App#save_password: Shell escape passwordshell-escape-passwords

Escape special shell characters so that passwords with single quotes can
be saved to the keychain. Otherwise, the single quotes surrounding the
"-w '%s'" cause an error on passwords with single quotes.

I know testing private methods is not recommended, but this seemed like
something that would be good to test. Maybe the method should be made
public if that's a concern?

1 files changed, 3 insertions, 2 deletions

diff --git a/lib/hcl/app.rb b/lib/hcl/app.rb
index 4f2530b..ab8ef5d 100644
--- a/lib/hcl/app.rb
+++ b/lib/hcl/app.rb
@@ -1,5 +1,6 @@
 require 'yaml'
 require 'fileutils'
+require 'shellwords'
 
 require 'trollop'
 require 'highline/import'
@@ -226,10 +227,10 @@ EOM
     end
 
     def save_password config
-      if system("security add-internet-password -U -l hcl -a '%s' -s '%s.harvestapp.com' -w '%s'" % [
+      if system("security add-internet-password -U -l hcl -a '%s' -s '%s.harvestapp.com' -w %s" % [
         config['login'],
         config['subdomain'],
-        config['password'],
+        Shellwords.escape(config['password']),
       ]) then config.delete('password') end
     end
   end