mini_magick 5.1.0 → 5.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7ac6bfa9bd38b6ba1482ad9d52e4ce0f983a44ae6cc51d1e7cb66c1cca49209f
-  data.tar.gz: e3088be1a95e47dc6b0426a8bc76f3ac071e3755f301c3d06c6d46b442ae7274
+  metadata.gz: da1546dc65a1492ca64c0747715e0e6b9b3b641541beac9edd6689a2e9544b8b
+  data.tar.gz: b03c897214f43f4d106d90b7fcea2d90ae1b9395afbefcf3810fd2af21fe5095
 SHA512:
-  metadata.gz: c2703437721ca376faf5674d2b0a10c34f456d0146ee4a7dc3ad506d700be9fcd098301213b1c688931ae872f8507691f02b70eb4f3131df2c1a760e8f86f25d
-  data.tar.gz: c8d33063710a5e0898e6bd2a5aaca6533c0d2943c4a5c545ab700de5e25eb38fa0efc4e08cf9d5eec46c3ba78d315231c541f6b4fe802306da181513b957291c
+  metadata.gz: 666e1178b7a89dedcae4de7220c1a41eb812f8a5a1b14143f669a1337deb26271a94ff7cc6698258617b2584dc93129e021b763365039939d83b7b85b47aa8f5
+  data.tar.gz: 6db3e4657d4e1db3c368b435ef256ba33becf7b164bea29154faeb209bd168f7c370b2ec915920c2ef1e1f61fde0da43b1753cacc6b829a9365039364b262902

data/README.md

@@ -241,6 +241,7 @@ MiniMagick.configure do |config|
   config.logger = Logger.new($stdout) # where to log IM commands
   config.cli_prefix = nil # add prefix to all IM commands
   config.cli_env = {} # environment variables to set for IM commands
+  config.restricted_env = false # when true, block IM commands from accessing system environment variables other than those in cli_env
 end
 ```
 

data/lib/mini_magick/configuration.rb

@@ -32,6 +32,16 @@ module MiniMagick
     #
     attr_accessor :cli_env
 
+    ##
+    # If set to true, Open3 will restrict system calls to access only
+    # environment variables defined in :cli_env, plus HOME, PATH, and LANG
+    # since those are required for such system calls. It will not pass on any
+    # other environment variables from the system.
+    #
+    # @return [Boolean]
+    #
+    attr_accessor :restricted_env
+
     ##
     # If you don't want commands to take too long, you can set a timeout (in
     # seconds).
@@ -73,6 +83,7 @@ module MiniMagick
       base.logger = Logger.new($stdout).tap { |l| l.level = Logger::INFO }
       base.warnings = true
       base.cli_env = {}.freeze
+      base.restricted_env = false
       base.graphicsmagick = false
     end
 

data/lib/mini_magick/shell.rb

@@ -27,12 +27,12 @@ module MiniMagick
     end
 
     def execute(command, stdin: "", timeout: MiniMagick.timeout)
-      env = {}
+      env = MiniMagick.restricted_env ? ENV.slice("HOME", "PATH", "LANG") : {}
       env.merge!(MiniMagick.cli_env)
       env["MAGICK_TIME_LIMIT"] = timeout.to_s if timeout
 
       stdout, stderr, status = log(command.join(" ")) do
-        Open3.capture3(env, *command, stdin_data: stdin)
+        Open3.capture3(env, *command, stdin_data: stdin, unsetenv_others: MiniMagick.restricted_env)
       end
 
       [stdout, stderr, status&.exitstatus]

data/lib/mini_magick/tool.rb

@@ -121,11 +121,10 @@ module MiniMagick
     #   identify.executable #=> ["firejail", "--force", "magick", "identify"]
     #
     def executable
-      exe = [name]
-      exe.unshift "gm" if MiniMagick.graphicsmagick
-      exe.unshift "magick" if MiniMagick.imagemagick7? && name != "magick"
-      exe.unshift *Array(MiniMagick.cli_prefix)
-      exe
+      exe = Array(MiniMagick.cli_prefix)
+      exe << "magick" if MiniMagick.imagemagick7? && name != "magick"
+      exe << "gm" if MiniMagick.graphicsmagick
+      exe << name
     end
 
     ##

data/lib/mini_magick/version.rb

@@ -8,7 +8,7 @@ module MiniMagick
 
   module VERSION
     MAJOR = 5
-    MINOR = 1
+    MINOR = 2
     TINY  = 0
     PRE   = nil
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mini_magick
 version: !ruby/object:Gem::Version
-  version: 5.1.0
+  version: 5.2.0
 platform: ruby
 authors:
 - Corey Johnson
@@ -12,8 +12,36 @@ authors:
 - Janko Marohnić
 bindir: bin
 cert_chain: []
-date: 2025-01-12 00:00:00.000000000 Z
+date: 2025-02-22 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: benchmark
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement