Skip to content

Commit

Permalink
Fix escape of filenames in bundle doctor
Browse files Browse the repository at this point in the history
  • Loading branch information
ooooooo-q committed Nov 27, 2021
1 parent 1e12c5d commit 3ede143
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 2 deletions.
5 changes: 3 additions & 2 deletions bundler/lib/bundler/cli/doctor.rb
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# frozen_string_literal: true

require "rbconfig"
require "shellwords"

module Bundler
class CLI::Doctor
Expand All @@ -22,14 +23,14 @@ def ldd_available?
end

def dylibs_darwin(path)
output = `/usr/bin/otool -L "#{path}"`.chomp
output = `/usr/bin/otool -L #{path.shellescape}`.chomp
dylibs = output.split("\n")[1..-1].map {|l| l.match(DARWIN_REGEX).captures[0] }.uniq
# ignore @rpath and friends
dylibs.reject {|dylib| dylib.start_with? "@" }
end

def dylibs_ldd(path)
output = `/usr/bin/ldd "#{path}"`.chomp
output = `/usr/bin/ldd #{path.shellescape}`.chomp
output.split("\n").map do |l|
match = l.match(LDD_REGEX)
next if match.nil?
Expand Down
10 changes: 10 additions & 0 deletions bundler/spec/commands/doctor_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -133,4 +133,14 @@
end
end
end

context "when home contains filesname with special characters" do
it "escape filename before command execute" do
doctor = Bundler::CLI::Doctor.new({})
expect(doctor).to receive(:`).with("/usr/bin/otool -L \\$\\(date\\)\\ \\\"\\'\\\\.bundle").and_return("dummy string")
doctor.dylibs_darwin('$(date) "\'\.bundle')
expect(doctor).to receive(:`).with("/usr/bin/ldd \\$\\(date\\)\\ \\\"\\'\\\\.bundle").and_return("dummy string")
doctor.dylibs_ldd('$(date) "\'\.bundle')
end
end
end

0 comments on commit 3ede143

Please sign in to comment.