hammer_cli 3.18.0 → 3.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33a172242f09152e20ca9c2527a575632ef103d2e8dc783463d833034f0463b6
-  data.tar.gz: a0ab45b803bb793cee25150e40ed69a268e21f1952ea84a0fe0bce68927de167
+  metadata.gz: cbca24c23af00680caa13b39ae16d0847f275329f10d6a3b9a1d28c394b0fe3c
+  data.tar.gz: cdffc9661309b9c0649ea029c9f53f7e38ed8a2b1e7680fe0b14a8dadc423ec4
 SHA512:
-  metadata.gz: 60b971d8a4cb6d8a431f5fe811e13b06948f7aec8c775d0b999dc89d8204ae9147ededb955964235fbcfc0e06fa32cc0d16a49805902740a74c9cccd160331c1
-  data.tar.gz: e00f5d37461468d9dd431f5ad4d84e44bff184473ef1f62b73e2fdea5fc8cc1bd8663090a999eaf82223fa41b8c4952455ddcde149d0f103a3fa568a5abc7d1c
+  metadata.gz: 2ab64958771030d846ecfca6752be9f573940ac9356bce4a547d00462b94ba6a560bb44a9b4ef930ebc22f4d908538687e5ea7b42ddad57d0eb368d6644afd62
+  data.tar.gz: 6314f12c4921b3b5b07b6c91fb440d6f29e7bf0cd87d7ea79dce2f59f8ef1820b4ed9410afe2e9d64b8a6bbfdf979e1b8891a1320f303eafb9a2e407ddf5c053

data/doc/release_notes.md

@@ -1,5 +1,8 @@
 Release notes
 =============
+### 3.19.0 (2026-05-11)
+* Bump to 3.19.0-develop
+
 ### 3.18.0 (2026-02-10)
 * Bump to 3.18.0-develop
 

data/lib/hammer_cli/utils.rb

@@ -1,4 +1,5 @@
 require 'highline'
+require 'shellwords'
 require 'tempfile'
 
 class String
@@ -91,7 +92,8 @@ module HammerCLI
     Tempfile.open([content_type, suffix], tempdir) do |f|
       f.write(content)
       f.rewind
-      system("#{ENV['EDITOR'] || 'vi'} #{f.path}")
+      editor = Shellwords.split(ENV['EDITOR'] || 'vi')
+      system(*editor, f.path)
       result = f.read
     end
     result

data/lib/hammer_cli/version.rb

@@ -1,5 +1,5 @@
 module HammerCLI
   def self.version
-    @version ||= Gem::Version.new "3.18.0"
+    @version ||= Gem::Version.new "3.19.1"
   end
 end

data/test/unit/utils_test.rb

@@ -195,4 +195,39 @@ describe HammerCLI do
       assert_equal(arr, [:a, 1, 2, 3, :b, :c])
     end
   end
+
+  describe 'open_in_editor' do
+    it 'uses array-based system call to prevent shell injection' do
+      ENV.stubs(:[]).with('EDITOR').returns('vi')
+      HammerCLI.expects(:system).with('vi', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'splits EDITOR with arguments into array form' do
+      ENV.stubs(:[]).with('EDITOR').returns('code --wait')
+      HammerCLI.expects(:system).with('code', '--wait', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'falls back to vi when EDITOR is not set' do
+      ENV.stubs(:[]).with('EDITOR').returns(nil)
+      HammerCLI.expects(:system).with('vi', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'does not pass shell metacharacters to a shell interpreter' do
+      ENV.stubs(:[]).with('EDITOR').returns('vi; echo INJECTED')
+      # Shellwords.split treats the semicolon as a literal character,
+      # producing ["vi;", "echo", "INJECTED"] - no shell is invoked
+      HammerCLI.expects(:system).with('vi;', 'echo', 'INJECTED', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'returns original content when editor does not modify the file' do
+      ENV.stubs(:[]).with('EDITOR').returns('true')
+      HammerCLI.stubs(:system).returns(true)
+      result = HammerCLI.open_in_editor('original content')
+      assert_equal 'original content', result
+    end
+  end
 end

metadata

@@ -1,14 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: hammer_cli
 version: !ruby/object:Gem::Version
-  version: 3.18.0
+  version: 3.19.1
 platform: ruby
 authors:
 - Martin Bačovský
 - Tomáš Strachota
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: amazing_print
@@ -165,10 +166,6 @@ executables:
 - hammer-complete
 extensions: []
 extra_rdoc_files:
-- README.md
-- config/cli.modules.d/module_config_template.yml
-- config/cli_config.template.yml
-- config/hammer.completion
 - doc/commands_extension.md
 - doc/commands_modification.md
 - doc/creating_apipie_commands.md
@@ -190,6 +187,10 @@ extra_rdoc_files:
 - doc/release_notes.md
 - doc/review_checklist.md
 - doc/writing_a_plugin.md
+- config/cli.modules.d/module_config_template.yml
+- config/cli_config.template.yml
+- config/hammer.completion
+- README.md
 files:
 - LICENSE
 - README.md
@@ -396,6 +397,7 @@ homepage: https://github.com/theforeman/hammer-cli
 licenses:
 - GPL-3.0-only
 metadata: {}
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -410,7 +412,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.2.33
+signing_key:
 specification_version: 4
 summary: Universal command-line interface
 test_files: