Pass EDITOR arguments as an array to system

lib/hammer_cli/utils.rb

@@ -1,4 +1,5 @@
 require 'highline'
+require 'shellwords'
 require 'tempfile'
 
 class String
@@ -91,7 +92,8 @@ def self.open_in_editor(content, content_type: '', tempdir: '/tmp', suffix: '.tm
     Tempfile.open([content_type, suffix], tempdir) do |f|
       f.write(content)
       f.rewind
-      system("#{ENV['EDITOR'] || 'vi'} #{f.path}")
+      editor = Shellwords.split(ENV['EDITOR'] || 'vi')
+      system(*editor, f.path)
       result = f.read
     end
     result

lib/hammer_cli/version.rb

@@ -1,5 +1,5 @@
 module HammerCLI
   def self.version
-    @version ||= Gem::Version.new "5.0.0"
+    @version ||= Gem::Version.new "5.0.1"
   end
 end

test/unit/utils_test.rb

@@ -195,4 +195,39 @@ class X
       assert_equal(arr, [:a, 1, 2, 3, :b, :c])
     end
   end
+
+  describe 'open_in_editor' do
+    it 'uses array-based system call to prevent shell injection' do
+      ENV.stubs(:[]).with('EDITOR').returns('vi')
+      HammerCLI.expects(:system).with('vi', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'splits EDITOR with arguments into array form' do
+      ENV.stubs(:[]).with('EDITOR').returns('code --wait')
+      HammerCLI.expects(:system).with('code', '--wait', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'falls back to vi when EDITOR is not set' do
+      ENV.stubs(:[]).with('EDITOR').returns(nil)
+      HammerCLI.expects(:system).with('vi', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'does not pass shell metacharacters to a shell interpreter' do
+      ENV.stubs(:[]).with('EDITOR').returns('vi; echo INJECTED')
+      # Shellwords.split treats the semicolon as a literal character,
+      # producing ["vi;", "echo", "INJECTED"] - no shell is invoked
+      HammerCLI.expects(:system).with('vi;', 'echo', 'INJECTED', anything).once.returns(true)
+      HammerCLI.open_in_editor('test content')
+    end
+
+    it 'returns original content when editor does not modify the file' do
+      ENV.stubs(:[]).with('EDITOR').returns('true')
+      HammerCLI.stubs(:system).returns(true)
+      result = HammerCLI.open_in_editor('original content')
+      assert_equal 'original content', result
+    end
+  end
 end