haveapi-client 0.31.2 → 0.32.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9262c30e31afb7945acb49f137c5f9c58c0f76a51b754a0cab7cc7554524c865
-  data.tar.gz: f8a38d4a8907b0e3f83327dce2c3009a125fc946d876949cfe80cbfccac369c9
+  metadata.gz: baae52475f71928ac2df1122fd12e2b83cb85c47059aba9e51e257cf67a9fb5d
+  data.tar.gz: c5b47290a8ea55093bbc513ddb85ca51febcf55ed08159fad7b3ea1663b1aeb3
 SHA512:
-  metadata.gz: f5834a948d75f51f9b85df7cfb1bdf5132e4691ac352e7be44854e5faf23b59c64761e8d44a1eac44613c53cf2e65ebd3f3f622d28aa4ba1ea19bb5268433798
-  data.tar.gz: a8082e60b055d31619b75bb66f0e24d5dd4a2ac628c7949b133b63712b50ee755868005e3ad4c6f06469a2f80714934d4d110315b0cf9a14cc15169c085a275e
+  metadata.gz: b24eef27ca7e9004d0cc8090cd972316f94f1339e0b781f0c10b5f9591401cc864cf0ed7c0de9257bcaee7d034f94a079459a5cf79edcd49ae9c60596a5af5b0
+  data.tar.gz: bdaa388b1e40bc44a2555a23474b2d8f5f5a7ec85b6ce8bf3b102b40d761b24bae696b0d3614d7ad08722aea3628f49bfe936a2bb624273967e7f51ba3a9635f

data/lib/haveapi/cli/example_formatter.rb

@@ -1,3 +1,5 @@
+require 'shellwords'
+
 module HaveAPI::CLI
   module ExampleFormatter
     def self.format_examples(cli, action, out = $>)
@@ -5,7 +7,7 @@ module HaveAPI::CLI
         out << ' > ' << example[:title] << ":\n" unless example[:title].empty?
 
         # request
-        out << "$ #{$0} #{action.resource_path.join('.')} #{action.name}"
+        out << "$ #{Shellwords.escape($0)} #{Shellwords.escape(action.resource_path.join('.'))} #{Shellwords.escape(action.name.to_s)}"
 
         params = example[:request]
 
@@ -36,15 +38,15 @@ module HaveAPI::CLI
 
       case desc[:type]
       when 'Boolean'
-        value ? "--#{option}" : "--no-#{option}"
+        Shellwords.escape(value ? "--#{option}" : "--no-#{option}")
 
       else
-        "--#{option} #{example_value(value)}"
+        "#{Shellwords.escape("--#{option}")} #{example_value(value)}"
       end
     end
 
     def self.example_value(v)
-      v.is_a?(String) && (v.empty? || v.index(' ')) ? "\"#{v}\"" : v
+      Shellwords.escape(v.to_s)
     end
   end
 end

data/lib/haveapi/client/version.rb

@@ -1,6 +1,6 @@
 module HaveAPI
   module Client
     PROTOCOL_VERSION = '2.0'.freeze
-    VERSION = '0.31.2'.freeze
+    VERSION = '0.32.0'.freeze
   end
 end

data/spec/cli_example_formatter_spec.rb

@@ -0,0 +1,86 @@
+require 'fileutils'
+require 'open3'
+require 'stringio'
+require 'tmpdir'
+require_relative '../lib/haveapi/cli'
+
+RSpec.describe HaveAPI::CLI::ExampleFormatter do
+  def format_request(request, program: 'haveapi-cli', resources: ['widget'], action_name: 'update',
+                     parameters: { name: { type: 'String' } }, title: '', response: {}, receiver: nil)
+    action = Object.new
+    action.define_singleton_method(:examples) { [{ title: title, request: request, response: response }] }
+    action.define_singleton_method(:resource_path) { resources }
+    action.define_singleton_method(:name) { action_name }
+    action.define_singleton_method(:param_description) { |_direction, name| parameters[name] }
+    action.define_singleton_method(:namespace) { |_direction| :widget }
+    cli = Object.new
+    cli.define_singleton_method(:format_output) { |*args| receiver&.call(*args) }
+    out = StringIO.new
+    saved = $0
+    begin
+      $0 = program
+      described_class.format_examples(cli, action, out)
+    ensure
+      $0 = saved
+    end
+    out.string
+  end
+
+  def capture_arguments(source, directory, program: 'haveapi-cli')
+    executable = File.join(directory, program)
+    File.write(executable, "#!/bin/sh\nprintf '%s\\0' \"$@\" > \"$CAPTURE\"\n")
+    File.chmod(0o755, executable)
+    capture = File.join(directory, 'arguments')
+    stdout, stderr, status = Open3.capture3(
+      { 'PATH' => "#{directory}:#{ENV.fetch('PATH')}", 'CAPTURE' => capture },
+      'sh', '-c', source.delete_prefix('$ '), chdir: directory
+    )
+    expect(status).to be_success, "#{stdout}\n#{stderr}"
+    File.binread(capture).force_encoding(Encoding::UTF_8).split("\0", -1)[0...-1]
+  end
+
+  it 'keeps the reported CLI-help request substitution literal', :aggregate_failures do
+    Dir.mktmpdir('haveapi-cli-help-') do |directory|
+      marker = File.join(directory, 'request-value-executed')
+      payload = "$(printf request-value-confirmed > #{marker})"
+      source = format_request({ name: payload })
+      argv = capture_arguments(source, directory)
+      expect(File.exist?(marker)).to be(false)
+      expect(argv).to eq(['widget', 'update', '--', '--name', payload])
+    end
+  end
+
+  it 'preserves every complete CLI-help token and existing conversions without evaluation' do
+    Dir.mktmpdir('haveapi-cli-help-') do |directory|
+      hostile = "space\tline\n雪'\"\\$value;`touch unintended`$(touch unintended)"
+      program = "cli #{hostile}"
+      option = "odd_name #{hostile}"
+      values = { option => hostile, empty: '', zero: 0, nil_value: nil, list: [false, 0, nil], object: { key: false },
+                 enabled_flag: true, disabled_flag: false, nil_flag: nil, at_file: '@example', escaped_at: '@@example', unknown: 'filtered' }
+      parameters = values.except(:unknown).to_h { |key, _| [key, { type: 'String' }] }
+      %i[enabled_flag disabled_flag nil_flag].each { |key| parameters[key] = { type: 'Boolean' } }
+      source = format_request(values, program: program, resources: [hostile, 'nested'], action_name: hostile, parameters: parameters)
+      argv = capture_arguments(source, directory, program: program)
+      expect(argv).to eq(["#{hostile}.nested", hostile, '--', "--#{option.tr('_', '-')}", hostile,
+                          '--empty', '', '--zero', '0', '--nil-value', '', '--list', values[:list].to_s,
+                          '--object', values[:object].to_s, '--enabled-flag', '--no-disabled-flag', '--no-nil-flag',
+                          '--at-file', '@example', '--escaped-at', '@@example'])
+      expect(File.exist?(File.join(directory, 'unintended'))).to be(false)
+    end
+  end
+
+  it 'keeps absent inputs, filtering, title and response output routing intact' do
+    saved = $0
+    calls = []
+    receiver = proc do |action, response, out|
+      calls << [action.name, response, out.class]
+      out << "formatted response\n"
+    end
+    source = format_request(nil, title: 'Visible title', response: { id: 0 }, receiver: receiver)
+    expect(source).to eq(" > Visible title:\n$ haveapi-cli widget update\nformatted response\n")
+    expect(calls).to eq([['update', { widget: { id: 0 } }, StringIO]])
+    expect(format_request({})).to eq("$ haveapi-cli widget update\n")
+    expect(format_request({ unknown: 'filtered' })).to eq("$ haveapi-cli widget update --\n")
+    expect($0).to eq(saved)
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: haveapi-client
 version: !ruby/object:Gem::Version
-  version: 0.31.2
+  version: 0.32.0
 platform: ruby
 authors:
 - Jakub Skokan
@@ -159,6 +159,7 @@ files:
 - lib/restclient_ext/resource.rb
 - spec/action_security_spec.rb
 - spec/authentication_token_security_spec.rb
+- spec/cli_example_formatter_spec.rb
 - spec/cli_i18n_spec.rb
 - spec/cli_security_spec.rb
 - spec/description_method_security_spec.rb