rufio 1.0.2 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f6a5acef1da176c0bfb0c96f4dacc64e6ab519095b9e282a0c2558ca2594cd34
-  data.tar.gz: 5be4e0fe22abcd6d866842ab61436605e940d38d5c3b43f477fc3afea0323413
+  metadata.gz: 247130c9fd76d05ed1ca70b859ea587e0b42f82ca7491fdc8b1ebea80d0257d4
+  data.tar.gz: 0122c547241cbd60c870798324b9cddaef6a3767a3153f52ca3b6b6cee3efa07
 SHA512:
-  metadata.gz: 40f7a8c8dc30211dd09ec1c047c2ca52f4f9854020e41e6a56d56d531f84e87dbf920c7f01df213d9d67c4085edf634e7e6b2c924b0b3a8fcb2da3ab56765d54
-  data.tar.gz: bc5b4458b71cdd85287f141ea8c8fff2cc66a6ba6a972cca558f1bf6bbd81c6a74a0e46fd1acaf413f2771e4170752fab4bb10838c45791d40c61e76c43c0f89
+  metadata.gz: 6ef019b2c59bc7bea03293c837ca7ff1f40cb4015e585056c9d12628dd552e33533a6ab3e6d012473110ebac0456978d1bb5c762b6192f13d7d8a269fd0826a9
+  data.tar.gz: 75138dbdeb740c137045ef17ba6ede44a8a4b2aa85450618e457b3e8d04ca0d5d6157622aadccb9abb934e4c60b4c5a830923406d9854d02128c5f65e4c19e53

data/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to rufio will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.3] - 2026-10-23
+
+### Security
+- **Fix shell command injection via file names**: `FileOpener` interpolated file paths into shell strings and only quoted them when they contained spaces or quotes, so opening a file named like `a;touch pwned` or containing `$(...)` / backticks could execute arbitrary commands. Commands are now executed in array form without a shell (`system(*argv)`), paths starting with `-` are prefixed with `./`, and the Windows default-app launch uses `rundll32 url.dll,FileProtocolHandler` instead of `cmd /c start` (avoids `%VAR%` / `&` expansion). Removed `quote_shell_argument`
+- **rga option injection**: A `--` separator is now passed before the search query so queries such as `--pre=cmd` are not interpreted as rga options
+- **Command logs are now written with `0600` permissions**, since command output may contain secrets
+
+### Removed
+- `TestUISnapshot` and its `test/snapshots/` fixtures (tests were failing independent of code changes)
+
+### Fixed
+- **Windows: Sluggish key handling**: The main loop processed only one input byte per frame and then slept ~33ms, so key repeat could not keep up. Now up to 32 queued inputs are processed per frame with a single redraw, and the Windows frame interval is ~8ms
+- **Windows: Input queue wait**: Uses `Queue#pop(timeout:)` on Ruby 3.2+ instead of 1ms `sleep` polling (inaccurate under the ~15ms Windows timer resolution)
+- **Windows: Arrow keys misread as ESC**: The wait for escape sequence follow-up bytes was extended from 5ms to 25ms to tolerate ConPTY byte delays
+
 ## [1.0.0] - 2026-04-28
 
 ### Added

data/lib/rufio/command_logger.rb

@@ -30,7 +30,8 @@ module Rufio
       # ディレクトリが存在しない場合は作成（バックグラウンドスレッドでの実行時の競合を防ぐ）
       FileUtils.mkdir_p(@log_dir) unless Dir.exist?(@log_dir)
 
-      File.write(filepath, content)
+      # コマンド出力に機密情報が含まれ得るため、所有者のみ読み書き可能にする
+      File.write(filepath, content, perm: 0o600)
     end
 
     # ログファイル一覧を取得（新しい順）

data/lib/rufio/file_opener.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'shellwords'
+
 module Rufio
   class FileOpener
     def initialize
@@ -43,26 +45,26 @@ module Rufio
     end
 
     def execute_command(application, file_path)
-      quoted_path = quote_shell_argument(file_path)
+      path = safe_path(file_path)
 
       case RbConfig::CONFIG['host_os']
       when /mswin|mingw|cygwin/
-        # Windows
-        system("start \"\" \"#{file_path}\"")
+        # Windows: cmd.exe を経由せず（%VAR% や & の展開を避ける）既定アプリで開く
+        run_command(['rundll32', 'url.dll,FileProtocolHandler', path])
       when /darwin/
         # macOS
         if application == 'open'
-          system("open #{quoted_path}")
+          run_command(['open', path])
         else
           # VSCodeなど特定のアプリケーション
-          system("#{application} #{quoted_path}")
+          run_command([*application_argv(application), path])
         end
       else
         # Linux/Unix
         if application == 'open'
-          system("xdg-open #{quoted_path}")
+          run_command(['xdg-open', path])
         else
-          system("#{application} #{quoted_path}")
+          run_command([*application_argv(application), path])
         end
       end
     rescue StandardError => e
@@ -71,37 +73,39 @@ module Rufio
     end
 
     def execute_command_with_line(application, file_path, line_number)
-      quoted_path = quote_shell_argument(file_path)
+      path = safe_path(file_path)
+      line = line_number.to_i
+      app = application_argv(application)
 
       case RbConfig::CONFIG['host_os']
       when /mswin|mingw|cygwin/
         # Windows
         if application.include?('code')
-          system("#{application} --goto #{quoted_path}:#{line_number}")
+          run_command([*app, '--goto', "#{path}:#{line}"])
         else
-          system("start \"\" \"#{file_path}\"")
+          run_command(['rundll32', 'url.dll,FileProtocolHandler', path])
         end
       when /darwin/
         # macOS
         if application == 'open'
-          system("open #{quoted_path}")
+          run_command(['open', path])
         elsif application.include?('code')
-          system("#{application} --goto #{quoted_path}:#{line_number}")
+          run_command([*app, '--goto', "#{path}:#{line}"])
         elsif application.include?('vim') || application.include?('nvim')
-          system("#{application} +#{line_number} #{quoted_path}")
+          run_command([*app, "+#{line}", path])
         else
-          system("#{application} #{quoted_path}")
+          run_command([*app, path])
         end
       else
         # Linux/Unix
         if application == 'open'
-          system("xdg-open #{quoted_path}")
+          run_command(['xdg-open', path])
         elsif application.include?('code')
-          system("#{application} --goto #{quoted_path}:#{line_number}")
+          run_command([*app, '--goto', "#{path}:#{line}"])
         elsif application.include?('vim') || application.include?('nvim')
-          system("#{application} +#{line_number} #{quoted_path}")
+          run_command([*app, "+#{line}", path])
         else
-          system("#{application} #{quoted_path}")
+          run_command([*app, path])
         end
       end
     rescue StandardError => e
@@ -109,27 +113,39 @@ module Rufio
       false
     end
 
-    def quote_shell_argument(argument)
-      if argument.include?(' ') || argument.include?("'") || argument.include?('"')
-        '"' + argument.gsub('"', '\"') + '"'
+    # シェルを介さず配列形式で実行する（ファイル名経由のコマンドインジェクション防止）
+    def run_command(argv)
+      system(*argv)
+    end
+
+    # 設定のアプリケーション指定（例: "code -r"）を引数配列に分解する
+    def application_argv(application)
+      if RbConfig::CONFIG['host_os'] =~ /mswin|mingw|cygwin/
+        # Windows のパスはバックスラッシュを含むため POSIX 分割は使わない
+        File.exist?(application) ? [application] : application.split
       else
-        argument
+        Shellwords.split(application)
       end
     end
 
+    # '-' で始まるパスがオプションとして解釈されないようにする
+    def safe_path(path)
+      path.start_with?('-') ? File.join('.', path) : path
+    end
+
     def execute_explorer_command(directory_path)
-      quoted_path = quote_shell_argument(directory_path)
+      path = safe_path(directory_path)
 
       case RbConfig::CONFIG['host_os']
       when /mswin|mingw|cygwin/
         # Windows
-        system("explorer #{quoted_path}")
+        run_command(['explorer', path])
       when /darwin/
         # macOS
-        system("open #{quoted_path}")
+        run_command(['open', path])
       else
         # Linux/Unix
-        system("xdg-open #{quoted_path}")
+        run_command(['xdg-open', path])
       end
     rescue StandardError => e
       warn "Failed to open directory: #{e.message}"

data/lib/rufio/search_controller.rb

@@ -57,7 +57,8 @@ module Rufio
       search_results = nil
       Dir.chdir(current_path) do
         escaped_query = Shellwords.escape(search_query)
-        search_results = `rga --line-number --with-filename #{escaped_query} . 2>/dev/null`
+        # "--" で検索語がオプション（--pre=コマンド 等）として解釈されるのを防ぐ
+        search_results = `rga --line-number --with-filename -- #{escaped_query} . 2>/dev/null`
       end
 
       if search_results.empty?

data/lib/rufio/terminal_ui.rb

@@ -237,7 +237,8 @@ module Rufio
     # Windows: IO.select を使わずキューから取得（5ms タイムアウト）。
     def read_next_input_byte
       if windows?
-        b = windows_queue_pop_with_timeout(0.005)
+        # ConPTY ではバイト到着が遅れることがあるため 5ms では ESC 単体と誤判定する
+        b = windows_queue_pop_with_timeout(0.025)
         b.nil? ? nil : b.chr(Encoding::BINARY)
       else
         STDIN.read_nonblock(1) rescue nil
@@ -280,7 +281,15 @@ module Rufio
     end
 
     # Windows 専用: @input_queue からタイムアウト付きで Integer バイトを取り出す。
+    # Ruby 3.2+ は Queue#pop(timeout:) で正確に待機する（sleep ポーリングは
+    # Windows のタイマー分解能 約15ms により遅延する）。それ以前はポーリング。
+    QUEUE_POP_TIMEOUT_SUPPORTED = Queue.instance_method(:pop).parameters.any? { |_, n| n == :timeout }
+
     def windows_queue_pop_with_timeout(timeout_sec)
+      if QUEUE_POP_TIMEOUT_SUPPORTED
+        return @input_queue.pop(timeout: timeout_sec)
+      end
+
       deadline = Time.now + timeout_sec
       loop do
         begin
@@ -344,10 +353,13 @@ module Rufio
     # ゲームループパターンのmain_loop（CPU最適化版：フレームスキップ対応）
     # UPDATE → DRAW → RENDER → SLEEP のサイクル
     # 変更がない場合は描画をスキップしてCPU使用率を削減
+    MAX_INPUTS_PER_FRAME = 32
+
     def main_loop
       # CPU最適化: 固定FPSをやめて、イベントドリブンに変更
       # 最小スリープ時間（入力チェック間隔）
-      min_sleep_interval = 0.0333  # 30FPS（約33.33ms/フレーム）
+      # Windows は入力をキュー経由で受けるため、入力遅延を抑えるよう短めにする
+      min_sleep_interval = windows? ? 0.008 : 0.0333  # Windows: 約8ms / Unix: 30FPS
       check_interval = 0.1  # バックグラウンドタスクのチェック間隔
 
       # Phase 3: Screen/Rendererを初期化
@@ -402,7 +414,14 @@ module Rufio
 
         # UPDATE phase - ノンブロッキング入力処理
         # 入力があった場合は再描画が必要
-        had_input = handle_input_nonblocking
+        # 1フレームで溜まった入力をまとめて処理し、再描画は1回だけにする
+        # （1フレーム1キーだとキーリピートに追いつけず操作がもたつく）
+        had_input = false
+        MAX_INPUTS_PER_FRAME.times do
+          break unless handle_input_nonblocking
+          had_input = true
+          break unless @running
+        end
         needs_redraw = true if had_input
 
         # バックグラウンドコマンドの完了チェック（0.1秒ごと）

data/lib/rufio/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rufio
-  VERSION = '1.0.2'
+  VERSION = '1.0.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rufio
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - masisz
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-12 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: io-console