From 49b981c11df90b13c91a2b1cb6d489f4b4edbc15 Mon Sep 17 00:00:00 2001
From: Lovro Bikic <lovro.bikic@infinum.hr>
Date: Sun, 27 Oct 2024 23:24:24 +0100
Subject: [PATCH] Remove Dir.chdir for thread-safety

---
 lib/bundler/audit/database.rb | 25 ++++++++++---------------
 spec/database_spec.rb         | 20 +++++++++++++++-----
 2 files changed, 25 insertions(+), 20 deletions(-)

diff --git a/lib/bundler/audit/database.rb b/lib/bundler/audit/database.rb
index c948c6be..85000d5e 100644
--- a/lib/bundler/audit/database.rb
+++ b/lib/bundler/audit/database.rb
@@ -17,6 +17,7 @@
 
 require 'bundler/audit/advisory'
 
+require 'open3'
 require 'time'
 require 'yaml'
 
@@ -203,17 +204,15 @@ def git?
       #
       def update!(options={})
         if git?
-          Dir.chdir(@path) do
-            command = %w[git pull]
-            command << '--quiet' if options[:quiet]
-            command << 'origin' << 'master'
+          command = %w[git pull]
+          command << '--quiet' if options[:quiet]
+          command << 'origin' << 'master'
 
-            unless system(*command)
-              raise(UpdateFailed,"failed to update #{@path.inspect}")
-            end
+          _, status = Open3.capture2(*command, chdir: @path)
 
-            return true
-          end
+          raise(UpdateFailed,"failed to update #{@path.inspect}") unless status.success?
+
+          true
         end
       end
 
@@ -227,9 +226,7 @@ def update!(options={})
       #
       def commit_id
         if git?
-          Dir.chdir(@path) do
-            `git rev-parse HEAD`.chomp
-          end
+          Open3.capture2('git rev-parse HEAD', chdir: @path).first.chomp
         end
       end
 
@@ -242,9 +239,7 @@ def commit_id
       #
       def last_updated_at
         if git?
-          Dir.chdir(@path) do
-            Time.parse(`git log --date=iso8601 --pretty="%cd" -1`)
-          end
+          Time.parse(Open3.capture2('git log --date=iso8601 --pretty="%cd" -1', chdir: @path).first)
         else
           File.mtime(@path)
         end
diff --git a/spec/database_spec.rb b/spec/database_spec.rb
index 97d89ce1..8a63b45f 100644
--- a/spec/database_spec.rb
+++ b/spec/database_spec.rb
@@ -141,7 +141,9 @@
       before { stub_const("#{described_class}::DEFAULT_PATH",dest_dir) }
 
       it "should execute `git pull`" do
-        expect_any_instance_of(subject).to receive(:system).with('git', 'pull', 'origin', 'master').and_return(true)
+        status = instance_double('Process::Status', success?: true)
+        expect(Open3).to receive(:capture2).with('git', 'pull', 'origin', 'master', chdir: dest_dir)
+                                           .and_return([anything, status])
 
         subject.update!(quiet: false)
       end
@@ -150,7 +152,9 @@
 
       context "when the `git pull` fails" do
         it do
-          expect_any_instance_of(subject).to receive(:system).with('git', 'pull', 'origin', 'master').and_return(false)
+          status = instance_double('Process::Status', success?: false)
+          expect(Open3).to receive(:capture2).with('git', 'pull', 'origin', 'master', chdir: dest_dir)
+                                             .and_return([anything, status])
 
           expect(subject.update!(quiet: false)).to eq(false)
         end
@@ -224,14 +228,18 @@
   describe "#update!" do
     context "when the database is a git repository" do
       it do
-        expect(subject).to receive(:system).with('git', 'pull', 'origin', 'master').and_return(true)
+        status = instance_double('Process::Status', success?: true)
+        expect(Open3).to receive(:capture2).with('git', 'pull', 'origin', 'master', chdir: Fixtures::Database::PATH)
+                                           .and_return([anything, status])
 
         subject.update!
       end
 
       context "when the :quiet option is given" do
         it do
-          expect(subject).to receive(:system).with('git', 'pull', '--quiet', 'origin', 'master').and_return(true)
+          status = instance_double('Process::Status', success?: true)
+          expect(Open3).to receive(:capture2).with('git', 'pull', '--quiet', 'origin', 'master', chdir: Fixtures::Database::PATH)
+                                             .and_return([anything, status])
 
           subject.update!(quiet: true)
         end
@@ -239,7 +247,9 @@
 
       context "when the `git pull` command fails" do
         it do
-          expect(subject).to receive(:system).with('git', 'pull', 'origin', 'master').and_return(false)
+          status = instance_double('Process::Status', success?: false)
+          expect(Open3).to receive(:capture2).with('git', 'pull', 'origin', 'master', chdir: Fixtures::Database::PATH)
+                                             .and_return([anything, status])
 
           expect {
             subject.update!