fix: Unsafe shell command constructed from library input

[opsysdebug]

Dynamically constructing a shell command with inputs from exported functions may inadvertently change the meaning of the shell command. Clients using the exported function may use inputs containing characters that the shell interprets in a special way, for instance quotes and spaces. This can result in the shell command misbehaving, or even allowing a malicious user to execute arbitrary commands on the system.

def run(merge_tool, destination)
  system %(#{merge_tool} "#{temp.path}" "#{destination}") 
end

[email protected]

[rafaelfranca]

Wait I sec, why was a CVE emitted for this fix? None of the maintainers requested it. I don't think there is a CVE here. Thor is a CLI tool and this is used for used controller input, not random input from the internet. In fact, I'm thinking about reverting this change because it breaks the use case it was made to, that is allow people to configure merge tools to resolve conflicts. See #909