bluewallet/BlueWallet
bluewallet/BlueWallet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

FIX: use array form of sh and File.open to avoid shell injection in Fastfile

Browse Source 
Co-authored-by: marcosrdz <4793122+marcosrdz@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-02-22 18:56:30 +00:00
parent 0cf466910f
commit 0ae944abbc
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fastlane/Fastfile
View File

@ -664,7 +664,7 @@ platform :ios do
UI.message("Added multilingual README with first-launch instructions to DMG")
FileUtils.rm_f(dmg_path)
sh("hdiutil create -volname 'BlueWallet' -srcfolder '#{dmg_staging}' -ov -format UDZO '#{dmg_path}'")
sh("hdiutil", "create", "-volname", "BlueWallet", "-srcfolder", dmg_staging, "-ov", "-format", "UDZO", dmg_path)
UI.user_error!("DMG was not created at #{dmg_path}") unless File.exist?(dmg_path)
UI.success("DMG created at: #{dmg_path}")
@ -673,8 +673,10 @@ platform :ios do
ENV['CATALYST_APP_PATH'] = catalyst_app_path
ENV['CATALYST_DMG_PATH'] = dmg_path
if ENV['GITHUB_OUTPUT']
sh("echo 'catalyst_app_path=#{catalyst_app_path}' >> $GITHUB_OUTPUT")
sh("echo 'catalyst_dmg_path=#{dmg_path}' >> $GITHUB_OUTPUT")
File.open(ENV['GITHUB_OUTPUT'], 'a') do |f|
f.puts "catalyst_app_path=#{catalyst_app_path}"
f.puts "catalyst_dmg_path=#{dmg_path}"
end
end
UI.success("macOS app built at: #{catalyst_app_path}")