hammer_cli 5.0.0 → 5.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 27faa46ea907e19dfe6c29420a5d355909a84c59a817e4bcde0f197a17d5c368
-  data.tar.gz: 8f5982c563ce5b2b4d3028d882f85fb627d5d840246a9e35f172a3fbb1a2ff48
+  metadata.gz: dcec4ff4f79807969ca8f80ed3d0e5165faa0c490b61ef6805c2f31a17a071e4
+  data.tar.gz: 581f9e123359d76299c241ffc4c61fed6c3fa62e5d281b9d740fdb144e0248b4
 SHA512:
-  metadata.gz: ad512c4ee9d15c567efde990f5c904f084c577239a1eb4b74c2440ef6000bc87982f1df6fe423a554137114e60078224faa157768cb794e5a6901f0e41de491c
-  data.tar.gz: c92b48e9eecc4b3ece82e782720766535c48d671b194d12e8e46be6f03df89fb58a2d20a79ada4a7b1519f77938f9b3596cc88ca833ae1c7286a351d0896ecf0
+  metadata.gz: a2961557d84e5f96ffe9bcccd456dec5ed570308bba92b372cb98c5542ff0f639aae59e57a27460b69f12fc1027c5d901d30e7091c3f98c56d3b3c80993708d2
+  data.tar.gz: e09843a589ca7ef891ede6baf40fe9586306af1156df84f53c292500efa9a504103071b78cc5ddcb0d513623e3be9cc8ac0d5753f45c9fcdd4f86f54f6ba153e

data/lib/hammer_cli/utils.rb

@@ -1,4 +1,5 @@
 require 'highline'
+require 'shellwords'
 require 'tempfile'
 
 class String
@@ -91,7 +92,8 @@ module HammerCLI
     Tempfile.open([content_type, suffix], tempdir) do |f|
       f.write(content)
       f.rewind
-      system("#{ENV['EDITOR'] || 'vi'} #{f.path}")
+      editor = Shellwords.split(ENV['EDITOR'] || 'vi')
+      system(*editor, f.path)
       result = f.read
     end
     result

data/lib/hammer_cli/version.rb

@@ -1,5 +1,5 @@
 module HammerCLI
   def self.version
-    @version ||= Gem::Version.new "5.0.0"
+    @version ||= Gem::Version.new "5.0.1"
   end
 end

data/test/unit/utils_test.rb

@@ -195,4 +195,39 @@ describe HammerCLI do
       assert_equal(arr, [:a, 1, 2, 3, :b, :c])
     end
   end
+
+  describe 'open_in_editor' do
+    it 'uses array-based system call to prevent shell injection' do
+      ENV.stubs(:[]).with('EDITOR').returns('vi')
+      HammerCLI.expects(:system).with('vi', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'splits EDITOR with arguments into array form' do
+      ENV.stubs(:[]).with('EDITOR').returns('code --wait')
+      HammerCLI.expects(:system).with('code', '--wait', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'falls back to vi when EDITOR is not set' do
+      ENV.stubs(:[]).with('EDITOR').returns(nil)
+      HammerCLI.expects(:system).with('vi', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'does not pass shell metacharacters to a shell interpreter' do
+      ENV.stubs(:[]).with('EDITOR').returns('vi; echo INJECTED')
+      # Shellwords.split treats the semicolon as a literal character,
+      # producing ["vi;", "echo", "INJECTED"] - no shell is invoked
+      HammerCLI.expects(:system).with('vi;', 'echo', 'INJECTED', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'returns original content when editor does not modify the file' do
+      ENV.stubs(:[]).with('EDITOR').returns('true')
+      HammerCLI.stubs(:system).returns(true)
+      result = HammerCLI.open_in_editor('original content')
+      assert_equal 'original content', result
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hammer_cli
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.0.1
 platform: ruby
 authors:
 - Martin Bačovský
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-11 00:00:00.000000000 Z
+date: 2026-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: amazing_print