davetron5000/methadone — pull request #44 by gchpaco (2012-05-17 21:07:03+00:00)
Title: Something I noticed lacking in methadone's shell support is invoking the shell without involving the shell.  Escaping is error prone and unreliable, I'd rather just use exec properly, which this supports.

Kernel.exec of a string, and anything that calls that (open4, open3,
or indirectly the JVM runtime execs) performs an additional layer of
tokenization; usually this is done by the shell on Unix systems. It
is not difficult to create a difficult to escape string that, when
passed to a shell, will cause some sort of security escalation; as a
simple example imagine running

sh "rm #{file}"

where file could, say, be equal to "-rf /".

To avoid problems like these, this patch permits users to use exec
with an array argument, which is supported by every execution strategy
methadone supports. This will not invoke the shell, and so in this
case

sh "rm", file

would probably return "file '-rf /' not found".

This change should be backwards compatible.