rake-ui 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd7aaae9a795ec46917f67bc68117f375f0c6fa4e22bc6e320fe082a8f633a37
-  data.tar.gz: cbf32b74d4a96a8156278a0e36c71f9f76672396a4a15031e094f8886ea5b4d7
+  metadata.gz: a66b9b0231a472dbbfb3dae969eab443def70832d9f52ffc4b803be8c1123782
+  data.tar.gz: ebef2c3058517271dd4bab6a2b99f647f42795359a04c4325e15647576e4e8c4
 SHA512:
-  metadata.gz: 1509e6793d3f88ec54ed69a4f5cbce635dc0212b48bc657a56562fa8494a8c870c75d086287ee0786804eb14ab118d140e8a2ab4101ccf0f147e07224947e540
-  data.tar.gz: c8baa27913c7c15ba812e3f4d4832783003fa47eb47c16c90603d9107083c1258a2b6f14562ab6f3208502c91fec767cd90258c589bc033071a5bc1ad12c4762
+  metadata.gz: c3688dbe3121f828132c8699d803100c0648ad10699ee22a80177606314797d46f336279d5dbd9cd8b92d44eb0dd138c91d8abc2f8a8c0177b707326000e7284
+  data.tar.gz: dd25fe11781e13cf75ca0d069ee17d40e08feb576ca42fbb038fcea9590058e2afcb4f0913681ddc859e469f61ee735098af31e348b2c7a84c50f07b2024801b

data/README.md

@@ -69,7 +69,7 @@ nodemon -w ./app/models/*  -e "rb" --exec "rake test TEST=test/rake_ui/rake_task
 ```
 
 ## Contributing
-Contributing information available in [CONTRIBUTING](./CONTRIBUTING.md)
+See [CONTRIBUTING](./CONTRIBUTING.md)
 
 ## License
 The gem is available as open source under the terms of the [Apache 2.0 License](./LICENSE).

data/app/models/rake_ui/rake_task.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "shellwords"
+
 module RakeUi
   class RakeTask
     def self.to_safe_identifier(id)
@@ -111,13 +113,34 @@ module RakeUi
       command = ""
 
       if environment
-        command += "#{environment} "
+        # Safely escape environment variables to prevent shell injection
+        # Only accept KEY=VALUE pairs; reject malicious tokens
+        #
+        # Shellwords.split raises ArgumentError on malformed input (e.g. an
+        # unbalanced quote like FOO="bar). Treat that as no usable env tokens
+        # rather than letting the exception bubble up as a 500.
+        tokens = begin
+          Shellwords.split(environment)
+        rescue ArgumentError
+          []
+        end
+
+        escaped_env = tokens.map do |token|
+          next unless token.match?(/\A[A-Z_][A-Z0-9_]*=.*\z/i)
+
+          # Valid KEY=VALUE pattern - escape only the value
+          key, value = token.split("=", 2)
+          "#{key}=#{Shellwords.escape(value)}"
+        end.compact.join(" ")
+
+        command += "#{escaped_env} " if escaped_env.present?
       end
 
       command += "rake #{name}"
 
       if args
-        command += "[#{args}]"
+        # Escape args to prevent shell injection
+        command += "[#{Shellwords.escape(args)}]"
       end
 
       command

data/lib/rake-ui/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeUi
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rake-ui
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Austin Story
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-01 00:00:00.000000000 Z
+date: 2026-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -116,7 +116,7 @@ metadata:
   homepage_uri: https://github.com/doximity/rake-ui
   source_code_uri: https://github.com/doximity/rake-ui
   changelog_uri: https://github.com/doximity/rake-ui/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -131,8 +131,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.1.6
+signing_key:
 specification_version: 4
 summary: A Mountable Rails Engine to manage Rake Tasks through a UI
 test_files: []