| 
									
										
										
										
											2021-01-31 14:50:29 -05:00
										 |  |  | # typed: false | 
					
						
							|  |  |  | # frozen_string_literal: true | 
					
						
							|  |  |  | 
 | 
					
						
							| 
									
										
										
										
											2021-03-17 15:27:26 +00:00
										 |  |  | require "rubocops/shell_commands" | 
					
						
							| 
									
										
										
										
											2021-01-31 14:50:29 -05:00
										 |  |  | 
 | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  | module RuboCop | 
					
						
							|  |  |  |   module Cop | 
					
						
							| 
									
										
										
										
											2021-04-14 16:08:37 +01:00
										 |  |  |     module Homebrew | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |       describe ShellCommands do | 
					
						
							|  |  |  |         subject(:cop) { described_class.new } | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |         context "when auditing shell commands" do | 
					
						
							|  |  |  |           it "reports and corrects an offense when `system` arguments should be separated" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   system "foo bar" | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                          ^^^^^^^^^ Homebrew/ShellCommands: Separate `system` commands into `"foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   system "foo", "bar" | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports and corrects an offense when `system` arguments involving interpolation should be separated" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   system "\#{bin}/foo bar" | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                          ^^^^^^^^^^^^^^^^ Homebrew/ShellCommands: Separate `system` commands into `"\#{bin}/foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   system "\#{bin}/foo", "bar" | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports no offenses when `system` with metacharacter arguments are called" do | 
					
						
							|  |  |  |             expect_no_offenses(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   system "foo bar > baz" | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports no offenses when trailing arguments to `system` are unseparated" do | 
					
						
							|  |  |  |             expect_no_offenses(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   system "foo", "bar baz" | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports no offenses when `Utils.popen` arguments are unseparated" do | 
					
						
							|  |  |  |             expect_no_offenses(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen("foo bar") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports and corrects an offense when `Utils.popen_read` arguments are unseparated" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read("foo bar") | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                                    ^^^^^^^^^ Homebrew/ShellCommands: Separate `Utils.popen_read` commands into `"foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read("foo", "bar") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports and corrects an offense when `Utils.safe_popen_read` arguments are unseparated" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.safe_popen_read("foo bar") | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                                         ^^^^^^^^^ Homebrew/ShellCommands: Separate `Utils.safe_popen_read` commands into `"foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.safe_popen_read("foo", "bar") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports and corrects an offense when `Utils.popen_write` arguments are unseparated" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_write("foo bar") | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                                     ^^^^^^^^^ Homebrew/ShellCommands: Separate `Utils.popen_write` commands into `"foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_write("foo", "bar") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports and corrects an offense when `Utils.safe_popen_write` arguments are unseparated" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.safe_popen_write("foo bar") | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                                          ^^^^^^^^^ Homebrew/ShellCommands: Separate `Utils.safe_popen_write` commands into `"foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.safe_popen_write("foo", "bar") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports and corrects an offense when `Utils.popen_read` arguments with interpolation are unseparated" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read("\#{bin}/foo bar") | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                                    ^^^^^^^^^^^^^^^^ Homebrew/ShellCommands: Separate `Utils.popen_read` commands into `"\#{bin}/foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read("\#{bin}/foo", "bar") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports no offenses when `Utils.popen_read` arguments with metacharacters are unseparated" do | 
					
						
							|  |  |  |             expect_no_offenses(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read("foo bar > baz") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports no offenses when trailing arguments to `Utils.popen_read` are unseparated" do | 
					
						
							|  |  |  |             expect_no_offenses(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read("foo", "bar baz") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports and corrects an offense when `Utils.popen_read` arguments are unseparated after a shell env" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read({ "SHELL" => "bash"}, "foo bar") | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                                                          ^^^^^^^^^ Homebrew/ShellCommands: Separate `Utils.popen_read` commands into `"foo", "bar"` | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |             expect_correction(<<~RUBY) | 
					
						
							|  |  |  |               class Foo < Formula | 
					
						
							|  |  |  |                 def install | 
					
						
							|  |  |  |                   Utils.popen_read({ "SHELL" => "bash"}, "foo", "bar") | 
					
						
							|  |  |  |                 end | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  |         end | 
					
						
							|  |  |  |       end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |       describe ExecShellMetacharacters do | 
					
						
							|  |  |  |         subject(:cop) { described_class.new } | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |         context "when auditing exec calls" do | 
					
						
							|  |  |  |           it "reports aan offense when output piping is used" do | 
					
						
							|  |  |  |             expect_offense(<<~RUBY) | 
					
						
							|  |  |  |               fork do | 
					
						
							|  |  |  |                 exec "foo bar > output" | 
					
						
							| 
									
										
										
										
											2023-04-07 17:16:48 +01:00
										 |  |  |                      ^^^^^^^^^^^^^^^^^^ Homebrew/ExecShellMetacharacters: Don't use shell metacharacters in `exec`. Implement the logic in Ruby instead, using methods like `$stdout.reopen`. | 
					
						
							| 
									
										
										
										
											2021-05-03 20:25:03 +01:00
										 |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  | 
 | 
					
						
							|  |  |  |           it "reports no offenses when no metacharacters are used" do | 
					
						
							|  |  |  |             expect_no_offenses(<<~RUBY) | 
					
						
							|  |  |  |               fork do | 
					
						
							|  |  |  |                 exec "foo bar" | 
					
						
							|  |  |  |               end | 
					
						
							|  |  |  |             RUBY | 
					
						
							|  |  |  |           end | 
					
						
							|  |  |  |         end | 
					
						
							|  |  |  |       end | 
					
						
							| 
									
										
										
										
											2021-01-31 14:50:29 -05:00
										 |  |  |     end | 
					
						
							|  |  |  |   end | 
					
						
							|  |  |  | end |