Wrap suggested patched versions in quotes

rubysec · Mar 2, 2022 · 017d1f5 · 017d1f5
1 parent 9cb6320
commit 017d1f5
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/lib/bundler/audit/cli/formats/junit.rb b/lib/bundler/audit/cli/formats/junit.rb
@@ -101,7 +101,7 @@ def bundle_title(result)
 
           def advisory_solution(advisory)
             unless advisory.patched_versions.empty?
-              "upgrade to #{advisory.patched_versions.join(' or ')}"
+              "upgrade to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}"
             else
               "remove or disable this gem until a patch is available!"
             end

diff --git a/lib/bundler/audit/cli/formats/text.rb b/lib/bundler/audit/cli/formats/text.rb
@@ -105,7 +105,7 @@ def print_advisory(gem, advisory)
 
             unless advisory.patched_versions.empty?
               say "Solution: upgrade to ", :red
-              say advisory.patched_versions.join(" or ")
+              say advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')
             else
               say "Solution: ", :red
               say "remove or disable this gem until a patch is available!", [:red, :bold]

diff --git a/spec/cli/formats/junit_spec.rb b/spec/cli/formats/junit_spec.rb
@@ -241,7 +241,7 @@
 
         context "when Advisory#patched_versions is not empty" do
           it 'must print "Solution: upgrade to ..."' do
-            expect(output).to include("Solution: upgrade to #{CGI.escapeHTML(advisory.patched_versions.join(' or '))}")
+            expect(output).to include("Solution: upgrade to #{CGI.escapeHTML(advisory.patched_versions.map { |v| "'#{v}'" }.join(', '))}")
           end
         end
 

diff --git a/spec/cli/formats/text_spec.rb b/spec/cli/formats/text_spec.rb
@@ -230,7 +230,7 @@
 
         context "when Advisory#patched_versions is not empty" do
           it 'must print "Solution: upgrade to ..."' do
-            expect(output_lines).to include("Solution: upgrade to #{advisory.patched_versions.join(' or ')}")
+            expect(output_lines).to include("Solution: upgrade to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}")
           end
         end