Merge pull request #897 from odaysec/patch-1

fix: Unsafe shell command constructed from library input

Author: rafaelfranca

lib/thor/shell/basic.rb

@@ -372,7 +372,7 @@ def merge(destination, content) #:nodoc:
         Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination)) do |temp|
           temp.write content
           temp.rewind
-          system %(#{merge_tool} "#{temp.path}" "#{destination}")
+          system(merge_tool, temp.path, destination)
         end
       end
 

spec/actions/create_file_spec.rb

@@ -142,7 +142,7 @@ def silence!
           create_file("doc/config.rb")
           allow(@base.shell).to receive(:merge_tool).and_return("meld")
           expect(Thor::LineEditor).to receive(:readline).and_return("m")
-          expect(@base.shell).to receive(:system).with(/meld/)
+          expect(@base.shell).to receive(:system).with("meld", /doc\/config\.rb/, /doc\/config\.rb/)
           invoke!
         end
       end

spec/shell/basic_spec.rb

@@ -553,14 +553,14 @@ def  #456  Lanç...
       it "invokes the merge tool" do
         allow(shell).to receive(:merge_tool).and_return("meld")
         expect(Thor::LineEditor).to receive(:readline).and_return("m")
-        expect(shell).to receive(:system).with(/meld/)
+        expect(shell).to receive(:system).with("meld", /foo/, "foo")
         capture(:stdout) { shell.file_collision("foo") {} }
       end
 
       it "invokes the merge tool that specified at ENV['THOR_MERGE']" do
         allow(ENV).to receive(:[]).with("THOR_MERGE").and_return("meld")
         expect(Thor::LineEditor).to receive(:readline).and_return("m")
-        expect(shell).to receive(:system).with(/meld/)
+        expect(shell).to receive(:system).with("meld", /foo/, "foo")
         capture(:stdout) { shell.file_collision("foo") {} }
       end