timet 1.5.8 → 1.5.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0426dff5bb0b43529afe26f4f3f9f751a43c8ce59a76add257c4da1dceda91e
-  data.tar.gz: 5bb737c4d928d378997df4e40543e52dd7c2eb631beea39f1c3e8dc3c0231b9b
+  metadata.gz: 9e5079b49daa5deed838350e66235ce5301518e928a478f405423f268e431390
+  data.tar.gz: e7ef91dd990022437605bdfe406387e1499b9d08de5f6c233211332d9cb5ea0d
 SHA512:
-  metadata.gz: 900a95c16f624f45c314af3edacefd58902c5225a0cde0010350ed9b57a83ed69345a7c3744935f082793a8f010efe0d87c5d81d7bee2c621542746a19bb2f96
-  data.tar.gz: 34c77eb47e0f443f33930cb037febdd0b0d298370f56f3553b861b9aff321edc6aed632df055359a924db5a77d86c3cbf967249cc66e308a3fcc8e94eef58626
+  metadata.gz: a6f4a1db83a82e0a0e53787a1b8847b7ceaa2694e0e4fbe318271bfc00a33c078d525d832f3be0b136d11c9b4a580ff3648ef9a1064e8921be6d7e79cb59c910
+  data.tar.gz: 7cd3c8513a161e3864501cec96317b833bdda14d937779b97d0feb680a894284f34d7427ba1197ad8ca0a721ede075b13b549489e5beaaa1cbfb751fa71f927f

data/.deepsource.toml

@@ -0,0 +1,13 @@
+version = 1
+
+[[analyzers]]
+name = "ruby"
+enabled = true
+
+[[analyzers]]
+name = "test-coverage"
+enabled = true
+
+[coverage]
+reporter = "simplecov"
+paths = ["coverage/.resultset.json"]

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [1.5.9] - 2025-07-30
+
+**Improvements:**
+
+- Replaced Code Climate with DeepSource for static analysis and test coverage reporting.
+- Updated the CI workflow by removing Code Climate steps and adding a .deepsource.toml configuration file.
+- Updated gem dependencies, including rubocop, thor, and various aws-sdk gems.
+- Refactored application.rb to use abort for more idiomatic error handling on invalid arguments.
+- Updated the README to replace the old Code Climate badges with a new DeepSource badge.
+
+**Bug fixes:**
+
+- Fixed a shell injection vulnerability in application_helper.rb by properly escaping notification messages using Shellwords.shellescape.
+- Corrected a timezone-related issue in time_validation_helper.rb by using Time.now.getlocal for future date validation.
+
 ## [1.5.8] - 2025-06-28
 
 **Improvements:**

data/README.md

@@ -1,8 +1,6 @@
 [![Gem Version](https://badge.fury.io/rb/timet.svg)](https://badge.fury.io/rb/timet)
 ![timet workflow](https://github.com/frankvielma/timet/actions/workflows/ci.yml/badge.svg)
-[![Maintainability](https://api.codeclimate.com/v1/badges/44d57b6c561b9be717f5/maintainability)](https://codeclimate.com/github/frankvielma/timet/maintainability)
-[![Test Coverage](https://api.codeclimate.com/v1/badges/44d57b6c561b9be717f5/test_coverage)](https://codeclimate.com/github/frankvielma/timet/test_coverage)
-
+[![DeepSource](https://app.deepsource.com/gh/frankvielma/timet.svg/?label=active+issues&show_trend=true&token=RV8_VCNrXIfEU7NL9mk9MSuP)](https://app.deepsource.com/gh/frankvielma/timet/)
 # Timet
 
 ![Timet](timet.webp)

data/lib/timet/application.rb

@@ -85,8 +85,7 @@ module Timet
           if VALID_ARGUMENTS.include?(command_name)
             @db = Database.new
           else
-            warn 'Invalid arguments provided. Please check your input.'
-            exit(1)
+            abort 'Invalid arguments provided. Please check your input.'
           end
         end
       end

data/lib/timet/application_helper.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'shellwords'
+
 module Timet
   # Provides helper methods for the Timet application.
   module ApplicationHelper
@@ -109,7 +111,8 @@ module Timet
     # @param tag [String] A tag or label for the session, used in the notification message.
     # @return [void]
     def run_linux_session(time, tag)
-      notification_command = "notify-send --icon=clock '#{show_message(tag)}'"
+      escaped_message = Shellwords.shellescape(show_message(tag))
+      notification_command = "notify-send --icon=clock #{escaped_message}"
       command = "sleep #{time} && tput bel && tt stop 0 && #{notification_command} &"
       pid = Kernel.spawn(command)
       Process.detach(pid)
@@ -121,7 +124,10 @@ module Timet
     # @param _tag [String] A tag or label for the session, not used in the notification message on macOS.
     # @return [void]
     def run_mac_session(time, tag)
-      notification_command = "osascript -e 'display notification \"#{show_message(tag)}\"'"
+      # Escape double quotes and backslashes for AppleScript, then shell-escape the entire AppleScript command
+      escaped_message_for_applescript = show_message(tag).gsub('\\', '\\\\').gsub('"', '\"')
+      escaped_applescript_command = Shellwords.shellescape("display notification \"#{escaped_message_for_applescript}\"")
+      notification_command = "osascript -e #{escaped_applescript_command}"
       command = "sleep #{time} && afplay /System/Library/Sounds/Basso.aiff && tt stop 0 && #{notification_command} &"
       pid = Kernel.spawn(command)
       Process.detach(pid)

data/lib/timet/time_validation_helper.rb

@@ -103,9 +103,10 @@ module Timet
     #
     # @raise [ArgumentError] If the new datetime is in the future.
     def validate_future_date(new_datetime)
-      return unless new_datetime > Time.now
+      # Ensure the new datetime is not in the future relative to the current time.
+      return unless new_datetime > Time.now.getlocal
 
-      raise ArgumentError, "Cannot set time to a future date: #{new_datetime.strftime('%Y-%m-%d %H:%M:%S')}"
+      raise ArgumentError, "Cannot set time to a future date or time: #{new_datetime.strftime('%Y-%m-%d %H:%M:%S')}"
     end
 
     # Validates that the difference between two timestamps is less than 24 hours.

data/lib/timet/version.rb

@@ -6,6 +6,6 @@ module Timet
   # @return [String] The version number in the format 'major.minor.patch'.
   #
   # @example Get the version of the Timet application
-  #   Timet::VERSION # => '1.5.8'
-  VERSION = '1.5.8'
+  #   Timet::VERSION # => '1.5.9'
+  VERSION = '1.5.9'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: timet
 version: !ruby/object:Gem::Version
-  version: 1.5.8
+  version: 1.5.9
 platform: ruby
 authors:
 - Frank Vielma
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-06-28 00:00:00.000000000 Z
+date: 2025-07-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -123,6 +123,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- ".deepsource.toml"
 - ".reek.yml"
 - ".rspec"
 - ".rubocop.yml"