Rubyipmi: red hat satellite: remote code execution in rubyipmi via malicious bmc username

@@ -66,7 +66,7 @@ def run
       logger.debug(makecommand) if logger
       begin
         command = makecommand
-        @lastcall = command.to_s
+        @lastcall = command
         @result, @result_err, status = Rubyipmi.capture3(command)
         # sometimes the command tool does not return the correct result, validate it with additional code
         process_status = validate_status(status)

@@ -25,9 +25,9 @@ def makecommand
         else
           "--#{k}=#{v}"
         end
-      end.join(" ")
+      end
 
-      "#{cmd} #{args.rstrip}"
+      [cmd] + args.compact
     end
 
     # This method will check if the results are really valid as the exit code can be misleading and incorrect

@@ -15,19 +15,19 @@ def max_retry_count
     end
 
     def makecommand
-      args = ''
+      args = []
       # need to format the options to ipmitool format
       @options.each do |k, v|
         # must remove from command line as its handled via conf file
         next if k == "P"
         next if k == "cmdargs"
-        args << " -#{k} #{v}"
+        args += ["-#{k}", v]
       end
 
       # since ipmitool requires commands to be in specific order
-      args << ' ' + options.fetch('cmdargs', '')
+      args += options.fetch('cmdargs', '').split
 
-      "#{cmd} #{args.lstrip}"
+      [cmd] + args.compact
     end
 
     # The findfix method acts like a recursive method and applies fixes defined in the errorcodes

@@ -147,7 +147,7 @@ def self.supported_privilege_type?(type)
 
   # test-friendly capture3
   def self.capture3(cmd)
-    return Open3.capture3(cmd)
+    return Open3.capture3(*cmd)
   end
 
   # method used to find the command which also makes it easier to mock with

@@ -19,21 +19,17 @@ def command_is_eql?(source, expected)
 
 def verify_freeipmi_command(cmdobj, exp_args_count, expcmd)
   actual = cmdobj.lastcall
-  actual.scan(/(^#{Regexp.escape(expcmd)})/) do |cmd_match|
-    expect(cmd_match.first).to eq(expcmd)
-  end
-  args_match = actual.scan(/(\-{2}[\w-]*=?[-\w\/]*)/)
+  expect(actual.first).to eq(expcmd)
+  args_match = actual.select { |arg| arg.match?(/^(-{2}[\w-]*=?[-\w\/]*)/) }
   # not sure how to exactly test for arguments since they could vary, so we will need to use count for now
   # args_match.should =~ exp_args
   expect(args_match.count).to eq(exp_args_count)
 end
 
 def verify_ipmitool_command(cmdobj, exp_args_count, expcmd, required_args)
   actual = cmdobj.lastcall
-  actual.scan(/(^#{Regexp.escape(expcmd)})/) do |cmd_match|
-    expect(cmd_match.first).to eq(expcmd)
-  end
-  args_match = actual.scan(/(-\w\s[\w\d\S]*)/)
+  expect(actual.first).to eq(expcmd)
+  args_match = actual.select { |arg| arg.match?(/^(-\w)/) }
   expect(actual.include?(required_args)).to eq true
   # not sure how to exactly test for arguments since they could vary, so we will need to use count for now
   # args_match.should =~ exp_args