rake-ui 0.0.1 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 218a68e063a489cf4b9f781a1f764fbe01439d8f40ab9a7ec2c887993b1b8cc6
-  data.tar.gz: a76cca82acafcb84c0e2039448eb0c0f0fad464dcfc9ad68a5378a7059abfc32
+  metadata.gz: a66b9b0231a472dbbfb3dae969eab443def70832d9f52ffc4b803be8c1123782
+  data.tar.gz: ebef2c3058517271dd4bab6a2b99f647f42795359a04c4325e15647576e4e8c4
 SHA512:
-  metadata.gz: b68e5dca03e6235494047686a766cc8a15cecb71d3bde9ac3767859d9d0971a00194527c756ac767434e15b3c7a56f833a46f9a80a99d1084bf43bae5b3f5ddb
-  data.tar.gz: f24ad6edc4612031b9cdf53b5df8046ff93a51451d216ed23cd12c7423a7c71469114d0b09e967061a78017af0268a7b5d2802a6ec15cc552a46f7acab38da2e
+  metadata.gz: c3688dbe3121f828132c8699d803100c0648ad10699ee22a80177606314797d46f336279d5dbd9cd8b92d44eb0dd138c91d8abc2f8a8c0177b707326000e7284
+  data.tar.gz: dd25fe11781e13cf75ca0d069ee17d40e08feb576ca42fbb038fcea9590058e2afcb4f0913681ddc859e469f61ee735098af31e348b2c7a84c50f07b2024801b

data/README.md

@@ -1,13 +1,23 @@
 # RakeUi
 Rake UI is a Rails engine that enables the discovery and execution rake tasks in a UI.
 
+![Example](./README_example.gif)
+
+## Routes
+
+NOTE: Relative to mountpoint in application
+
+ - GET /rake_tasks(.html/.json) - list all available rake tasks
+ - GET /rake_tasks/:id(.html/.json) - list info a single tasks
+ - POST /rake_tasks/:id/execute - execute a rake task
+ - GET /rake_task_logs(.html/.json) - list rake task history
+ - GET /rake_task_logs/:id(.html/.json) - list a single rake task history
+
 ## Installation
 Add this line to your application's Gemfile:
 
 ```ruby
-group :development do 
-  gem 'rake-ui'
-end
+gem 'rake-ui'
 ```
 
 And then execute:
@@ -34,7 +44,13 @@ end
 
 This tool is built to enable developer productivity in development.  It exposes rake tasks through a UI.
 
-This tool will currently not work in production because we add a guard in the root controller to respond not found if the environment is development or test.  
+This tool will currently not work in production because we add a guard in the root controller to respond not found if the environment is development or test. You may override this guard clause with the following configuration.
+
+```rb
+RakeUi.configuration do |config|
+  config.allow_production = true
+end
+```
 
 We recommend adding guards in your route to ensure that the proper authentication is in place to ensure that users are authenticated so that if this were ever to be rendered in production, you would be covered.  The best way for that is [router constraints](https://guides.rubyonrails.org/routing.html#specifying-constraints)
 
@@ -53,7 +69,7 @@ nodemon -w ./app/models/*  -e "rb" --exec "rake test TEST=test/rake_ui/rake_task
 ```
 
 ## Contributing
-Contributing information available in [CONTRIBUTING](./CONTRIBUTING.md)
+See [CONTRIBUTING](./CONTRIBUTING.md)
 
 ## License
 The gem is available as open source under the terms of the [Apache 2.0 License](./LICENSE).

data/app/controllers/rake_ui/application_controller.rb

@@ -7,7 +7,9 @@ module RakeUi
     private
 
     def black_hole_production
-      raise ActionController::RoutingError, "Not Found" unless Rails.env.test? || Rails.env.development?
+      return if Rails.env.test? || Rails.env.development? || RakeUi.configuration.allow_production
+
+      raise ActionController::RoutingError, "Not Found"
     end
   end
 end

data/app/models/rake_ui/rake_task.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "shellwords"
+
 module RakeUi
   class RakeTask
     def self.to_safe_identifier(id)
@@ -111,13 +113,34 @@ module RakeUi
       command = ""
 
       if environment
-        command += "#{environment} "
+        # Safely escape environment variables to prevent shell injection
+        # Only accept KEY=VALUE pairs; reject malicious tokens
+        #
+        # Shellwords.split raises ArgumentError on malformed input (e.g. an
+        # unbalanced quote like FOO="bar). Treat that as no usable env tokens
+        # rather than letting the exception bubble up as a 500.
+        tokens = begin
+          Shellwords.split(environment)
+        rescue ArgumentError
+          []
+        end
+
+        escaped_env = tokens.map do |token|
+          next unless token.match?(/\A[A-Z_][A-Z0-9_]*=.*\z/i)
+
+          # Valid KEY=VALUE pattern - escape only the value
+          key, value = token.split("=", 2)
+          "#{key}=#{Shellwords.escape(value)}"
+        end.compact.join(" ")
+
+        command += "#{escaped_env} " if escaped_env.present?
       end
 
       command += "rake #{name}"
 
       if args
-        command += "[#{args}]"
+        # Escape args to prevent shell injection
+        command += "[#{Shellwords.escape(args)}]"
       end
 
       command

data/app/models/rake_ui/rake_task_log.rb

@@ -53,13 +53,13 @@ module RakeUi
       end
 
       new(id: id,
-          name: name,
-          args: args,
-          environment: environment,
-          rake_command: rake_command,
-          rake_definition_file: rake_definition_file,
-          log_file_name: log_file_name,
-          log_file_full_path: log_file_full_path)
+        name: name,
+        args: args,
+        environment: environment,
+        rake_command: rake_command,
+        rake_definition_file: rake_definition_file,
+        log_file_name: log_file_name,
+        log_file_full_path: log_file_full_path)
     end
 
     def self.all

data/lib/rake-ui/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeUi
-  VERSION = "0.0.1"
+  VERSION = "0.1.1"
 end

data/lib/rake-ui.rb

@@ -3,4 +3,11 @@
 require "rake-ui/engine"
 
 module RakeUi
+  mattr_accessor :allow_production
+  self.allow_production = false
+
+  def self.configuration
+    yield(self) if block_given?
+    self
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rake-ui
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.1.1
 platform: ruby
 authors:
 - Austin Story
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-02-12 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -116,7 +116,7 @@ metadata:
   homepage_uri: https://github.com/doximity/rake-ui
   source_code_uri: https://github.com/doximity/rake-ui
   changelog_uri: https://github.com/doximity/rake-ui/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -131,8 +131,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.1.6
+signing_key:
 specification_version: 4
 summary: A Mountable Rails Engine to manage Rake Tasks through a UI
 test_files: []