spoom 1.8.8 → 1.8.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f156e3fd1596713d8fb893ba5e4e0cdc127fc9ee1a21006c751773178e4eb1d3
-  data.tar.gz: 84ce5c28958b0fe1b45251336dc283e005738b3c0d280a7f8cb5b643d4b8e8da
+  metadata.gz: 97cf397397aa58c2322089f795e390e7b7946445966fc341dd6a8566ae9b8ded
+  data.tar.gz: e42da92b60a476c7ed03116b9ce1c780fc59ec133b02ed73a6f501a0bb162359
 SHA512:
-  metadata.gz: 98c8db47ce06755ac7ca5b3426f4f0413d611297240f28d19e767f3c76230c5ed963f54e51b092b6d5361f41b4c7a000423355ef4d4eb445d6ebe334c870c5f5
-  data.tar.gz: 4c7a33cef72bc373fe5f7bd9f3230669d301baab006a26f5ce7c0483d627e3dd01e30b5a215282d3c537c77b10b5cc20eff739259bec6bfbb55851b6a654eb39
+  metadata.gz: eefa8467cecb02ee37700b60ba0d6570e90650a3a148992aeecf42e605ea51a787dfa4e0b08c31ae4c48f26b715bd13a21aba40197f10f63dfeef935378399e9
+  data.tar.gz: ae699ed2ce340106b923744a6b3583fe32c6ecd67c8b8dca16d750d32f2c13e95c0d11a11410d8587852d1a77caedd974f88ba18cd3a21166486114bacc3135e

data/lib/spoom/cli/deadcode.rb

@@ -158,7 +158,7 @@ module Spoom
         new_source = remover.remove_location(nil, location)
         context.write!("PATCH", new_source)
 
-        diff = context.exec("diff -u #{location.file} PATCH")
+        diff = context.exec("diff -u #{location.file.shellescape} PATCH")
         $stderr.puts T.must(diff.out.lines[2..-1]).join
         context.remove!("PATCH")
 

data/lib/spoom/context/git.rb

@@ -1,6 +1,8 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "shellwords"
+
 module Spoom
   module Git
     class Commit
@@ -52,7 +54,7 @@ module Spoom
       #: (?branch: String?) -> ExecResult
       def git_init!(branch: nil)
         if branch
-          git("init -b #{branch}")
+          git("init -b #{branch.shellescape}")
         else
           git("init")
         end
@@ -61,16 +63,16 @@ module Spoom
       # Run `git checkout` in this context directory
       #: (?ref: String) -> ExecResult
       def git_checkout!(ref: "main")
-        git("checkout #{ref}")
+        git("checkout #{ref.shellescape}")
       end
 
       # Run `git checkout -b <branch-name> <ref>` in this context directory
       #: (String branch_name, ?ref: String?) -> ExecResult
       def git_checkout_new_branch!(branch_name, ref: nil)
         if ref
-          git("checkout -b #{branch_name} #{ref}")
+          git("checkout -b #{branch_name.shellescape} #{ref.shellescape}")
         else
-          git("checkout -b #{branch_name}")
+          git("checkout -b #{branch_name.shellescape}")
         end
       end
 
@@ -79,10 +81,10 @@ module Spoom
       def git_commit!(message: "message", time: Time.now.utc, allow_empty: false)
         git("add --all")
 
-        args = ["-m '#{message}'", "--date '#{time}'"]
+        args = ["-m #{message.shellescape}", "--date #{time.to_s.shellescape}"]
         args << "--allow-empty" if allow_empty
 
-        exec("GIT_COMMITTER_DATE=\"#{time}\" git -c commit.gpgsign=false commit #{args.join(" ")}")
+        exec("GIT_COMMITTER_DATE=#{time.to_s.shellescape} git -c commit.gpgsign=false commit #{args.join(" ")}")
       end
 
       # Get the current git branch in this context directory
@@ -120,7 +122,7 @@ module Spoom
       # Run `git push <remote> <ref>` in this context directory
       #: (String remote, String ref, ?force: bool) -> ExecResult
       def git_push!(remote, ref, force: false)
-        git("push #{force ? "-f" : ""} #{remote} #{ref}")
+        git("push #{force ? "-f" : ""} #{remote.shellescape} #{ref.shellescape}")
       end
 
       #: (*String arg) -> ExecResult

data/lib/spoom/file_collector.rb

@@ -1,6 +1,8 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "open3"
+
 module Spoom
   class FileCollector
     #: Array[String]
@@ -94,7 +96,15 @@ module Spoom
     #: (String path) -> String?
     def mime_type_for(path)
       # The `file` command appears to be hanging on MacOS for some files so we timeout after 1s.
-      %x{timeout 1s file --mime-type -b '#{path}'}.split("; ").first&.strip
+      #
+      # The arguments are passed straight to the process instead of being interpolated into a
+      # shell command: `path` comes from the scanned directory, so a crafted file name could
+      # escape any quoting we applied ourselves and run as a command.
+      out, _status = Open3.capture2("timeout", "1s", "file", "--mime-type", "-b", path)
+      out.split("; ").first&.strip
+    rescue Errno::ENOENT
+      # `timeout` isn't part of a stock MacOS install. The shell used to swallow that for us.
+      nil
     end
   end
 end

data/lib/spoom/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Spoom
-  VERSION = "1.8.8"
+  VERSION = "1.8.9"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spoom
 version: !ruby/object:Gem::Version
-  version: 1.8.8
+  version: 1.8.9
 platform: ruby
 authors:
 - Alexandre Terrasa