Skip to content

Conversation

@jsonbailey
Copy link
Contributor

@jsonbailey jsonbailey commented Dec 5, 2025

Tracked Internally: SDK-1675

Note

Replace IO.read with File.read in FileDataSourceImpl and add tests ensuring filenames aren’t executed as shell commands.

  • File reading:
    • Replace IO.read(path) with File.read(path) in lib/ldclient-rb/impl/integrations/file_data_source.rb for direct, shell-free file access.
  • Tests:
    • Add spec to verify malicious filenames (with shell metacharacters) are treated as literal paths and do not trigger command execution in spec/integrations/file_data_source_spec.rb.

Written by Cursor Bugbot for commit b38011c. This will update automatically on new commits. Configure here.

@jsonbailey jsonbailey requested a review from a team as a code owner December 5, 2025 17:28
@jsonbailey jsonbailey merged commit 9ca4b98 into main Dec 5, 2025
11 checks passed
@jsonbailey jsonbailey deleted the jb/prevent-io-injection branch December 5, 2025 17:40
jsonbailey pushed a commit that referenced this pull request Dec 5, 2025
🤖 I have created a release *beep* *boop*
---


##
[8.11.2](8.11.1...8.11.2)
(2025-12-05)


### Bug Fixes

* Fix diagnostic logging for connection results in stream
([#343](#343))
([d49eaa8](d49eaa8))
* Prevent command injection in FileDataSourceImpl
([#341](#341))
([9ca4b98](9ca4b98))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Bumps SDK to 8.11.2, updates changelog with two bug fixes, and
refreshes provenance instructions.
> 
> - **Version bump**:
>   - Update `lib/ldclient-rb/version.rb` to `8.11.2`.
>   - Update `.release-please-manifest.json` to `8.11.2`.
>   - Update `PROVENANCE.md` `SDK_VERSION` to `8.11.2`.
> - **Documentation**:
> - Add `8.11.2` entry to `CHANGELOG.md` noting bug fixes: diagnostic
logging for stream connection results; prevent command injection in
`FileDataSourceImpl`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
bbadc19. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants