gitlabhq/grack — pull request #3 by jacobvosmaer (2014-02-20 18:55:27+00:00)
Title: Safer shell command invocations

This PR contains the following changes:
- Split commands in tokens using Ruby rather than the shell (to avoid `sh -c "some string I just interpolated"`);
- Keep the process running `Grack::Server` in the same working directory, and only let the subprocesses (system commands) `cd` into another directory;
- Restrict the environment variables passed to Git processes to a minimum: only pass `$PATH`, so that the update hook of gitlab-shell can find `/usr/bin/env ruby`.

/cc @randx @dosire