Merge branch 'ameyadarshan-master-patch-18206' into 'master'

Ensure Gitlab::Popen raises error for incorrect arguments

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/146844



Merged-by: Kassio Borges <kborges@gitlab.com>
Approved-by: Kassio Borges <kborges@gitlab.com>
Reviewed-by: Aditya Tiwari <atiwari@gitlab.com>
Co-authored-by: Aditya Tiwari <atiwari@gitlab.com>
Co-authored-by: Ameya Darshan <adarshan@gitlab.com>

lib/gitlab/popen.rb

@@ -31,6 +31,10 @@ def popen_with_detail(cmd, path = nil, vars = {})
         raise "System commands must be given as an array of strings"
       end
 
+      if cmd.one? && cmd.first.match?(/\s/)
+        raise "System commands must be split into an array of space-separated values"
+      end
+
       path ||= Dir.pwd
       vars['PWD'] = path
       options = { chdir: path }

spec/lib/gitlab/popen_spec.rb

@@ -57,6 +57,12 @@
     end
   end
 
+  context 'unsafe array command' do
+    it 'raises an error when it gets called with an unsafe array' do
+      expect { @klass.new.popen(['ls -l'], path) }.to raise_error(RuntimeError)
+    end
+  end
+
   context 'with custom options' do
     let(:vars) { { 'foobar' => 123, 'PWD' => path } }
     let(:options) { { chdir: path } }