" class="deviceName" href="#<%= screen %>-<%= device_name %>"><%= device_name %></a>
+            <a id="<%= ERB::Util.h(screen) %>-<%= ERB::Util.h(device_name) %>" class="deviceName" href="#<%= ERB::Util.h(screen) %>-<%= ERB::Util.h(device_name) %>"><%= ERB::Util.h(device_name) %></a>
           </th>
         </tr>
         <tr><% screens.each do |language, screen_path| %><% next if screen_path.include?"_framed.png" %>
           <td><% image_counter += 1 %>
-            <a href="<%= screen_path %>" target="_blank" class="screenshotLink">
-              <img class="screenshot" src="<%= screen_path %>" style="width: 100%;" alt="<%= language %> <%= device_name %>" data-tab="2" data-counter="<%= image_counter %>">
+            <a href="<%= ERB::Util.h(screen_path) %>" target="_blank" class="screenshotLink">
+              <img class="screenshot" src="<%= ERB::Util.h(screen_path) %>" style="width: 100%;" alt="<%= ERB::Util.h(language) %> <%= ERB::Util.h(device_name) %>" data-tab="2" data-counter="<%= image_counter %>">
             </a>
-            <div class="caption"><%= language %></div>
+            <div class="caption"><%= ERB::Util.h(language) %></div>
           </td><% end %>
         </tr><% end %>
       </table><% end %>
@@ -222,9 +222,14 @@
           imageDisplay.alt             = img.alt;
           imageDisplay.dataset.counter = img.dataset.counter;
 
-          imageInfo.innerHTML          = '<h3>'+img.alt+'</h3>';
-          imageInfo.innerHTML         += decodeURI(img.src.split("/").pop());
-          imageInfo.innerHTML         += '<br />'+tmpImg.height+'&times;'+tmpImg.width+'px';
+          // textContent, not innerHTML: file names must not be interpreted as HTML
+          var imageTitle               = document.createElement('h3');
+          imageTitle.textContent       = img.alt;
+          imageInfo.textContent        = '';
+          imageInfo.appendChild(imageTitle);
+          imageInfo.appendChild(document.createTextNode(decodeURI(img.src.split("/").pop())));
+          imageInfo.appendChild(document.createElement('br'));
+          imageInfo.appendChild(document.createTextNode(tmpImg.height+'\u00d7'+tmpImg.width+'px'));
 
           overlay.style.display        = "block";
         });

data/snapshot/lib/snapshot/reports_generator.rb

@@ -51,7 +51,7 @@ module Snapshot
 
       export_path = File.expand_path(export_path)
       UI.success("Successfully created HTML file with an overview of all the screenshots: '#{export_path}'")
-      system("open '#{export_path}'") unless Snapshot.config[:skip_open_summary]
+      system("open", export_path) unless Snapshot.config[:skip_open_summary]
     end
 
     def xcode_8_and_below_device_name_mappings

data/snapshot/lib/snapshot/simulator_launchers/simulator_launcher_base.rb

@@ -82,7 +82,7 @@ module Snapshot
       unless launcher_config.headless
         simulator_path = File.join(Helper.xcode_path, 'Applications', 'Simulator.app')
         device_udid = TestCommandGenerator.device_udid(device_types.first)
-        command = "open -a #{simulator_path} -g"
+        command = "open -a #{simulator_path.shellescape} -g"
         command += " --args -CurrentDeviceUDID #{device_udid}" if device_udid
         Helper.backticks(command, print: FastlaneCore::Globals.verbose?)
       end

data/snapshot/lib/snapshot.rb

@@ -1,8 +1,6 @@
 require_relative 'snapshot/runner'
 require_relative 'snapshot/reports_generator'
 require_relative 'snapshot/detect_values'
-require_relative 'snapshot/screenshot_flatten'
-require_relative 'snapshot/screenshot_rotate'
 require_relative 'snapshot/dependency_checker'
 require_relative 'snapshot/latest_os_version'
 require_relative 'snapshot/test_command_generator'

data/spaceship/README.md

@@ -27,8 +27,7 @@ Get in contact with the creators on Twitter: [@FastlaneTools](https://twitter.co
     <a href="#whats-spaceship">Why?</a> &bull;
     <a href="#usage">Usage</a> &bull;
     <a href="#installation">Installation</a> &bull;
-    <a href="#technical-details">Technical Details</a> &bull;
-    <a href="#need-help">Need help?</a>
+    <a href="#technical-details">Technical Details</a>
 </p>
 
 -------
@@ -165,7 +164,7 @@ _spaceship_ does a lot of magic to get everything working so neatly:
 - **Multiple Spaceship**: You can launch multiple _spaceships_ with different Apple accounts to do things like syncing the registered devices.
 
 # Code of Conduct
-Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/CODE_OF_CONDUCT.md).
+Help us keep _fastlane_ open and inclusive. Please read and follow our [Code of Conduct](https://github.com/fastlane/fastlane/blob/master/docs/CODE_OF_CONDUCT.md).
 
 # License
 This project is licensed under the terms of the MIT license. See the LICENSE file.

data/spaceship/lib/spaceship/base.rb

@@ -224,7 +224,9 @@ module Spaceship
     # The initialize method accepts a parsed response from Apple and sets all
     # attributes that are defined by `attr_mapping`
     #
-    # Do not override `initialize` in your own models.
+    # Do not override `initialize` in your own models, use `setup` instead. An
+    # override that has to take a value Apple's response does not carry must call
+    # `super`, or `attr_mapping`, `raw_data`, `client` and `setup` are all skipped.
     def initialize(attrs = {}, existing_client = nil)
       attrs.each do |key, val|
         self.send("#{key}=", val) if respond_to?("#{key}=")