6 ms·

I personally find Ruby's built-in shell features more ergonomic: `cat package.json | grep name` branch = `git branch --show-current` `dep deploy -

I personally find Ruby's built-in shell features more ergonomic: `cat package.json | grep name` branch = `git branch --show-current` `dep deploy --branch=#{branch}` if $?.success? [ "sleep 1; echo 1", "sleep 2; echo 2", "sleep 3; echo 3", ].map { |cmd| Thread.new { %x(cmd) } }.each(&:join) name = 'foo bar' `mkdir /tmp/#{name}` if $?.success?

eurekin 5y ago
Does this carry over to jruby as well?
chubot 5y ago
How do you do shell escaping of #{name} if it comes from user input?
- pornel 5y ago
  The unnecessary "from user input" qualification is why spaces are kryptonite for most shell-based tools. It doesn't matter where input comes from. Input needs to be escaped for the context it's used in, period. Non-exploitable doesn't mean it's correct.
jitl 5y ago
What I don’t like about backticks in Ruby is that they “ignore” errors in commands you run. It’s up to the program author to remember to check $? for the last executed command’s exit status. And guess how many times the average Ruby script using this feature implements error handling? Usually it’s totally forgotten. To be safe, abstractions that make it easy to shell out must also: - escape all variable interpolations by default using “shellwords” or similar. - throw exceptions on error by default. Backticks in Ruby are very easy to use, but aren’t safe.
- eatonphil 5y ago
  Ruby noob, but surely there's a way to metaprogram and change this to default to throw on non-zero exit?
- dvogel 5y ago
  I agree that people often don't treat the exit code the way they should when using the backticks. However there's better options in the ruby stdlib too, like `system` and `spawn` and `popen`. Using the other methods allows you to also sidestep the shell if you know the arguments you want to pass.
- ilyash 5y ago
  In that case, welcome to Next Generation Shell (I'm the author), which actually cares about errors when running external programs. Yes, I mean much more than naive "non-zero is error" because that's just not true in many cases. https://ilya-sher.org/2017/01/28/ngs-unique-features-exit-code-handling/ https://ilya-sher.org/2017/01/28/ngs-unique-features-exit-co...
  - hulitu 5y ago
    I do not want to sound like an oldtimer but even command.com had "if %errorlevel%"
antifa 5y ago
Crystal does this, too.

eurekin 5y ago

Does this carry over to jruby as well?

chubot 5y ago

How do you do shell escaping of #{name} if it comes from user input?

pornel 5y ago
The unnecessary "from user input" qualification is why spaces are kryptonite for most shell-based tools. It doesn't matter where input comes from. Input needs to be escaped for the context it's used in, period. Non-exploitable doesn't mean it's correct.

jitl 5y ago

What I don’t like about backticks in Ruby is that they “ignore” errors in commands you run. It’s up to the program author to remember to check $? for the last executed command’s exit status. And guess how many times the average Ruby script using this feature implements error handling? Usually it’s totally forgotten. To be safe, abstractions that make it easy to shell out must also: - escape all variable interpolations by default using “shellwords” or similar. - throw exceptions on error by default. Backticks in Ruby are very easy to use, but aren’t safe.

eatonphil 5y ago
Ruby noob, but surely there's a way to metaprogram and change this to default to throw on non-zero exit?
dvogel 5y ago
I agree that people often don't treat the exit code the way they should when using the backticks. However there's better options in the ruby stdlib too, like `system` and `spawn` and `popen`. Using the other methods allows you to also sidestep the shell if you know the arguments you want to pass.
ilyash 5y ago
In that case, welcome to Next Generation Shell (I'm the author), which actually cares about errors when running external programs. Yes, I mean much more than naive "non-zero is error" because that's just not true in many cases. https://ilya-sher.org/2017/01/28/ngs-unique-features-exit-code-handling/ https://ilya-sher.org/2017/01/28/ngs-unique-features-exit-co...
- hulitu 5y ago
  I do not want to sound like an oldtimer but even command.com had "if %errorlevel%"

antifa 5y ago

Crystal does this, too.