mini_magick 5.1.2 → 5.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 573cda9139f6e0b3dea89a7d981006b64b577902cebc65c99b397c298ab069cd
-  data.tar.gz: 6c84cd11d7308fc2555740606cc42caf6be7a404e8b8233443d6591780f38395
+  metadata.gz: da1546dc65a1492ca64c0747715e0e6b9b3b641541beac9edd6689a2e9544b8b
+  data.tar.gz: b03c897214f43f4d106d90b7fcea2d90ae1b9395afbefcf3810fd2af21fe5095
 SHA512:
-  metadata.gz: '010348f8a6140c1e6df3cf274521cae0935be4d1f262e564456e725d983a7c4962975265ba763c320ccf423841aa323ff78ccd1c045b3553499932f1e1292997'
-  data.tar.gz: 3480cdc918c7ccf0b39c19a520484c89782ee3f6c84aea57eaf69f0efabaae5f92287a087da7f49bf6d1c035e8b2f4d86e380eb1653779c7222cec5133f6a7e4
+  metadata.gz: 666e1178b7a89dedcae4de7220c1a41eb812f8a5a1b14143f669a1337deb26271a94ff7cc6698258617b2584dc93129e021b763365039939d83b7b85b47aa8f5
+  data.tar.gz: 6db3e4657d4e1db3c368b435ef256ba33becf7b164bea29154faeb209bd168f7c370b2ec915920c2ef1e1f61fde0da43b1753cacc6b829a9365039364b262902

data/README.md

@@ -241,6 +241,7 @@ MiniMagick.configure do |config|
   config.logger = Logger.new($stdout) # where to log IM commands
   config.cli_prefix = nil # add prefix to all IM commands
   config.cli_env = {} # environment variables to set for IM commands
+  config.restricted_env = false # when true, block IM commands from accessing system environment variables other than those in cli_env
 end
 ```
 

data/lib/mini_magick/configuration.rb

@@ -32,6 +32,16 @@ module MiniMagick
     #
     attr_accessor :cli_env
 
+    ##
+    # If set to true, Open3 will restrict system calls to access only
+    # environment variables defined in :cli_env, plus HOME, PATH, and LANG
+    # since those are required for such system calls. It will not pass on any
+    # other environment variables from the system.
+    #
+    # @return [Boolean]
+    #
+    attr_accessor :restricted_env
+
     ##
     # If you don't want commands to take too long, you can set a timeout (in
     # seconds).
@@ -73,6 +83,7 @@ module MiniMagick
       base.logger = Logger.new($stdout).tap { |l| l.level = Logger::INFO }
       base.warnings = true
       base.cli_env = {}.freeze
+      base.restricted_env = false
       base.graphicsmagick = false
     end
 

data/lib/mini_magick/shell.rb

@@ -27,12 +27,12 @@ module MiniMagick
     end
 
     def execute(command, stdin: "", timeout: MiniMagick.timeout)
-      env = {}
+      env = MiniMagick.restricted_env ? ENV.slice("HOME", "PATH", "LANG") : {}
       env.merge!(MiniMagick.cli_env)
       env["MAGICK_TIME_LIMIT"] = timeout.to_s if timeout
 
       stdout, stderr, status = log(command.join(" ")) do
-        Open3.capture3(env, *command, stdin_data: stdin)
+        Open3.capture3(env, *command, stdin_data: stdin, unsetenv_others: MiniMagick.restricted_env)
       end
 
       [stdout, stderr, status&.exitstatus]

data/lib/mini_magick/tool.rb

@@ -121,11 +121,10 @@ module MiniMagick
     #   identify.executable #=> ["firejail", "--force", "magick", "identify"]
     #
     def executable
-      exe = [name]
-      exe.unshift "gm" if MiniMagick.graphicsmagick
-      exe.unshift "magick" if MiniMagick.imagemagick7? && name != "magick"
-      exe.unshift *Array(MiniMagick.cli_prefix)
-      exe
+      exe = Array(MiniMagick.cli_prefix)
+      exe << "magick" if MiniMagick.imagemagick7? && name != "magick"
+      exe << "gm" if MiniMagick.graphicsmagick
+      exe << name
     end
 
     ##

data/lib/mini_magick/version.rb

@@ -8,8 +8,8 @@ module MiniMagick
 
   module VERSION
     MAJOR = 5
-    MINOR = 1
-    TINY  = 2
+    MINOR = 2
+    TINY  = 0
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mini_magick
 version: !ruby/object:Gem::Version
-  version: 5.1.2
+  version: 5.2.0
 platform: ruby
 authors:
 - Corey Johnson
@@ -12,7 +12,7 @@ authors:
 - Janko Marohnić
 bindir: bin
 cert_chain: []
-date: 2025-02-02 00:00:00.000000000 Z
+date: 2025-02-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logger