SECUIRTY: Escape input made to system calls.

lib/backup_restore/backuper.rb

@@ -199,8 +199,8 @@ module BackupRestore
       log "Finalizing database dump file: #{@backup_filename}"
 
       execute_command(
-        "mv #{@dump_filename} #{File.join(@archive_directory, @backup_filename)}",
+        'mv', @dump_filename, File.join(@archive_directory, @backup_filename),
-        "Failed to move database dump file."
+        failure_message: "Failed to move database dump file."
       )
 
       remove_tmp_directory
@@ -212,17 +212,17 @@ module BackupRestore
       tar_filename = "#{@archive_basename}.tar"
 
       log "Making sure archive does not already exist..."
-      execute_command("rm -f #{tar_filename}")
+      execute_command('rm', '-f', tar_filename)
-      execute_command("rm -f #{tar_filename}.gz")
+      execute_command('rm', '-f', "#{tar_filename}.gz")
 
       log "Creating empty archive..."
-      execute_command("tar --create --file #{tar_filename} --files-from /dev/null")
+      execute_command('tar', '--create', '--file', tar_filename, '--files-from', '/dev/null')
 
       log "Archiving data dump..."
-      FileUtils.cd(File.dirname("#{@dump_filename}")) do
+      FileUtils.cd(File.dirname(@dump_filename)) do
         execute_command(
-          "tar --append --dereference --file #{tar_filename} #{File.basename(@dump_filename)}",
+          'tar', '--append', '--dereference', '--file', tar_filename, File.basename(@dump_filename),
-          "Failed to archive data dump."
+          failure_message: "Failed to archive data dump."
         )
       end
 
@@ -232,8 +232,8 @@ module BackupRestore
       FileUtils.cd(File.join(Rails.root, "public")) do
         if File.directory?(upload_directory)
           execute_command(
-            "tar --append --dereference --file #{tar_filename} #{upload_directory}",
+            'tar', '--append', '--dereference', '--file', tar_filename, upload_directory,
-            "Failed to archive uploads."
+            failure_message: "Failed to archive uploads."
           )
         else
           log "No uploads found, skipping archiving uploads..."
@@ -243,7 +243,7 @@ module BackupRestore
       remove_tmp_directory
 
       log "Gzipping archive, this may take a while..."
-      execute_command("gzip -5 #{tar_filename}", "Failed to gzip archive.")
+      execute_command('gzip', '-5', tar_filename, failure_message: "Failed to gzip archive.")
     end
 
     def after_create_hook
@@ -277,7 +277,7 @@ module BackupRestore
 
     def remove_tar_leftovers
       log "Removing '.tar' leftovers..."
-      `rm -f #{@archive_directory}/*.tar`
+      system('rm', '-f', "#{@archive_directory}/*.tar")
     end
 
     def remove_tmp_directory

lib/backup_restore/restorer.rb

@@ -115,7 +115,7 @@ module BackupRestore
       # For backwards compatibility
       @dump_filename =
         if @is_archive
-          if system("tar --list --file #{@source_filename} #{BackupRestore::OLD_DUMP_FILE}")
+          if system('tar', '--list', '--file', @source_filename, BackupRestore::OLD_DUMP_FILE)
             File.join(@tmp_directory, BackupRestore::OLD_DUMP_FILE)
           else
             File.join(@tmp_directory, BackupRestore::DUMP_FILE)
@@ -176,7 +176,7 @@ module BackupRestore
 
     def copy_archive_to_tmp_directory
       log "Copying archive to tmp directory..."
-      execute_command("cp '#{@source_filename}' '#{@archive_filename}'", "Failed to copy archive to tmp directory.")
+      execute_command('cp', @source_filename, @archive_filename, failure_message: "Failed to copy archive to tmp directory.")
     end
 
     def unzip_archive
@@ -185,7 +185,7 @@ module BackupRestore
       log "Unzipping archive, this may take a while..."
 
       FileUtils.cd(@tmp_directory) do
-        execute_command("gzip --decompress '#{@archive_filename}'", "Failed to unzip archive.")
+        execute_command('gzip', '--decompress', @archive_filename, failure_message: "Failed to unzip archive.")
       end
     end
 
@@ -193,11 +193,11 @@ module BackupRestore
       log "Extracting metadata file..."
 
       @metadata =
-        if system("tar --list --file #{@source_filename} #{BackupRestore::METADATA_FILE}")
+        if system('tar', '--list', '--file', @source_filename, BackupRestore::METADATA_FILE)
           FileUtils.cd(@tmp_directory) do
             execute_command(
-              "tar --extract --file '#{@tar_filename}' #{BackupRestore::METADATA_FILE}",
+              'tar', '--extract', '--file', @tar_filename, BackupRestore::METADATA_FILE,
-              "Failed to extract metadata file."
+              failure_message: "Failed to extract metadata file."
             )
           end
 
@@ -232,8 +232,8 @@ module BackupRestore
 
       FileUtils.cd(@tmp_directory) do
         execute_command(
-          "tar --extract --file '#{@tar_filename}' #{File.basename(@dump_filename)}",
+          'tar', '--extract', '--file', @tar_filename, File.basename(@dump_filename),
-          "Failed to extract dump file."
+          failure_message: "Failed to extract dump file."
         )
       end
     end
@@ -362,8 +362,8 @@ module BackupRestore
         log "Extracting uploads..."
         FileUtils.cd(File.join(Rails.root, "public")) do
           execute_command(
-            "tar --extract --keep-newer-files --file '#{@tar_filename}' uploads/",
+            'tar', '--extract', '--keep-newer-files', '--file', @tar_filename, 'uploads/',
-            "Failed to extract uploads."
+            failure_message: "Failed to extract uploadsd."
           )
         end
       end

lib/backup_restore/utils.rb

@@ -1,14 +1,16 @@
+require 'open3'
+
 module BackupRestore
   module Utils
-    def execute_command(command, failure_message = "")
+    def execute_command(*command, failure_message: "")
-      output = `#{command} 2>&1`
+      stdout, stderr, status = Open3.capture3(*command)
 
-      if !$?.success?
+      if !status.success?
         failure_message = "#{failure_message}\n" if !failure_message.blank?
-        raise "#{failure_message}#{output}"
+        raise "#{failure_message}#{stderr}"
       end
 
-      output
+      stdout
     end
 
     def pretty_logs(logs)