Commits on Oct 11, 2022

1. Call IO.popen with an Array of command arguments (#518). …

   * By calling `IO.popen` with an Array of command arguments
     (ex: `['ls', '-l', ...]`) it runs the command as a separate process
     instead of running it in a sub-shell as a shell command. This prevents
     any arbitrary command injection or env variable interpolation, without
     needing complex shell-escaping logic.
     https://ruby-doc.org/core-3.1.2/IO.html#method-c-popen
   * Changed `Configuration#executable` to return a String or an Array for
     when xvfb mode is enabled.
   * Changed `PDFKit#command` to return an Array of command arguments for
     `IO.popen`.
   * Removed argument quoting logic as it's not necessary when calling
     `IO.popen` with an Array of arguments.
   * Rewrote some specs to test if the command's Array of arguments contains
     specific argument values.
   * Added a custom RSpec `contain` matcher for testing if an expected Array
     exists within another Array.

   

   postmodern committed Oct 11, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for c9bf248
   • Browse repository at this point

   Copy the full SHA

   c9bf248 View commit details

   Browse the repository at this point in the history